| --- |
| license: apache-2.0 |
| tags: |
| - encrypted |
| - confidential-computing |
| - proof-of-concept |
| --- |
| |
| # Encrypted model artifact |
|
|
| **This repository does not contain a loadable model.** It contains one |
| encrypted file, `artifact.enc`, published by a confidential model |
| distribution pipeline. Downloading it without the decryption key gets you |
| bytes indistinguishable from random. |
|
|
| That is the point. The artifact is public and still confidential, because the |
| only secret in the system is the key — which never travels with it. |
|
|
| ## What is inside |
|
|
| `artifact.enc` is an AES-256-GCM ciphertext of an uncompressed tar archive |
| containing [`google/bert_uncased_L-2_H-128_A-2`](https://huggingface.co/google/bert_uncased_L-2_H-128_A-2), re-serialized to |
| safetensors. |
|
|
| ``` |
| artifact.enc := nonce (12 bytes) || ciphertext || GCM tag (16 bytes) |
| ``` |
|
|
| The repository id `juanlumc1988/bert-tiny-encrypted` is bound into the ciphertext as associated data, |
| so the artifact cannot be relocated to another repository without failing |
| authentication. |
|
|
| ## How it is consumed |
|
|
| A workload running in Kubernetes mounts the decryption key from a Secret, |
| downloads this artifact, verifies and decrypts it in memory, and loads the |
| model into a RAM-backed volume — the plaintext never reaches disk. |
|
|
| ## Source |
|
|
| Pipeline, design decisions and reproduction steps: |
| <https://github.com/juanlumc1988/confidential-model-distribution> |
|
|
| ## Licence |
|
|
| Apache 2.0, following the upstream model. |
|
|
