Question 1

What is confidential AI?

Accepted Answer

Confidential AI is inference that protects your data while it is being processed, not just while it is stored or in transit. With LibertAI, the model runs inside a Trusted Execution Environment, a hardware-isolated enclave with encrypted memory, so the data stays private even from the operator running the machine. The key difference from ordinary 'private' AI is that the privacy is verifiable through remote attestation rather than promised in a policy.

Question 2

What is a TEE in AI inference?

Accepted Answer

A TEE, or Trusted Execution Environment, is a hardware-isolated region of a CPU where code runs with its memory encrypted and shielded from the rest of the system. In AI inference, the model and your prompt are loaded into this enclave, so the host operating system, the hypervisor, and the node operator cannot read them while the model is computing. The enclave can also produce a remote attestation, a signed proof of exactly which code is running inside it.

Question 3

How is this different from a privacy policy promise?

Accepted Answer

A privacy policy is a statement of intent: you trust that the provider will not look at or retain your data. Confidential AI replaces that trust with verification. Because the inference runs in a TEE, the operator is technically unable to read your prompt, and remote attestation lets you confirm which code is running before you send anything. Instead of trusting a document, you verify the enclave.

Question 4

Can I verify what code is running?

Accepted Answer

Yes. The enclave produces a hardware-signed attestation, a measurement of the exact code loaded inside it. Because the entire LibertAI serving stack is open source at github.com/libertai, you can check that measurement against the published build and confirm you are talking to the real, unmodified server rather than something that has been altered.

Question 5

Which models run in a TEE?

Accepted Answer

Hermes 3 8B is served inside a TEE today. The platform also serves a range of larger open models, including Qwen3.6-35B-A3B, Qwen3.6-27B, Gemma 4 31B with 262K context, DeepSeek V4 Flash, Qwen3 Coder, GLM-4.7, and Qwen3.5 122B, all with no logging and no training on user data.