[Gopalakrishnan Nallasamy (GopalakrishnanN)]

Description

Add a Java integration test for compile -> AES-GCM encrypt/store -> decrypt/load -> numerical inference with real external EPContext data.

• Test two input sets and authentication/payload failure controls.
• External context is persisted only as ciphertext.
• Release compilation state before restored inference.

Java limitation: the compilation API only exposes model file output. The test temporarily writes plaintext compiled ONNX, then encrypts and deletes it before loading. This does not prove no-plaintext-at-any-time for the compiled ONNX model.

Depends on shared fixture #33216 and includes its identical prerequisite commit; merge #33216 first. Draft pending CI/review. Local test is Windows-gated.

Review follow-up

Reuse one SecureRandom for test keys and nonces. Clarify temporary plaintext model-file compilation in Java and pending companion availability. All branches also contain the shared generator import fix, native fixture regression, and qualified companion documentation.

October 23 approved-review follow-up

Load the shared two-input ONNX fixture directly, add persisted authenticated-but-invalid context through the real decrypt/read callback, and use JUnit tempdir for exception-safe cleanup.

Validation: From java, with an isolated JAVA_TOOL_OPTIONS=-Djava.io.tmpdir=<session-temp> and the matching API31 staged runtime: gradlew.bat --no-daemon --offline -DcmakeBuildDir=<matching-native-build> spotlessJavaCheck test --tests ai.onnxruntime.EncryptedEpContextTest --tests ai.onnxruntime.CompileApiTest.externalEpContextDataUsesCallbacks: 2 passed, zero skipped. Existing protobuf generated-code and Gradle deprecation warnings remain. The isolated temp directory avoids a pre-existing fallback context left in the shared system temp directory.

The shared fixture corrections are included on all six approved branches. git diff --check passed. Updated-head CI is pending; no old-head results are claimed for these changes.

Motivation and Context

Follow-up to #32265 and Java binding #32305. Existing callback tests lacked encrypted compiled-state inference.

Local validation (from java, using JNI rebuilt from source and matching staged native artifacts):

.\gradlew.bat --no-daemon --offline -DcmakeBuildDir=C:\Users\gnallasamy\Codes\ort-encryption-471c3cdf\build\Encryption spotlessJavaApply test --tests ai.onnxruntime.EncryptedEpContextTest --tests ai.onnxruntime.CompileApiTest.externalEpContextDataUsesCallbacks

Result: 2 passed, zero skips; Java source/JNI build passed. git diff --check passed. Publication branch cleanly cherry-picked onto current main; full current-main rebuild not run locally.

Not covered: Apple/mobile execution, production provider binaries, external initializer encryption.

[Copilot]

🟡 Changes recommended

The documentation contains an unconditional plaintext claim and references four tests not present in this branch.

2 open findings

• Overview incorrectly claims ORT never writes plaintext to disk · New
• Documented workflows lack companion tests · New

What changed in this PR

Adds Java end-to-end validation for encrypted compiled-model and external EPContext inference using the example plugin EP.

Changes:

• Adds an executable two-input Mul EPContext fixture.
• Tests AES-GCM persistence, restoration, inference, and rejection cases.
• Documents cross-binding encryption workflows.

File	Description
.gitignore	Allows the generated ONNX fixture.
onnxruntime/​test/​testdata/​encrypted_ep_context_mul.py	Generates the shared Mul model.
onnxruntime/​test/​testdata/​encrypted_ep_context_mul.onnx	Provides the generated fixture.
onnxruntime/​test/​autoep/​library/​example_plugin_ep/​ep.h	Adds restored EPContext execution state.
onnxruntime/​test/​autoep/​library/​example_plugin_ep/​ep.cc	Serializes and executes the test Mul descriptor.
onnxruntime/​test/​autoep/​library/​example_plugin_ep/​ep_factory.cc	Parses the opt-in execution setting.
java/​src/​test/​java/​ai/​onnxruntime/​EncryptedEpContextTest.java	Adds encrypted compile/load/inference coverage.
docs/​design/​Compiled_Model_Encryption.md	Documents binding tests and commands.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Gopalakrishnan Nallasamy (GopalakrishnanN)]

Fixed the common fixture compiler ambiguity by explicitly selecting the unordered-map provider-options overload (f8e377d). Corrected call passed MSVC C++17 /W4 /WX syntax validation. New-head CI is running; superseded old-head Windows jobs were not manually rerun.

[Tianlei Wu (tianleiwu)]

LGTM overall! Clean Java integration test covering EPContext write/read callbacks with AES-GCM encryption, restored multi-iteration inference, and authentication failure checks. Verified spotlessJavaCheck and compileTestJava locally.

Left a couple of non-blocking suggestions inline (adding an authenticated-but-invalid payload check and simplifying temp directory cleanup / fixture loading).