What is protected, against whom, and what is not.
Your model runs on customer sites, edge devices, partner clouds and delivered systems without being decrypted there. This page sets out exactly what that does and does not cover.
Asset protected
Model weights
Encrypted at rest, in transit and during inference. Never present in plaintext on the deployment hardware.
Adversaries considered
- Host OS and kernel
- Hypervisor
- Co-tenant on shared infrastructure
- Device administrator
- Physical attacker with the box in hand
- Partner or customer staff
Not protected by encryption alone
Encryption covers confidentiality of the weights. These need other measures:
Query-based functional cloning
A deployer with unlimited plaintext outputs can train a copy of a narrow model. The owner keeps the decryption key, so decrypted outputs, query volume and output granularity stay under the owner's control.
Side channels
Power and electromagnetic side channels on edge accelerators have not been evaluated.
Host integrity and availability
Out of scope. The host can refuse to run the model or feed it garbage inputs. Protection here covers confidentiality.
Full comparison
| Aspect | Licensing and dongles | Hardware enclaves | Encrypted inference |
|---|---|---|---|
| Weights at rest | Encrypted | Encrypted | Encrypted |
| Weights during inference | Decrypted in memory | Plaintext inside the enclave | Stay encrypted |
| Host administrator | Can read process memory | Isolated from the host OS | Sees ciphertext only |
| Physical possession of the box | Model recoverable from memory | Relies on physical security | Yields ciphertext |
| Hardware requirements | Dongle or licence server | Specific CPU or GPU with enclave support | No enclave required |
| Latency overhead | Low | Low | Significant, measured per model |
| Licence metering and revocation | Core strength | Depends on the attestation design | Owner-held key controls decrypted outputs |
| Query-based cloning | Not addressed | Not addressed | Not stopped by encryption alone |
Where enclaves remain the right choice
Encrypted inference is stronger than an enclave against physical and privileged-host attackers. Enclaves are faster, and they remain adequate in your own data centre, for latency-critical workloads and for large models.
Standards mapping
- MITRE ATLAS AML.T0048.004
- Intellectual property theft
- MITRE ATLAS AML.T0024.002
- Model extraction through the inference interface
- OWASP ML05
- Model theft
- NIST AI 100-2
- Adversarial machine learning: model extraction
- ISO/IEC 27090
- Cybersecurity for AI systems
Under the EU Trade Secrets Directive, encrypting weights in use is a documentable technical measure that supports a reasonable-steps showing. It is a measure, not recognised precedent.
Bring one model and one target.
We tell you what it costs in latency and what it buys in protection.