Organizations are bringing artificial intelligence in-house. Rather than sending their most sensitive data to third-party AI services, they are running private models — self-hosted open-weight and proprietary models, and the data pipelines that feed them — on infrastructure they control. This white paper examines the security problem that shift creates, and the architecture required to solve it.
Why organizations are bringing AI in-house
The first wave of AI adoption ran through public, cloud-hosted services. That is fast to adopt but carries an inherent trade-off: the organization's data, and increasingly its workflows, depend on infrastructure it does not control and cannot fully inspect. A second wave is now underway and moving quickly, driven by cost, data protection, model intellectual property, regulatory and data-residency requirements, and the desire for latency, sovereignty, and continuity.
The concentrated risk
Bringing AI in-house solves the exposure problem of public services, but it creates a new one: a concentrated, high-value asset that must be defended on two fronts.
- Confidentiality — a model's value sits in a single, portable artifact. An attacker who copies the weights has the model, and even without direct access a reachable model can be extracted through systematic querying or inverted to reconstruct sensitive training data.
- Integrity — corrupting training or fine-tuning data can plant a backdoor that behaves normally until a specific trigger is present. Self-hosting means pulling open-weight models, adapters, and dependencies from public sources, any of which can introduce code that remains dormant until triggered.
Why current solutions fall short
Perimeter security assumes a trusted interior — once an attacker is inside, the concentrated AI asset is reachable. Cloud Zero Trust is a genuine improvement, but it relocates trust to a vendor cloud control plane that is itself a high-value target. Cloud identity and shared infrastructure place access control in software that can be misconfigured or bypassed. None of these makes the AI infrastructure invisible and inaccessible to the internet, and none roots trust in the owner's own keys.
What private AI actually needs
The paper makes the case for an architecture where models and data are unreachable by default, reachable and modifiable only by cryptographic authorization the owner controls, and where no external service — not even the platform provider — holds the keys.
What the paper covers
- Why private AI is growing, and the concentrated risk it creates
- How Faction compares with VPNs and firewalls, cloud ZTNA/SASE, and peer-to-peer mesh
- Key benefits for private AI infrastructure security
- Human identity, authority, and control
- Deployment scenarios for private AI
- Zero Trust for hardware — Zero Trust to silicon, and quantum-assured trust