kLLM Enterprise

kLLM Enterprise is the commercial offering of Agent Network around the open-source kLLM. It serves organizations that need models sealed under their own key, support for new models without waiting for the open-source releases, and deployment in confidential virtual machines with attested key release. The open-source package remains complete for sealing, serving and the Private Seal profile; Enterprise adds services and separately licensed components on top of it.

Offering

Service

Description

Custom sealing service

The kLLM team seals the models a customer selects under a customer key and delivers the sealed artifacts with their manifests. The keys of the public catalog are not used.

Day-zero model support

Support for newly released models from the day of their release, under the customer’s key. Enterprise customers receive sealed builds of newly supported models first; the community release in the public catalog follows after a period set per model (Release timing), and the corresponding support reaches the open-source releases later.

Enterprise deployment and maintenance

Deployment of kLLM on the customer’s SGLang or vLLM infrastructure, and its maintenance as engines and models change.

Attested key release and gateway

The separately licensed kllm-enterprise package: the cdh key source, which obtains the model key from a key broker that releases it only to a confidential VM whose measurements match the deployer’s policy, the gramine key source, and the attesting TLS gateway, which lets users check that TLS terminates inside the attested VM. Together they implement the Attested CPU profile (Deployment profiles).

The components of kllm-enterprise are listed in License. Their deployment is described in Confidential VM deployment, and the user-side check in Verifying a deployment.

What Enterprise does not change

kLLM Enterprise uses the same open transforms and the same sealed-checkpoint format as the open-source package, so a sealed model can be verified with the open-source tools. It does not extend the security claims of any profile:

  • The Attested CPU profile keeps the key and the decrypted tokenizer in confidential-VM memory. It does not protect GPU memory, which is an ordinary passthrough device, and it has not yet been validated on TDX, SEV-SNP or Hygon CSV hardware.

  • A sealed copy of a public model, or of a fine-tune of one, remains recoverable by a holder of the public checkpoint once it is unlocked to run, whatever key seals it (Weights of a public model, or of a fine-tune of one). Locked weights protect the files on disk, not a model that runs.

  • Support for confidential-computing GPUs is on the Roadmap; no kLLM profile protects GPU memory today.

Claims states what each profile claims and does not claim.

Contact

To discuss kLLM Enterprise, write to hi@anet0.com or see the Enterprise page of the kLLM website.

Security issues in kLLM are reported privately as described in the repository’s SECURITY.md, not through the Enterprise contact.