When calling an AI inference API, clients have no guarantee the provider serves the exact model advertised. Reports of silent quantization or swapped weights, like variations seen with Claude Opus, are common. Tinfoil addresses this with Modelwrap, a system that cryptographically binds an inference server to a specific, untampered set of model weights for each request.

Standard hardware attestation only proves which code booted, not what data loaded afterward. Modelwrap bridges this gap by using dm-verity, a Linux kernel subsystem that enforces a cryptographic commitment to the model weights at every disk read. This creates a runtime guarantee: the system cannot read bytes that don't match the publicly committed hash.

The process starts by downloading a specific model version from Hugging Face, verifying checksums, and storing it on a read-only EROFS filesystem. A Merkle tree over this image generates a root hash commitment. This hash is supplied to the kernel at boot, binding the enclave to the exact weights. Any client can independently verify this commitment, making secret model degradation impossible.