Nobody will exfiltrate frontier weights because nobody has access to them. Anthropic bought Opaque, a confidential compute provider, to build end-to-end private AI. From training to inference, not even internal team members have access to the weights. If AI is a black box, then this is a black box around the black box. Many people have misconceptions about the use cases of confidential compute, and have tried to use it for things like distributed networks, blockchain, etc, but it has one big weakness: sidechannel attacks. In a distributed network, anyone with access to the hardware can attack it and read out the data. For a distributed network (anyone offering public permissionless confidential AI) there is a big gotcha, which is that the machines have to be operated by a whitelisted node provider and signed with something like a "Proof of Cloud" attestation, which means they are colocated in a major datacenter. As frontier models suck up more and more GPUs, this makes confidential compute more valuable. Just a handful of frontier customers can allocate millions of these GPUs. Attacking the hardware, like an NVIDIA cluster, is not an easy activity to hide. The racks are equivalent in weight to a Tesla roadster, and at 300 pounds, each DGX B300 requires a lift to rack and unrack. If they weights are distributed across multiple racks, as in an NVL72, you'd need to attack all of them simultaneously. These systems are being fully secured so that nobody, not even Dario himself, can get the weights. They are trained confidentially, delivered to inference machines securely and deployed on confidential hardware which makes it practically impossible to view. https://aiweekly.co/alerts/anthropic-acquires-opaque-systems-hires-its-ceo-and-cto