Modelwrap is an open-source tool that lets clients of Tinfoil's enclave-hosted inference service check which model weights it runs.
Tinfoil reports running the service on AMD or Intel confidential virtual machines with NVIDIA GPUs in confidential-computing mode. Modelwrap packs the weights into a read-only disk image with a 32-byte Merkle-tree commitment. That hash is written into the enclave's measured boot configuration, and the kernel checks every block read against it.
Clients check the hardware-signed attestation against measurements published through Sigstore, and anyone can rebuild the hash for a public model. As of September 2026 no independent security evaluation has been published. This attestation chain inherits the limits of the confidential-computing hardware.
Researchers with physical access have forged Intel TDX and broken AMD SEV-SNP attestation, and a software-only attack forged SEV-SNP attestations before AMD's firmware fixes. For private models, clients can confirm only that the same weights are served each time.
Tinfoil reports running the chain in its production service, but almost all the evidence comes from Tinfoil, no independent evaluation exists, and the underlying TEEs have open critical flaws.
Assessed use: showing clients that the served weights match a committed hash
On this page
What it is
Tinfoil reports that it operates an AI inference service inside secure enclaves. It runs on AMD EPYC processors with SEV-SNP or Intel Xeon processors with TDX, together with NVIDIA H100, H200 or B200 GPUs in confidential-computing mode 2. Its stated trust model is that clients trust the hardware manufacturer, but not the cloud provider's software stack, the hypervisor or the host OS 2.
Modelwrap is Tinfoil's open-source tool, under an MIT license, that "builds reproducible dm-verity EROFS images of Hugging Face models" 5. It lets clients check which weights the service is running 1. The chain implements model identity attestation on top of TEE remote attestation.
How it works
Tinfoil states the problem as follows: "attestation measures launch state, not runtime state", and weights are read from disk after the enclave boots 1. The system works in three phases 1:
- Commit. Modelwrap builds a normalized, read-only image of a pinned model revision and computes a Merkle-tree root hash.
- Bind. The root hash is passed to dm-verity on the kernel command line, which the enclave measurement covers, so the attestation vouches for the hash.
- Enforce. Whenever the inference server reads the weights, dm-verity checks each block against the attested root and fails on any mismatch.
Tinfoil contrasts this with signing weights, for example with Sigstore Model Transparency. It argues that a signature protects the weights only at the moment it is checked, while a malicious hypervisor could alter the disk afterwards 1.
The rest of the boot chain is measured too: firmware, kernel, initrd and a configuration file. The enclave checks each GPU's attestation at boot and does not start if the check fails 3. Tinfoil's software development kit (SDK) then runs the client-side checks:
- it verifies the attestation back to the CPU vendor's root certificate;
- it compares the measurements with a Sigstore-published record of the expected values;
- it binds the TLS connection to the key in the attestation 3.
In October 2026, Tinfoil's documentation describes a chain of enclaves for its inference API. The SDK verifies a model-router enclave 4. The router forwards requests only to model enclaves whose measurements match the latest Sigstore-logged release of the repository that its measured code assigns to each model 3. Clients can also verify a model enclave directly, but Tinfoil notes that direct verification may not be reachable from arbitrary networks 3.
For a public model, anyone can rerun Modelwrap on the same Hugging Face commit and compare root hashes. For a private model, the customer builds the image and can encrypt it with dm-crypt, and the attestation shows only the root hash 1. Tinfoil lists billing and account management as closed-source components outside the security-critical path 3.