Lesson 7.1 · 12 min read
AI assets and threat model
Model weights, prompts, outputs, training data and fine-tuning sets, and who wants them.
What needs protecting
| Asset | Owner | Typical adversary |
|---|---|---|
| Model weights | Model developer | Infrastructure operator, competitor, insider who can snapshot GPU or VM memory |
| Prompts and completions | End users and their organisations | Model host, platform admins, logging pipelines |
| Training and fine-tuning data | Data owners, often several parties | Model developer, other data contributors, the cloud provider |
| Retrieval corpora and embeddings | The deploying organisation | Anyone with access to the vector database host |
Confidential AI uses TEEs so that these assets are visible only to approved, attested code. A common deployment is a confidential VM (AMD SEV-SNP or Intel TDX) with a confidential-computing-capable GPU attached, where model weights are decrypted only after both the VM and GPU have been attested.
Key takeaways
- Enumerate the AI assets and their owners before choosing a TEE design.
- Confidential AI typically pairs a confidential VM with a GPU in confidential computing mode.
- Model-level attacks and authorised data flows are out of scope for hardware isolation; review them separately.