OPAQUE, a confidential computing firm specializing in AI workloads within hardware-isolated environments, has introduced an open standard designed to give AI model builders greater control over their intellectual property. The new standard, called Weight Custody Manifest (WCM), allows builders to specify the conditions under which their AI model weights can be decrypted once those weights are no longer on the builder's own servers.
The WCM standard aims to address a growing challenge in the AI industry, where enterprises fine-tune open models with proprietary data, and AI labs deploy valuable frontier models to customers who demand the models run on their own infrastructure, including sovereign clouds. Currently, once model weights leave the builder's data center, there is no technical mechanism to enforce contractual agreements regarding their use.
Imran Siddique, Chief Platform Officer at OPAQUE, stated that WCM shifts the focus from protecting the customer from the model to protecting the model from the customer. He emphasized the need for builders to have verifiable proof that their intellectual property will only be unlocked in environments that meet agreed-upon conditions, providing all parties with cryptographic assurance rather than relying on trust alone.
The WCM standard operates by keeping model weights encrypted until the receiving infrastructure cryptographically proves it meets the conditions specified by the builder. Access can also be revoked if these conditions change. The system relies on a protected workload requesting a single-use challenge from a key broker. CPU and, if applicable, GPU attestation bind this challenge, a measurement of the running workload, and a transport key to the specific launch. The broker then verifies certificate chains, signatures, revocation status, and freshness before sealing the decryption key to the attested workload. A mismatch in verification results in the key not being released.
OPAQUE has reportedly tested this exchange on an NVIDIA H100 GPU, as well as on AMD and Intel confidential servers hosted on Azure and Google Cloud. The company also stated that two independent builds of the SDK produced identical output across 5,948 files.
The WCM standard is released as a developer-preview specification, accompanied by a Python SDK and a public test suite comprising 91 test cases. While the public quickstart runs broker and workload logic in a single Python process using synthetic evidence and a placeholder key, the conformance suite tests the reference protocol's logic against synthetic certificate roots. It is important to note that the public quickstart and conformance suite do not include GPU cryptographic verification. Passing these tests confirms the code's logic, but hardware confirmation requires separate testing on the actual deployment machine.
A key limitation acknowledged by OPAQUE is that a valid signature cannot differentiate between an authorized key and one an attacker might have already extracted from the hardware. The company points to existing research on physical attacks against confidential computing chips, indicating that the WCM standard does not claim to solve this particular problem.
