China Mobile Releases AI Trusted Computing, with Confidential Tokens Covering Model Training and Inference

On September 12, China Mobile officially released AI Trusted Computing (AITC) at the main forum of the 2026 China Computing Conference and launched a strategic cooperation initiative to jointly build the AI trusted computing ecosystem.

This is neither another large model nor a simple layer of encryption added to cloud servers. China Mobile aims to build a security foundation covering AI data, models, computing environments, and terminal devices. Through technologies such as confidential computing, domestic cryptography, and information-flow privacy protection, it provides multiple forms of confidential computing power and confidential Tokens, enabling enterprises to train, deploy, and call models on public clouds while obtaining a security boundary close to that of a private cloud.

For industries such as finance, government affairs, healthcare, and manufacturing, the value of this capability is more practical than “improving the model by another few percentage points.” Many enterprises have AI needs but do not dare to hand customer data, medical records, transaction records, industrial parameters, and internal model weights to the cloud. AITC is aimed precisely at the barrier between “can we move to the cloud?” and “do we dare to use AI?”

Moving AI Security from Boundary Defense to the Computing Process

Traditional cloud security largely revolves around network boundaries: identity authentication, access control, disk encryption, and log auditing, supplemented by firewalls and security operations centers. These measures remain necessary, but they mainly answer “who can access the data” and “where is the data stored?” They do not completely solve a more difficult question: when data is used for computation, can the cloud platform, operations personnel, or other tenants see it?

The core narrative of AITC is to extend the security perimeter into the computing process itself. China Mobile summarizes its capabilities in three layers:

• Data security: usable but invisible. End-to-end encryption prevents sensitive data from being exposed in plaintext for extended periods during transmission, storage, and computation.
• Model security: computable but not extractable. It supports confidential deployment and ciphertext-based operation of AI models in public clouds, reducing the risk of model weights, prompts, and inference results being stolen.
• Environment security: verifiably trusted. Hardware-level trusted mechanisms are used to verify the operating environment, ensuring that models and data are not placed in environments that have been tampered with, subjected to debugging, or found to be inconsistent with policy.

Ordinary inference in the cloud can be understood as a company handing its files to an outsourced kitchen, with the kitchen promising not to look at them. Confidential computing is more like locking the ingredients inside a device with extremely limited transparency that only designated programs can operate: the kitchen can complete the cooking, but cannot easily come into direct contact with the ingredients themselves. This analogy does not mean “absolute security,” but it changes the trust model. Enterprises do not have to regard the cloud provider and all of its operational processes as completely trustworthy; instead, hardware, cryptography, and attestation mechanisms reduce reliance on people.

Confidential Tokens Solve More Than Key Management

What deserves more attention from developers in this release is the “confidential Token.” Based on the information currently disclosed, China Mobile does not define it as a new unit for model-token billing. Rather, it treats it as a security credential and access-control capability within the AI trusted computing system. Its role is to bind user identity, device status, computing environment, data permissions, and model invocation policies together, providing trusted authorization at different stages of training, inference, and data use.

This means that when an enterprise calls a model in the future, permission checks may no longer look only at whether the API Key is correct. They may also comprehensively assess:

1. Which user, device, or business system the request comes from;
2. Whether the current operating environment has passed trusted verification;
3. Whether the data used in the request belongs to the tenant and business scenario in question;
4. Whether the model is allowed to be downloaded, debugged, or exported;
5. Whether the returned results need to be desensitized, audited, or restricted from further dissemination.

For developers, this mechanism is closer to a “verifiable short-term pass” than to a universally valid key with a long lifespan. Once a traditional API Key is leaked, an attacker can often continue calling the interface throughout its validity period. If a Token is bound to a device, workload, trusted execution environment, and specific policies, copying the credential will still make abuse more difficult.

Of course, whether confidential Tokens can ultimately create real product competitiveness will depend on whether they can integrate smoothly with existing identity systems, Kubernetes, model gateways, key management services, and enterprise auditing platforms. Security capabilities are not merely exhibition-hall technical terms only when they enter the development process.

Covering the Full Lifecycle of Training, Inference, and Data Use

Many cloud providers’ confidential computing solutions initially serve inference scenarios, because inference tasks are easier to package as protected workloads. But enterprises are concerned about more than online requests. The model-training stage also contains a large amount of high-value assets: raw datasets, cleaning rules, annotation results, training logs, checkpoints, and final model weights. A leak at any stage could directly expose a competitive advantage.

China Mobile emphasized this time that its coverage extends across the full lifecycle of AI training, inference, and data use. This means it is attempting to move security capabilities upstream to data preparation and model training, and then extend them to model deployment, online inference, and result output. Ideally, enterprises could complete the following process:

• Import raw data into a protected environment and restrict the scope within which the data can leave;
• Complete data preprocessing, annotation, and training in ciphertext or under controlled conditions;
• Deploy model weights to a confidential environment that has passed attestation;
• Issue least-privilege access to specific applications through confidential Tokens;
• Audit every inference call, data access, and model operation;
• Revoke credentials and clear temporary keys after the business process ends or authorization is withdrawn.

This approach is particularly suitable for financial risk control, medical diagnosis, and industrial manufacturing. For example, banks do not want to hand complete transaction records to the cloud, hospitals do not want medical records to run exposed in an inference service provider’s operations system, and manufacturers do not want equipment parameters and process models to become “common knowledge” throughout the supply chain. Confidential computing cannot solve data compliance, data quality, or model-bias problems for enterprises, but it can reduce the psychological and compliance costs associated with “losing control as soon as data moves to the cloud.”

AI-eSIM and Super SIM Push the Security Boundary to the Endpoint

Another feature of AITC is that China Mobile combines AI trusted computing with AI-eSIM and Super SIM to create a “Internet of Things + Internet of People” collaborative AI security solution spanning endpoints and the cloud.

This approach differs from pure cloud-based security products. Traditional solutions often begin by hardening the cloud and then use software clients to distribute permissions to mobile phones, cameras, industrial gateways, or sensors. China Mobile instead hopes to use the hardware security capabilities of SIMs or eSIMs to store keys, perform identity authentication, and protect endpoint data and instructions. In other words, the security identity is not merely a string written into an application configuration file; it is pushed as far as possible down into the chip and communications-connection layers.

In industrial, connected-vehicle, energy, and government environments, endpoints are often the most overlooked and yet easiest-to-compromise link. Devices may remain unattended for long periods, system versions may be inconsistent, and network conditions may be unstable. If an attacker can replace device firmware, clone identities, or steal keys, even a secure cloud can protect only half of the chain. Connecting endpoint identities, network connections, and cloud workloads could theoretically reduce the scope for device spoofing and man-in-the-middle attacks.

But this area will also put implementation capabilities to the greatest test. Enterprises typically already have multiple endpoint-management, zero-trust, IAM, and certificate systems. Whether AI-eSIM and Super SIM can provide open standard interfaces, adapt to non-mobile communications networks, support cross-cloud deployment, and make device replacement and key rotation simple enough will determine whether they become general-purpose infrastructure or proprietary capabilities within China Mobile’s system.

Domestic Computing Power Is AITC’s Practical Foundation

China Mobile says that AITC is built on Mobile Cloud’s full-stack domestic computing-power foundation. This background cannot be ignored. Confidential computing depends on the coordination of CPUs, accelerators, trusted execution environments, cryptographic modules, virtualization systems, and orchestration software. If any link lacks security capabilities, it can become a weak point.

China Mobile has already been continuously building intelligent-computing infrastructure. Its intelligent-computing centers in Hohhot, Harbin, and other locations undertake training tasks, while clusters at the 10,000-GPU scale and heterogeneous-chip adaptation provide a computing foundation for confidential AI. During the conference, China Mobile also released the Jiutian Shanzhi multimodal foundation model and 30 self-developed industry-specific models. The foundation model was trained on a 10,000-GPU domestic computing cluster and a domestic algorithm framework, supports 17 domestic AI chips from 11 manufacturers, and enables model migration and continued training across heterogeneous chips.

This shows that AITC is not an isolated security product but part of China Mobile’s “computing center—cloud platform—model—industry application” system. For enterprise customers, a provider that can simultaneously offer computing power, models, networks, and security services is indeed more convenient than purchasing several security components separately. For developers, however, new questions arise: Can models be migrated across platforms? Are the training frameworks open? Do confidential environments support mainstream containers and inference engines? Can security policies be managed through standard APIs?

If these questions have no answers, the so-called full-stack capability may become a new form of lock-in. Enterprises may have just escaped dependence on a single chip, only to become tied to a single cloud, model, and security system, with no guarantee that their long-term costs will be lower.

Compared with Traditional Private Deployment, Both the Advantages and Costs Are Clear

AITC proposes to “let customers use public clouds as if they were private clouds.” This phrase captures a market pain point, but it cannot simply be understood to mean that public clouds are already equivalent to private clouds.

The greatest advantage of private deployment is that data and model assets remain within a physical or logical boundary controlled by the enterprise, making compliance explanations relatively straightforward. Its disadvantages are a long construction cycle and low equipment utilization; enterprises must also bear responsibility for data centers, operations, computing-power scheduling, model upgrades, and security protection. Confidential computing in public clouds seeks to retain the elasticity and cost advantages of the cloud while reducing trust risks through hardware isolation, remote attestation, key custody, and ciphertext-based operation.

It is better suited to several types of scenarios:

• Enterprises with sensitive data but pronounced peaks and valleys in their AI-computing needs;
• Organizations that do not want to purchase an entire GPU cluster but need to train or run inference on industry models;
• Projects that require joint modeling by multiple parties whose participants are unwilling to directly expose their raw data;
• Teams that need to meet audit requirements quickly without entirely giving up the elasticity of public clouds.

The costs must also be acknowledged. Ciphertext computation typically causes performance degradation, hardware isolation limits debugging and observability, and remote attestation, key rotation, and policy orchestration add system complexity. For training tasks, communication, checkpoint storage, and cross-node synchronization are already demanding. After adding security encapsulation, the final cost may be significantly higher than that of ordinary bare computing power.

Therefore, the key metrics for AITC should not simply be whether it “supports confidential computing.” They should include: How much does training throughput decline? How much does inference latency increase? Which GPUs or domestic AI chips are supported? Can PyTorch and mainstream inference engines run? How many additional permissions are required for troubleshooting? Can customers independently verify the operating environment? Without this data, users will find it difficult to make engineering decisions that balance security benefits against performance costs.

Ecosystem Building Will Determine Whether It Moves from a Launch Event to Production

This time, China Mobile joined forces with China Electronics Corporation, Bank of China, China National Nuclear Corporation, the China Academy of Information and Communications Technology, Huawei, ZTE, Alibaba Cloud, Inspur, Hygon, Moore Threads, Zhaoxin, and other partners to launch strategic cooperation for jointly building an AI trusted computing ecosystem. The participants cover telecom operators, cloud providers, banks, research institutions, complete-machine manufacturers, and chip companies, indicating that AI security has evolved from a single-product issue into an industry-coordination issue.

The reason is simple: A usable confidential AI system cannot be completed by a cloud platform alone. Chips must provide trusted execution and isolation capabilities; servers and the virtualization layer must ensure a trusted boot chain; operating systems and container platforms must support protected workloads; model frameworks must adapt to encrypted memory and secure communications; and enterprise applications must connect to identity, auditing, and compliance processes. If any layer is incompatible, development teams may have to rewrite their entire delivery chain for the security solution.

But “ecosystem cooperation” is not itself a product capability. What deserves more attention next is whether China Mobile will make technical standards, interface documentation, compatibility lists, and third-party evaluation results public; whether confidential Tokens will support cross-cloud and cross-vendor verification; and whether customers can complete key management, policy distribution, and audit evidence collection without relying on manual platform operations.

If AITC can connect to enterprises’ existing MLOps and cloud-native toolchains in a standardized manner, it has an opportunity to become infrastructure for sensitive industries adopting public-cloud AI. Conversely, if it can operate only within China Mobile’s own computing, model, and network systems, it will look more like a vertical solution for government and enterprise customers, and its ability to scale will be limited.

In Closing: Competition in Secure AI Has Entered the “Trusted Delivery” Stage

Over the past few years, competition in AI infrastructure has focused primarily on model parameters, computing scale, and inference speed. As enterprises begin integrating AI into core businesses, the focus of competition is shifting to another question: Can models continue running in an environment that is controllable, auditable, and verifiable?

China Mobile’s release of AITC has captured this change. Its strengths lie in simultaneously possessing communications networks, cloud computing power, a SIM-based identity system, and government and enterprise customer resources, enabling it to extend security from the data center all the way to endpoints. Its weakness is that the currently disclosed information remains largely at the level of capability frameworks and ecosystem cooperation. Sufficient details are still lacking regarding performance overhead, compatibility, pricing, the degree of standards openness, and real-world cases.

For developers, when judging whether this type of product is useful, do not focus only on keywords such as “confidential,” “trusted,” and “end-to-end.” Return instead to several engineering questions: Can my training framework run? Can I prove that my model weights have not been exported by the platform? Can my data be isolated by tenant and task? Can a leaked Token be revoked quickly? When a failure occurs, who can access the logs, and who can modify the environment?

Only when these questions have clear answers can AITC become an AI security foundation that enterprises are genuinely willing to use. Otherwise, it remains a directionally correct launch that needs more product details to prove itself.

Sources

• ITHome: China Mobile Releases AI Trusted Computing, Providing Multiple Forms of Confidential Computing Power and Confidential Tokens: Introduces information about the release of AITC, its core technologies, and ecosystem cooperation.
• OpenAI Hub: An AI API aggregation platform that supports calling multiple mainstream models through interfaces compatible with the OpenAI format.