Confidential AI inference on FLOP: TEE-only sessions explained

A FLOP miner is a stranger's GPU. For many prompts that's fine, but some data shouldn't be readable by whoever runs the machine. FLOP's answer is a per-request choice: a session request carries a confidentiality flag, and an agent that sets it is matched "only to capable machines" with hardware attestation, according to the whitepaper. This use case explains what that buys you, what it costs, and why it isn't usable yet.

Status, November 10, 2026: the attested HARD tier "is a specified target, not currently deployable," per Flop's tier doc. The testnet is not live. See the compute use cases hub.

Who sees your prompt on a normal FLOP session?

Flop's verification FAQ says the inference stream "runs directly between buyer and miner; there is no FLOP server in the path." The chain stores commitments and receipts, "never inputs or outputs, and validators never see them." Prompts and outputs are kept only by the agent and the miner, for the session and its challenge window, so a disputed block can be re-executed. Flop's technology FAQ gives 14 days as the published retention for that evidence class.

So on the default tier the miner can read your data. The FAQ says so: a job goes either to TEE-capable hardware "or to the full pool where the miner can see the data."

What changes with confidential execution?

The FAQ says that with attested execution "the prompt is encrypted and even the miner cannot read it." The agent turns it on per session through the confidentiality flag, one of the five fields in a session request. It is "never applied by default, even on hardware that supports it."

The trade-offs, from Flop's docs:

• A smaller pool. TEE is "supported on H100-class enterprise cards," and consumer GPUs don't have it.
• A higher price. Agents that need it "can expect to pay more for it."
• Stricter miners. On the HARD tier, "a failed attestation on that tier is a 100% slash," so only miners who've validated their hardware should opt in.
• Hardware isn't everything. "A GPU's confidential-compute mode on its own is not a guarantee: the assurance also rests on the physical security of the host."

The FAQ's own advice is blunt: "data that cannot tolerate any exposure does not belong on an open network of unknown operators."

Why you can't use it yet

The tier doc says HARD's "attestation bridge and quote-verification transport are unbuilt." It would need NVIDIA Confidential Computing on a TDX or SEV-SNP host, and "HARD cannot currently be selected as an operational upgrade." SOFT, which needs no attested hardware, is the current devnet path. Flop's challenge game doc also lists "per-turn encrypted input/output blobs" as "a designed next step," not a shipped feature.

What a builder would do when it's available

1. Sort your workloads. Send non-sensitive prompts to the full pool, which is larger and cheaper.
2. Set the confidentiality flag only on sessions that need it.
3. Check the hardware quote the miner returns. The integration doc says a quote is included "only when the miner runs the optional HARD tier."
4. Encrypt anything you store elsewhere. On Technocore, the FAQ notes, encryption "is the agent's responsibility and is not enforced by the platform."

Does confidential inference earn the airdrop?

Flop doesn't describe any extra weight for it. The draft airdrop page shares the agent pool "pro rata to compute purchased in settled sessions," and the timeline FAQ says "the task itself does not matter." If HARD isn't deployable when the testnet opens, confidential sessions won't be available to buy at all. Our airdrop guide covers the agent rules, and FLOP for AI agents explains the session request.

FAQ

Can FLOP miners read my prompts?

On the default tier, yes. Flop's docs say prompts and outputs are held by the agent and the miner for the session and its challenge window. With attested execution the prompt is encrypted so even the miner can't read it, but that tier isn't deployable yet.

Does FLOP support TEE or confidential computing?

It's specified as an optional HARD tier using NVIDIA Confidential Computing on TDX or SEV-SNP hosts. Flop's docs say its attestation bridge is unbuilt and it can't currently be selected.

Is confidential inference more expensive on FLOP?

Flop's verification FAQ says agents that require attested execution use the smaller TEE-capable pool "and can expect to pay more for it." No price has been published.