How MorpheusAIs moves AI inference from operator integrity to hardware-enforced guarantees — verifiable by anyone, trusted by no one.
Where the MorpheusAIs decentralized stack stands today: baseline on the left, TEE phases moving right.
MorpheusAIs protocol — decentralized routing, wallet identity, encrypted transport.
C-Node → P-Node attestation: consumer verifies the provider runs the signed TEE image before each session.
P-Node → Backend LLM attestation: provider cryptographically verifies its own LLM on every prompt — CPU TDX + NVIDIA NRAS GPU + pinned TLS.
Diversify beyond the v7.0 launch partner: achieve full Phase 1 + Phase 2 parity with a second independent TEE stack.
Reduce friction on the consumer side: NodeNeo v2.7+ on iPhone & desktop, streamlined attestation verification UX.
Reference hardware + config so any operator with Intel TDX / NVIDIA CC can run a fully-attested TEE P-Node themselves. Informed by 3a + 3b learnings.
Pseudonymous, encrypted, decentralized, open-source — but provider trust is a promise, not a proof. The P-Node operator could log prompts.
Hardware-enforced isolation. The P-Node operator cannot access memory, attach debuggers, or modify the running image. Cryptographic attestation proves what’s running — to anyone who asks.
The second hop of the trust chain. Phase 1 proved the P-Node runs the signed TEE image; Phase 2 proves the P-Node’s backend LLM is itself running in attested hardware — CPU TDX quote, workload RTMR3 replay, CPU–GPU nonce binding, and NVIDIA NRAS v4 GPU attestation — re-checked on every prompt.
main at
Morpheus-Lumerin-Node v7.0.0.
Forward-compatible: v6.0.0+ consumers automatically gain Phase 2 guarantees when they connect to a v7.0.0+ provider — no client upgrade required.
Next: bring a second TEE partner to parity (Phase 3a).
MODELS line in docker-compose.yaml, the backend TLS cert is pinned inside the quote’s reportData, the CPU–GPU nonce is cross-bound, and NVIDIA NRAS v4 returns a JWT-signed EAT for the GPU. All of this re-runs on every single prompt via FastVerifyBackend (~50 ms hot path) — any drift (image swap, cert rotation, replay from another box) and the prompt is refused. Per-model state is exposed live at GET /v1/models/attestation.Phase 2 shipped the full two-hop chain with one partner. Phase 3a and 3b run in parallel now (stacked on the left below); Phase 4 follows, informed by what we learn in 3a and 3b.
backend_verifier.go so a second vendor plugs in cleanly.tee-tagged offer from a non-SCRT operator.docker-compose.tee.yml that produces matching RTMR3 measurements.tee-tagged offers with community-verifiable artifact submissions.“The first decentralized AI where privacy isn’t a policy — it’s physics.”
Run your own C-Node. Stake your own MOR. Verify the TEE yourself. No trust required.