Hardware-Bound Model Entitlement for Offline AI

Abstract. Software that runs offline cannot rely on a network call to check whether it is licensed, yet vendors of capable AI still need a way to entitle the models a given customer may run. The usual answer, a licence server the client contacts, reintroduces exactly the network dependency that a sovereign, offline deployment is meant to avoid. This paper describes an alternative in which the entitlement is bound to the machine rather than to a network check. A hardware-fingerprint-bound access key entitles exactly the set of models that a particular machine is capable of running, verifies offline, and will not verify on any other machine. Provisioning is preceded by a two-stage capability probe: a browser pre-qualification probe gives an early estimate of what the hardware can run, and a native probe at install establishes the exact match that the key encodes. The matching download then delivers only the entitled model files, each verified on arrival against a published checksum. We discuss the trade this makes against cloud licence servers: the operator gains predictable cost and genuinely offline operation, at the price of self-service revocation, which a network-bound licence retains and an offline binding does not. We are explicit that a hardware binding is tamper-evident and deters casual copying rather than being unbreakable, and we describe the mitigations, such as key expiry and re-issue, that bound the resulting exposure.