Encrypted model artifact
This repository does not contain a loadable model. It contains one
encrypted file, artifact.enc, published by a confidential model
distribution pipeline. Downloading it without the decryption key gets you
bytes indistinguishable from random.
That is the point. The artifact is public and still confidential, because the only secret in the system is the key — which never travels with it.
What is inside
artifact.enc is an AES-256-GCM ciphertext of an uncompressed tar archive
containing google/bert_uncased_L-2_H-128_A-2, re-serialized to
safetensors.
artifact.enc := nonce (12 bytes) || ciphertext || GCM tag (16 bytes)
The repository id juanlumc1988/bert-tiny-encrypted is bound into the ciphertext as associated data,
so the artifact cannot be relocated to another repository without failing
authentication.
How it is consumed
A workload running in Kubernetes mounts the decryption key from a Secret, downloads this artifact, verifies and decrypts it in memory, and loads the model into a RAM-backed volume — the plaintext never reaches disk.
Source
Pipeline, design decisions and reproduction steps: https://github.com/juanlumc1988/confidential-model-distribution
Licence
Apache 2.0, following the upstream model.