Organization · Company
Tinfoil
A company offering AI inference inside secure hardware enclaves, with remote attestation that clients can check; developer of the Modelwrap model-identity tool.
Tinfoil describes its product as AI that is "verifiable, thanks to secure hardware enclaves". Its documentation and code describe how a client checks what runs in the enclave:
- Model identity. Tinfoil developed Modelwrap, which it reports binds model weights to enclave attestation 1. The open-source tool commits the weights to a dm-verity root hash 2. See Tinfoil model identity (Modelwrap) and Model identity attestation.
- Attestation architecture. Tinfoil documents a measured boot chain, reproducible builds, publication of expected measurements through Sigstore, and verification by the client 3, with checks at connection time and transparency logs 4; see TEE remote attestation for AI workloads.
- Supported hardware and limits. Its documentation lists AMD SEV-SNP and Intel TDX confidential virtual machines, and NVIDIA GPUs in confidential-computing mode, as supported hardware 5. The same page documents limitations, including physical attacks, side channels, I/O leakage, denial of service, supply-chain risks and rollback 5.
Implementations
- Tinfoil's method for proving which model weights its enclave-hosted inference service runs, by binding a dm-verity hash of the weights into remote attestation.
Mechanisms
Mechanisms this organization has designed, built, evaluated or supplied.
- Establishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.
- Trusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.
Publications
Sources this organization authored or published.
- BTinfoil (2026). A primer on secure enclaves. Tinfoil documentation. RecordCited by Model identity attestation; TEE remote attestation for AI workloads; Tinfoil model identity (Modelwrap); NVIDIA; Tinfoil
- BTinfoil (2026). Backend infrastructure. Tinfoil documentation. RecordCited by Model identity attestation; TEE remote attestation for AI workloads; Tinfoil model identity (Modelwrap); Tinfoil
- CTinfoil Team (2026). How Tinfoil Proves Exactly What Model Is Running. Tinfoil. RecordCited by Model identity attestation; Safeguard attestation; TEE remote attestation for AI workloads; Tinfoil model identity (Modelwrap); Tinfoil
- BTinfoil (2026). How verification works in Tinfoil. Tinfoil documentation. RecordCited by Model identity attestation; TEE remote attestation for AI workloads; Tinfoil model identity (Modelwrap); Tinfoil
- BTinfoil (2026). modelwrap: Reproducible dm-verity read-only image of Huggingface models. GitHub. RecordCited by Model identity attestation; TEE remote attestation for AI workloads; Tinfoil model identity (Modelwrap); Tinfoil
Sources
- CTinfoil Team (2026). How Tinfoil Proves Exactly What Model Is Running. Tinfoil. Source recordSupports: Modelwrap binds model weights to enclave attestation (provider-reported)
- BTinfoil (2026). modelwrap: Reproducible dm-verity read-only image of Huggingface models. GitHub. Source recordSupports: Modelwrap code: dm-verity commitment to model weights
- BTinfoil (2026). Backend infrastructure. Tinfoil documentation. Source recordSupports: measured boot, reproducible builds, Sigstore measurements, client verification
- BTinfoil (2026). How verification works in Tinfoil. Tinfoil documentation. Source recordSupports: connection-time verification and transparency logs
- BTinfoil (2026). A primer on secure enclaves. Tinfoil documentation. Source recordSupports: supported hardware (AMD SEV-SNP, Intel TDX, NVIDIA confidential-computing mode) and documented limitations