Enterprises are now able to run the most capable generative models on sensitive data without moving that data out of their controlled environment. The shift comes from confidential AI architectures that combine encryption at rest and in transit with hardware‑isolated execution, allowing data and model weights to stay encrypted until they reach a verified enclave.
What changed: confidential AI enclaves
Traditional SaaS AI services require customers to send raw data to a provider’s cloud, exposing it to additional networks, operators, and compliance risk. Confidential AI introduces a protected execution environment—often called an enclave—where both the customer’s data and the provider’s model are decrypted only inside a hardware‑verified memory region. The model is encrypted with the public key of a specific confidential VM; only that VM’s private key can unlock the model inside the enclave. Cryptographic attestation confirms the hardware, VM, and software stack before any keys are released, ensuring that neither the data owner nor the model owner relinquishes control of their respective keys during runtime.
Why engineers should care
For AI engineers, cloud/platform engineers, DevOps/SRE staff, and security specialists, the new model resolves a long‑standing trust gap. It lets teams keep personally identifiable information (PII) or proprietary IP within their own jurisdiction while still leveraging state‑of‑the‑art models. The approach also aligns with regulatory constraints that forbid cross‑border data movement or require strict data‑handling attestations. From an operational perspective, the enclave model supports hybrid deployments—some workloads can stay on‑premises or in‑country, while others run in the public cloud—without sacrificing the protection of either side’s assets.
Architectural and operational implications
- Hardware requirements: Deployments need CPUs that support confidential computing (e.g., SGX, AMD SEV). Selecting compatible hardware becomes a prerequisite for any confidential AI workload.
- Key management separation: Organizations must manage encryption keys for their data independently from the keys used by model providers. This often means integrating a dedicated key management service (KMS) that can supply keys to the enclave only after successful attestation.
- Attestation workflow: Before a model can be loaded, the enclave must produce a cryptographic proof of its identity and configuration. Engineers need to embed attestation checks into CI/CD pipelines to ensure only approved images are promoted.
- Operational visibility: While the enclave protects keys from the infrastructure operator, monitoring must focus on enclave health, performance metrics, and attestation logs rather than raw data access logs.
- Hybrid strategy support: The VAST Data Enclave, released on September 22, demonstrates a concrete implementation that bundles the model, application layer, and data platform under customer‑controlled conditions, making it feasible to run confidential AI both on‑prem and in the cloud.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Teams should start by inventorying workloads that require strict data isolation and identifying models they wish to consume. Next, evaluate whether existing hardware supports confidential enclaves or plan a phased upgrade. Integrate attestation steps into deployment pipelines and configure a KMS that can issue keys only to verified enclaves. Finally, establish monitoring that tracks enclave lifecycle events and performance, ensuring that the separation of data and model keys remains enforceable throughout operation.