Cohere 发布公共贝塔模型断层的机密计算

AI 模型和平台

Cohere 发布公共贝塔模型断层的机密计算

在 Google 上的首选来源中添加 Unite.AI

Cohere 2026年10月22日宣布 Z 机密电子计算在Cohere Model Vault上的公开β，其专用的，完全管理的模型推论平台，运行在NVIDIA H100 GPU上，用于处理敏感数据的企业。

发布将Model Vault扩展至涉及临床记录、财务信息、特权文件、知识产权和专有源代码的工作量。 Cohere 称的目标是让企业利用管理下的AI的能力和操作简便性，同时使其敏感的纯文本数据远离服务运行的基础设施。 公司列出了候选工作量，包括金融服务欺诈调查、特许文件搜查和法律小组的尽职调查、敏感的公共部门信息、专利和研究材料、专有工程和接口设计文件，以及跨专有源代码的搜索和分析。

在β的角色划分下，Microsoft Azure提供了基本的保密计算基础设施，NVIDIA机密计算将保护带入H100 GPU,Cohere用品管理型号服务，加密请求路径，远程证明，并通过Model Vault进行客户侧验证。 客户可以通过Model Vault设置和管理加密金库，通过相同的Cohere API连接，从金库开始。 cohere.com，据该公司称。

机密执行和加密请求路径

机密计算针对的是正在使用的数据，意思是当一个模型正在积极处理时的信息，是除传统上加密的存储和在途数据之外的第三个状态。 在Model Vault中，模型服务堆栈，包括操作系统，驱动器，和推论服务器，运行在一个保密的虚拟机内，根据与发布同时发布的配套技术深潜Cohere，硬件支持的隔离屏蔽其内存与主机环境，政策将环境限制在被批准的软件上，同时让操作者无法交互进入运行工作量。 NVIDIA 机密计算保护GPU内存，并加密CPU和GPU之间的流量，因此保密边界覆盖了执行推论的加速器，而不是以CPU协调它而结束。

请求本身得到单独的保护。 Model Vault使用Oblivious HTTP，或OHTTP，对请求的敏感内容加密到与经认证的机密环境相连的公钥上。 加密消息将中介基础设施交叉作为密码文本，只有环境内部的OHTTP网关持有匹配的私人密钥，回复在返回途中得到同样的保护。 Cohere 称这样将运行平台的工作从读取客户发送通过它的能力中分割开来，因为中间人仍然可以在没有看到纯文本有效载荷的情况下进行交通路线。 应用程序保留模型Vault API和熟悉的请求格式，在客户和基础设施层实施保护，而不需要重新设计的有效载荷。

远程测试作为主动控制

在发出受保护请求之前，保密环境生成经加密签名的证据，以获取其硬件、固件、操作环境和应用软件的测量和安全相关特性，以及客户端软件的检查，这些证据与核准的政策相对应。 证据记录了环境的实际运行情况；政策编码了该环境是否应该与数据信任。 当需要的属性不匹配时，例如，改变的软件测量或没有达到预期保密模式的GPU，客户端无法核实，拒绝传输有效载荷，请求停留在客户自己的环境中。 这种证据在频繁周期内得到更新，客户在继续发出受保护请求之前，每次都对照核准的政策重新检查新的测量和安全状态，Cohere称这把用于审计的记录的证明转换为积极决定受保护数据是否为发布的控制。

在Cohere的发布公告中，CTO Phil Blunsom 称："有了硬件证明，客户不仅有密码证明工作量是在安全，保密的计算环境中运行的，他们还可以核实他们的数据受到保护，不被未经授权的访问，甚至不被来自Cohere. Vikas Bhatia, Azure 机密计算产品负责人，Microsoft，称与 Cohere 的工作表明，机密计算如何将管理下的AI的简单性与可独立核查的技术控制结合起来。 NVIDIA公司企业软件副总裁约翰·法内利(John Fanelli)，称 NVIDIA公司在其GPU上的机密计算提供了硬件支持的保护，帮助Model Vault等平台为企业工作量带来保密AI推断。

威胁模式、限制和开源计划

系统屏蔽处理过程中的提示、文件、回应和模式执行，云提供商、主机操作系统、超透视器、基础设施管理员以及Cohere本身的操作员，信任的计算基础仍然包括提供机密计算基础的硬件和固件，在环境内部运行的测量软件，定义核定配置的参考测量，以及评价和标志证据的证明基础设施。 Cohere 称设计缩小了必须信任的内容，形成一套明确的组件，产生可测量，可核查的证据。

Cohere还阐明了边界排除的内容。 物理和侧通道攻击，例如从时间或其他共享硬件行为推断信息，仍然处于其外，无法读取工作量的操作员仍然可以停止，延迟，或防止，因此设计本身没有可用的保证。 提示词注入，不安全的工具使用，授权错误，以及其他软件漏洞等应用层风险，不能通过将软件置于机密计算硬件内来解决。

可观察元数据是另一个排除因素：虽然有效载荷内容是加密的，但消息大小，请求时间，流量，路由细节仍然可见，在目前的架构中，API证书和模型标识符也位于OHTTP保护的有效载荷之外。 公司声明机密计算不是应用安全性的替代，也不是数据存留机制，也不是遵守或合同控制的替代，也不是同质加密，因为模型仍然在受保护环境内的平版字上运行。

执行工作以开源 Kata集装箱和保密集装箱项目为基础，Cohere 称计划以开源的形式发布保密推论堆，使客户和安全研究人员能够检查代码，查看哪些政策得到实施，并独立复制核查测量数据。 β目前在Microsoft Azure的NVIDIA H100 GPU上运行，Cohere 称支持包括B200 GPU在内的NVIDIA Blackwell基础设施正在通向通用的道路上。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

AI Models & Platforms

Cohere Launches Confidential Computing on Model Vault in Public Beta

Add Unite.AI to your preferred sources on Google

Cohere on October 22, 2026, announced the public beta of Confidential Computing on Cohere Model Vault, its dedicated, fully managed model inference platform, running on NVIDIA H100 GPUs on Microsoft Azure for enterprises processing sensitive data.

The launch extends Model Vault to workloads involving clinical records, financial information, privileged documents, intellectual property, and proprietary source code. Cohere said the goal is to let enterprises use the capabilities and operational simplicity of managed AI while keeping their sensitive plaintext data out of reach of the infrastructure running the service. The company names candidate workloads including financial-services fraud investigations, privileged document search and due diligence for legal teams, sensitive public-sector information, patent and research material, proprietary engineering and interface design documents, and search and analysis across proprietary source code.

Under the beta’s division of roles, Microsoft Azure provides the underlying confidential computing infrastructure, NVIDIA Confidential Computing carries that protection onto the H100 GPUs, and Cohere supplies managed model serving, an encrypted request path, remote attestation, and customer-side verification through Model Vault. Customers can set up and manage encrypted vaults through Model Vault, connect them through the same Cohere APIs, and begin at vault.cohere.com, according to the company.

Confidential Execution and the Encrypted Request Path

Confidential computing targets data in use, meaning information while a model is actively processing it, a third state beyond the stored and in-transit data that encryption traditionally covers. In Model Vault, the model-serving stack, including the operating system, drivers, and inference server, runs inside a confidential virtual machine, where hardware-backed isolation shields its memory from the host environment and policy limits the environment to approved software while giving operators no interactive path into the running workload, according to a companion technical deep-dive Cohere published alongside the launch. NVIDIA Confidential Computing protects GPU memory and encrypts traffic between the CPU and GPU, so the confidential boundary covers the accelerator performing the inference instead of ending at the CPU coordinating it.

The request itself receives separate protection. Model Vault uses Oblivious HTTP, or OHTTP, to encrypt the sensitive contents of a request to a public key tied to the attested confidential environment. The encrypted message crosses intermediary infrastructure as ciphertext, only the OHTTP gateway inside the environment holds the matching private key, and responses receive the same protection on their way back. Cohere says this splits the job of operating the platform from the ability to read what customers send through it, because intermediaries can still route traffic without seeing plaintext payloads. Applications keep the Model Vault API and familiar request formats, with the protection implemented in the client and infrastructure layers rather than requiring redesigned payloads.

Remote Attestation as an Active Control

Before a protected request is sent, the confidential environment generates cryptographically signed evidence that captures measurements and security-relevant properties of its hardware, firmware, operating environment, and application software, and customer-side software checks that evidence against an approved policy. The evidence records what environment is actually running; the policy encodes whether that environment should be trusted with the data. When a required property does not match, for instance a changed software measurement or a GPU that is not in its expected confidential mode, the client fails verification, refuses to transmit the payload, and the request stays within the customer’s own environment. That evidence is refreshed on a frequent cycle, and the client re-checks the new measurements and security state against the approved policy each time before continuing to send protected requests, which Cohere describes as converting attestation from a record kept for audits into a control that actively decides whether protected data is released.

In Cohere’s launch announcement, CTO Phil Blunsom said: “With hardware attestation, customers not only have cryptographic proof that workloads are running in a secure, confidential computing environment, they also can verify that their data is protected from unauthorized access, even from Cohere.” Vikas Bhatia, head of product for Azure Confidential Computing at Microsoft, said the work with Cohere demonstrates how confidential computing can combine the simplicity of managed AI with independently verifiable technical controls. John Fanelli, vice president of enterprise software at NVIDIA, said NVIDIA Confidential Computing on its GPUs provides hardware-backed protections that help platforms like Model Vault bring confidential AI inference to enterprise workloads.

Threat Model, Stated Limits, and Open-Source Plans

Within its stated threat model, the system shields prompts, documents, responses, and model execution during processing, and the cloud provider, host operating system, hypervisor, infrastructure administrators, and Cohere’s own operators are blocked from reading protected workload memory. The trusted computing base still includes the hardware and firmware providing the confidential computing foundation, the measured software running inside the environment, the reference measurements that define an approved configuration, and the attestation infrastructure that evaluates and signs evidence. Cohere says the design shrinks what must be trusted into an explicit set of components that produce measurable, checkable evidence.

Cohere also spells out what the boundary excludes. Physical and side-channel attacks, such as inferring information from timing or other shared hardware behavior, remain outside it, and an operator who cannot read a workload can still stop, delay, or prevent it, so the design carries no availability guarantee on its own. Application-level risks such as prompt injection, insecure tool use, authorization errors, and other software vulnerabilities are not solved by placing the software inside confidential computing hardware.

Observable metadata is another exclusion: while payload contents are encrypted, message size, request timing, traffic volume, and routing details remain visible, and in the current architecture the API credential and model identifier also sit outside the OHTTP-protected payload. The company states confidential computing is not a replacement for application security, not a data-residency mechanism, not a substitute for compliance or contractual controls, and not homomorphic encryption, because the model still operates on plaintext inside the protected environment.

The implementation builds on the open-source Kata Containers and Confidential Containers projects, and Cohere said it plans to release the confidential inference stack as open source, allowing customers and security researchers to examine the code, see which policies are enforced, and reproduce verification measurements independently. The beta currently operates on NVIDIA H100 GPUs in Microsoft Azure, and Cohere said support for NVIDIA Blackwell infrastructure, including B200 GPUs, is in progress on the path to general availability.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.