kLLM Enterprise
Day-zero models, custom keys and attested deployment for organizations
kLLM Enterprise is the commercial offering of Agent Network around the open-source kLLM. It serves organizations that need newly released models sealed from the day of their release, models sealed under a key issued for them alone, and deployment in confidential virtual machines with attested key release.
Offering
Four services on top of the open-source package
Day-zero model support
Newly released models are sealed and delivered to Enterprise customers from the day of their release. The same models reach the public catalog of official sealed models after an agreed period, and the architecture support reaches the open-source releases later.
Custom keys
The kLLM team seals the models a customer selects, from the catalog or the customer's own checkpoints, under a key issued for that customer alone, and delivers them locked, with their manifests. The key is not shared with other customers or with holders of official model keys.
Deployment and maintenance
The team deploys kLLM on the customer's SGLang or vLLM infrastructure and maintains the installation as engines and models change.
Attested key release and gateway
Separately licensed key sources for confidential VMs obtain the model key from a key broker that releases it only to a VM whose measurements match the deployer's policy. The attesting TLS gateway lets users check that TLS terminates inside the attested VM.
Open source and Enterprise
The open-source package is complete for sealing and serving
Enterprise adds services and separately licensed components. It uses the same open transforms and the same sealed-checkpoint format, so a sealed model can be verified with the open-source tools.
| Capability | Open source (Apache-2.0) | kLLM Enterprise |
|---|---|---|
| Sealing transforms (orth, perm) and checkpoint format | Included | The same transforms and format |
| Serving on SGLang and vLLM | Included | Deployed and maintained by the team |
| Official sealed models | Public catalog, with a model key per model on approved application | Delivered on day zero, before the public catalog |
| Models sealed under a private key | Self-service with the open-source tool | Sealing service under a key issued for the customer alone |
| Newly released models | Added to the library over time | Day-zero support |
| Locked weights and kllm verify | Included | Included |
| Key sources | Passphrase-protected key file | Adds confidential-VM key sources (cdh, gramine) |
| Attesting TLS gateway | Not included | Included |
| User-side binding check (python -m kllm.keyed.attest) | Included | Included |
Security claims
What Enterprise does not change
kLLM Enterprise does not extend the security claims of any deployment profile. The measured limits of the current release apply unchanged.
- The Attested CPU profile keeps the key and the decrypted tokenizer in confidential-VM memory. It does not protect GPU memory and has not yet been validated on TDX, SEV-SNP or Hygon CSV hardware.
- A sealed copy of a public model, or of a fine-tune of a public model, remains recoverable from the unlocked weights by a holder of the public checkpoint within the measured limits, regardless of the sealing key. Locking protects the files, not a running model.
- Support for confidential GPUs is on the roadmap. No kLLM profile protects GPU memory today.
Contact
Contact the team
Describe the requirements in the first message. The team responds by email.
An enquiry should state
- Target models and modalities, including models expected on day zero
- Whether the models are to be sealed under a customer key
- Inference engine and GPU hardware
- Deployment environment, including any confidential-VM platform
- Timeline
Report security vulnerabilities privately through GitHub Security Advisories, not through this address.