Attested · Issue #1

Attested #1: Brave puts Leo behind attestation, Tinfoil pins DeepSeek's newest weights in an enclave

This week in confidential inference: attested Leo, hash-pinned DeepSeek, a 38% Kimi K3 cut, and zero providers verified end to end

Subscribe on Substack

This week in confidential inference · Oct 10–19, 2026

This is the first issue of Attested, a weekly note on confidential inference: AI models running inside hardware enclaves (TEEs), where the operator isn't supposed to be able to read your prompts.

Every issue has two halves. First, the news that matters if you build on this stuff or pay for it. Then what changed on the providers I track and what my monitor at confidentialinference.net measured. Prices link to the provider's own page. Attestation and post-quantum TLS results are my own measurements.

The top stories

Brave Leo now encrypts to a NEAR AI enclave, in production

On Oct 15 Brave turned on end-to-end encrypted chat for GLM 5.3 Flash in Leo, in Release, Beta and Nightly. The browser encrypts each prompt with Oblivious HTTP to a key held inside a NEAR AI TEE (profile), running Intel TDX plus NVIDIA confidential computing. Brave's relay sees your IP but not the prompt. NEAR sees the prompt but not your IP. The browser only gets the enclave key after Brave's open-source verifier checks the TDX quote, the GPU attestation and a rebuild of NEAR's code.

Brave is upfront about the gap: today the browser relies on Brave's gateway to do that check. In-browser verification, a published log of TEE keys and attestation of the exact weights loaded into memory are listed as next steps (Brave).

Why it matters: this is the first mass-market client I know of that checks the enclave itself instead of trusting the provider's word. It lines up with my data, too: GLM 5.3 Flash is the only one of NEAR's 9 TEE models that gets past the hardware check on my NEAR attestation page; the other 8 fail it. One caveat for the harvest-now-decrypt-later crowd: the OHTTP layer uses HPKE with X25519, which is classical, and NEAR's public API endpoint didn't negotiate hybrid post-quantum TLS in my latest probe (PQC run #32).

Sources: Brave · NEAR AI · The Register

DeepSeek shipped a new Flash checkpoint, and Tinfoil had a measured enclave build of it the next day

DeepSeek published DeepSeek-V4.1-Flash-1017 on Oct 17. On Oct 18, Tinfoil (profile) switched the B300 build in its enclave repo for the model to the new weights, pinned by commit hash (DeepSeek-V4.1-Flash-1017@1bae0e10…, the same revision Hugging Face serves). Each build ships as a release with SEV-SNP and TDX measurements, an image digest and a Sigstore entry: v0.0.6+b300 and v0.0.7+b200. (A v0.0.6+b200 in between had a startup packaging defect, per Tinfoil's own release note.)

Why it matters: this is what a model update on an attested service should look like. The new weights are a hash in a public config, the build that loads them has a measurement you can compare against the attestation report, and the release is in a transparency log. You don't have to take "we upgraded the model" on trust.

What I can't tell you yet is whether Tinfoil's production endpoint serves the 1017 build. The public model name didn't change (deepseek-v4-1-flash in Tinfoil's model catalog, still $0.65/$1.45 per M input/output tokens), and my monitor couldn't fetch fresh evidence for that route in its latest run (Tinfoil attestation page), so I can't match the served measurement to a release yet.

Everywhere else, 1017 is only available outside an enclave so far:

  • Venice (profile) lists deepseek-v4-1-flash-1017 at $0.30/$1.20 with TEE attestation and E2EE both marked false. Its E2EE DeepSeek is still the older e2ee-deepseek-v4-flash (Venice model API).
  • PPQ.AI (profile) lists deepseek/deepseek-v4.1-flash-1017 at $0.3165/$1.266 as a regular route. Its TEE route, private/deepseek-v4-1-flash, runs on Tinfoil at $0.68575/$1.52975 (PPQ model API).
  • NanoGPT (profile) lists deepseek/deepseek-v4.1-flash-1017 on a standard route at $0.10/$0.60. Its TEE route, TEE/deepseek-v4.1-flash, says it runs through Tinfoil, at $0.65/$1.45 (NanoGPT model API).

So if you want 1017 inside an enclave this week, Tinfoil is the only place it could be, directly or through the PPQ and NanoGPT routes that resell it.

Chutes cut Kimi K3 by 38%, and Prem is the cheapest enclave DeepSeek V4.1 Flash I track

Chutes (profile) cut prices on four models on Oct 12. Kimi K3 went from $3.00/$15.00 to $1.85/$9.50 per million input/output tokens (Chutes pricing, model API): 38% off input, 37% off output. Qwen3.8 27B went from $0.24/$2.20 to $0.039/$1.25, Kimi K2.6 from $0.50/$2.85 to $0.45/$1.95, and Qwen3.6 27B input from $0.30 to $0.25 (all in the model API). Chutes didn't announce it anywhere I could find. The date comes from archived copies of its own pages: the model API at 05:31 on Oct 12 still shows the old prices, the pricing page at 19:24 the same day shows the new ones (Rome time).

Kimi K3 across providers with public per-token TEE prices, per M input / output tokens, from each provider's own page or API, checked Oct 19:

Note the Redpill line: it's a TEE route that its own API says is served by Chutes, at a 62% markup on Chutes' direct input price.

Prem undercuts everyone on DeepSeek V4.1 Flash. Prem lists it for confidential inference at $0.35/$1.40 per M (Prem models and pricing), against Tinfoil's $0.65/$1.45 (Tinfoil model catalog), which PPQ and NanoGPT resell at the prices above. The same Prem page lists cached input on confidential models as free under a promotion that ends October 20, the day this issue goes out, so don't plan around it.

Smaller moves. NEAR lists Qwen3.8 27B at $0.04/$1.35 (model page), basically tied with Chutes, and GLM 5.3 Flash, the Brave model, at $0.08/$0.50 (model page): the lowest TEE price I can find for it, against Venice's E2EE $0.16/$0.54 (Venice model API) and Privatemode's (profile) €0.20/€0.65 (Privatemode pricing). I couldn't find a dated before-price for NEAR, so I'm not calling those cuts. Privatemode made GLM 5.3 and GLM 5.3 Flash generally available in v1.59.0 on Oct 13. Going the other way, PPQ.AI retired its private GLM 5.3 Flash on Oct 12, and it's still missing from Tinfoil's catalog, which PPQ's private models run on.

What the monitor measured

Prem joins the monitor

Prem (profile) went on the site on Oct 17 with the full check: TDX quote, NVIDIA GPU evidence, workload identity and route binding. Prem's confidential API encrypts requests end to end to the enclave and verifies attestation with its open-source Reticle verifier (Prem attestation docs).

First results (Prem attestation page, Oct 19 run): 2 of 5 models pass hardware and TCB (DeepSeek V4.1 Flash and Nemotron 3 Ultra, both on Intel TDX). Both stall at channel binding: I couldn't verify that the encryption key is bound to the attested environment, so the monitor sees them as a TEE-only gateway rather than the attested E2EE Prem declares. The other 3 (Qwen 3.6 27B, Qwen 3.8 27B and the Deepgram Nova 3 transcription model) have been unreachable since Oct 17, so there's no verdict for them, good or bad.

Attestation: nobody is fully verified end to end

Across all 11 providers, 55 of 97 checks pass hardware and TCB, and 0 pass every applicable gate (attestation monitor). Workload identity (15 of 97), source provenance (1 of 97) and request route (0 of 96) are where almost everyone stops. Privatemode gets 13/13 through hardware and TCB, Chutes 13/14 and Tinfoil 9/9, though 8 of Tinfoil's had no fresh evidence in the latest run. NEAR AI gets 1 of 9: the Brave model.

No real verdict regressions in the window. The wall of "unobserved → failed" events in the changes feed on Oct 15 came from my own event-pipeline cutover, not from providers getting worse.

Post-quantum TLS: hybrid at the edge, not into the enclave

In PQC run #32 (Oct 18), 9 of 11 provider endpoints negotiated hybrid X25519MLKEM768: Tinfoil, NanoGPT, Confidential AI (profile), Prem, Redpill, Maple (profile), Privatemode, PPQ.AI and Venice. Chutes and NEAR AI negotiated no hybrid group. All 11 still accept a classical handshake. For all nine hybrid ones the site marks the result as edge-only, because I can't prove TLS terminates inside the attested TEE. On current data, no provider has a post-quantum channel that provably ends in the enclave. Raw data: /api/providers.json.

Housekeeping: about 190 "offer added/removed" events between Oct 10 and 17 were the same offers re-keyed under new IDs at the same price, and Privatemode's daily sub-cent moves look like currency conversion. I left both out. Raw feed: /api/v1/changes.json.

Security

FABRICKED and STALEUS: two software-only breaks of AMD SEV-SNP

Both come from Benedict Schlüter and Shweta Shinde's group at ETH Zurich (Secure & Trustworthy Systems Group), published at USENIX Security (proceedings up Oct 8). Both target AMD SEV-SNP and need a malicious host at hypervisor or firmware level, not physical access. FABRICKED misconfigures Infinity Fabric routing so AMD's security co-processor initializes SEV-SNP wrongly, giving arbitrary read/write in the guest and forged attestation reports (CVE-2025-54510). STALEUS makes the co-processor cache-incoherent with the x86 side, giving arbitrary read/write inside a fully attested CVM (CVE-2025-54509).

Why it matters: "the hardware attested" only means something if the TCB version behind it has the fix. On my monitor, Privatemode and Tinfoil attest on SEV-SNP, and so do the PPQ and NanoGPT routes that resell Tinfoil. That's why the TCB policy gate is its own column on the attestation pages.

Sources: FABRICKED (USENIX) · STALEUS (USENIX) · STALEUS paper and code

dstack v0.6.1 fixes a gap between attested image and issued certificate

Phala's dstack is the TEE stack behind a lot of this market. v0.6.1 (Oct 13) fixes a bug where, on SEV-SNP, a certificate request could pass authorization with one os_image_hash while the issued certificate claimed another. That's exactly the step where "attested" quietly turns into "trust the cert". If you run on dstack, upgrade the guest OS, KMS and verifier. NEAR's GLM 5.3 Flash route shows up as Phala/dstack on its provider page, and Redpill uses Phala attestation. (release)

"It's time to talk about TEEs," and DDRop at CCS in November

Alin Tomescu's survey of TEE attacks got a Hacker News thread on Oct 18. His sharpest point for anyone running a verifier: a remote attestation verifier accepts a quote from any Intel CPU in good standing, and an attacker's CPU is one of them, so a physical break of one chip is a break of all unless you pin to your own PCK certificates.

The physical attack to watch is DDRop, which goes to ACM CCS in November: a DDR5 interposer, about $159 in parts, that silently drops memory writes. It breaks memory integrity on Intel TDX, Scalable SGX and AMD SEV-SNP, and on TDX it was used to forge attestation reports. Intel and AMD call it out of scope. According to the researchers, NVIDIA's confidential GPU memory isn't exposed because it sits inside the chip package. Expect more people asking the question I care about for every provider: who physically operates this hardware? (CSA research note · The Hacker News)

Customers and performance

Thunderbird's Thunderbolt ships Tinfoil built in. Tinfoil spent Oct 12–16 naming customers. The biggest is Thunderbolt, the open-source AI client from MZLA, the Thunderbird company, which ships Tinfoil as a built-in model option. It's in the code, not just a logo: a Tinfoil client and a backend proxy. The others: Maple (GPU models on Tinfoil, own backend in AWS Nitro Enclaves), screenpipe, Syncopate Lab and Cybera (all on Tinfoil's customers page). That's two consumer apps in one week, Brave on NEAR and Thunderbolt on Tinfoil, putting an attested backend behind a default option. (Tinfoil customers · Thunderbolt · Tinfoil on X)

The cost of confidential computing keeps shrinking. Confidential AI published KV-cache offloading under confidential computing (Oct 13). Stock CC copies between GPU and host memory run at about 4 GB/s through an encrypted bounce buffer; they got that to 50 GB/s. On NVIDIA B300s with CC on, throughput rose 141% on llm-d's benchmark and mean time to first token fell from 39 s to 1.5 s, with the cache encrypted in host memory. NVIDIA's own B200 numbers put CC overhead on DeepSeek-R1 at 96.1–98.2% of baseline throughput. "TEEs are too slow" is getting hard to defend for inference. (Confidential AI · NVIDIA)

New names, and the router question

Most new entrants are routers on top of a few enclave operators. The useful question for each is whether the router verifies the upstream enclave or just passes the claim along. NanoGPT answers it honestly for Phala's new Kev-4B decision model: its model API says it "does not currently enforce attestation or verify signed receipts for this route," so the enclave is Redpill's claim, not something NanoGPT checks for you. (Kev-4B)

I don't track these yet and haven't run my verifier against any of them:

  • Umbra announced itself live on Oct 18 (post). It's an x402 pay-per-request gateway: no account, each call paid in stablecoin, with a signed receipt per response. It says the gateway runs in an Intel TDX VM on Phala's dstack (post) and publishes a TDX quote. Its "sealed" open models are listed as served by Phala's confidential AI; its "standard" tier is Claude, served by Anthropic, which sees the prompt (Umbra labels this). It has a token, and its site calls itself a public testnet. None of this is verified.
  • Enclave42 (Dubai): Intel TDX plus NVIDIA GPUs; the client verifies a nonce-bound quote before it encrypts anything (attestation docs). Python client on PyPI since Oct 7.
  • OffRouter: E2EE live since Oct 10 (post), a pay-per-call router for onchain agents with a signed receipt per response (docs). Its model IDs match Redpill's catalog, so I read it as a reseller.

Releases

  • dstack v0.6.1 (Oct 13): security release, see above. Release
  • Privatemode v1.59.0 (Oct 13): GLM-5.3 and GLM-5.3-Flash GA, Contrast v1.25.0, vLLM v0.31.0. Release
  • NVIDIA nvtrust 2026.10.02.001 (Oct 16): Protected PCIe Verifier v3.0.0 on the C++ attestation SDK 2.0.0. The Python SDK and Local GPU Verifier are past end of support, and CUDA 13.5 drivers will require the C++ SDK 2.x, so plan the migration. Release
  • tinfoil-go v0.16.3 (Oct 14): bumps encrypted-http-body-protocol to v0.4.1. Release
  • Tinfoil confidential-deepseek-v4-1-flash v0.0.6+b300 / v0.0.7+b200 (Oct 18): the 1017 builds, see above. v0.0.6+b300 · v0.0.7+b200

That's #1. Attested comes out weekly. If someone forwarded this to you, subscribe here so the next one lands in your inbox.

Every issue, plus the live provider data behind it, is archived at confidentialinference.net. You can follow attestation changes as they happen via the alerts RSS.

If you run one of these services and I got something wrong, reply to this email and I'll fix it in public.

Aljaz

← All issues of Attested