OPAQUE, the Confidential AI company, today introduced Weight Custody Manifest (WCM), an open standard and developer-preview SDK that gives AI builders verifiable control over when and where their model weights can be unlocked when deployed on customer-controlled infrastructure. Weight Custody Manifest ends standoff that keeps best models out of customer-controlled environments: builders get verifiable control over where weights are unlocked, and customers keep control of own machines. Announcement was made from San Francisco on September 9, 2026.
WCM extends OPAQUE's Confidential AI infrastructure to protect actual models running on sensitive data, not just data itself. AI models increasingly moving beyond infrastructure of companies that built them. Enterprises fine-tuning open models on proprietary data, while AI labs and software companies asked to deploy increasingly valuable models directly into customer, sovereign and on-premises environments. This shift creates new trust problem for model builders.
WCM directly addresses challenge by keeping model weights encrypted until new infrastructure proves it meets conditions approved by model builder. Even after key released, if conditions change or required proof not consistently met, access can be revoked at any time.
"Today's Confidential AI protects the customer from the model. WCM protects the model from the customer," said Imran Siddique, Chief Platform Officer at OPAQUE. "The terms of a written contract have limited reach as AI models increasingly move onto infrastructure their builders don't control. Builders need proof that their intellectual property will only be unlocked in an environment that meets agreed-upon conditions. WCM gives all parties verifiable proof instead of asking either side to simply trust the other."
Unlike existing key brokers, WCM connects key release to model itself and terms governing its use. Jointly signed manifest can define model's identity, license, permitted uses, jurisdiction, approved software and custody requirements before weights unlocked. WCM also tracks fine-tuned derivatives back to parent models and supports revocation down chain. Manifest co-signed by model builder and custodian, OPAQUE by default or self-hosted by sovereign customer. Either side can trigger emergency revocation, and sovereign deployments can require quorum so no single party can switch model off on own. Manifests can be recorded to public, append-only log, which sovereign deployments require. Complements OpenSSF Model Signing where signing proves model genuine, while WCM determines whether it can be unlocked.
WCM being released as open, Apache-licensed developer preview with published specification, defined data format, working reference library and 91 public test cases. Specification, threat model and tests public so model builders, customers and infrastructure providers can independently evaluate and implement protocol.
OPAQUE has validated WCM end-to-end on real hardware. Build is reproducible, with two back-to-back builds producing byte-identical results across 5,948 files, verified automatically. WCM validated using NVIDIA H100 in confidential mode, as well as AMD and Intel confidential servers on Azure and Google Cloud.
About OPAQUE
OPAQUE is Confidential AI company. Born from UC Berkeley's RISELab, OPAQUE lets organizations run AI models, agents, and workflows on most sensitive data with hardware-rooted isolation and verifiable evidence that approved governance policies actually enforced. Founded by Dr. Ion Stoica, Dr. Raluca Ada Popa, and Rishabh Poddar; Imran Siddique is Chief Platform Officer.
