Private inference is not a single toggle. It is a set of claims about who can see prompts, model weights, retrieved documents and outputs throughout the request.
Define the adversary and the protected asset
Is the concern a curious cloud operator, other customers, internal support staff, a compromised user account or unauthorized model extraction? Each scenario calls for different controls. Hardware attestation may address some operator-access threats while failing to prevent an authorized application from storing raw prompts in an analytics database.
Walk the complete request
Trace the client device, API gateway, authentication, retrieval engine, inference runtime, safety filters, response cache and logs. Name where data is decrypted and whether a model is run in a measured environment. Include batch processes and human review queues; privacy claims limited to inference compute cannot silently extend to all connected systems.
How enclaves fit
AWS Nitro Enclaves can make key-release decisions conditional on measurements provided in attestation documents; their isolated compute has no direct external networking and relies on controlled communication with the parent instance. That architecture reduces certain exposures but makes the parent interface, KMS policy and outbound response path critical.
Test the risks that remain
Use synthetic canary records to test unauthorized retrieval, prompt injection, output leakage and telemetry. Review access logs without storing unnecessary personal prompts. Measure accidental disclosure to permitted users with inadequate roles; a secure enclave cannot repair permissions that should have denied an answer in the first place.
Document the claim honestly
A meaningful statement reads “for this endpoint and version, model execution and decrypted inputs are in an attested TEE with the following documented exceptions.” Avoid “nobody can ever see your data.” If evidence is unavailable, describe ordinary encryption, minimization or client-side alternatives without promising confidential hardware execution.
Sources & Further Reading
- AWS Nitro Enclaves KMS cryptographic attestation — Amazon Web Services.
- Azure Confidential Computing Overview — Microsoft Learn.
- OWASP Top 10 for LLM Applications (2025) — OWASP.
Jurisdiction/scope: Global technical; deployment-specific privacy. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.