Microsoft Patents a Locked Vault Inside Your Chip for Downloaded AI Models
AI models cost a fortune to build, and the moment one lands on your laptop, it becomes easy to steal. Microsoft's patent application describes a locked room inside the chip where only approved parts can read the model.
What Microsoft's AI model vault actually does
A company spends years and a huge amount of money training an AI model, then lets people download it so it can work without an internet connection. Anyone with the right know-how could copy it straight off the machine. For you, that tension helps decide which AI tools run on your own device and which stay locked in the cloud.
Microsoft's patent application describes a fix built into the chip itself. The model arrives scrambled. Before it can be unscrambled, a small guard processor proves to the model owner's server that the chip's built-in software is genuine and untampered. Only then does the server hand over the key.
The unscrambled model goes into a protected section of memory that only the AI processor and the guard can read. If your computer's main processor tries to peek, it gets gibberish.
… decrypting, by the security processor, the encrypted AI model using the decryption key; writing, by the security processor, the decrypted AI model to a protected memory space …
Translation: The security processor unlocks the model and places it into a secure memory zone.
How the security chip hands out the key
The claims cover a method and a chip design (a system on a chip, where the processor, memory controller and security hardware sit on one piece of silicon). The device first downloads an encrypted AI model and parks it in ordinary, unprotected memory.
Next, a security processor (a small, locked-down helper processor) attests to the identity of the firmware (the built-in software) on each part that will touch the model, such as a neural processing unit (NPU, a chip part built for AI math). It loads each firmware and takes a measurement, a kind of fingerprint called a hash. The attestation can include a freshness element showing the measurements are current. The model owner's server compares them to known good values and, if they match, sends back the decryption key.
The security processor decrypts the model and writes it into a protected memory space. The memory controller (the circuit that manages traffic to memory) encrypts everything written there with a key only the approved parts share. If the main CPU tries to read it, the controller either refuses or decrypts with the CPU's own key, which returns unintelligible data.
The filing also describes:
- License limits enforced by the security processor: number of runs, number of simultaneous runs, or how long the model can be used
- Separate protected spaces for the model's input and output data
The SP may attest to the identity of firmware of the SP and SPU to obtain a decryption key to decrypt the encrypted model downloaded to unprotected memory space.
Translation: The security chip checks system software to safely unlock the downloaded AI model.
Why this could bring premium AI models offline
AI makers who want to protect a valuable model often keep it on their own servers. That means the tool needs a connection and your data travels over the network. A scheme like this could let more capable AI run on your laptop, gaming device or even a car (the filing lists these as example devices), including when you are offline.
It also gives model owners a way to sell by the use: the license can cap how many times, how many at once, or how long a model runs. The application is at an early stage, since the examiner's first review rejected the claims as filed, which is routine and usually followed by amendments.
Microsoft's 20th filing we've tracked since August follows earlier applications like hiding names in group chats and locking only sensitive data, continuing the pattern we follow in our on-device AI privacy watchlist.
The problem is real. A trained AI model is expensive to build, and once a readable copy sits on a stranger's laptop, the owner cannot take it back. That risk is a big reason owners keep their best models on their own servers, and why those tools stop working when your connection drops.
The fix matches the size of that problem. It puts the protection into the hardware, so even someone who takes over the main processor finds only gibberish. It also lets the owner inspect the chip before handing over the key, which is how a lock should work when the buyer's machine cannot be trusted.
The limit is that it needs hardware with a security processor and a programmable memory controller. Devices without them gain nothing. For companies selling premium models, that is a reasonable price for a serious problem.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Microsoft patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
9 drawing sheets from US 2026/0352443 A1 · click any drawing to enlarge
Show the other 1 sheets
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in