You can mitigate this by running the LLM engine and model in a publicly remotely attestable secure enclave able to prove every line of code that went into the f

You can mitigate this by running the LLM engine and model in a publicly remotely attestable secure enclave able to prove every line of code that went into the final machine code running in memory. You can also encrypt prompts to an ephemeral key held by the enclave for privacy from even the provider sysadmins. The result are remotely hosted tamper evident LLMs proving you get the same responses anyone else would, while being confidential. All the tech for this already exists as open source, just waiting on people to package up a combined solution.