Can You Build Confidential Legal AI Without a TEE? Empirical Lessons on PIR and Keyed Models

Two studies on fictional UK employment matters, October 2026, with the cloud provider treated as an attacker with full access. A model hidden behind a secret key was read in full: 100% of the secret content recovered from public statistics of its weights. Keeping client work on a laptop and fetching public law by private information retrieval sent 0 of 17 client secrets to the cloud, where a standard cloud pipeline sent 16 private tokens. With dates and amounts computed in code, 30 of 30 conclusions on 8 unseen matters were correct. Work that needs cloud compute on client data needs a hardware trusted execution environment, such as Prem Enclave.