Confidential AI

Privacy-Preserving Intelligence — Steve Korshakov, Bee (acq. Amazon)

Jul 20, 2026 · 15:53

Steve Korshakov, founder of Bee (acquired by Amazon), explains how his company built the 'most sensitive capture device on the market' with a guarantee that no one—not even Amazon—can read user data. Bee records everything a user says, generating about 10 million tokens per year, and within a week learns virtually everything about the person. To protect data, the encryption key never leaves the user's phone; the phone runs an attestation pipeline checking workloads against a public transparency log (Sigstore) before sharing the key with backends running in confidential compute. Keys in memory expire after seven days, and a two-tier signing system ensures no insider can ship code unnoticed: a separate Amazon privacy team holds signing keys hardcoded into apps. The entire system is only about 20,000 lines of memory-safe code, most of it verifying attestation, with no homegrown cryptography. Korshakov also discusses the challenges of moving from startup to Amazon, and his view on taming AI agents: sandboxing and not giving them the ability to cause harm.

The Unofficial Guide to Apple’s Private Cloud Compute - Jmo, CONFSEC

Jul 30, 2025 · 20:36

Jonathan Mortensen explains Apple's Private Cloud Compute (PCC), a paradigm shift in confidential computing that delivers cryptographically provable privacy for AI inference on remote servers. He details Apple's five requirements—stateless computation, enforceable guarantees, non-targetability, no privileged runtime access, and verifiable transparency—and six technical components, including oblivious HTTP, blind signatures, secure enclave, remote attestation, transparency logs, and secure boot. The talk highlights how remote attestation allows an iPhone to verify server software and tie encryption to that verified state, while the transparency log enables public auditing of all deployed binaries. Mortensen notes trade-offs: complete trust in Apple's supply chain, higher latency and compute costs, and no support for custom models or third-party developers. He points to alternative tools like TPMs, SigStore, and confidential VMs for non-Apple environments, and concludes that Apple's approach is being adopted by Azure AI and Meta.

GPU-less, Trust-less, Limit-less: Reimagining the Confidential AI Cloud - Mike Bursell

Jun 3, 2025 · 43:41

Mike Bursell of Super Protocol argues that Confidential AI, built on hardware Trusted Execution Environments (TEEs) like Intel TDX, AMD SEV-SNP, and NVIDIA GPU TEEs, solves the trust problem in AI by enabling secure processing of sensitive data and proprietary models without exposure. Super Protocol, a decentralized confidential AI cloud and marketplace, allows users to deploy models in TEEs, verify execution via cryptographic attestation, and collaborate across organizations without blind trust. Demos show deploying DeepSeek on H100 GPUs, running n8n healthcare workflows, distributing vLLM inference across four GPU nodes, and provably training a medical model on datasets from Alice's lab and Bob's clinic. Case studies include Realize achieving 75% accuracy and 3-5% sales increase for Mars, and BEL reducing FDA audit time from weeks to 1-2 hours. The protocol replaces trust with on-chain proofs, enabling GPU-less, trustless, limitless AI.

LLM Safeguards: Security Privacy Compliance Anti Hallucination: Daniel Whitenack

Dec 31, 2024 · 34:10

Daniel Whitenack of Prediction Guard outlines a practical checklist for deploying secure and accurate LLMs in enterprise, addressing hallucination, supply chain vulnerabilities, flaky model servers, data breaches, and prompt injection. He proposes a factual consistency model fine-tuned to detect inconsistencies between AI output and ground truth, rather than relying solely on RAG. For supply chain risks, he recommends a trusted model registry and industry-standard libraries. Data breaches are mitigated via PII detection filters and confidential computing (e.g., Intel SGX) to encrypt server memory. Prompt injection is countered with a custom firewall layer using ensembled classification models. In Q&A, he discusses latency trade-offs using smaller NLP models, pre-production testing for visibility, data access controls via role-based database queries, SIEM integration for monitoring new artifacts like model caches, and additional challenges with agents such as excessive agency, proposing dry-run approvals.