> ## Content Index
> Fetch the complete content index at: https://www.tao.media/llms.txt
> Use this file to discover other available public pages before exploring further.

# Chutes Brings Confidential AI Inference to Bittensor’s SayGM Gateway
- URL: https://www.tao.media/chutes-brings-confidential-ai-inference-to-bittensors-saygm-gateway/
- Published: 2026-10-28T17:04:32.000Z
- Updated: 2026-10-28T17:04:32.000Z
- Description: Developers can access Chutes’ hardware-protected open-weight models alongside Claude, GPT, and Gemini through one SayGM account.
- Author: Tristan Hillerich
- Tags: Chutes, saygm, Subnets, AI, News

Chutes has [joined SayGM as an upstream inference provider](https://chutes.ai/news/chutes-models-are-now-on-saygm?ref=tao.media), bringing its hardware-protected open-weight AI models to the gateway on Bittensor Subnet 28\. Developers can use a single SayGM API key and base URL to access Chutes alongside Claude, GPT, and Gemini, without opening a separate Chutes account.

The integration connects two distinct services on Bittensor: SayGM handles access, routing, and billing, while Chutes, operating on Subnet 64, runs the models. Developers already using the gateway gain confidential model execution without a second inference integration.

[SayGM’s launch update](https://x.com/say%5Fgm%5F/status/2115428371161039324?ref=tao.media) emphasizes protection at both stages of a request: its gateway runs inside a trusted execution environment, or TEE, and Chutes runs inference inside its own attested hardware. Inference is the process of running a trained model to generate a response.

## How SN28 Routes Requests to SN64

[SayGM’s gateway architecture](https://tao.media/saygm-sn-28-your-private-gateway-to-frontier-models-on-bittensor/?ref=tao.media) separates routing from model execution. Independent inference providers on SN28 carry requests to approved upstream services, with Chutes now among those approved providers.

An application sends its request to the [SayGM API](http://api.saygm.com/?ref=tao.media). The gateway processes it inside an Intel TDX confidential virtual machine, selects an inference provider with capacity for the requested model, and forwards the call through that provider to Chutes. Chutes runs the model inside its own TEE, then streams the response back through the same route.

Each SN28 provider routing to Chutes uses its own Chutes API key. Those credentials stay sealed inside a TEE instead of an ordinary configuration file. The application developer needs only a SayGM key; the SN28 provider pays Chutes for the inference it consumes.

Pricing is set on the gateway side. SN28 inference providers compete by offering discounts against retail list prices, with current offers visible on [SayGM’s miner dashboard](http://saygm.com/miners?ref=tao.media). Chutes does not set those rates.

The arrangement gives [Chutes’ decentralized inference service](https://tao.media/the-investors-guide-to-chutes-bittensors-inference-layer/?ref=tao.media) another distribution channel through a separate subnet’s product. Chutes says it follows a September integration in which SOMA, on Subnet 114, connected its agents to Chutes inference.

## What the Confidential Tier Protects

![SayGM x Chutes partnership, Enclave Verified](https://storage.ghost.io/c/78/0b/780ba906-b1a7-4bf0-873c-bdd5c32e5331/content/images/2026/10/8f47eada-0ac6-4b4f-bd77-5bc8f188a8bd-chutes-x-saygm-1920x1080.png)

[SayGM x Chutes partnership, Enclave Verified | SayGM](https://saygm.com/blog/access-chutes-private-models-on-the-saygm-gateway?ref=tao.media)

A TEE isolates code and data from the operating system and infrastructure operators surrounding it. That protection applies while information is being processed, and extends beyond data traveling over an encrypted network connection.

On Chutes, Intel TDX encrypts the memory of each protected virtual machine, preventing the host hypervisor from inspecting it. NVIDIA Protected PCIe encrypts the connection between the CPU and GPU, extending protection to data moving to the accelerator that runs the model.

[Chutes’ confidential-compute stack](https://chutes.ai/news/confidential-compute-for-ai-inference-how-chutes-delivers-verifiable-privacy-with-trusted-execution-environments?ref=tao.media) also ties startup to remote attestation: cryptographic evidence of the hardware environment and software measurements. A node receives the disk-decryption key needed to enter service only after those checks succeed.

Its open-source sek8s infrastructure allows developers to inspect the implementation, and Chutes says its production virtual-machine image can be rebuilt and compared with published measurements. Signed workload images and runtime integrity checks complement the hardware isolation by checking what code is allowed to execute inside it.

The gateway and inference environments provide separate layers of protection for a Chutes-served confidential request. SayGM protects request handling from the gateway operator and host; Chutes protects processing on its serving hardware from the infrastructure operator.

The model choice determines how far that protection extends. Under [SayGM’s privacy model](https://docs.saygm.com/security/privacy/?ref=tao.media), confidential models carry a `-tee` suffix and appear with `tier: "confidential"` in the catalog. Frontier models such as Claude, GPT, and Gemini still reach their upstream providers, which process requests under their own terms. Sharing a gateway does not give those proprietary models Chutes’ confidential-execution boundary.

Chutes joins [NEAR AI’s confidential inference](https://tao.media/near-ai-confidential-inference-goes-live-on-bittensors-saygm-gateway/?ref=tao.media) as another hardware-protected model provider on the SayGM gateway.

## Selecting Chutes From an Application

Developers can list models with `GET /v1/models`, check the confidential tier, and select an appropriate model ID. To require Chutes specifically, they add `X-GM-Providers: chutes` to the request.

The [provider-routing controls](https://docs.saygm.com/api/routing/?ref=tao.media) also accept a comma-separated list, such as `chutes,kubetee`. The restriction applies on retries as well: if none of the permitted providers can serve the model, SayGM returns an error rather than sending the prompt elsewhere.

A separate header, `X-GM-Routing`, selects `cheapest` or `fastest` routing among allowed providers. The cheapest mode considers expected charges and recent success rates, while the fastest uses recent time to first token and output speed. Omitting the header leaves SayGM’s standard routing in place.

The integration sits alongside [SayGM’s OAuth access for user-funded inference](https://tao.media/saygm-adds-oauth-login-for-ai-apps-with-user-funded-inference/?ref=tao.media), which lets users authorize individual applications to draw from their existing balance with separate permissions and spending limits.

Direct Chutes customers keep their existing keys and [API endpoint](http://llm.chutes.ai/v1?ref=tao.media). Its full catalog remains available directly, including image, audio, video, and embedding models alongside LLMs. The SayGM integration does not change that setup, while Chutes’ separate [Qwen3.8 Max and DeepSeek V4.1 Pro rollout](https://tao.media/chutes-rolls-out-qwen3-8-max-and-deepseek-v4-1-pro-as-subscriptions-end/?ref=tao.media) uses pay-as-you-go access as existing subscriptions expire at the end of their billing periods.