X0NE-INFER

Confidential
Inference
Only.

An inference engine that only runs inside an attested enclave. Whoever owns the machine sees neither your model, your prompts nor the answers.

talk to us → early access
attestation gate
enclavenone
proofnone
✗ refusedexit 64
cpu · intel tdxverified ✓
gpu · nvidia h100 ccverified ✓
model keyreleased
receiptsigned, per answer
● servingconfidential inference only

the sequence, illustrated · machine without an enclave → intel tdx + nvidia h100, confidential mode

how

No proof, no inference.

①

Only in an enclave

by construction

There is no other mode. Without a hardware proof, no port opens and no key is released.

②

Proof first

Intel TDX · NVIDIA H100

The CPU and the GPU prove what they are, checked live with Intel and NVIDIA, before anything arrives.

③

You verify

a signed receipt per answer

Every answer comes with a signed receipt. You check it on your own machine.

real

Run on real hardware.

Intel TDX with an NVIDIA H100 in Confidential Computing mode, 20 August 2026. Written in Rust by x0ne, in Paris. Version française.

frequently asked

Confidential inference engine: the questions.

What is a confidential inference engine?

An inference server that runs an AI model inside a hardware enclave (a TEE) and proves cryptographically, through remote attestation, that the enclave is genuine before it receives the model or the data. The machine's owner cannot read the model weights, the prompts or the answers.

What does confidential-only mean?

Most confidential inference services place a stock engine such as vLLM inside a confidential VM: the same program can also serve outside an enclave. x0ne-infer has no such mode. Its attestation gate is a Rust type, so without a proof object nothing binds a socket or releases a key, and on a machine without an enclave the binary refuses to start. There is no development bypass.

How do I know it is real?

It ran on real hardware on 2026-08-20: an Intel TDX machine with an NVIDIA H100 in Confidential Computing mode at a cloud provider, 10 min 23 s of billed machine, about $0.5. The CPU attestation is verified up to Intel's root and against Intel's live service, the GPU attestation through NVIDIA's production service, and the client re-verifies everything on its own machine.

What does it not prove yet?

A verified verdict means genuine confidential hardware answered this session's challenge. It does not yet mean that this exact binary is running: no launch measurement is pinned today. That is the next milestone, together with reproducible builds.

Is it open source?

x0ne-infer is written in Rust by x0ne, in Paris. Its open-source release under Apache-2.0 is planned; the code is not public yet. Early access: contact@x0ne.co.