Lit Protocol now supports confidential, verifiable AI deployments
Today we are extending Lit Protocol to AI. Training, fine-tuning, and inference can now run inside the same confidential, verifiable execution environment that powers Lit’s Chipotle network, which secures over $50B in transactions and is accessed through API.
What’s new
Lit’s runtime was built to answer one question for programmable wallets: can you prove what code ran, and that no one, including the operator, could see inside while it ran? AI customers asked us to answer the same question for models.
With this launch, an AI workload deployed to Lit gets three guarantees:
- Confidential execution. The workload runs inside hardware-isolated confidential VMs. Model weights, training data, and every step of inference are processed in memory that the host, the cloud provider, and Lit itself cannot read.
- Verifiable software. Each deployment is hardware-attested. Anyone can check the environment’s measurements against the approved release hashes recorded on Base. Runtime keys are released only to deployments that match.
- Explicit boundaries. You define what the workload may read, what it may return, and where it may send data. Egress is a policy enforced by the runtime, not a promise made by an operator.
Supported workloads
Training and fine-tuning. Train on sensitive datasets and proprietary model assets without exposing either to the infrastructure running the job.
Inference. The full inference path executes inside the confidential boundary. The model, the prompt and its context, and the generated response exist in plaintext only inside attested hardware. Your users’ inputs are never visible to the operator serving the model.
Data control. Permitted data sources, outputs, and outbound requests are specified at deployment and enforced during execution.
How it works
Nothing fundamental about the runtime changed. The same style of environment that authorizes and signs transactions on Chipotle now runs AI workloads. Lit operates the confidential infrastructure. You bring the code and connect the data.
When a workload starts, the hardware measures the environment and checks it against contract-approved release hashes. Only a matching deployment receives its keys. Changing an approved hash is an on-chain transaction, so the upgrade history is public and inspectable by your customers, auditors, and counterparties.
Getting started
The API and developer docs are available today at developer.litprotocol.com. AI deployments are onboarded with our team, beginning with a workload assessment that covers hardware, model handling, privacy requirements, and permitted outputs. Self-hosting is available for on-premises deployments.
Get in touch to scope an AI deployment.