Confidential AI Builds Mutual Trust Between Data Owners and Model Providers

Enterprises face a fundamental tension when deploying AI: they need to harness powerful models to gain competitive advantage, yet many cannot send sensitive information—patient records, financial data, trade secrets—outside their own infrastructure. Sending that material to cloud or SaaS platforms means crossing external networks and relying on third-party operators, raising concerns about who controls the data and what happens if it leaks.

This trust gap has created a stalemate. On one side, organizations want assurance their confidential information stays under their roof. On the other, model builders refuse to hand over their trained weights—the product of substantial research investment and intellectual property—to customers who might copy or misuse them.

How Confidential Computing Creates Encrypted Enclaves#

Confidential AI tackles this two-sided problem using hardware-isolated execution. Rather than encrypting data only at rest or in transit, this approach extends encryption into the processing environment itself.

The mechanism works through cryptographic attestation: the system verifies the specific hardware, virtual machine, software configuration, and other characteristics requesting access before releasing decryption keys. A model builder can encrypt its model weights using the public key of a particular confidential VM; only that VM's private key can decrypt them within protected memory. The enterprise controls its own data encryption keys; the model provider controls its model keys. During execution, neither the infrastructure operator nor any outside party can access either set.

This architecture transforms who owns what at every step:

• Enterprise retains control of keys governing its sensitive data
• Model provider retains control of keys protecting its intellectual property
• Infrastructure operator controls neither, creating a neutral third party without a back door

The Ecosystem Challenge#

Turning architectural theory into deployable systems requires orchestration across the entire stack. No single vendor can handle models, applications, data infrastructure, accelerated hardware, and operational tooling alone. That's why implementations like VAST Data's DataEnclave work with an ecosystem of partners—model builders (Cohere, Deepgram, TwelveLabs), hardware providers (Nvidia, Supermicro), and security firms (CrowdStrike, Fortanix, Cisco).