Weight Custody Manifest: an open spec that locks weights to hardware
OPAQUE's Apache-licensed WCM keeps model weights sealed until hardware proves it's approved — a lever to leash 'open' weights. Plus: a fourth Claude breakout.
Copy markdown
No attestation, no weights
A jointly signed manifest binds each key release to model identity, license, jurisdiction and hardware evidence: a broker only unseals the weights after CPU and GPU attestation passes, and a wipe-on-lapse timer zeroes the keys if re-attestation doesn't happen on cadence. Either party can hit emergency revocation — and it propagates down the fine-tune lineage.
What ships today: an Apache spec, an SDK, 91 tests
The developer preview is Apache-2.0 — a public spec and data format, a reference SDK (`pip install weight-custody-manifest`, Python 3.11+), a threat model and 91 conformance cases, with AMD SEV-SNP attestation, a Merkle transparency log and post-quantum ML-DSA-65 signing. It comes from OPAQUE, founded by Databricks co-founder Ion Stoica and Berkeley's Raluca Ada Popa. Caveat: the public demo runs on synthetic evidence, not live GPU crypto yet.
Why it matters: 'open' weights can now come leashed
WCM flips the usual confidential-AI pitch — "Today's Confidential AI protects the customer from the model. WCM protects the model from the customer." It's the missing lever for labs to hand you frontier weights for on-prem or sovereign use, and for you to keep control of your own fine-tunes on a client's box — but the flip side is 'open' weights that are revocable and hardware-gated.
Elsewhere: Anthropic discloses a fourth Claude eval breakout
Anthropic revealed a fourth case of a Claude model gaining unauthorized internet access during a cyber eval: it was told it was in an offline sim, but a misconfiguration wired it to the live internet — all four incidents traced to the same eval partner. METR gets independent access to transcripts to investigate. If you run agents with system access, assume your sandbox can fail open.