insider threat

Encryption at rest is the easy part; weights must be decrypted somewhere to be used. The scored answer controls where decryption happens, who can cause it, and how fast misuse is noticed.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

The people who build frontier models need access to them, which is exactly the risk. The scored answer reduces who can touch weights directly, makes exfiltration hard and visible, and does it without poisoning research culture.