DREAMNOVA · JERUSALEM
Confidential computing proves the machine, once, at the door. Nothing proves the weights, on this token, right now. DreamNova does — in software, on the GPUs already in the rack.
One idea
A multi-tenant GPU operator cannot prove to a model owner that the weights served were the weights shipped. NVIDIA names exactly this — model-weight theft by privileged infrastructure operators — as a primary buyer concern, and the model owner cannot trust the host OS, the hypervisor, or the root admin.
The shipping answer is hardware confidential computing. It works, and it costs: H100/H200-class GPUs, Kubernetes pods repackaged into Kata Containers VMs, CPU TEEs paired with confidential GPUs, plus an external attestation service and key broker. It also proves the environment at workload admission — one shot, at the door — and says nothing about individual inference steps, tensor loads, or weight swaps.
DreamNova delivers weight-level integrity as a software layer. A cryptographic hash of the exact weight configuration in use is computed inside the GPU kernel that is already running the matmul, and written to a tamper-evident record — every step. Under 0.3% overhead, because it rides a kernel launch that happens anyway. No TEE. No chip swap. No re-architecture.
Environment attestation. Validates the TEE against known-good measurements, gates key release at admission.
Answers: is this the machine I trust?
Requires: confidential GPUs, TEE-capable CPUs, Kata Containers, attestation service, key broker.
Weight attestation, per step. Hashes the active configuration inside the fused kernel, logs it, verifies against reference.
Answers: are these the weights I shipped, on this token, right now?
Requires: any CUDA GPU. Drops in above the existing serving stack.
It runs on what exists
This is the part that makes it deployable now rather than in 2027.
Who has this problem, and has budget
They rent other people's GPUs to run other people's models. Their commercial problem is trust: a model owner will not place a frontier model on infrastructure where a root admin could read or alter it. Confidential computing solves it only on the newest silicon, and strands the rest of the fleet.
Finance, health, defence and public sector deploy models in their own racks and must evidence that the deployed model is the approved model. Today that evidence is a process document, not a cryptographic record.
Anyone shipping weights to a customer's infrastructure has no technical recourse against extraction. The per-step hash sequence is a unique execution signature — evidence of unauthorized use.
Robotics and embedded deployments run on constrained devices where no TEE path exists, and where an altered model is a safety event rather than a compliance one.
The honest read
We researched our own prior art adversarially before bringing this to you.
Not defensible on its own
Keeping a hot subset of weights resident in VRAM. PowerInfer published exactly that in December 2023. Additive recombination of factorized weight components. CALDERA (NeurIPS 2024) approximates each weight matrix as a quantized backbone plus a low-rank correction — summed, with the intermediate dimension held at O(d). Sparsity as a product. Neural Magic sold it, Red Hat acquired it in November 2024, and the proprietary sparse stack was deprecated in June 2025 in favour of open-source vLLM.
Partial weight residency with on-demand streaming was also published by Apple in December 2023, and factorized low-rank weight decomposition by LoftQ in October 2023. And we went looking for the patent that hurts most: US10719761B2 — top-k gating with weighted summation of expert outputs. It reads directly on the recombination step we had been calling our differentiator. We would rather hand you that reference than have your diligence find it.
We also corrected our own dossier: the patent we had cited as sparse-routing prior art (US10635934B2) is assigned to Ramot at Tel Aviv University and concerns image recognition. It was simply wrong.
Integrity attestation fused into the sparse-routing kernel. Verifiable-inference research exists — but it either runs as a separate verification pass, or requires a hardware TEE. Ours is free-riding a kernel launch the sparse runtime performs anyway, which is what takes the cost from 4–7% to under 0.3%. The sparse routing is not the product; it is the reason the attestation is affordable.
That composition — per-step weight-configuration hashing fused into the routing kernel, on unmodified hardware — is what the five patent families are written around.
The objection you will raise
It is, and we will not pretend otherwise: price for fixed capability falls at a median of roughly 50× per year, and GPT-3.5-equivalent output went from $20 per million tokens to $0.07 in under two years. Isolating algorithmic efficiency alone, controlling for hardware and competition, the rate is about 3× per year.
Which is precisely why we are not selling cost reduction. Cost is a commodity curve with well-funded incumbents on it. Trust is not on that curve. No amount of cheaper tokens tells a model owner whether the weights on that box were the weights they shipped — and the value of that answer rises as inference gets cheap enough to run everywhere, on hardware nobody audits.
There is a second, sharper version of the same objection, and it is the one we would raise ourselves: the documented capacity bottleneck in modern serving is the KV cache, not the weights. Batch size — the main throughput lever in vLLM and TensorRT-LLM — is capped because every concurrent sequence needs its own cache. Freeing weight memory does not lift that ceiling on its own. And on unchanged hardware, standard datacenter TCO has no term for memory saved: it reduces to throughput, which means our current transfer latency counts against us until pre-fetching lands. This is exactly why the company is not being pitched on the memory number.
The memory work still matters commercially, for a narrower reason: TCO studies find that throughput on thin GEMMs — the memory-bound decode phase — moves cost per token more than peak hardware throughput does. Weight placement acts on the binding constraint. But it is the vehicle, not the pitch.
Proof plan
Every step below produces an artefact your team can verify without taking our word for it.
Reproducible memory benchmark — done
Runs today on CPU, MPS and CUDA at three model widths. The ratio is exact by construction: holding K of N subspaces resident puts a quarter of the bank on the device. We hand your engineers the script; they run it themselves.
Available now
Provisional filings, five families
Drafted to filing-ready state and timestamped. Filing is the first use of proceeds — no claim language is disclosed before it, because Europe and Israel grant no grace period.
Within 30 days of close
Attestation overhead, measured under load
The sub-0.3% figure, benchmarked against the 4–7% cost of hashing as a separate operation, on production-shaped traffic. Published as a runnable harness.
Month 3–6
Iso-quality against the real field
Not against our own dense baseline — against FlexGen, PowerInfer, ZeRO-Inference and llama.cpp offloading, at equal output quality, with a Tier-1 inference partner. This is the number the company gets judged on, and we would rather generate it under your diligence than assert it now.
Month 6–12
The return question
| Company | At seed | Outcome |
|---|---|---|
| Run:ai | ~$3M seed, 2018 · pre-product — first product shipped 2020 | $700M to NVIDIA |
| Deci AI | 3 founders incl. a Technion professor · shipped platform + a headline speed benchmark | ~$300M to NVIDIA |
| Neural Magic | $15M seed · MIT professor · software-only sparsity runtime | Acquired by Red Hat |
| DreamNova | $3M sought · two founders · reproducible benchmark · five filing-ready families | — |
Category pricing
Open material — no login
Comparable figures above are from public reporting and we will send the underlying sources on request rather than ask you to take them on trust.
Same day, on request: the benchmark script, run it yourselves. Under NDA: the full anchor stack and claim language, ahead of the provisional wave.
Financial calendar
Eighteen months, sequenced so that the cheapest risks are retired first. Figures are our operating model, not results.
Provisional filings, five families
First use of proceeds. Nothing else starts until novelty is locked — Europe and Israel grant no grace period, so this gate comes before any publication or design-partner disclosure.
≈ $180K · IP counsel, drafting, filing fees
Two engineering hires
ML-Systems lead and inference engineering lead. Team goes from two to four. This is the single largest line and the core team bet in the seed.
≈ $1.15M over the 18 months, fully loaded
Attestation overhead, measured under load
The sub-0.3% claim benchmarked against separate-pass hashing on production-shaped traffic, published as a runnable harness. Risk retired: does the core primitive cost what we say.
≈ $260K · GPU compute and benchmarking
Iso-quality against the field, first design partner
Measured against FlexGen, PowerInfer, ZeRO-Inference and llama.cpp offloading with a Tier-1 partner. In parallel, one neocloud or sovereign-deployment design partner runs the attestation record in a real fleet. Risk retired: does anyone pay for this.
≈ $420K · partner integration, field engineering
Two to three paying design partners, Series A on traction
Open-source runtime published for distribution; the attestation record licensed as the commercial layer. Series A raised against deployment evidence rather than a benchmark claim — the path Run:ai and vLLM both took.
≈ $600K · GTM, IP counsel hire, PCT extension · reserve ≈ $390K
The runtime is free and open — that is the only distribution model that has worked at this layer, and the two comparables that reached $400M and $800M in January 2026 both took it. The attestation record is the product. It is licensed per GPU per month to the party that needs to prove something to someone else: the fleet operator to the model owner, the regulated deployer to their auditor, the model licensor to their customer.
The economics are unusually clean because the buyer already has the budget line. A neocloud operator running ten thousand GPUs is today either buying confidential-computing hardware to answer this question, or losing the deals where it is asked. At a licence in the low tens of dollars per GPU per month, a single operator of that size is an eight-figure annual contract, and the marginal cost of serving them is close to zero — we ship a kernel, not a service.
Breakeven does not require many of them. A team of twelve to fifteen in Jerusalem and Tel Aviv runs at roughly $4M a year fully loaded; two operators at that scale, or a dozen mid-sized regulated deployments, cover it. That is a Series A milestone, not a Series C one — and it is why we are asking for $3M rather than more.
The ask
Eighteen months, one bet: weight attestation fused into the sparse routing kernel, proven against the real field with a Tier-1 inference partner. Filings first, benchmark second, design partner third. No fab risk on the critical path.
Roughly ₪15M of non-dilutive programme applications are scoped ahead of the equity — applications, not awards. We are looking for a lead who builds with founders rather than around them.