Security1 publisher2 min readPublished
OPAQUE ships a spec that keeps model weights sealed until the host proves what it is running
Weight Custody Manifest binds a model's decryption key to hardware attestation, which gives builders a lever once weights leave their data center. The public 91-case suite exercises protocol logic on synthetic certificate roots.
The Watch · Security desk
What happened
- OPAQUE released Weight Custody Manifest, an open standard shipping as a developer-preview specification, a Python SDK and a public test suite of 91 cases.
- The design keeps weights encrypted until the receiving infrastructure proves cryptographically that it matches conditions the builder signed off on, and access can be pulled later if those conditions change.
- A workload requests a single-use challenge from a key broker, CPU and where required GPU attestation bind that challenge to the specific launch, and the broker seals the key only after checking chains, revocation and freshness.
- OPAQUE says it ran the exchange on an NVIDIA H100 and on separate AMD and Intel confidential servers hosted on Azure and Google Cloud, with two independent SDK builds matching across 5,948 files.
- The public quickstart runs broker and workload in one Python process on synthetic evidence with a placeholder key, and the conformance suite tests synthetic certificate roots while skipping GPU cryptographic verification.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability Model builders get an enforcement lever they did not have off-premises: a key sealed to an attested launch, withdrawable when conditions change, instead of a clause someone would have to litigate.
- constraint Nobody can accept the passing conformance run as deployment assurance, so verification has to be repeated on each target machine and that recurring work lands on whoever owns the rack.
- exposure If key material is ever extracted from a confidential computing chip, every subsequent attestation still validates, which puts the residual trust on silicon vendors rather than on the specification.
- decision Labs that have been refusing sovereign-cloud and customer-hosted deployments now have a testable artifact to evaluate against, at developer-preview maturity, rather than a choice between trust and refusal.
The adversary in this design is the party paying for the model. OPAQUE's chief platform officer, Imran Siddique, states it directly: "Today's Confidential AI protects the customer from the model. WCM protects the model from the customer" [4]. The inversion is the point, because a lab handing frontier weights to a customer that insists on running them in its own data center or in a sovereign cloud held inside a country's legal borders has had no technical enforcement at all, only contract language [3].
Two piles of evidence arrived with the release, and they are not interchangeable. The reproducible pile is the suite anyone can run: tiers of 32, 37, 12 and 10 checks, which sum to all 91, and none of them reaches GPU cryptographic verification [9][13]. What a green run establishes is that the reference protocol logic behaves as written [10]. The second pile is OPAQUE's own account of running the exchange on confidential-computing silicon across two clouds, with two independent SDK builds producing identical output across 5,948 files [7]. That account is vendor-reported, not independently verified. The gap between the piles is where the remaining work sits, because hardware confirmation is a separate test on the exact machine a builder intends to deploy [10].
That per-machine test is the standing cost of the scheme. Attestation is worth what the certificate chain, the revocation status and the freshness window the broker checks are worth [5], and none of those can distinguish a key the hardware holds legitimately from one an attacker has already pulled out of the package [11]. OPAQUE points at the published physical-attack research against confidential computing chips rather than claiming the problem is solved [12]. That marks the boundary of the guarantee: below the chip, custody is unenforceable.
On novelty, the material supports less than the framing suggests. The source describes the squeeze and the shipped artifact [3][2], names no competing weight-custody specification, and an absent comparison is not evidence that this is the only one [14].
What a builder can do today is narrow and real. Encrypt the weights, seal the key to an attested launch, and keep the ability to say no after delivery [6].
What to watch
- Whether OPAQUE publishes conformance profiles that exercise real NVIDIA, AMD and Intel attestation roots instead of synthetic ones.
- Whether a model builder outside OPAQUE commits to WCM for a named sovereign-cloud deployment and says on which silicon.
- Whether new key-extraction research against confidential computing chips forces a rewrite of the spec's threat model.