How Do I Use Private (Confidential) AI Models?

Bankr allows you to run specific AI models inside a Trusted Execution Environment (TEE). This is often called "private inference." When you use a private model, your prompts and the model's responses are processed inside a hardware-secured enclave (like Intel TDX). This ensures that even the infrastructure provider cannot see the data being processed.

1. Choose a Supported Model

Private inference is currently available for open-weight models. Proprietary models like Claude (Anthropic), GPT (OpenAI), and Gemini (Google) do not support confidential serving through this method.

Supported model families include:

• DeepSeek

• GLM (Z.ai)

• Kimi (Moonshot)

• MiniMax

• Gemma

To see the most up-to-date list of models that support private inference, run this command in your terminal:

bankr llm models --private

In the model list, look for models where "private": true and "confidential": true are listed.

2. Use the :private Suffix

The simplest way to trigger a private session is to append :private to the end of any supported model name. For example, instead of using bankr/glm-4, you would use bankr/glm-4:private.

Bankr uses a "fail-close" policy. This means if you request a :private model and a secure enclave isn't available, the request will fail with an error rather than silently falling back to a non-private connection. This ensures your data is never accidentally exposed.

3. Configure Your Tools

You can use private models across different interfaces by updating your configuration.

Using Claude Code

If you are using Claude Code but want to route your work through a private open-weight model, edit your ~/.claude/settings.json file:

{
  "models": {
    "claude-code": {
      "model": {
        "primary": "bankr/glm-4:private"
      }
    }
  }
}

Using the API

If you are building an app or using curl, you can either append :private to the model string or include "private": true in your JSON request body:

curl https://api.bankr.bot/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $BANKR_API_KEY" \
  -d '{
    "model": "bankr/deepseek-v3:private",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

How to Verify a Private Response

When you receive a response from a private model, Bankr includes specific headers to prove the computation happened inside a verified enclave. You can look for these headers in the API response:

• X-Confidential-Verified: Confirms the enclave attestation was successful.

• X-Confidential-Signer: The identity of the secure enclave.

Troubleshooting

• Error 422 (confidential_unavailable): This happens if you try to add :private to a model that doesn't support TEE slots (like GPT-4).

• Error 503 (attestation_unverified): This occurs if the gateway cannot verify the hardware's security certificate. Bankr blocks these requests to keep your data safe.

For a deeper dive into attestation verification and technical flow, visit the Bankr Private Inference documentation.