Qwen3.5-397B Confidential API
397B Mixture-of-Experts (17B active) running in Intel TDX, built for long-document enterprise reasoning.
Parameters
397B total, 17B active (MoE)
Context
128,000 tokens
Organization
Qwen Team
TDX Intel TDX Hardware Guarantee
Qwen3.5-397B Confidential runs inside an Intel TDX trust domain at our inference provider, whose host cannot read the enclave memory. Your request passes in clear through our API relay, which forwards it over TLS.
- Intel TDX
CPU-enforced trust domain isolates the inference VM from the host.
- Encrypted Memory
Enclave RAM is encrypted at the controller level with a key the host never sees.
- NVIDIA GPU evidence
The attestation of the serving instances includes NVIDIA confidential-computing GPU evidence.
- Remote Attestation
GET /v1/attestation returns a TDX quote per serving instance, on your nonce, verifiable against Intel DCAP. It proves the instances are TDX guests, not that a given response came from them; responses carry no attestation.
Attestation Flow
How you check the instances that serve this model, with a nonce you choose.
- Generate 32 random bytes as your nonce (64 hexadecimal characters).
- Call GET /v1/attestation?model=Qwen/Qwen3.5-397B-A17B-TEE&nonce=<nonce> with your API key.
- For each instance returned, verify the Intel TDX quote with DCAP: signature chain to the Intel root, TCB status, debug bit off.
- Check that report_data equals SHA256(nonce || e2e_pubkey), the binding the response describes.
- Verify the NVIDIA GPU evidence of each instance with NVIDIA's verifier; it uses the same value as its nonce.
- A pass proves the instances serving the model are genuine TDX guests answering your nonce. Not proven: which code they run, or that a given response came from them.
Confidential Playground
Send a prompt to Qwen3.5-397B Confidential: it goes through our relay to the model's Intel TDX enclave at our inference provider.
Built for Regulated Industries
What you can show an auditor today: the TDX and NVIDIA evidence of the instances serving the model, on your own nonce. It does not prove which code they run (no reference measurements are published yet) or that a given response came from them.
Legal
The model runs in an Intel TDX enclave; our relay forwards documents. Privilege remains your call.
Healthcare
Model memory encrypted by the CPU at the inference host. No BAA offered yet.
Financial Services
Attestation of the serving instances on your own nonce, for your audit file.
Defense & Government
Hardware isolation of the model from its host on shared infrastructure; no government certification.
Quick Start
Start using Qwen3.5-397B Confidential in minutes. VoltageGPU provides an OpenAI-compatible API, just change the base_url. Requests pass through our relay, which sees them in clear (TLS ends at our host). To keep plaintext off our servers, run your own inference server in a Confidential VM and terminate TLS inside its trust domain.
from openai import OpenAI
import os
client = OpenAI(
base_url="https://api.voltagegpu.com/v1",
api_key=os.environ["OPENAI_API_KEY"],
)
response = client.chat.completions.create(
model="Qwen/Qwen3.5-397B-A17B-TEE",
messages=[
{"role": "system", "content": "You are a confidential due diligence analyst."},
{"role": "user", "content": "Compare the indemnification clauses in these two MSAs and flag drift: ..."},
],
max_tokens=2048,
temperature=0.3,
)
print(response.choices[0].message.content)curl -X POST https://api.voltagegpu.com/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-d '{
"model": "Qwen/Qwen3.5-397B-A17B-TEE",
"messages": [
{"role": "system", "content": "You are a confidential due diligence analyst."},
{"role": "user", "content": "Compare the indemnification clauses in these two MSAs and flag drift: ..."}
],
"max_tokens": 2048,
"temperature": 0.3
}'Pricing
| Component | Price | Unit |
|---|---|---|
| Input tokens | $0.83 | per 1M tokens |
| Output tokens | $5.55 | per 1M tokens |
Prepaid balance, no subscription: $3.80 bonus on your first top-up of $10 or more (one hour on an RTX PRO 6000 Blackwell VM).
Capabilities & Benchmarks
Confidential inference with Intel TDX enclaves. MoE architecture: 397B total parameters, 17B active per token. Supports OpenAI-compatible chat completions, function calling, streaming, and 128K context. Multilingual coverage spans English, Chinese, French, German, Spanish, Japanese, and Korean at production quality.
About Qwen3.5-397B Confidential
Qwen3.5-397B-A17B Confidential is a Mixture-of-Experts model running inside Intel TDX enclaves at our inference provider. The sparse architecture activates only 17B parameters per token. This is the model to reach for when you need confidentiality plus capacity: long-form due diligence, comparative contract analysis across many documents, multilingual regulated workflows, and complex enterprise RAG over heterogeneous corpora. The 128K context window combined with the MoE expert routing produces high-quality long-document reasoning that smaller dense models cannot match. The hypervisor and host operating system cannot read the model's memory. Your prompts pass in clear through our API relay. GET /v1/attestation proves that the instances serving the model are TDX guests; it does not prove which code they run (no reference measurements are published yet) or that a given response came from them.
Use Cases
Due Diligence & M&A
Compare data rooms, surface obligation drift across hundreds of contracts, and produce sourced executive summaries with the model in Intel TDX.
Multilingual Compliance Review
Process regulated documents in mixed-language portfolios without exposing trade secrets to translation APIs.
Confidential Research Synthesis
Synthesize internal R&D notes, lab reports, and patent filings without sending plaintext to a public LLM.
Enterprise RAG over Long Corpora
Retrieval over policy manuals, regulatory archives, and internal wikis with 128K context, the model in encrypted memory.
API Reference
Endpoint
https://api.voltagegpu.com/v1/chat/completionsHeaders
| Authorization | Bearer YOUR_VOLTAGE_API_KEY | Required |
| Content-Type | application/json | Required |
Model ID
Qwen/Qwen3.5-397B-A17B-TEEUse this value as the model parameter in your API requests.
Example Request
curl -X POST https://api.voltagegpu.com/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-d '{
"model": "Qwen/Qwen3.5-397B-A17B-TEE",
"messages": [
{"role": "system", "content": "You are a confidential due diligence analyst."},
{"role": "user", "content": "Compare the indemnification clauses in these two MSAs and flag drift: ..."}
],
"max_tokens": 2048,
"temperature": 0.3
}'Related Models
Qwen3.5-397B Confidential, Related Resources
Confidential Compute
Run models on Confidential VMs (Intel TDX) with attestation you generate.
Confidential AI Inference
OpenAI-compatible API with TEE-attested model serving.
Pricing
Confidential Compute and AI Inference pricing with no hidden fees.
Browse Confidential GPUs
H200, H100 and RTX PRO 6000 Blackwell in Intel TDX Confidential VMs.
Frequently Asked Questions
What is Intel TDX and why does it matter for AI?
Intel Trust Domain Extensions (TDX) is a hardware feature that creates an AES-encrypted memory enclave for an entire virtual machine: the host operating system and hypervisor cannot read enclave memory in plaintext. For AI inference this means the model weights, the KV cache and the prompts being processed live inside encrypted memory at the inference host. Before reaching the enclave, your prompt passes in clear through our relay.
How does VoltageGPU prove the enclave is genuine?
GET /v1/attestation?model=Qwen/Qwen3.5-397B-A17B-TEE&nonce=<64 hex characters> returns, for each instance serving the model, an Intel TDX quote and NVIDIA GPU evidence bound to your nonce. You verify the quote against Intel's DCAP root of trust and the GPU evidence with NVIDIA's verifier. It proves the instances are genuine TDX guests; it does not prove which code they run or that a given response came from them, and responses carry no attestation.
What is the performance overhead of TDX on a 397B MoE model?
We have not published our own measurement. A third-party benchmark of NVIDIA Hopper confidential mode reports an overhead below 7% for most typical LLM queries (arXiv 2409.03992).
Can I get a dedicated enclave for this model?
Not on the inference API: it runs on shared instances at our inference provider. To run a model in an enclave you control, rent a Confidential VM (Intel TDX) and serve it yourself, with an attestation you generate. For anything else, write to contact@voltagegpu.com.
Which other providers offer this scale of confidential MoE inference?
Azure's confidential GPU VM (NCC H100 v5) runs AMD SEV-SNP with an H100 NVL and lists at $8.90/hr in West Europe (Azure Retail Prices API, 7 November 2026). AWS Nitro Enclaves isolate CPU workloads only. For ten providers compared on 7 November 2026, see /compare/confidential-gpu-clouds.
What compliance frameworks does this support?
The attestation of the serving instances can support a GDPR Article 32 or HIPAA technical-safeguards file; it does not make a workload compliant by itself, and we hold no SOC 2 or ISO 27001 certification. Requests go through our API relay, which sees them in clear.
Start using Qwen3.5-397B Confidential today
$3.80 bonus on your first top-up of $10 or more (one hour on an RTX PRO 6000 Blackwell VM). Prepaid, no subscription. Deploy in under 30 seconds with our OpenAI-compatible API.