{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "K-0006",
    "slug": "trusted-execution-environment",
    "title": "Trusted execution environment (TEE)",
    "aliases": [
      "TEE",
      "enclave",
      "confidential computing",
      "confidential VM"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "An execution area protected by the processor that keeps the data inside confidential and unaltered, and the code unaltered, even from the host's own software.",
    "sources": [
      {
        "source": "S-1600",
        "supports": "NIST definition of TEE as an area or enclave protected by a system processor",
        "locator": "term: trusted_execution_environment (NISTIR 8320)"
      },
      {
        "source": "S-1604",
        "supports": "confidential computing defined as computation in a hardware-based, attested TEE; core TEE attributes (data confidentiality, data integrity, code integrity); optional attributes including code confidentiality and attestability; attestation as validation of a hardware-signed report of TCB measurements; confidential VMs protected from the hypervisor and host OS",
        "locator": "definitions; TEE attributes; attestation; confidential VMs"
      },
      {
        "source": "S-0012",
        "supports": "property attestation using confidential VMs with Intel TDX and NVIDIA H100 GPUs",
        "locator": "abstract"
      },
      {
        "source": "S-0009",
        "supports": "TEE-based verifiable benchmarks keeping model and test data confidential",
        "locator": "abstract"
      },
      {
        "source": "S-0014",
        "supports": "attestation-key holder can produce valid reports; microarchitectural side channels and physical attacks such as bus interposition as limitations",
        "locator": "Limitations"
      }
    ],
    "related": [
      "K-0004",
      "K-0005",
      "K-0013"
    ],
    "type": "concept",
    "url": "https://trustbutveri.fyi/concepts/trusted-execution-environment/",
    "source_file": "content/concepts/trusted-execution-environment.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "A trusted execution environment (TEE) is an execution area that the processor protects, so that software outside it, including the host operating system and hypervisor, cannot read the data inside or alter its code and data [[S-1600]] [[S-1604]].\n\nThe Confidential Computing Consortium lists data confidentiality, data integrity and code integrity as the core attributes of a TEE; code confidentiality and attestability are optional [[S-1604]]. Isolation and [[K-0004|remote attestation]] are separate properties: the TEE protects a workload, and attestation, the validation of a hardware-signed report of what was loaded, lets a remote party check it [[S-1604]]. The consortium defines confidential computing as computation in a hardware-based, attested TEE, so it requires both [[S-1604]]. A TEE can cover a whole confidential virtual machine and extend to accelerators; PAL\\*M, for example, pairs Intel TDX confidential VMs with NVIDIA H100 GPUs to attest properties of generative models [[S-0012]] [[S-1604]]. In AI verification, TEEs underpin [[M-0008|TEE remote attestation for AI workloads]] and [[M-0025|confidential multi-party verification]], such as running safety benchmarks while keeping both the model and the test data confidential [[S-0009]]. A 2026 MIRI Technical Governance Team post notes that whoever holds the hardware's attestation key can produce valid reports, and that microarchitectural [[K-0013|side channels]] and physical attacks such as bus interposition remain concerns [[S-0014]].",
    "body_text": "A trusted execution environment (TEE) is an execution area that the processor protects, so that software outside it, including the host operating system and hypervisor, cannot read the data inside or alter its code and data [S-1600] [S-1604]. The Confidential Computing Consortium lists data confidentiality, data integrity and code integrity as the core attributes of a TEE; code confidentiality and attestability are optional [S-1604]. Isolation and remote attestation are separate properties: the TEE protects a workload, and attestation, the validation of a hardware-signed report of what was loaded, lets a remote party check it [S-1604]. The consortium defines confidential computing as computation in a hardware-based, attested TEE, so it requires both [S-1604]. A TEE can cover a whole confidential virtual machine and extend to accelerators; PALM, for example, pairs Intel TDX confidential VMs with NVIDIA H100 GPUs to attest properties of generative models [S-0012] [S-1604]. In AI verification, TEEs underpin TEE remote attestation for AI workloads and confidential multi-party verification, such as running safety benchmarks while keeping both the model and the test data confidential [S-0009]. A 2026 MIRI Technical Governance Team post notes that whoever holds the hardware's attestation key can produce valid reports, and that microarchitectural side channels and physical attacks such as bus interposition remain concerns [S-0014].",
    "referenced_by": [
      {
        "id": "M-0018",
        "title": "Chip location verification",
        "url": "https://trustbutveri.fyi/mechanisms/chip-location-verification/"
      },
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/"
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/"
      },
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/"
      },
      {
        "id": "I-0009",
        "title": "Lucid sovereignty (location) certificates",
        "url": "https://trustbutveri.fyi/implementations/lucid-location-certificates/"
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/"
      },
      {
        "id": "C-0005",
        "title": "The declared model is the one being served",
        "url": "https://trustbutveri.fyi/claims/declared-model-is-served/"
      },
      {
        "id": "C-0006",
        "title": "Declared safeguards were applied during inference",
        "url": "https://trustbutveri.fyi/claims/safeguards-were-applied/"
      },
      {
        "id": "K-0004",
        "title": "Remote attestation",
        "url": "https://trustbutveri.fyi/concepts/remote-attestation/"
      },
      {
        "id": "K-0005",
        "title": "Root of trust",
        "url": "https://trustbutveri.fyi/concepts/root-of-trust/"
      },
      {
        "id": "K-0013",
        "title": "Side channel",
        "url": "https://trustbutveri.fyi/concepts/side-channel/"
      }
    ]
  }
}