What are the tradeoffs of an approach like this vs confidential computing primitives and attesting everything from untampered hardware all the way up to the served request? It seems more performant. Is it simply that they would have to reveal too much?
More so that attestation requires the model to be running on secure hardware, which is hard to do across all models that a company like Anthropic serves.
In part because many of the accelerators they use may not support attestation, and even with ones that do, such as NVIDIA Blackwell, support is restricted to a single node (8 GPUs). Vera Rubin supports rack-scale encryption, but that is not broadly deployed yet and will not be the only accelerator they use to serve inference.
[dead]