New AMD Patent Locks AI Models Inside Chips Against Software Theft

By Patentlyze Team · Updated Jul 3, 2026

Your AI model is only as safe as the hardware running it. AMD is filing a patent that treats the chip itself as a security vault, encrypting and re-encrypting AI models as they move through different parts of the processor so no rogue software can ever read them in full.

What AMD's on-chip AI model encryption actually does

Imagine you have a secret recipe stored on a computer. Even if the computer is locked with a password, a sneaky program running on that same machine could potentially peek at the recipe while it's being used. That's roughly the problem AI companies face: a trained AI model sitting on a chip is valuable intellectual property, and malicious software could try to steal it.

AMD's patent describes a system where the AI model is kept encrypted almost continuously inside the chip. It only gets decrypted in small, controlled moments right before the chip's dedicated AI processor needs to run it, then gets re-encrypted again afterward. Different parts of the chip handle the encryption and decryption separately, so no single piece of software can see the whole picture at once.

The approach also locks down the memory buffers the AI processor uses during its work, adding another layer of protection. The goal is to make it genuinely hard for any unauthorized software, including malware, to pull a usable copy of the model out of the chip.

How AMD re-encrypts the model at each processing stage

The patent describes a method built around AMD's Neural Processing Unit (NPU), the dedicated AI-processing block inside modern AMD chips. The NPU is assigned its own unique encryption key, a secret code that belongs only to that unit.

When an AI model needs to be stored in main memory, the processor encrypts it using that NPU-specific key first. The encrypted blob sits in memory. When it's time to run the model, the chip decrypts it just in time for the NPU to execute it, then re-encrypts it again for storage. This cycle of decrypt, run, re-encrypt happens at different physical processing units across the chip.

The clever part is the distribution of responsibility:

• Encryption and decryption tasks are spread across separate processing engines, so no single unit ever has the full unprotected model and the keys at the same time.
• The NPU's internal working memory (its buffers, the scratch space it uses mid-calculation) is also protected from outside access.
• The first encryption key used to store the model can differ from keys used at later stages, meaning an attacker intercepting data at one point gets an incompatible chunk.

The net effect is that the model is only ever fully readable in tiny windows, inside tightly controlled hardware, making software-based theft much harder to pull off.

What this means for companies protecting proprietary AI

AI models represent enormous investment. A large language model or image-recognition system can cost millions of dollars to train, and the weights (the numbers that define its behavior) are effectively the product itself. Right now, once a model is loaded onto a chip for inference, protecting it relies heavily on software locks, which skilled attackers can sometimes bypass. AMD's approach moves that protection into the hardware layer, where software has far less reach.

For cloud providers, enterprise AI deployments, and device makers shipping AI features on AMD silicon, this kind of chip-level protection could become a genuine selling point. It's particularly relevant as more sensitive AI models run on edge devices like laptops and phones, where physical access and a wider range of software threats are both real concerns.

Editorial commentary on a publicly published patent application. Not legal advice.