Encrypting Models & Resources
Encrypt AI models and other binary assets, and read them back at runtime without ever writing plaintext to disk.
magiclock protect-model encrypts a model, weights file, or any other resource into a .enc envelope. Your app decrypts it in memory at runtime with bootstrap() + open_model() — the plaintext bytes never touch disk.
Encrypting a model
magiclock protect-model models/face.onnx # -> models/face.onnx.enc
magiclock protect-model weights/net.pt --feature ai_model -o net.enc--feature names the capability your license must grant to unlock it — it defaults to ai_model. The same expiry (--trial / --expires-in / --expires-at) and protection-level flags from Encrypting Code all apply here too: the default .enc is keyless portable (decrypts on any machine with the runtime), --passphrase / --emit-key add a portable secret, and --bind-machine (optionally + --passphrase) node-locks it to this machine.
Reading it back at runtime
import magiclock
import onnxruntime
magiclock.bootstrap() # brings the gate up — needed for --bind-machine envelopes; portable ones decrypt without it
model_bytes = magiclock.open_model("models/face.onnx.enc") # plaintext, in memory only
session = onnxruntime.InferenceSession(model_bytes)open_model() works the same way regardless of what's inside the envelope — ONNX, PyTorch state dicts, raw weight arrays, or arbitrary binary resources like configuration bundles or datasets. Anything bytes-shaped in, and back out.
Function reference
| Signature | Notes | |
|---|---|---|
magiclock.bootstrap() | bootstrap(vault_dir=None, *, app_version="1.0.0") -> MagicLockRuntime | Call once, before any open_model() (or gated code) runs. magiclock build inserts this call for you at the compiled entry point — you only call it by hand in plain (non-compiled) scripts. Raises if this machine hasn't been activated. |
magiclock.open_model() | open_model(path, *, vault_dir=None, passphrase=None, key=None) -> bytes | Auto-detects machine-locked vs. portable envelopes (keyless portable ones decrypt with no argument at all). Pass passphrase/key for passphrase/key-portable or two-factor (--bind-machine --passphrase) artifacts instead of prompting. |
See the full Python API Reference for exceptions and edge cases.
Memory-only, every time
Decrypted model bytes exist only in the process's memory for as long as you hold a reference to them — open_model() never writes a plaintext copy to disk, a temp directory, or anywhere else. If your inference framework needs a file path rather than bytes, keep it in a memory-backed location (e.g. an in-memory file object) rather than writing it out yourself, or the plaintext ends up on disk outside MagicLock's protection.