Fortanix brings protected AI models into Kubernetes deployments

Fortanix announced on 19 October that its Confidential AI service now supports CNCF Confidential Containers, or CoCo. It says the service is available immediately, with deployment options including customer premises and environments disconnected from the internet.[1]

The commercial problem runs in two directions. A business wants to keep sensitive records close; a model provider wants its trained weights, the values encoding what its system has learnt, protected when someone else operates the hardware.[1]

Opening the software inside the boundary

CoCo changes where the packaged software is opened. Its design documentation says container images are downloaded and unpacked inside a protected virtual machine. In an ordinary Kata Containers arrangement, that happens on the host, exposing the images to the machine running the workload.[2]

The protected boundary surrounds a pod, Kubernetes’ group of cooperating containers, along with supporting processes. The host and cluster control plane remain outside it. That lets containers share information inside the protected group without trusting every component that manages the cluster.[2]

For accelerated AI, CoCo can bind evidence about virtual CPUs and accelerators in a single attestation. A policy can then condition release of a secret on that combined check. The project warns that application interfaces crossing the protected boundary still need their own security design.[3][2]

A service around the keys

Fortanix’s contribution connects its environment-verification and key-management services to that machinery. The announcement says open-source plugins are in development, separately from the available CoCo service. Its stated aim is to keep both customer data and the model provider’s intellectual property away from infrastructure operators.[1]

That offers a route to selling access to proprietary AI where the customer’s data already lives. The commercial product includes managing the conditions under which the model is unlocked, alongside the ability to run it.[1]

Report an error or suggest a correction