待翻译：Confidential AI: Let AI Work for You Without Handing over Your Privacy

AI 服务暂时不可用，以下为来源正文，待恢复后补全翻译。

Confidential AI: How PlugClaw Protects Your AI Work The AI Privacy Paradox AI is no longer just a tool that answers questions - it's becoming an agent that works for you. A year ago, you'd ask AI to summarize an article or draft an email. Now, AI agents can process your inbox, review contracts, write code, call APIs, and even control apps and databases. The catch? The more useful an AI is, the more it needs to know about you. To get things done, an agent may need access to your personal emails, files, source code, customer data, financial records, login credentials, long‑term memory, and third‑party services. So in the age of AI agents, what we need to protect isn't just a single prompt. It's the entire digital workspace the AI can access while working on your behalf. The more an AI knows and the more access it has, the higher the privacy and security stakes. Cloud AI: Great Power, Greater Trust Today's most powerful AI models live in the cloud - because they require massive amounts of compute that your phone or laptop simply can't provide. Large models, long context windows, and complex agent tasks all demand resources far beyond what most local hardware can deliver. So when you use advanced AI, you inevitably send your prompts, files, and context to a cloud environment. That means trusting the AI provider and its cloud infrastructure to handle your data responsibly. They may have privacy policies, access controls, and internal audits in place - but at the end of the day, the model is still largely based on trust: "Trust us not to look." And if your requests pass through proxies, gateways, or other third parties, every additional hop creates another place where plaintext data could be exposed - and another party you have to trust. For truly sensitive data, the better question is: Can we make it technically hard for unauthorized parties to see it - rather than simply asking them not to? That question becomes even more important for AI agents. They don't just process one-off prompts; they work with continuously accumulating data that can span your personal and professional life. On-Device AI: Better Privacy, Limited Capability The obvious answer is to run everything locally. If the AI runs on your device, your data never has to leave it. But local devices have hard limits on compute, memory, and battery life. They simply can't run the largest models, handle very long context windows, or perform complex multi-step reasoning as effectively as cloud infrastructure can. So you're left with a trade-off: On-device: Your data stays private, but the AI is less capable. Cloud: The AI is more powerful, but you have to trust it with your data. That's the AI privacy paradox. The very data you care about protecting most is often the same data the most powerful AI needs access to. What Is Confidential AI? Since we can't fully trust cloud promises, and we can't afford to dumb down our AI, we need a third way: the cloud's computing muscle with near-local privacy protection. That's what Confidential AI is built for. Traditional data security focuses on two states: data at rest and data in transit. But AI introduces a third, trickier state - data in use. During computation, a model has to process plaintext data to generate results. That's precisely when sensitive data needs to be exposed to the computing environment. Confidential Computing is designed to protect data at this stage. It uses hardware-based Trusted Execution Environments (TEEs), hardware-backed memory encryption, and isolation mechanisms to keep sensitive data and computation inside a protected execution environment. One key implementation is the Confidential VM (CVM): Hardware-encrypted memory: The VM's memory is encrypted and isolated at the hardware level. Outside the protected environment, the data remains encrypted. The cloud provider's operating system, hypervisor, and administrators cannot simply read the plaintext from memory as they could on an ordinary server. Remote attestation: Before sending sensitive data, your device can verify a cryptographically signed attestation from the remote environment. It provides evidence about the environment's identity and the code it is running. Only after the device verifies that the expected environment is running does it release the data. Inside this environment, sensitive data and computation are isolated behind a hardware-protected boundary. Even if the cloud's underlying operating system or hypervisor is compromised, those components cannot simply access the plaintext inside the protected environment. Simple version: Confidential AI means your data can be computed, but it can't be seen. Why Confidential AI Matters Once you understand how Confidential AI works, three things become clear about what it can change for AI. 1. From "Trust Us" to "Verify It" With traditional cloud AI, security largely depends on the provider's privacy policies, access controls, and internal practices. In other words: "Trust us not to look." Confidential AI changes the model. Instead of relying solely on policies and promises, it uses hardware-based isolation, encryption, and cryptographic verification to make unauthorized access technically difficult or impossible. The goal isn't to eliminate trust entirely. It's to reduce what you have to trust - fewer systems, fewer people, and fewer components with access to your data. And the security guarantees become something that can be verified, rather than simply promised. 2. Breaking the Privacy-Capability Trade-off You no longer have to settle for weaker local models just to keep your data private. And you don't necessarily have to hand sensitive data over to an unprotected cloud environment just to use the most capable AI models. Confidential AI offers a third option: use the computing power of the cloud while processing sensitive personal and business data inside a hardware-protected environment. Privacy and AI capability no longer have to be a binary choice. 3. A Stronger Security Boundary for AI Agents AI agents can access emails, source code, financial data, long-term memory, and other sensitive resources on your behalf. As agents become more capable and gain more permissions, the security boundary around that data becomes increasingly important. With Confidential AI, sensitive data and agent computation can be processed within a hardware-protected environment. The more an agent knows and the more it can do, the more important it becomes to have a security boundary that doesn't depend solely on trusting the infrastructure around it. PlugClaw's Confidential AI Architecture To bring confidential computing into the world of AI agents, PlugClaw uses a confidential AI architecture that protects data from the device all the way through cloud processing and model inference. The traditional AI flow is straightforward: User → AI provider → AI model. You send your prompts, files, and context directly to the AI provider. PlugClaw takes a different approach: PlugClaw device → Confidential Cloud → Confidential / Non-Confidential AI Model. The confidential cloud sits between your data and the external AI. It handles the most sensitive data and controls exactly what gets sent to the model. PlugClaw Device: Your Data Stays at Home PlugClaw is a tiny, standalone AI computer - with its own multi‑core CPU, memory, and encrypted storage - running a hardened Android OS called PlugOS. It connects to your phone or computer via USB. Your host device provides the screen and keyboard, but PlugClaw runs its own AI workspace independently. PlugClaw does not run on your phone or computer, and it doesn't automatically gain access to everything on your host. Your chat history, files, knowledge base, and agent data all live inside PlugClaw's encrypted storage. It's your AI workspace - not just another app. Only when a task truly needs cloud‑scale power does PlugClaw send the minimum necessary data to the confidential cloud. Confidential Cloud: A Hardware‑Protected AI Environment PlugClaw's cloud infrastructure is not just another server. It runs AI workloads inside hardware-isolated confidential computing environments, with different parts of the cloud service separated into distinct security zones: The business service layer handles accounts, billing and logging - but it never touches your prompts, files, or agent context. The actual data processing happens inside confidential VMs - hardware‑protected enclaves. When PlugClaw connects to the cloud, it first performs remote attestation to verify that the environment is genuine and running the correct code. Only then does it release any data. Inside the VM, your data is decrypted and processed - and the plaintext exists only inside that hardware‑protected space. The cloud's own OS and admins can't read it. That makes PlugClaw's Confidential Cloud more than an API proxy. It is a hardware-protected AI execution environment designed to keep sensitive data isolated throughout cloud-side processing. Model Inference: Two Levels of Protection PlugClaw Confidential AI supports two ways of using AI models. You can choose the model that best fits the sensitivity of your task and the level of AI capability you need. Confidential inference: The model itself runs inside a confidential computing environment within the trusted domain. Your data remains within protected environments from PlugClaw through inference and back. No party outside the trusted execution environment can access the plaintext, including the model operator. This is the full form of Confidential AI - and the path to end-to-end confidentiality. Non-confidential inference: With closed-source models such as Claude, GPT, and Gemini, the model provider's inference environment is outside our trusted domain. The model provider can therefore see the plaintext content of the request it processes. In this case, the Confidential Cloud acts as an anonymizing gateway. It protects your original data, agent context, and data processing inside the confidential environment. The external model provider sees only the specific content that is actually sent to the model. If I Use a Closed‑Source Model, Is It Still "Confidential AI"? This is probably the most important question to ask about PlugClaw's approach to Confidential AI. In the PlugClaw architecture, "confidential" means protection across three distinct layers: Confidential from the host device: The operating system, apps, or even malware on your phone or computer cannot access the data stored inside PlugClaw. Hardware isolation keeps your AI workspace separate from the host device. Confidential from TrustKernel and the cloud provider: Data is processed inside Confidential VMs throughout its time in the cloud. Confidential computing and remote attestation cryptographically keep TrustKernel and the underlying cloud provider outside the trusted execution environment, so they cannot access your data. Confidential from the model provider: This depends on the model you choose. With a confidential inference model, the entire inference path remains within the trusted domain, providing end-to-end confidentiality. With a conventional closed-source model, this layer does not apply: the model provider can see the plaintext content of the request it processes - but, through anonymized routing, does not directly see who the request belongs to. So why not simply use confidential inference models for everything? Because the reality today is that many of the most capable frontier models - including Claude, GPT, and Gemini - are not available for deployment inside a confidential computing environment. If "confidential" meant giving up access to those models, users would simply be back to the old choice: powerful AI or privacy. PlugClaw takes a different approach: give users the choice. For highly sensitive tasks - contracts, medical records, financial in [truncated for AI cost control]