The AI Emperor’s New Clothes: Is Your Data Safe During Inference?

Lawyers encrypt their data when it is stored and when it travels. But when an AI model reads it, are those fine security clothes really there at all?

Every time a lawyer pastes a witness statement into an AI assistant, or an investigator asks a model to sift a custodian’s emails, that material is briefly laid bare. To be processed by an AI, the data must be decrypted in the memory of a computer the client does not own, in a data centre it will never see. For that moment, the security everyone admires is not really there.

A remedy exists, mostly in the laboratory: “confidential computing”, which keeps data sealed even while it is being worked on. Anthropic has published a design for it and OpenAI is previewing a version. But none of the big AI providers offer it as standard for the services most law firms use. Until they do, the question for general counsel and compliance teams is not whether to use AI, but which data should go where.

Three States of Data

Security professionals talk of data in three states: at rest, in transit and in use.

The third state is where the emperor’s robes fall away. A processor cannot reason about scrambled text, so a document must be decrypted into memory before a model can read it. Think of a confidential letter kept in a safe and posted in a sealed envelope, which is then opened and laid flat on a desk in someone else’s office.

For AI, this desk is the moment of “inference”, when a large language model (LLM) takes a prompt and produces an answer. The prompt, any attached documents and the response all exist in readable form on the provider’s servers and in the graphics chips (GPUs) that do the heavy lifting. The window is short, but it is real, and it occurs on hardware run by someone else.

Who Is Watching the Procession

Several kinds of adversary could, in principle, peer through that window. A rogue employee or administrator at the provider. An attacker who breaks into the server or the software that divides one customer’s workload from another’s. A neighbouring tenant sharing the same hardware. Someone with physical access to the data centre. Or a government with a lawful demand on the provider (for US-headquartered providers, potentially under the CLOUD Act, wherever the data centre happens to sit). Data can also linger after the request ends, in logs, caches and the “crash dumps” engineers use to diagnose faults.

This is not idle speculation. Security researchers have already played the child in the crowd. In 2024, researchers at Trail of Bits showed that some GPUs failed to wipe their working memory between jobs. A program sharing the chip could reconstruct another user’s chatbot conversation, recovering around 181 megabytes per query on one AMD card. In October 2025, academics from Georgia Tech and Purdue used under $1,000 of equipment, clipped onto a server’s memory, to extract secret keys from the very hardware designed to keep data sealed, including keys that can undermine Nvidia’s confidential-computing protection for GPUs. Intel and AMD replied that physical attacks fall outside what their protections promise.

Proportion matters. No theft of inference data from a major AI provider has been publicly reported, and these firms invest heavily in security. The risk is of low probability but high consequence, and for privileged, regulated or investigative material the consequence is what counts. This is not meant to be alarmist, just informative. Almost everything we do carries some risk. The important thing is to recognise the risks, account for them and minimise them.

The open desk should also be kept in perspective. In practice, AI data is far more likely to escape through ordinary doors: a stolen account or API key, a misconfigured cloud tenant, or an employee pasting client material into a consumer chatbot on a personal account, where retention and training terms are much weaker than under an enterprise contract. Copies also outlive the prompt. Many legal AI tools build searchable indexes of the documents they are given, and researchers have shown that the numerical “embeddings” in those indexes can be turned back into much of the original text, so they deserve the same protection as the documents themselves. Assistants such as Microsoft 365 Copilot will surface anything a user is technically allowed to open, turning untidy access permissions into a quick route to forgotten sensitive files.

A Sealed Room

The answer the industry is converging on is confidential computing. Modern processors can carve out an isolated enclave whose memory is encrypted to everything outside it, including the cloud operator’s own staff and software. The enclave can also produce “attestation”: a cryptographically signed statement, vouched for by the chipmaker, of exactly what software is running inside. A customer’s data is unlocked only once that statement checks out. The effect is a sealed room with a verified guest list.

Anthropic’s design, published in June 2025 with the security firm Pattern Labs (since renamed Irregular), applies this to AI. Encrypted prompts and model weights are decrypted only inside attested enclaves, with keys released by a separate keyserver. Its threat model is candid: it treats Anthropic’s own staff and its cloud providers as potential adversaries. So is its list of gaps. Where the GPU sits outside the enclave, data crossing between processor and chip travels unencrypted. Subtle “side-channel” leaks, which infer secrets from timing or power use, remain a risk, as do physical attacks. Anthropic calls the work a sketch for discussion, not a product.

Others show it can work at scale. Apple has run its Private Cloud Compute on these principles since 2024, and Google launched a comparable Private AI Compute for Gemini in late 2025. Both serve consumer features, not enterprise contracts. Even here, perfection is elusive. An independent review of Google’s system by NCC Group found a timing leak and weaknesses in parts of its attestation, and noted that the protection ultimately still rests on trusting Google itself.

Where the Market Stands

For the enterprise services that firms actually buy, progress is patchy. Microsoft lists confidential inferencing only as a private preview for Whisper, its speech-to-text model, not for GPT or other Foundry models. OpenAI announced “Private Intelligence” in September 2026. Its confidential-computing element, Private Inference, is in preview, and OpenAI has not said which hardware it uses or how customers can verify it. Google sells confidential GPU machines for customers running their own models, but there is no sign that managed Gemini endpoints run in confidential mode. Anthropic’s design remains research.

Meanwhile, retention (the other half of the exposure) has moved the wrong way. Anthropic’s newest “Mythos-class” models (Claude Fable and Claude Mythos) require prompts and outputs to be kept for 30 days for security monitoring, whether accessed directly or through AWS, Google Cloud or Microsoft. Zero data retention, long the standard assurance for sensitive work, is not available for them unless Anthropic expressly authorises it.

Regulators have yet to catch up. Guidance from bodies such as the UK’s Information Commissioner’s Office and National Cyber Security Centre covers AI security at length but says little specifically about data in use.

Why It Matters

For clients, the implications run beyond IT. Lawyers must consider whether placing privileged material on a third party’s hardware, readable by that party’s systems, is consistent with confidentiality, privilege and other obligations such as the Official Secrets Act or defence restrictions. UK GDPR requires security “appropriate to the risk” (as does Switzerland’s revised Federal Act on Data Protection, where lawyers’ and bankers’ secrecy is also backed by criminal sanctions), and a regulator investigating a breach will ask whether data in use was considered. Financial services and public-sector clients face outsourcing rules that ask where and how data is processed. Investigations and litigation carry the most attractive material of all: whistleblower reports, custodians’ inboxes and documents assembled for regulators.

Investigations add a risk of their own. When a model reads documents and can act on them (searching, summarising, drafting, sending), a document can carry hidden instructions that the model may follow, a technique known as prompt injection. In a review set supplied by an opposing party or an investigated company, a planted file could nudge the model to misreport, omit or leak material. Keeping such tools away from email and other outbound channels, and having a human check what matters, remains the best defence.

Contracts rarely fill the gap. Zero data retention terms limit what is stored afterwards but say nothing about the moment of processing. The same model may also be reached directly or through Microsoft, Google or Amazon, each with different retention, access rules and audit reports.

Triage, Not Abstinence

None of this argues for shunning AI inference in the cloud. We are very much in favour of it. It does mean making informed, deliberate decisions. Firms should classify data before it reaches a model, separating routine material from the confidential and from the privileged, regulated or highly sensitive. Each tier should then be matched to a service.

A standard enterprise contract with zero data retention suits most confidential work. Attested, confidential environments, where available, suit the most sensitive. Models run on the firm’s own infrastructure suit material that must never leave it, and for a few matters the right answer is no AI at all.

Redacting names and privileged passages before processing narrows the exposure further. Vendors, meanwhile, should be pressed on six questions.

The answers belong in contracts, service agreements and data protection impact assessments, where they can later be shown to a regulator or a court.

In Practice

At Lineal, these questions are settled with the client before any review begins: what may be processed by AI, where, and under which controls. That matters most where obligations run highest, including clients protecting confidential business secrets, defence and government work in the UK, and matters covered by professional and banking secrecy in Switzerland. The same discipline pays off when something goes wrong. The first questions after an AI-related incident are usually forensic ones (which data went to which model, through which account, and what was kept), and organisations that log their AI use as carefully as their email are the ones able to answer them.

Encryption in transit once seemed an exotic precaution. It is now taken for granted. Data in use is on the same path, and the providers’ own research shows they know it. Until the sealed room becomes standard, the prudent course is neither panic nor complacency. It is to be the child in the crowd: to see clearly what is, and is not, being worn, and to decide which secrets are worth the risk of an open desk.

If your team is deciding which matters and data sets can safely go to AI, get in touch to talk it through with our investigations and forensics specialists.

__

About the Authors

Ilan Sherr is a regulatory and AI compliance leader with over two decades of experience advising global organisations on competition law, internal investigations, and applied AI. Ilan has advised global organisations on dawn raids, cartel inquiries, internal investigations, merger control and multi-jurisdictional regulatory strategy. He is Vice President of Investigations and Regulatory Response at Lineal, where he helps clients move from reactive enforcement to proactive, intelligence-led regulatory management harnessing Lineal’s products and services including AmplifyAI. Before Lineal, Ilan was Executive Director at DLA Piper, where he founded Aiscension, an AI-driven compliance business recognised by The Lawyer, the Financial Times Innovative Lawyer Awards, Legal Week, and ALM Law.com. A qualified solicitor in England & Wales and the Republic of Ireland, he was named in The Lawyer’s Hot 100 for his work in AI and legal risk management.

Lionel Bloch is Partner, EMEA at Lineal and the founder and Managing Partner of Forentec AG, the Swiss digital investigations firm that became part of Lineal in 2026. Since founding Forentec near Zurich in 2015, he has grown it from a digital forensics practice into a multidisciplinary team spanning eDiscovery, digital forensics, cyber security and open-source intelligence (OSINT). For more than a decade, Lionel has helped law firms, financial institutions and corporate clients preserve digital evidence, respond to cyber incidents and support regulatory investigations. At Lineal, he works with the global team to expand its cyber security and OSINT capabilities for clients across EMEA and beyond.

__

About Lineal

Lineal is an innovative eDiscovery and legal technology solutions company that empowers law firms and corporations with modern data management and review strategies. Established in 2009, Lineal specialises in comprehensive eDiscovery services, leveraging its proprietary technology suite, AmplifyAI to enhance efficiency and accuracy in handling large volumes of electronic data. With a global presence and a team of experienced professionals, Lineal is dedicated to delivering custom-tailored solutions that drive optimal legal outcomes for its clients. For more information, visit lineal.com.