OPAQUE publishes WCM to control where encrypted model weights can run

OPAQUE, a San Francisco confidential-AI company, published Weight Custody Manifest (WCM) on September 9, an open specification and developer SDK that lets AI developers place encrypted model weights on customer-controlled hardware while retaining control over decryption via attestation-gated key release. The company aims to address sovereign and regulated buyers' need for on-premises model deployment without surrendering intellectual property, though production readiness is limited per developer-preview documentation.

OPAQUE publishes WCM to control where encrypted model weights can run OPAQUE's Weight Custody Manifest uses attestation-gated key release to govern encrypted models, while its developer-preview documentation sets firm limits on production readiness. By RuntimeWire Staff /author/runtimewire-staff · Published Primary source: PR Newswire https://www.prnewswire.com/news-releases/opaque-introduces-an-open-standard-that-unlocks-frontier-models-for-sovereign-and-on-premises-deployment-302869612.html Why it matters Sovereign AI buyers want powerful models on machines they control, while model developers fear losing their core intellectual property. WCM offers a technical contract between them, provided OPAQUE can win model-lab adoption and prove the production hardware path. OPAQUE https://opaque.co/?ref=runtimewire , a San Francisco confidential-AI company, published Weight Custody Manifest on September 9, according to its launch announcement https://www.prnewswire.com/news-releases/opaque-introduces-an-open-standard-that-unlocks-frontier-models-for-sovereign-and-on-premises-deployment-302869612.html?ref=runtimewire . The open specification and developer SDK are designed to let AI developers place encrypted model weights on customer-controlled hardware without permanently surrendering control over when those weights can be decrypted. Co-founder and CTO Rishabh Poddar studied related security problems at UC Berkeley. According to his 2020 Berkeley dissertation https://www2.eecs.berkeley.edu/Pubs/TechRpts/2020/EECS-2020-211.html?ref=runtimewire , his work examined systems for computing on encrypted data and the security-performance tradeoffs among cryptographic protocols, trusted execution environments and real applications. Poddar helped turn the Berkeley research into OPAQUE with professors Raluca Ada Popa @ralucaadapopa https://x.com/ralucaadapopa?ref=runtimewire and Ion Stoica @istoica05 https://x.com/istoica05?ref=runtimewire , along with Wenting Zheng and Chester Leung. OPAQUE hired Aaron Fulkerson as CEO https://www.businesswire.com/news/home/20231026983207/en/Opaque-Systems-Appoints-Aaron-Fulkerson-as-Chief-Executive-Officer/?ref=runtimewire in October 2023 to commercialize the Berkeley work. Fulkerson previously co-founded enterprise knowledge software developer MindTouch and later ran ServiceNow Impact. Weight Custody Manifest, or WCM, addresses a commercial problem: sovereign and regulated buyers want models inside infrastructure they control, while model developers want enforceable limits on what those buyers can do with the weights. A contract the hardware can enforce The WCM specification and developer materials https://github.com/agentrust-io/weight-custody-manifest?ref=runtimewire turn a deployment agreement into a signed, machine-readable manifest. That manifest can identify the exact model weights, permitted uses, jurisdiction, approved software, license terms and custody requirements. The documented flow https://wcm.agentrust-io.com/?ref=runtimewire keeps model weights encrypted while a separate key broker retains the decryption key. When a customer workload requests access, the broker issues a fresh, single-use challenge. The protected runtime returns CPU evidence and, where required, GPU evidence binding that challenge to the workload and an ephemeral transport key. The broker checks signatures, measurements, certificate chains and revocation status before releasing a key sealed for that workload. Authorization is designed to expire rather than remain valid indefinitely. The reference implementation https://github.com/agentrust-io/weight-custody-manifest/blob/main/README.md?ref=runtimewire requires fresh evidence for renewal and calls for service to stop and the in-memory key to be zeroized if authorization lapses. A builder or custodian can initiate emergency revocation, while the documented sovereign controls https://github.com/agentrust-io/weight-custody-manifest/blob/main/docs/tutorials/how-it-works.md?ref=runtimewire can require several parties to approve a shutdown or reconstruct a split key. Enforcement occurs by the next authorization cadence lapse. These are reference-protocol and software-implementation behaviors, rather than proof against an operator with physical control of the hardware. WCM also records relationships between a base model and fine-tuned derivatives, an important detail when much of the commercial value resides in the tuning rather than the original checkpoint. OPAQUE positions the manifest as a companion to OpenSSF Model Signing. A model signature establishes identity and provenance. WCM governs whether that model is allowed to decrypt and run in a particular environment. That distinction matters because confidential computing already protects data, applications and models inside hardware-backed trusted execution environments. Edgeless Systems https://www.edgeless.systems/wiki/use-cases/confidential-ai?ref=runtimewire , for example, describes confidential AI deployments that keep model weights inaccessible to infrastructure operators. Anjuna Seaglass https://www.anjuna.io/product/seaglass?ref=runtimewire releases secrets and configurations to attested containers across cloud and on-premises systems. OPAQUE's bet is that model custody needs a portable policy format covering licensing, lineage, jurisdiction, renewal and revocation across infrastructure providers. The preview draws its own boundaries The public WCM repository https://github.com/agentrust-io/weight-custody-manifest?ref=runtimewire carries an Apache 2.0 license and includes source code, schemas, a threat model, contribution guidance and conformance assets. OPAQUE says the release includes 91 public test cases https://www.opaque.co/resources/articles/opaque-introduces-an-open-standard-that-unlocks-frontier-models-for-sovereign-and-on-premises-deployment?ref=runtimewire . The current Python package https://pypi.org/project/weight-custody-manifest/?ref=runtimewire is classified as alpha software and warns developers that the pre-1.0 specification is not ready to build production systems against. The verified public demo repository https://github.com/agentrust-io/demos?ref=runtimewire uses a software mock attestation provider and requires no attestation hardware. Its closed-weight example https://raw.githubusercontent.com/agentrust-io/demos/main/demo-07-closed-weight/run.py?ref=runtimewire verifies signatures, hashes placeholder checkpoint content and makes allow-or-deny key-release decisions in ordinary in-process Python. It does not load a real model or isolate memory in hardware. The repository says its software-only flow cannot prevent an operator with physical access from extracting a key. WCM's documentation https://agentrust-io.com/wcm/?ref=runtimewire says protecting real weights requires validated platform evidence, channel binding, workload isolation, trusted time and control of the serving runtime. OPAQUE's announcement https://www.opaque.co/resources/articles/opaque-introduces-an-open-standard-that-unlocks-frontier-models-for-sovereign-and-on-premises-deployment?ref=runtimewire says WCM underwent end-to-end validation on an NVIDIA H100 in confidential mode and on AMD and Intel confidential servers running on Azure and Google Cloud. As of September 9, the public package documentation https://pypi.org/project/weight-custody-manifest/?ref=runtimewire says AMD SEV-SNP verification has been validated against live hardware, NVIDIA H100 confidential-mode validation has occurred, and Intel TDX report generation has been validated on a live Google Cloud C3 guest. Intel TDX remote quote generation remains provisional, and GPU cryptographic verification is outside the package's portable conformance vectors. Those statements cover different validation scopes rather than establishing a contradiction between OPAQUE's announcement and the public SDK. The materials released on September 9 do not include an independent security audit or performance measurements for attestation-gated inference. OPAQUE also did not name a frontier-model developer implementing WCM at launch. That is the commercial test. A custody standard becomes useful when model owners, hardware vendors, cloud operators and sovereign buyers agree on the same manifest and attestation profiles. Without that coordination, each deployment can fall back into custom integration work and bilateral contracts. OPAQUE raised $24M in February OPAQUE said in a February 12 financing announcement https://www.opaque.co/resources/articles/opaque-raises-24m-series-b-at-300m-valuation-to-advance-confidential-ai-for-the-enterprise?ref=runtimewire that Walden Catalyst led a $24M Series B, with Intel Capital, Race Capital, Storm Ventures, Thomvest and the Advanced Technology Research Council participating. OPAQUE said the round brought its disclosed funding to $55.5M and valued it at approximately $300M post-money. OPAQUE is now trying to make WCM useful beyond its own platform. AgenTrust's project charter https://github.com/agentrust-io/weight-custody-manifest/blob/main/CHARTER.md?ref=runtimewire defines WCM as an open specification and reference implementation, with operated services and product integrations outside the project's governance. The charter says sponsorship grants no ownership or authority over the specification. Its sponsor disclosure https://github.com/agentrust-io/weight-custody-manifest/blob/main/SPONSORS.md?ref=runtimewire says OPAQUE provided founding engineering and infrastructure support, including contributions to the initial specification, threat model and reference SDK. The structure is deliberate. Model developers are unlikely to hand control of their most valuable weights to a protocol perceived as a proprietary feature of one security vendor. OPAQUE needs outside contributors and competing implementations if WCM is to become shared infrastructure. OPAQUE can still sell the hosted custodian, protected runtime and enterprise controls around that standard. Poddar and OPAQUE's academic founders built their earlier systems around a simple constraint: organizations will withhold valuable data when they cannot verify how it is handled. WCM applies the same logic in reverse. Model developers will withhold valuable weights when customer-controlled infrastructure /article/devin-multi-vm-cloud-agents-modal-outposts cannot prove what it is running and how long it remains authorized. The protocol gives that negotiation a credible technical shape. Frontier-model adoption, independent review and production hardware evidence will determine whether WCM becomes a common custody layer or remains a capable reference implementation for a problem every sovereign AI deal must solve.