Sealed Inference

Ordinary cloud AI inference asks you to trust the operator: you send data to someone else's server, their model processes it, and you have to take their word for it that they didn't peek at your inputs, didn't copy the model weights they're running, and ran the code they said they'd run. "Sealed inference" is the informal name for the alternative, running that same inference step inside hardware that encrypts and isolates it so thoroughly that not even the machine's own operator can see the model weights or the data passing through, and where a signed hardware report (an attestation, see that entry) is the only proof anyone gets that it actually happened inside a genuine, unmodified sealed environment rather than a regular, inspectable one.

Where it comes from

The hardware foundation is real, external, and specific. NVIDIA's Hopper generation (H100/H200) was the first GPU line to support this as "Confidential Computing", encrypting GPU memory and fencing off a protected compute region even from the host operating system, alongside comparable CPU-side technology from Intel (TDX/SGX) and AMD (SEV). "Sealed" itself isn't a standards-body term; it's plain-English framing that confidential-computing infrastructure projects (Phala Network's "sealed agents" is a widely cited example) have popularized for this pattern. Solidus built none of the underlying hardware and did not originate the "sealed" framing.

Solidus status

Worth being precise here, because Solidus's actual GPU tier is a different, weaker trust model that's easy to mistake for this one. Solidus's node product ships a GPU build, onnx-cuda, an ONNX Runtime paired with NVIDIA's CUDA execution provider: that an operator downloads and runs on their own hardware. What makes that trustworthy today is a signed-supply-chain model, not a sealed one: the binary is Ed25519-signed and its SHA-256 matches a published manifest, so an operator (or a stranger) can confirm they're running the exact code Solidus published. That is not sealed inference, it doesn't encrypt model weights or inputs against the machine's own operator, and it carries no hardware attestation that the GPU ran inside an isolated, encrypted memory region. Solidus has also published zero throughput or cost-per-job numbers for this GPU tier, in either direction, it's an optional, unbenchmarked tier, full stop. TEE-based sealed inference is not on Solidus's shipped roadmap as of this writing.

Proof: none, there's nothing to demonstrate, because Solidus hasn't built this. The honest, adjacent thing that is checkable: download the signed onnx-cuda build from releases.solidus.network and verify its SHA-256 against the published manifest yourself. That proves supply-chain integrity. It does not prove, and should never be described as, a sealed, attested execution environment.