Tinfoil model identity (Modelwrap)

What it is

Tinfoil reports that it operates an AI inference service inside secure enclaves. It runs on AMD EPYC processors with SEV-SNP or Intel Xeon processors with TDX, together with NVIDIA H100, H200 or B200 GPUs in confidential-computing mode ². Its stated trust model is that clients trust the hardware manufacturer, but not the cloud provider's software stack, the hypervisor or the host OS ².

Modelwrap is Tinfoil's open-source tool, under an MIT license, that "builds reproducible dm-verity EROFS images of Hugging Face models" ⁵. It lets clients check which weights the service is running ¹. The chain implements model identity attestation on top of TEE remote attestation.

How it works

Tinfoil states the problem as follows: "attestation measures launch state, not runtime state", and weights are read from disk after the enclave boots ¹. The system works in three phases ¹:

1. Commit. Modelwrap builds a normalized, read-only image of a pinned model revision and computes a Merkle-tree root hash.
2. Bind. The root hash is passed to dm-verity on the kernel command line, which the enclave measurement covers, so the attestation vouches for the hash.
3. Enforce. Whenever the inference server reads the weights, dm-verity checks each block against the attested root and fails on any mismatch.

Tinfoil contrasts this with signing weights, for example with Sigstore Model Transparency. It argues that a signature protects the weights only at the moment it is checked, while a malicious hypervisor could alter the disk afterwards ¹.

The rest of the boot chain is measured too: firmware, kernel, initrd and a configuration file. The enclave checks each GPU's attestation at boot and does not start if the check fails ³. Tinfoil's software development kit (SDK) then runs the client-side checks:

• it verifies the attestation back to the CPU vendor's root certificate;
• it compares the measurements with a Sigstore-published record of the expected values;
• it binds the TLS connection to the key in the attestation ³.

For a public model, anyone can rerun Modelwrap on the same Hugging Face commit and compare root hashes. For a private model, the customer builds the image and can encrypt it with dm-crypt, and the attestation shows only the root hash ¹. Tinfoil lists billing and account management as closed-source components outside the security-critical path ³.

Evidence

• Reported costs. Tinfoil reports that the hash tree adds about 0.8% to storage and that builds take 5 s for a 549 MB model and 13 min 25 s for a 554 GB model. Cold-cache loading takes about 80% longer with verification, but inference runs at full speed once the weights are in GPU memory ¹.
• Public code. Modelwrap is public under an MIT license, and v0.3.0 was the latest release in September 2026 ⁵.
• Production use. Tinfoil reports serving each model from multiple enclaves in its production deployment ⁴. Its attestation architecture checks model volumes against Modelwrap commitments at boot ³.

Limitations

Tinfoil documents several limitations of enclaves ²:

• an attacker with physical access "can potentially compromise the enclave", with demonstrated attestation forgery for Intel TDX and key extraction for AMD SEV-SNP;
• timing, power and electromagnetic side channels;
• host observation of access patterns and I/O;
• denial of service, supply-chain compromise and rollback.

Other limits:

• GPU binding. Independent researchers report that NVIDIA does not bind the H100 to the identities of specific VMs. By pairing relayed H100 attestations with forged TDX attestations, they made a system running outside TEE protection pass both checks ⁶. Tinfoil's GPU check runs inside the enclave at boot ³.
• Private models. Clients learn only that the same weights are served each time ¹.
• Audit-time verification. Tinfoil "does not provide a supported tool for querying these records", and it notes that rebuilding binaries to check measurements independently is expensive ⁴.