OPAQUE Unveils Weight Custody Manifest to Secure AI Model Weights
OPAQUE has introduced the Weight Custody Manifest (WCM), an open standard designed to cryptographically bind AI model weights to specific hardware, preventing unauthorized decryption and use.
OPAQUE, a company specializing in confidential computing for AI, has released a new open standard aimed at addressing a critical security gap in the deployment of artificial intelligence models. Dubbed the Weight Custody Manifest (WCM), this developer-preview specification allows AI model builders to dictate precisely when and where their model weights can be decrypted, even after the weights have left the builder's controlled environment.
The WCM standard emerges as a response to the growing need for trust in AI deployments. As enterprises increasingly fine-tune open-source AI models with their proprietary data, and as AI labs are pressured to share valuable frontier models with customers, a gap exists in enforcing contractual agreements regarding model usage. Once model weights are transferred to a customer's infrastructure, the original builder loses technical control, relying solely on trust or legal recourse.
This new standard seeks to bridge that gap by ensuring that AI model weights remain encrypted until the receiving infrastructure cryptographically proves it meets predefined conditions set by the builder. The WCM acts as a verifiable attestation mechanism, providing proof that the model is running in an approved environment. Crucially, access can be revoked if these conditions change, offering a dynamic security layer.
"Today’s Confidential AI protects the customer from the model. WCM protects the model from the customer," stated Imran Siddique, Chief Platform Officer at OPAQUE. He emphasized that WCM provides builders with verifiable proof that their intellectual property will only be accessed in environments that adhere to agreed-upon terms, moving beyond simple trust-based relationships.
The technical mechanism involves a protected workload requesting a single-use challenge from a key broker. This challenge, along with a measurement of the running workload and a transport key, is then cryptographically bound to the specific hardware and software environment through CPU and GPU attestation. The key broker verifies certificate chains, signatures, and revocation status before sealing the decryption key to the attested workload, ensuring that only the authorized environment can decrypt the weights.
OPAQUE has demonstrated the WCM's functionality on NVIDIA H100 GPUs and on confidential computing servers from AMD and Intel hosted on Azure and Google Cloud. While the public quickstart and conformance suite test the protocol's logic using synthetic evidence and placeholder keys, a full hardware-level confirmation requires separate testing on the intended deployment machine. The standard acknowledges that physical attacks against confidential computing hardware remain a concern, directing users to existing research rather than claiming a complete solution.
The WCM specification, accompanied by a Python SDK and a test suite covering 91 cases, aims to provide a robust framework for securing AI models throughout their lifecycle. By enabling conditional decryption and offering verifiable proof of compliance, OPAQUE's initiative seeks to foster greater trust and security in the rapidly evolving landscape of AI deployment.