Overview

Protect model weights on GPUs — sealed to hardware, decrypted only in VRAM, released only under policy you can verify.

What this protects

Model weights are the asset. On a shared or rented GPU, they normally sit in plain memory the moment inference runs — copyable by anyone with host access. SCSA seals the weights to the attested silicon of a specific GPU: they are decrypted only inside the GPU's VRAM, only after the hardware proves itself, and only while policy holds. Off that GPU — copied to disk, another card, or a cloud bucket — they are noise.

The same cryptographic core as SCSA Vault, pointed at the GPU: keys are derived from a live hardware measurement at access time, never stored.

The four things it does

Bind weights to the GPU

Keys derive from the GPU's attestation measurement. Move the model to another card and decryption fails — the key can't leave the silicon it was bound to.

Decrypt only in VRAM

Weights are decrypted on the GPU and consumed there. The plaintext never lands in host memory; only results leave the device.

Split the key across parties

Threshold custody: no single party — not even the operator — can unseal alone. Any party can revoke and make the model permanently unrecoverable.

Prove it, don't assert it

Every property is a live, externally verifiable proof: attestation, anti- replay, in-VRAM consumption, revocation, and a transparent STARK audit stream.

How you run it

SCSA is a set of binaries that run on the GPU host itself — scsa-vault, scsa-sealmodel, scsa-infer and zk-cli. There is no control plane in the middle. What differs between deployments is not the software but who has access to the box:

Sovereign / self-hosted — you run everything, under your own key, and nothing passes through anyone else's infrastructure. See Sovereign mode.
On hardware you own or rent — the same binaries, on-prem or in your own cloud account, with an honest table of who can unseal in each arrangement. See Bring your own GPU.

The security rests on the math — hardware-signed attestation and threshold custody — not on trusting whoever holds shell access. That principle runs through every page below.

Start here

Find out what your hardware can actually enforce, before sealing anything to it:

scsa-vault attest        # does the GPU attest, and at which tier
scsa-vault cc-check      # is Confidential Computing active
scsa-vault verify-replay # is a captured report rejected against a fresh challenge

Then seal a model and run it without the weights ever landing on disk:

scsa-sealmodel seal model.safetensors -o model.scsa
scsa-infer run model.scsa --input <data>

To put each use of the model under a quorum that logs and signs every decision, add the Authority Fabric.