Model weights sealed to silicon.
Model weights decrypt directly into VRAM on attested GPUs and exist nowhere else in plaintext. Sealing binds to the die itself, so an exfiltrated checkpoint is useless off the approved hardware.
Frontier weights are among the most expensive files ever made, and they are mostly protected like any other blob: disk encryption at rest, TLS in flight, and trust in whoever operates the box. Once loaded, plaintext weights sit in system memory on hardware you may not own.
SCSA derives the decryption key from the GPU itself. Weights ship as ciphertext, attest the die they land on, and decrypt only inside VRAM under Confidential Computing mode. A checkpoint copied off the cluster carries nothing, and fine-tune deltas chain back to the publisher's Merkle commitment, so provenance survives the supply chain.
In-VRAM decryption on H100 / H200 / B100 / B200
Weights stream encrypted from disk and decrypt only inside GPU memory under Confidential Computing mode. Plaintext never exists on disk, in system RAM, or on the wire.
Attestation-derived keys, no key files to steal
The decryption key derives from a SHA3 measurement of the die UUID, VBIOS, driver, and CC flags at load time. There is no key file to phish, copy, or subpoena.
Safe deployment on rented or shared compute
Seal to an attested remote GPU before shipping the model. The host operator sees ciphertext and an attestation handshake, never your weights.
You can rent the compute without renting out the model.