Skip to main content
dRouter
Vault locked
About dRouter

Why this exists, where it falls short, and who runs confidential hardware today.

Standard AI APIs ask you to trust a privacy policy while reading your prompts in plaintext at the gateway. Pure cryptographic inference (FHE or MPC) removes hardware trust for small linear models, but non-linear attention layers make it too slow for frontier LLMs today. dRouter bridges the gap by verifying hardware enclaves in your browser and encrypting requests directly to the enclave key before sending a single word.

Open consoleHow it worksView node registry
Limits & Ground Truth

What you should know before trusting any enclave

Hardware attestation is stronger than a terms-of-service promise, but it has real boundaries. Here are the exact constraints of this system.

Plaintext runs inside attested hardware enclaves (not frontier LLM FHE)

The launch tier decrypts and runs prompts inside hardware-attested Trusted Execution Environments (TEEs). Pure homomorphic encryption (FHE) and multi-party computation (MPC) cannot reach usable interactive speed for frontier models today.

FHE Tier C is a real small CKKS linear classifier, not a frontier LLM

Live Tier C (node-seal 7.0.0 / Microsoft SEAL 4.1.2 WASM at /api/ashi) executes a real CKKS homomorphic linear computation (4x128 matrix-vector dot products plus encrypted squared L2 norm over a 128-dimensional embedding vector, N=4096, 128-bit security) where the server never sees plaintext or the secret key. Frontier 3T MoE FHE numbers remain an explicitly labelled analytical simulation.

Vercel Sandbox is an isolated Firecracker microVM, not a hardware TEE

Tool execution at /api/sandbox runs inside a Vercel Sandbox Firecracker microVM (@vercel/sandbox 3.9.0, 1 vCPU, ephemeral filesystem, zero host environment variables passed). It provides hypervisor-level microVM isolation, not an AMD SEV-SNP or Intel TDX hardware-attested enclave.

Tinfoil router and Kimi K3 enclave topology (262,144 token limit)

The live Tinfoil router (router-0.tinfoil.sh) attests with AMD SEV-SNP. The Kimi K3 model enclave (kimi-k3-inf14.tinfoil.containers.tinfoil.dev) runs on Intel TDX plus NVIDIA confidential-computing GPUs with a maximum context length of 262,144 tokens, not 1M. Gemini 4 Argon supports 1,000,000 tokens for outer orchestration over scrubbed metadata.

Tinfoil safeguards classifier and usage sidecars

Tinfoil's router runs a safeguards acceptable-use classifier sidecar (gpt-oss-safeguard-120b with kimi-k3 review) that reports policy violations to https://api.tinfoil.sh, plus a usage reporter.

Simulated test nodes (sim-1, sim-2, sim-3)

Nodes sim-1, sim-2, and sim-3 are simulated software nodes derived from SIM_HARDWARE_SEED to test client verification and failure handling. They are not real hardware enclaves.

TEEs are not perfect (physical memory-bus attacks exist)

Hardware enclaves reduce trust in the cloud host, but they are not invincible. Physical memory-bus interposers such as TEE.fail can probe deterministic CPU RAM lines on socketed DDR5 DIMMs, and silicon firmware bugs remain a real risk.

Timing and size buckets remain visible

Encryption and 4,096-byte bucket padding hide your text, but the relay and network operator still observe when a request happens and which coarse byte bucket it falls into.

Execution Tiers

FHE linear computation and Firecracker microVM sandbox as they really are

Alongside hardware-attested TEEs (Tinfoil AMD SEV-SNP router plus Intel TDX and NVIDIA Confidential Computing GPUs), dRouter exposes two specialized execution primitives with strict scope boundaries.

Tier C: Small FHE Linear ComputationLive CKKS (node-seal 7.0.0)

Encrypted 4x128 linear classifier & L2 norm (not a frontier LLM)

The /api/ashi endpoint runs real Microsoft SEAL 4.1.2 WebAssembly (CKKS scheme, polynomial modulus degree N=4096, 128-bit security). The client encrypts a 128-dimensional embedding vector locally and sends only the ciphertext, relinearization keys, and Galois rotation keys. The server computes four 128-dimensional dot products and a squared L2 norm homomorphically without ever seeing plaintext or the secret key. Frontier 3T MoE FHE numbers are an explicitly labelled analytical simulation.

Tool Runner: Vercel SandboxFirecracker microVM (Not a TEE)

Isolated ephemeral Firecracker microVM via @vercel/sandbox

The /api/sandbox endpoint executes Python and Node.js snippets inside an isolated Vercel Sandbox Firecracker microVM (1 vCPU, 2,048 MB RAM, non-persistent rootfs, zero host environment variables passed, and automatic teardown after execution). Firecracker provides hardware-virtualized KVM isolation between tenants, but it is not an AMD SEV-SNP or Intel TDX hardware-attested confidential enclave.

Checking confidential provider endpoints (cached 1 hour)...
Research Roadmap

Where the specification goes next

Five planned upgrades that reduce remaining hardware trust assumptions and scale settlement on Circle Arc (contract 0xbc8085c2b6fe6e0db05f169925c0b841828f4481 on chain 5042002).

01

Speculative Split-Execution (Draft in Enclave, Verify in 3PC/FHE)

Research Tier (FHE / 3PC Bridge)

Pure FHE and 3-party MPC cannot reach usable interactive speeds on frontier MoE models because non-linear softmax and normalization layers require billions of cryptographic operations per token.

Show details
Mechanism

Run fast token drafting inside the hardware-attested GPU TEE while asynchronously checking sensitive policy commitments inside a 3-party secret-sharing ring.

Verification artifact

Dual-signed receipt pairing the enclave's per-token ECDSA signature with a delayed threshold MAC over the verification transcript.

02

Attested Tool Sandboxes (Enclave-to-Enclave Agent Loops)

Multi-Hop Agentic Extension

Confidential inference loses its privacy guarantee if a model emits a tool call (code execution, SQL query, or web search) that exits the enclave into an unverified host runner.

Show details
Mechanism

Extend the 2-hop HPKE session so the model enclave delegates code execution and retrieval to ephemeral Intel TDX micro-sandboxes bound to the same session key.

Verification artifact

Chained Merkle transcript binding the model measurement, tool sandbox registers, and zeroized ephemeral filesystem hashes into one turn receipt.

03

Cross-Provider Session Migration via Client K_freeze

Cross-Provider Portability

If a provider enclave goes offline or fails re-attestation mid-conversation, encrypted conversation state is normally stranded with that provider.

Show details
Mechanism

Use the browser-held AES-256-GCM K_freeze key to re-encrypt a frozen session bundle and resume on another attested provider without exposing plaintext history.

Verification artifact

Resumption receipt proving the replacement enclave decrypted the prior state root inside TEE memory only after passing client-side quote verification.

04

Batched Nullifiers and Receipt Anchoring on Circle Arc

Settlement Scalability

Individual on-chain nullifier checks and per-session receipt transactions add latency and gas cost on Circle Arc at high concurrency.

Show details
Mechanism

Batch anonymous blind-credit nullifiers and session pop receipts into periodic Merkle root transitions anchored on the Arc testnet registry contract.

Verification artifact

On-chain Arc state root transition verifying zero double-spends and anchoring session pop receipt digests.

05

CXL 3.0 / SEV-TIO Hardware-Bound GPU Link Encryption

Next-Gen Silicon Custody

Current Hopper and Blackwell Confidential Computing relies on software-managed SPDM session encryption over PCIe between the CPU enclave and the GPU.

Show details
Mechanism

Adopt AMD SEV-TIO and Intel TDX Connect with PCIe IDE link encryption so GPU HBM regions are bound directly into the CPU hardware root of trust at boot.

Verification artifact

Hardware-rooted PCIe IDE stream integrity counters embedded directly inside the CPU and GPU attestation report bundle.