AI Verification LandscapeSearch

Glossary

Trusted execution environment (TEE)

An execution area protected by the processor that keeps the data inside confidential and unaltered, and the code unaltered, even from the host's own software.

A trusted execution environment (TEE) is an execution area that the processor protects, so that software outside it, including the host operating system and hypervisor, cannot read the data inside or alter its code and data 1 2.

The Confidential Computing Consortium lists data confidentiality, data integrity and code integrity as the core attributes of a TEE; code confidentiality and attestability are optional 2. Isolation and remote attestation are separate properties: the TEE protects a workload, and attestation, the validation of a hardware-signed report of what was loaded, lets a remote party check it 2. The consortium defines confidential computing as computation in a hardware-based, attested TEE, so it requires both 2. A TEE can cover a whole confidential virtual machine and extend to accelerators; PAL*M, for example, pairs Intel TDX confidential VMs with NVIDIA H100 GPUs to attest properties of generative models 3 2. In AI verification, TEEs underpin TEE remote attestation for AI workloads and confidential multi-party verification, such as running safety benchmarks while keeping both the model and the test data confidential 4. A 2026 MIRI Technical Governance Team post notes that whoever holds the hardware's attestation key can produce valid reports, and that microarchitectural side channels and physical attacks such as bus interposition remain concerns 5.

Related

Used in

Sources

  1. ANational Institute of Standards and Technology (2026). NIST Computer Security Resource Center (CSRC) Glossary. NIST Computer Security Resource Center. Source recordSupports: NIST definition of TEE as an area or enclave protected by a system processor · term: trusted_execution_environment (NISTIR 8320)
  2. BConfidential Computing Consortium (2022). Common Terminology for Confidential Computing. Confidential Computing Consortium. Source recordSupports: confidential computing defined as computation in a hardware-based, attested TEE; core TEE attributes (data confidentiality, data integrity, code integrity); optional attributes including code confidentiality and attestability; attestation as validation of a hardware-signed report of TCB measurements; confidential VMs protected from the hypervisor and host OS · definitions; TEE attributes; attestation; confidential VMs
  3. BP. Chantasantitam et al. (2026). PAL*M: Property Attestation for Large Generative Models. arXiv. Source recordSupports: property attestation using confidential VMs with Intel TDX and NVIDIA H100 GPUs · abstract
  4. BC. Schnabl et al. (2025). Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments. ICML 2025 Workshop on Technical AI Governance. Source recordSupports: TEE-based verifiable benchmarks keeping model and test data confidential · abstract
  5. CGloria Z (2026). On TEEs for Privacy-Preserving Monitoring in AI Governance. MIRI Technical Governance Team. Source recordSupports: attestation-key holder can produce valid reports; microarchitectural side channels and physical attacks such as bus interposition as limitations · Limitations