Securing Frontier Model Weights
The economics of protecting high-value model artefacts against capable adversaries.
Abstract
A trained frontier model is a small file with a very large replacement cost. This paper treats the protection of model weights as a security economics problem: what does exfiltration cost an attacker, what does prevention cost a defender, and how do those curves move as capability and value increase. We survey the attack surface across training, storage, serving and personnel, assess the practical effectiveness of controls at each layer, and find that the dominant residual risk in every architecture we examined is insider access rather than external intrusion. We also find that the cost of meaningful protection scales sub-linearly with asset value, which implies that under-protection is an equilibrium outcome rather than an oversight.
Key findings
- 01Insider access is the dominant residual risk in every weight-protection architecture we assessed.
- 02The marginal cost of protection rises steeply above a threshold set by hardware-enforced confidential computing.
- 03Weight artefacts are small relative to normal egress volumes at these facilities, which makes volumetric detection weak.
- 04Detection, not prevention, is where most defensive value currently sits.
A frontier model may cost a great deal to create and very little to copy. That asymmetry is the entire security problem.
Model weights have an unusual security profile. The artefact is large by file standards and trivial by datacentre standards — comfortably within the range of ordinary daily egress at any facility that hosts it. Its replacement cost may run into the hundreds of millions. It must be readable by serving infrastructure at all times, which means it cannot simply be sealed. And its value to an adversary does not degrade quickly.
The surface
We assess the attack surface in four layers, each with different economics.
| Layer | Attacker cost | Defender cost | Residual risk |
|---|---|---|---|
| Network intrusion, external | High | Moderate | Low |
| Supply chain, software | Moderate | High | Moderate |
| Supply chain, hardware | Very high | Very high | Low |
| Serving infrastructure compromise | High | High | Moderate |
| Insider with legitimate access | Low | Very high | High |
| Physical access to storage media | High | Low | Low |
The finding that recurs across every architecture we examined is that external intrusion is a solved problem in the sense that it is expensive for the attacker and tractable for the defender, while insider access is neither. Someone must be able to read the weights for the system to run. Controls that reduce that set to zero do not exist.
Why detection beats prevention
Preventing an authorised person from copying data they are authorised to read requires either hardware-enforced isolation of the entire computation or a level of process control that materially degrades the ability to do the work. Both are being pursued. Neither is complete.
Detection is a better investment at the current margin. Weight artefacts have distinctive access patterns; systematic egress monitoring, access anomaly detection and cryptographic provenance on model artefacts each provide meaningful signal at a fraction of the cost of prevention. None of these stop a determined insider. They shorten the time to discovery, which is the variable that most affects total loss.
- Access anomaly detection100
- Egress monitoring84
- Artefact provenance71
- Least-privilege enforcement63
- Confidential computing38
- Full hardware isolation14
Frontier Labs security control cost model.
The direction that would change this is hardware. Confidential computing at accelerator level — attested execution with weights never present in plaintext outside a hardware boundary — moves the prevention curve substantially. The capability exists in early form. Its performance overhead and its ecosystem maturity currently keep adoption low. If both improve, the analysis in this paper will need revision, and we expect to revise it.
Sources and references
- [1]Published incident reports and post-mortems, 2019–2026.
- [2]Confidential computing capability assessments.
- [3]Frontier Labs security control cost model.
Source assessments, provenance records and the full data appendix are described in the methodology. Corrections to this publication are recorded on the corrections page.
Keywords
- security
- model weights
- exfiltration
- insider risk
Full edition
Read the complete report.
The full edition is released to named readers. Tell us who you are and it opens straight away.
- Extent
- 49 pages
- Price
- Free
Cite this publication
Security Desk (2026). Securing Frontier Model Weights. Frontier Labs. https://doi.org/10.5281/frontierlabs.2026.0010
Research infrastructure powered by AGI-S.