Every use case isn’t security critical. There’s a lot of AI used to render silly images and films, generate marketing copy, play games, proofread social media posts, etc.

You solve this by charging a little more for security certified AI that runs in a secure DC.

You can also easily randomize AI work load distribution, so individual nodes don’t get all queries for a whole coherent conversation or project. It makes an attack less valuable.

Apple has done some research on blinding and obfuscating AI too.