Sovereign AI and data services with Duality and Red Hat

Enterprise AI adoption is hitting a regulatory wall. Organizations in highly regulated sectors—from global banking to defense and life sciences—possess petabytes of valuable data. But privacy regulations, national data sovereignty mandates, and intellectual property risks prevent them from training models on central clouds or third-party AI platforms.

Duality Technologies is a leader in privacy-enhancing technologies (PETs), helping organizations collaborate and derive value from sensitive data without exposing the underlying information. This supports privacy-preserving AI across distributed data environments, allowing organizations to meet stringent regulatory and security requirements.

Duality Technologies and Red Hat provide a joint solution: combining advanced PETs with enterprise open source container infrastructure to support sovereign AI operations across on-premise, hybrid, and multicloud environments.

Figure 1: Logical architecture diagram showing Duality’s PET on Red Hat infrastructure.

The architecture in Figure 1 shows how the sovereign data services and PETs use underlying hardware capabilities like AMD’s Secure Encrypted Virtualization (SEV) and Intel’s Software Guard Extensions (SGX) instruction codes to establish trusted execution environments (TEEs). Red Hat platforms are using those hardware capabilities to provide the foundation for sovereign data services.

The sovereign AI imperative: Protecting data in use

Data security traditionally focuses on 2 states: data at rest (encrypted in storage) and data in transit (encrypted across networks). However, traditional AI pipelines expose a major vulnerability: data in use. To run an inference query or train a machine learning model, data must be decrypted in memory, leaving it vulnerable to memory dumps, administrators, or co-located, multitenant threats.

Sovereign AI addresses this challenge by verifying that hardware infrastructure, training data, intermediate model weights, and final outputs remain strictly under local legal jurisdiction and administrative control.

A 4-layer defense: How the joint architecture works

The combined solution integrates Red Hat’s enterprise Kubernetes platform with Duality’s privacy engine to safeguard the entire data lifecycle.

Figure 2: Data and control flows between aggregators and distributed data contributors.

Hardened foundation: Red Hat OpenShift and confidential containers

Red Hat OpenShift provides the enterprise infrastructure to orchestrate confidential containers, a Cloud Native Computing Foundation (CNCF) sandbox project Red Hat champions.

Confidential containers use hardware-based TEEs, Intel Trust Domain Extensions (TDX), or AMD Secure Encrypted Virtualization (SEV) to isolate running workloads inside stable memory enclaves. Even if an attacker gains root access to the host operating system or cloud hypervisor, the data inside the enclave remains encrypted and inaccessible. Hardware attestation capabilities verify the cryptographically signed integrity of the container before any code executes.

Federated learning (FL)

Rather than pulling raw datasets into a single central repository, Duality’s federated learning framework pushes model training to the data sources. Each participating node computes model updates locally on its own Red Hat infrastructure. Only the intermediate mathematical parameters are encrypted and transmitted back to a central server for aggregation so that raw, sensitive records never leave their local premises.

Security-focused aggregation

Standard federated learning can still leave intermediate gradient updates vulnerable to reverse-engineering attacks. Duality addresses this by protecting server-side aggregation using fully homomorphic encryption (FHE) or TEEs running on confidential containers.

FHE lets you run calculations on encrypted data without decrypting it, meaning you can aggregate model updates without exposing them. Alternatively, confidential containers use hardware-backed TEEs to perform aggregation inside an isolated, protected execution environment, preventing the server operator or underlying infrastructure from accessing sensitive data.

Differential privacy (DP)

To prevent adversarial reconstruction attacks on the final model output or query results, Duality integrates differential privacy (DP). By adding mathematically bounded, controlled noise to model weights and analytical query outputs, DP guarantees that an observer can’t infer whether a specific record was included in the dataset, preserving privacy without degrading model utility.

Market-specific applications

This joint architecture moves sovereign AI from theoretical concept to production deployment across privacy-critical industries.

The open source advantage for sovereign AI

Relying on proprietary, closed-source black boxes for sovereign AI is inherently contradictory. True technical sovereignty requires complete transparency into every software layer.

By running the Duality platform natively on Red Hat, enterprises gain:

• Vendor independence: Workloads remain fully portable across on-premise datacenters, sovereign national clouds, or major hyperscalers without rewriting application logic.
• Supply-chain auditability: Open source components provide transparent software bills of materials (SBOMs) and AI bills of materials (AIBOMs) to verify code provenance and regulatory compliance.
• Unified governance: Policy management, fine-grained access controls, and detailed operational audit logs satisfy strict compliance frameworks while maintaining central governance across distributed clusters.

By uniting hardware-backed confidential computing with advanced mathematical privacy techniques on open source infrastructure, Red Hat and Duality Technologies deliver a production-ready blueprint for sovereign AI. Organizations no longer need to choose between data protection and AI innovation—they can take advantage of the full predictive power of distributed data assets while maintaining total ownership over their models, inputs, and outputs.

Under the hood: Native OpenShift Operators at work

Deploying the joint Duality and Red Hat solution relies on 2 essential building blocks from the Red Hat ecosystem, both easily installed directly from the OpenShift OperatorHub:

• OpenShift sandboxed containers Operator

Installed in the openshift-sandboxed-containers-operator namespace, this operator provisions the kata-cc runtime. It orchestrates the hardware-isolated virtual machines (such as Intel TDX) where Duality’s confidential workloads safely execute away from host-level visibility.

Figure 3: Screenshot of confidential containers Operator running on Red Hat OpenShift.

• Red Hat build of Trustee

Operating within the trustee-operator-system namespace, Red Hat build of Trustee is the verifier and the key broker. It handles Key Broker Service (KbsConfig) and Red Hat build of Trustee configuration (TrusteeConfig), verifying hardware integrity quotes before releasing sensitive keys or data to the running container.

Figure 4: Screenshot showing Red Hat build of Trustee running on Red Hat OpenShift.

Streamlined 4-Step deployment flow

Once these 2 core operators are running, bringing up a Duality node requires minimal operational steps:

1. Establish the trust contract (initdata) 

Red Hat build of Trustee consumes and verifies the signed configuration payload (initdata.toml) containing the trust endpoints and security policies, which is injected directly into the pod deployment manifest.

2. Configure permissions

The deployment binds to OpenShift’s anyuid security context constraint (SCC) so the Duality workload can execute as root inside its isolated virtual enclave without compromising host node security.

3. Launch the confidential workload

Applying the manifest schedules the pod using the kata-cc runtime class. OpenShift sandboxed containers automatically provision the encrypted enclave and pull the Duality container image directly inside the guest virtual machine.

4. Automate hardware attestation

Upon startup, the container initiates an automated handshake with Red Hat build of Trustee, which verifies the hardware TDX quote against its stored policy and securely releases the required cryptographic keys. This establishes an encrypted communication channel without manual infrastructure overhead.

Demo

Watch a demo of how Duality and Red Hat OpenShift support sovereign AI by running workloads inside confidential containers.