IBM Patent Locks AI Models Inside an Encrypted Vault From All Parties
What happens when two companies want to use each other's AI without trusting each other? IBM has a patent for exactly that scenario: a locked, encrypted container that lets a model run without either side seeing the other's secrets.
What IBM's confidential AI computing actually does
Imagine a bank wants to use an outside company's fraud-detection AI, but the AI company won't hand over its model code, and the bank won't hand over its customer data. Right now, someone has to blink first. IBM's patent describes a way to resolve that standoff.
The idea is to spin up a sealed virtual computer (think of it as a temporary, windowless room) that runs the AI model in private. The model arrives encrypted, the data arrives encrypted, and the internet connection gets cut off entirely before any of that happens. Two separate digital keys unlock each piece only inside the room, so neither the model owner nor the data owner can spy on each other's inputs or outputs.
The software asking questions gets its answers back through a controlled interface, but nobody outside the room, not even the company running the server, can see what went on inside. When the job is done, the room disappears.
How the encrypted vault boots, locks, and runs the model
The patent describes a step-by-step process built around what IBM calls a confidential virtual machine (VM), a software-defined computing environment with hardware-enforced memory isolation (meaning even the cloud host can't read what's inside).
The sequence goes like this:
- A software application requests an AI inference. The system boots a fresh VM from a fixed, pre-approved image (a snapshot guaranteeing no surprise software is present).
- Network access is immediately disabled so the VM can't phone home or leak data.
- An encrypted disk and an encrypted ML model are imported into the isolated VM separately.
- Two independent decryption keys are brought in, one for the model, one for the disk, so each owner keeps control of their own asset.
- The model is decrypted and launched only inside the VM, and the calling application can feed it data through a narrow interface without ever touching the model's raw weights.
The architecture relies on confidential computing, a real technology already available from Intel (TDX) and AMD (SEV-SNP) that uses CPU-level hardware to guarantee memory contents are invisible to the host operating system or hypervisor. IBM is patenting the orchestration layer on top of that hardware.
What this means for companies sharing AI without sharing secrets
A growing number of AI deals fall apart because one side refuses to expose its model and the other refuses to expose its data. This patent describes infrastructure that could make those deals work without either party having to trust the other, or the cloud provider hosting everything.
For enterprises in regulated industries like finance, healthcare, or defense, where data can't legally leave a controlled environment, this kind of architecture could open up AI collaboration that's currently off-limits. It also points to a broader IBM strategy of positioning its cloud and AI infrastructure as the neutral ground where competing companies can safely do business together.
This is genuinely useful infrastructure work, not a flashy consumer patent. The problem IBM is solving, mutual distrust between two parties who both need something the other has, is real and common in enterprise AI deals. The patent doesn't invent confidential computing hardware, but the orchestration approach it describes is practical and fills a gap that pure hardware vendors haven't addressed.
The drawings
12 drawing sheets from US 2026/0195158 A1 · click any drawing to enlarge
Which company should we read for you?
We track 17 companies here. Pro is the same weekly breakdown for any company you choose, delivered privately. Type a name and we'll scope it and send you a quote.
Get one Big Tech patent every Sunday
Plain English, intelligent commentary, no hype. Free.
Editorial commentary on a publicly published patent application. Not legal advice.