The isolation primitive for multi-tenant AI
Isolation
you can prove.
Confidential AI serving for sovereign, regulated, and multi-tenant deployments. Isolation you can prove, not just promise, on commodity hardware with no foreign hardware root of trust. Because tenants can safely share one model, serving runs faster and costs less.
Sharing model state across tenants leaks. That is why safe multi-tenant sharing has meant an enclave per tenant, or not sharing at all. isovert makes shared serving provably safe, in software.
What it unlocks
Three things provable isolation makes possible
Share one model across tenants, safely.
MHA · GQA · MLA in cross-tenant recall — SSM reported separately, in cosine
Per-tenant isolation across the transformer KV designs in production today, measured as cross-tenant recall. State-space and hybrid architectures are measured separately, by different questions — a state-space model has no KV cache to partition, so what is measured there is whether the rotation inverts, in cosine units. Cosine separation is not cross-tenant recall, and the two do not belong in one column.
Scope: representative models per architecture class, single hardware configuration.
Lower serving cost.
Cold-start reduced up to ~80×
Two independent levers, both isolation-gated. Sharing one warm model across tenants cuts cold-start ~21× at N=8. Baking a prefix to disk and injecting it removes the prefill work entirely: ~80× at 16k prefix, with a one-time ~1.1s load excluded from time-to-first-token. They attack the same cost and are alternatives, not additive. In the deployable posture with per-tenant rotation on, time to first token is 0.144s. In the v2.4 density sweep — bare H100, per-tenant rotation on, median of five boots — that posture serves 4 to 32 tenants per GPU depending on tenant size and latency target, with the isolation gate passing at every count tested.
Scope: transformer serving, single node, eager execution path, A100, Qwen 2.5 3B. Fleet-scale validation is the next step, with design partners. Figures are fork-side: piecewise, full capture, N≤8. The shipped isovert-vllm extension is a separate column — N≤4, eager only, V1 runner — and these numbers do not transfer to it without a port run.
See the serving-cost storyCatch prompt-injection attacks.
Advisory detection (AgentDojo) · threat-model comparison in progress
Activation-based monitoring flags real third-party injection attempts for review, adding an advisory line of defense to multi-tenant agents. Detection figures will be published once the threat-model comparison is written.
Scope: advisory, human-in-the-loop, single model. It detects. It does not prevent, and it does not stop an adaptive attacker.
All of it is provable. Machine-checked proofs (Lean 4 + Verus), data authenticated at rest by construction (AES-GCM, bound to tenant, slot, and context), and 18 filed patent applications behind it.
Positioning
Between policy and hardware
Isolating tenants has meant choosing between two imperfect options.
Software policy
Namespaces, RBAC, tenant-id filters. Cheap and portable, but enforcement-based. One missed check and tenants leak into each other, silently.
isovert
Tenant isolation as a structural property with a machine-checked proof behind it. Runs on commodity hardware and composes with the TEEs you already run. The assurance of a structural boundary without an enclave per tenant.
Hardware
Trusted execution environments. Strong host-level isolation, but a certified-hardware dependency, and in practice one enclave per tenant. A cost wall that doesn’t scale.
isovert doesn't replace the host boundary. It adds the per-tenant layer that policy can't reliably enforce and hardware has made expensive.
Architecture breadth
Validated across
architecture classes
Three classes, three different questions. They are reported separately because they do not share a statistic.
Transformer attention: MHA, GQA, MLA
Validated across the major KV-cache designs in production today: MHA, GQA, and MLA. Qwen and DeepSeek both measure 0.0000 cross-tenant recall; Gemma’s worst cell is 0.0054.
State space: a different question
A state-space model compresses history into a fixed recurrent state, so there is no per-token KV to partition and cross-tenant recall cannot be posed. What we measure instead is whether the rotation inverts. On Mamba-130m, wrong-key similarity is 0.0795 against a separation of 0.9205, on the full state with block-diagonal rotations. Cosine units — not comparable to the recall figures above.
Trained hybrid: measured layer by layer
Jamba-tiny-dev, 14 state-space and 2 attention layers. Both attention layers measure 0.0000 cross-tenant recall, anchored against 0.0143 shared-rotation and 0.11 identity. The state-space layers are PARTIAL — 0.48–0.67 against a <0.2 threshold — in cosine units; the limitation is in the statistic, not in the model. And the seam holds: residual-stream separation across all four block-type transitions, worst Δ 0.0104 against a noise floor of 0.0113. The model is a small development build.
Scope: representative models per class, single hardware configuration. The KV figures measure geometry alone; the enforcement fence is measured separately, on a different surface.
Properties
Structural
per-tenant isolation
Software-defined
No foreign hardware root of trust required. Isolation is enforced in software and composes with hardware where you have it.
Commodity hardware
Runs on the machines you already have. No special hardware required.
Provable on demand
A wrong-tenant read fails authentication and is rejected during operation, not only checked at startup.
Key-drop delete
Drop the key that encrypts a tenant’s data and it becomes cryptographically inaccessible. Deletion you can demonstrate.
Operator-screened, not self-screened
Rotation-key strength is screened by the operator, who holds the data. A customer cannot self-screen: key geometry alone does not predict which keys isolate weakly. Keys-only predictors score AUC 0.527–0.606; the only quantity carrying signal (AUC 0.706) requires both tenants’ vectors.
Authenticated at rest
Every stored vector is encrypted and authenticated with AES-GCM, bound to its tenant, slot, and context. A wrong-tenant or wrong-slot read fails the authentication tag and is rejected by construction, before any data is returned.
Composes with your stack
Sits inside the TEEs you run, and is designed to compose with a post-quantum (ML-KEM) key layer. It complements those boundaries rather than replacing them.
Attacker-tested
Evaluated under adversarial conditions: 16 tenants, 240 ordered pairs, isolation metric v2. Scope: correctness on a single hardware configuration.
The surface
Four calls
Key binding lives at the session layer — never an argument a model can supply. The isolation boundary sits below the application, where it can't be reasoned around.
01ctx = isovert.TrustContext(key=tenant_key)02ctx.bind(data)03ctx.run(query) # operates inside the isolated context04ctx.delete() # key-drop delete: drop the keyThe stack
One substrate.
Products on top.
NablaDB
in developmentConfidential multi-tenant retrieval
Deletable
in developmentPer-subject erasure with a certificate
Same substrate, two guarantees: NablaDB isolates tenants from each other, Deletable erases an individual subject and proves it.
From Cittela, a deep-tech research entity.
Proofs & verification
Don't trust. Verify.
Reviewed prior to publication by independent practitioners. Reproducible. Open.
Who it's for
Regulated multi-tenant AI platforms
Demonstrate tenant segregation to auditors and customers without one enclave per tenant.
Sovereign / national cloud
Provable isolation without depending on a foreign hardware root of trust.
Confidential-computing teams
The per-tenant layer of confidential computing, in software. Isolate tenants inside the trusted boundary you already run — composing with your TEEs and key management, and adding the tenant-level isolation that one-enclave-per-tenant makes expensive.
Teams facing erasure obligations
Per-subject deletion that reaches vector state and backups, with a certificate that states its own coverage. Built on the same substrate. See deletable.org.