Fortanix extends Confidential AI to Kubernetes workloads through Confidential Containers

Fortanix extends Confidential AI to Kubernetes workloads through Confidential Containers

Data security company Fortanix Inc. today extended its Fortanix Confidential AI platform to support the Cloud Native Computing Foundation’s Confidential Containers project, so enterprises can run artificial intelligence workloads on Kubernetes inside hardware-based trusted execution environments.

The release goes after the exposure that comes during inference, when model weights and the data fed to them have to be decrypted in processor memory. Privileged administrators and cloud operators with access to the infrastructure can potentially reach them at that point.

Fortanix published survey figures last week on how AI leaders view that risk. Atomik Research polled 300 of them at large U.S. companies on Fortanix’s behalf, and 93% said traditional encryption does not protect data while AI is processing it. Security concerns had led 41% to block a deployment completely.

Fortanix’s answer builds on Confidential Containers, which reached incubating status at the CNCF in July. The open-source plugins the company is writing for the project verify that a container is genuine before it gets anywhere near an encryption key. That check runs through Fortanix Confidential Computing Manager, which attests the CPU and GPU together so an inference job spanning both is covered in full.

The company’s Data Security Manager hands over the keys only if the result satisfies the customer’s security policy. They go nowhere but the protected environment.

Co-founder and Chief Executive Anand Kashyap said moving AI into containers “doesn’t change the threat,” since models and agents still touch a company’s most sensitive data while they run. With the plugins in place, deploying a container into a confidential computing environment takes one click on supported hardware and Kubernetes platforms.

Fortanix is pitching the update at regulated industries that need confidential AI to hold up in production. Key release runs on a cluster, so losing one server does not block it. Customers with sovereignty requirements can run the platform on-premises or fully air-gapped, and the company says that also lets an enterprise host a frontier lab’s proprietary model next to its own data without putting the lab’s intellectual property at risk.

“Attestation is a protocol. Trust is an operation,” said Anuj Jaiswal, Fortanix’s chief product officer. Having attestation and key management on one platform spares enterprises from building the trust layer themselves when they adopt standard Confidential Containers, he said.

Advanced Micro Devices Inc., Intel Corp. and CrowdStrike Holdings Inc. are among more than a dozen companies Fortanix lists as supporting the work. John Fanelli, vice president of enterprise software at Nvidia Corp., said Fortanix is building on open standards for attestation and secure key release “at production scale.” Nvidia and Fortanix launched a joint on-premises confidential AI platform last October.

Fortanix Confidential AI for Confidential Containers is available now. The company plans to demonstrate it on Nvidia GPUs with confidential computing enabled at Nvidia GTC Berlin, which runs Oct. 20-22.

Image: Fortanix