Proposal Explorer

Add claims to see which ones the mechanisms address.

Operational use

• Operational use TEE remote attestation for AI workloads for showing which software ran to a party that distrusts the operator holding the hardware

Built for an adversarial prover

Network taps and certifiers and Bounding unexplained information in outputs

No new hardware needed

TEE remote attestation for AI workloads

Failures since mitigated

• Verifier dictionary attacks on hashes in Network taps and certifiers ¹
• Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked) in TEE remote attestation for AI workloads ^{24 25 29 30}

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

• Network taps and certifiers: Analysis
• TEE remote attestation for AI workloads: Independent red-team
• Bounding unexplained information in outputs: Independent red-team

Open critical failures

• DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop) in TEE remote attestation for AI workloads

  Critical when the verifier must resist physical access plus host control on the affected DDR5 platforms. The Intel demonstrations defeat attestation; TEE.fail's AMD demonstration extracts a guest key, not an AMD attestation key. These results do not cover every TEE architecture.

  Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges.

  • On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations.
  • On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse and Fabricked from malicious host software.

  A second team, from KU Leuven, ETH Zurich, Durham University and Google, built DDRop, an active DDR5 interposer with a bill of materials of $159. It silently drops memory writes, which memory encryption without freshness protection cannot detect. With brief physical access and control of the host software and BIOS, the researchers forced trust domains into debug mode and forged attestation reports on an up-to-date Intel TDX platform. The same primitive breaks the integrity of Scalable SGX and SEV-SNP, though the authors report no SEV-SNP attestation forgery.

  The TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation. The DDRop authors report the same position, and that both vendors issued security advisories on disclosure in September 2026. PAL*M lists this attack class as out of its scope, and Tinfoil's documentation acknowledges it. Gloria Z calls key extraction through bus interposition "relatively low-hanging fruit" in an international treaty scenario. ^{12 13 16 17 22 24 28 29}

  Known failure · Demonstrated attack · Critical · Open · Mechanism-class evidence. On the record

  Related mechanism Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors: A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically. A pointer, not evidence that this failure is mitigated. Add

• DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap) in TEE remote attestation for AI workloads

  Critical for the tested DDR4 SGX and SEV-SNP configurations against a physical host attacker. The authors exclude DDR5 from these demonstrations, including TDX servers; the DDR5 attacks have a separate finding.

  Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host.

  • Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time alias checks that AMD and Intel introduced against static aliasing attacks such as BadRAM. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation.
  • WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments.

  Both attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments. ^{22 23}

  Known failure · Demonstrated attack · Critical · Open · Mechanism-class evidence. On the record

  Related mechanism Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors: A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically. A pointer, not evidence that this failure is mitigated. Add

Open significant failures

6 failures in 3 mechanisms

• Output nondeterminism leaves covert capacity in Network taps and certifiers

  Hashing cannot remove information hidden in the outputs themselves. The Secure Gateway Device paper estimates that about 0.1 bit per token remains even with seed-synchronized replay checks. For a 200k-GPU inference cluster at full load (2,000 tokens per GPU per second), that is about 40 Mbit/s of covert egress, enough to move a 1 TB model in under three days. The paper names this the core remaining challenge and points to deterministic replay or active scrubbing of hardware-induced entropy. An independent study found that an adversary who chooses the prompts roughly doubles the bits leaked per token under Gumbel-based inference verification; see Bounding unexplained information in outputs. ^{1 9}

  Known failure · Theoretical argument · Significant · Open. On the record

  Related mechanism Operational use Deterministic and bit-exact inference: Deterministic replay is one of the two remedies the flaw's source names. A pointer, not evidence that this failure is mitigated. Add

  Related mechanism Research demo Bounding unexplained information in outputs: Bounds the hidden information outputs can carry by measuring what the declared computation fails to predict. A pointer, not evidence that this failure is mitigated. In the proposal.

• Residual side channels in simple passive setups in Network taps and certifiers

  Amodo's analysis of its own tapped prototype lists unvalidated header fields, timing of permitted traffic and variation in response formatting as residual channels, and concludes that the passive tap must be replaced by an active one. ⁵

  Known failure · Theoretical argument · Significant · Open. On the record

• H100 attestation not bound to a specific confidential VM in TEE remote attestation for AI workloads

  The demonstration combines a genuine H100 report with forged Intel TDX evidence. It depends on the CPU attestation already being defeated; a GPU report alone does not demonstrate that an intact CPU-to-GPU trust chain was bypassed.

  The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side. ¹⁶

  Known failure · Demonstrated attack · Significant · Open · Mechanism-class evidence. On the record

• Side channels and other attacks by the host on CPU and GPU TEEs in TEE remote attestation for AI workloads

  The cited studies concern particular CPU and GPU platforms and attack prerequisites. StackWarp has AMD microcode patches; the open class-level entry does not mean every cited defect is unmitigated or applies to every TEE-backed implementation.

  PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope. Attestable Audits proposes revoking vulnerable enclave images. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance. New attacks of this kind continue to appear. In StackWarp, researchers at CISPA showed that a malicious hypervisor can shift the stack pointer of an SEV-SNP guest on AMD Zen 1 to Zen 5 processors with simultaneous multithreading enabled, which fully breaks the guest's integrity. AMD released microcode patches. On the GPU side, an independent analysis of NVIDIA's confidential computing by IBM Research and Ohio State University found that bulk command and data transfers are protected, but some metadata, timing behaviour and coordination signals remain in unprotected shared memory. The authors report that these can reveal computational behaviour and in some cases allow manipulation of operations. They disclosed the findings to NVIDIA. ^{11 12 13 31 32}

  Known failure · Demonstrated attack · Significant · Open · Mechanism-class evidence. On the record

• Root of trust concentrated in a few hardware vendors in TEE remote attestation for AI workloads

  Vendor trust is an assumption of the attestation chain. The root-seed extraction study concerns AMD EPYC Milan and firmware downgrade with privileged host and platform-flash access; it is not evidence of the same failure on Intel, NVIDIA or all AMD generations.

  The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip. Attestable Audits notes that the approach holds only "as long as the vendor of the secure hardware is trusted". A 2026 preprint reports that a host with root control and the ability to rewrite platform flash can downgrade an AMD EPYC Milan processor to legacy security-processor firmware and extract the hardware root seed from which SEV-SNP attestation keys are derived. The authors state that this lets them forge attestation reports for any firmware version. AMD describes the firmware-loader flaw the attack starts from as a legacy attack mitigated in 2021. ^{11 13 35 36}

  Known failure · Theoretical argument · Significant · Open · Mechanism-class evidence. On the record

• Prompt-controlled entropy inflation widens the covert channel in Bounding unexplained information in outputs

  Gumbel-based inference verification tolerates token choices that honest GPU nondeterminism could produce, and the size of that tolerated set grows with the model's output entropy. Kezins, an independent researcher, showed that an adversary who controls the prompt distribution can raise output entropy and roughly double the bits leaked per token. Across six models of 1 to 32 billion parameters, this cut the slowdown from 146–254 times under benign prompts to 60–118 times. Kezins argues that architectures built on the same unexplained-information bound inherit this attack surface, and recommends calibrating tolerances against local token entropy rather than benign traffic. ^{9 38}

  Known failure · Demonstrated attack · Significant · Open. On the record

  Related mechanism Operational use Deterministic and bit-exact inference: Bit-exact replay would remove the tolerance for numerical noise that sets the size of this channel. The record notes that it needs full hardware and software metadata. A pointer, not evidence that this failure is mitigated. Add

Scope limitations

• Some links cannot be passively tapped in Network taps and certifiers

  Cankaya notes that copper-connected scale-up domains (for example NVL72 racks and TPU v7 cubes) are much harder to tap than fibre, and that optical budgets make passive taps impractical on 400GBASE-SR8 multimode links. Amodo found no taps advertised for 53 GBaud links as of May 2026. ^{2 10}

  Scope limitation · Open question. On the record

• Encrypted fabrics hide plaintext from both parties in Network taps and certifiers

  Cankaya notes that with TEE-protected sessions whose keys are ephemeral and managed inside the TEE, neither the operator nor the manufacturer can recover session keys after the session, so tapped traffic could not be opened for recomputation. For other encrypted fabrics, the operator can retain keys. ²

  Scope limitation · Open question. On the record

• Completeness rests on physical monitoring left out of scope in Network taps and certifiers

  The Secure Gateway Device paper assumes the facility is physically monitored, and states that the whole architecture depends on the device being the only communication channel. It names radio emanation, power-line signalling and thermal channels as covert channels beyond that scope. ¹

  Scope limitation · Open question. On the record

  Related mechanism Proposed Side-channel suppression for isolated facilities: Addresses the radio, power-line and thermal channels that network-level designs leave out. A pointer, not evidence that this failure is mitigated. Add

• Attestation covers launch state, and measurements can be incomplete in TEE remote attestation for AI workloads

  A general measurement-boundary limitation. The concrete WhatsApp configuration findings were fixed before launch; Apple's research-environment configuration flaw was also fixed. Their fixes do not remove the need to bind each deployment's runtime inputs.

  Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are "perhaps the most likely failure mode". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash "without breaking the hash function itself". Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged. ^{13 26 27 33 34}

  Scope limitation · Theoretical argument · Mechanism-class evidence. On the record

• Deployment-level attestation does not cover the whole chip in TEE remote attestation for AI workloads

  A limitation of deployment-level evidence when the claim concerns all activity on a chip. It does not defeat a narrower claim about which software served one attested request.

  An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring "the gaping hole in this plan". This matters most for negative claims such as the absence of training. ¹³

  Scope limitation · Theoretical argument · Mechanism-class evidence. On the record

  Related mechanism Research demo On-chip telemetry from timing, memory and performance counters: On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give. A pointer, not evidence that this failure is mitigated. Add

• Information the declared computation explains is not bounded in Bounding unexplained information in outputs

  The bound limits unexplained bits only. Outputs that the declared computation fully explains can still carry valuable information: a compression study notes that an adversary with inference access can extract more proprietary information per bit than naive transmission allows. ^{37 39}

  Scope limitation · Theoretical argument. On the record

• Channels other than checked outputs are outside the bound in Bounding unexplained information in outputs

  The inference-verification scheme treats side channels as out of scope. A low-trust system design argues that suppressing physical covert bandwidth below kilobits per second is much more achievable than aiming for zero, and that a malicious device can leak one bit of information by deliberately outputting a wrong result. ^{3 38}

  Scope limitation · Theoretical argument. On the record

  Related mechanism Proposed Side-channel suppression for isolated facilities: Physical side channels need separate suppression, which is this mechanism's purpose. A pointer, not evidence that this failure is mitigated. Add

Open questions

• The facility-level design is untested in Bounding unexplained information in outputs

  The compute-verification architecture is described with protocol details, potential attacks and prototyping plans, but no prototype results have been published. ³⁷

  Open question · Open question. On the record

Not yet demonstrated

Proposed Network taps and certifiers

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• Operational use Deterministic and bit-exact inference Add
  • Bears on the open significant failure “Output nondeterminism leaves covert capacity” in Network taps and certifiers. Deterministic replay is one of the two remedies the flaw's source names.
  • Bears on the open significant failure “Prompt-controlled entropy inflation widens the covert channel” in Bounding unexplained information in outputs. Bit-exact replay would remove the tolerance for numerical noise that sets the size of this channel. The record notes that it needs full hardware and software metadata.
  • Network taps and certifiers waits on it. Nondeterministic inference leaves covert capacity in outputs that hashing cannot remove.
  • Bounding unexplained information in outputs waits on it. Tolerance for numerical nondeterminism sets the size of the residual channel; bit-exact replay would remove it but needs full hardware and software metadata.
• Research demo Bandwidth limits and compartmentalization Add
  • Bounding unexplained information in outputs waits on it. The prover's compute must be isolated so that all traffic passes through the verifier's interlock; any unmonitored path voids the bound.
• Research demo On-chip telemetry from timing, memory and performance counters Add
  • TEE remote attestation for AI workloads waits on it. Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide.
• Research demo Tamper evidence for verifier devices Add
  • Network taps and certifiers waits on it. Taps and gateway devices need tamper-evident housing and physical monitoring so that traffic cannot bypass them.
• Proposed Side-channel suppression for isolated facilities Add
  • Network taps and certifiers waits on it. Radio, power-line and thermal channels are not addressed by network-level designs.
  • Bounding unexplained information in outputs waits on it. Physical side channels need separate suppression, and one design treats a low residual bandwidth, rather than zero, as the realistic target.
• Operational use Sampled inference recomputation Add
  • Network taps and certifiers depends on it.
  • Bounding unexplained information in outputs depends on it.
• Proposed Hardware-enabled guarantees (flexHEG) and guarantee processors Add

  Excluded by filters: needs new chips

  • Bears on the open critical failure “DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop)” in TEE remote attestation for AI workloads. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
  • Bears on the open critical failure “DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap)” in TEE remote attestation for AI workloads. A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically.
  • TEE remote attestation for AI workloads waits on it. Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware.

Missing prerequisites

• Operational use Sampled inference recomputation needed by Network taps and certifiers and Bounding unexplained information in outputs Add
• Operational use Deterministic and bit-exact inference needed by Network taps and certifiers Add
• Research demo Tamper evidence for verifier devices needed by Network taps and certifiers Add
• Proposed Side-channel suppression for isolated facilities needed by Network taps and certifiers and Bounding unexplained information in outputs Add
• Research demo Bandwidth limits and compartmentalization needed by Bounding unexplained information in outputs Add

Shared foundations

• Sampled inference recomputation relied on by Network taps and certifiers and Bounding unexplained information in outputs
• Deterministic and bit-exact inference relied on by Network taps and certifiers and Bounding unexplained information in outputs
• Side-channel suppression for isolated facilities relied on by Network taps and certifiers and Bounding unexplained information in outputs

Blockers

15 blockers recorded

• Network taps and certifiers
  • No complete verification tap has been demonstrated at production frontend link rates, and on the tested CPU no hash algorithm reached line rate with minimum-size frames. Performance & compatibility ^{10 40}
  • Nondeterministic inference leaves covert capacity in outputs that hashing cannot remove. Evidence binding. Waits on Deterministic and bit-exact inference ¹
  • Taps and gateway devices need tamper-evident housing and physical monitoring so that traffic cannot bypass them. Hardware trust. Waits on Tamper evidence for verifier devices ^{1 3}
  • Radio, power-line and thermal channels are not addressed by network-level designs. Coverage & hidden compute. Waits on Side-channel suppression for isolated facilities ¹
  • Red-teaming by specialists is called for but has not been reported. Adversarial validation ¹
• TEE remote attestation for AI workloads
  • Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware. Hardware trust. Waits on Hardware-enabled guarantees (flexHEG) and guarantee processors ^{14 16 22 23 28 41}
  • Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide. Coverage & hidden compute. Waits on On-chip telemetry from timing, memory and performance counters ¹³
  • Multi-GPU and multi-node coverage is incomplete, because Hopper leaves NVLink traffic unencrypted and NVIDIA's April 2026 release notes list no multi-node confidential mode. Performance & compatibility ^{14 42}
  • Rival parties have not agreed on trust roots and key provenance they would accept. Access & governance ¹³
  • CPU-only enclaves are costly for large models, because in the Attestable Audits prototype CPU inference cost 21.7 times as much per token as GPU inference and the enclave roughly doubled the CPU cost. Performance & compatibility ¹¹
• Bounding unexplained information in outputs
  • The prover's compute must be isolated so that all traffic passes through the verifier's interlock; any unmonitored path voids the bound. Coverage & hidden compute. Waits on Bandwidth limits and compartmentalization ³⁷
  • Physical side channels need separate suppression, and one design treats a low residual bandwidth, rather than zero, as the realistic target. Coverage & hidden compute. Waits on Side-channel suppression for isolated facilities ^{3 38}
  • Tolerance for numerical nondeterminism sets the size of the residual channel; bit-exact replay would remove it but needs full hardware and software metadata. Protocol soundness. Waits on Deterministic and bit-exact inference ^{3 9}
  • Recomputation over confidential weights and inputs needs a protected setting: prover recomputation in a verifier-controlled enclosure, verifier recomputation in a prover-controlled enclosure, or zero-knowledge proofs. Privacy & leakage ³⁷
  • No prototype of the facility-level architecture exists to red-team. Adversarial validation ³⁷

From the family or selected implementation's record. ?

Model weights

Depends on the design for Network taps and certifiers and Bounding unexplained information in outputs.

Hidden by TEE remote attestation for AI workloads.

Inputs and outputs

Depends on the design for Network taps and certifiers and Bounding unexplained information in outputs.

Hidden by TEE remote attestation for AI workloads.

Training data

Depends on the design for Network taps and certifiers.

Hidden by TEE remote attestation for AI workloads.

Not involved: Bounding unexplained information in outputs.

Network taps and certifiers

• Proposed AI 2040 inference-only verification stack Proposed architecture, AI Futures Project
• Proposed Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• Proposed SASH confidential network logger Research prototype, Singapore AI Safety Hub (SASH)

TEE remote attestation for AI workloads

• Operational use Apple Private Cloud Compute Product
• Research demo Attestable Audits Research prototype, University of Cambridge
• Research demo Cove Open-source project
• Research demo PAL*M Research prototype, University of Waterloo
• Operational use Tinfoil model identity (Modelwrap) Product, Tinfoil

Bounding unexplained information in outputs

None on the map

1. Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors, N. Cankaya et al. (2026). Original
2. The Fundamentals and Feasibility of Secure Network Taps for Verifying AI Datacenter Use, N. Cankaya (2026). Original
3. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
4. Verification Plan, R. Dean (2026). Original
5. Fitting a Network TAP to our Inference Verification Prototype, Amodo Design (2026). Original
6. Amodo-Design/Inference-Recomputation-Prototype (GitHub repository), Amodo Design (2026). Original
7. inference-verification: Inference Verification Prototype, Singapore AI Safety Hub (SASH) (2026). Original
8. Internationalising AI Verification, Singapore AI Safety Hub (SASH) (2026). Original
9. Adversarial Entropy Inflation Against Gumbel-Based Inference Verification, N. Kezins (2026). Original
10. Network Tapping for AI Verification: A Technical Assessment, Amodo Design (2026). Original
11. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). Original
12. PAL*M: Property Attestation for Large Generative Models, P. Chantasantitam et al. (2026). Original
13. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). Original
14. NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper), NVIDIA (2025). Original
15. Now in General Availability: NVIDIA H100 GPUs in Microsoft Azure Confidential Virtual Machines, C. Su (2024). Original
16. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). Original
17. A primer on secure enclaves, Tinfoil (2026). Original
18. Backend infrastructure, Tinfoil (2026). Original
19. How verification works in Tinfoil, Tinfoil (2026). Original
20. modelwrap: Reproducible dm-verity read-only image of Huggingface models, Tinfoil (2026). Original
21. Private Cloud Compute: A new frontier for AI privacy in the cloud, Apple Security Engineering and Architecture (SEAR) (2024). Original
22. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). Original
23. WireTap: Breaking Server SGX via DRAM Bus Interposition, A. Seto et al. (2025). Original
24. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). Original
25. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). Original
26. What we learned about TEE security from auditing WhatsApp's Private Inference, Trail of Bits (2026). Original
27. Meta WhatsApp Private Processing (security review), Trail of Bits (2025). Original
28. DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes, J. De Meulemeester et al. (2026). Original
29. Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP, B. Schlüter et al. (2026). Original
30. SEV-SNP Routing Misconfiguration (AMD-SB-3034), AMD (2026). Original
31. Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing, Z. Gu et al. (2026). Original
32. StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine, R. Zhang et al. (2026). Original
33. How Tinfoil Proves Exactly What Model Is Running, Tinfoil Team (2026). Original
34. Beyond Prompt Injection: Hacking Apple's Private Cloud Compute, D. Selmanaj (2026). Original
35. Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack, M. Shen & Y. Qin (2026). Original
36. MilanLaunchy Firmware Loader (AMD-SB-3045), AMD (2026). Original
37. Verifying AI Compute by Bounding Unexplained Information Exfiltration, J. Petrie & Y. Mühlhäuser (2026). Original
38. Verifying LLM Inference to Detect Model Weight Exfiltration, R. Rinberg et al. (2025). Original
39. Haiku to Opus in Just 10 bits: LLMs Unlock Large Compression Gains, R. Rinberg et al. (2026). Original
40. Network Traffic Hashing, Amodo Design (2026). Original
41. Technical Options for Flexible Hardware-Enabled Guarantees, J. Petrie & O. Aarne (2025). Original
42. NVIDIA Trusted Computing Solutions Release Notes (R595 TRD1), NVIDIA (2026). Original