Confidential AI inference.
Hardware-proven.

Run AI models inside hardware-isolated enclaves. Every inference produces a cryptographic receipt proving exactly what happened — which model ran, what data was processed, and that it all happened inside an attested environment.

Cloud AI requires trust you can't verify

!

The cloud sees your data

Standard AI APIs process your prompts and data in plaintext. The cloud operator has full access to inputs, outputs, and model weights.

?

No audit trail

There is no cryptographic evidence that a specific model processed your data, or that your data was handled according to policy.

×

Trust-me security

Compliance relies on vendor promises and SOC 2 reports. No hardware-level enforcement, no verifiable receipts, no way to prove data handling to auditors.

Three steps to verifiable AI

EphemeralML reduces trust in cloud operators via hardware attestation, policy-gated key release, and cryptographically signed execution receipts.

1

Attest

The client verifies the enclave's identity and code measurements before sending any data. Hardware attestation confirms the exact software running inside the TEE.

2

Infer

Data is encrypted end-to-end. The model runs inside a hardware-isolated enclave. The host forwards ciphertext only — it never sees plaintext prompts or outputs.

3

Receipt

Every inference produces an Ed25519-signed receipt covering model identity, input/output hashes, attestation evidence, and session lifecycle events.

Measured, tested, verified

Benchmark metrics (overhead, cost, quality) measured on AWS m6i.xlarge. Test and compliance counts from CI.

12.6%
Confidential Overhead
$4.72
Per 1M Inferences
16
Compliance Rules
365
Tests Passing
≈1.0
Output Cosine Similarity

Cryptographic proof for every inference

The receipt is the product. A compliance officer sends data to an endpoint, gets a result back, and receives a verifiable receipt they can show to auditors.

Execution Receipt

receipt_id68796942-19cf-4b60-a17c-91e5a0de8555
modelminilm-l6-v2 v1.0.0
platformtdx-mrtd-rtmr
Hashes

input_hashsha256:a1b2c3d4e5f6...
output_hashsha256:f6e5d4c3b2a1...
model_hashsha256:9f8e7d6c5b4a...
Verification

signatureEd25519 VERIFIED
attestationHardware measurements PASS
destroy_evidence5 actions confirmed
compliance16/16 rules PASS

What we guarantee, and what we don't

Guaranteed

  • Host blindness — the host relays ciphertext only; cannot decrypt prompts, outputs, or model keys
  • Attestation-gated key release — model decryption keys released only to approved enclave measurements
  • Session binding — encryption keys bound to attestation + nonce to prevent key swapping
  • Model integrity — Ed25519-signed manifests prevent serving a different model
  • Auditability — each inference produces a verifiable receipt with destroy evidence

Explicitly not claimed

  • Protection against all microarchitectural side-channels
  • Availability guarantees (the host can deny service)
  • Confidentiality under full enclave compromise

Three-zone trust model

Client (Trusted)

Verifies attestation, holds policy allowlists, establishes encrypted sessions

Host (Untrusted)

Networking, storage, API proxy. Forwards ciphertext only.

Enclave (TEE)

Decrypts data, loads models, runs inference, signs receipts

Multi-cloud confidential compute

EphemeralML targets confidential computing platforms from AWS, GCP, and Azure.

AWS Nitro Enclaves
GCP Confidential Space (TDX)
NVIDIA H100 CC (Azure/GCP)
Azure SEV-SNP

Deploy confidential AI

If you run AI in a regulated environment and need verifiable confidentiality, let's talk about a pilot.