A new open standard locks AI weights to approved hardware

OPAQUE, a confidential computing company that runs AI workloads inside hardware-isolated environments so operators cannot inspect them, released an open standard that lets AI model builders decide when and where their weights can be decrypted once those weights leave the builder’s own servers. The standard, called Weight Custody Manifest, ships as a developer-preview specification, a Python SDK, and a public test suite covering 91 cases.

The release targets a specific squeeze. Enterprises are fine-tuning open models on their own data, and AI labs are being asked to hand increasingly valuable frontier models to customers who insist the model run on infrastructure they control, including sovereign clouds kept within a country’s legal borders. Once weights leave the builder’s data center, the builder has no technical way to enforce what a contract says.

WCM keeps weights encrypted until the receiving infrastructure proves, cryptographically, that it matches conditions the builder signed off on, and access can be pulled later if those conditions change.

“Today’s Confidential AI protects the customer from the model. WCM protects the model from the customer,” said Imran Siddique, Chief Platform Officer at OPAQUE. “Builders need proof that their intellectual property will only be unlocked in an environment that meets agreed-upon conditions. WCM gives all parties verifiable proof instead of asking either side to simply trust the other.”

How the check runs

A protected workload requests a single-use challenge from a key broker. CPU and, where required, GPU attestation bind that challenge, a measurement of the running workload, and a transport key to the specific launch. The broker checks certificate chains, signatures, revocation status, and freshness before sealing the decryption key to that attested workload. A mismatch means no key.

OPAQUE says it ran this exchange on an NVIDIA H100 and on separate AMD and Intel confidential servers hosted on Azure and Google Cloud, and that two independent builds of the SDK produced identical output across 5,948 files.

What the demo does not prove

Try the standard yourself and you get something different from what OPAQUE ran on its own hardware. The public quickstart runs broker and workload logic in one ordinary Python process, on synthetic evidence, with a placeholder key. Run the conformance suite and 91 checks pass, 32 at the first level, 37 at the second, 12 at the third, 10 at the fourth. All of it tests the reference protocol’s logic against synthetic certificate roots, and it skips GPU cryptographic verification entirely. A passing run confirms the code’s logic works as written. Confirming the hardware takes a separate test, run on the machine a builder plans to deploy.

One limit here is sharp: a valid signature cannot tell an authorized key from one an attacker has already pulled out of the hardware. Physical attacks against confidential computing chips are real and documented, and OPAQUE points to that research instead of claiming the problem is solved.