{ "schema_version": "1.2", "url": "https://trustbutveri.fyi/explorer/?mechanisms=M-0018,M-0008&ready=R3", "data_generated": "2026-10-08", "definitions": { "methodology": "https://trustbutveri.fyi/about/methodology/", "readiness": "https://trustbutveri.fyi/about/readiness/", "filters": [ { "id": "prover", "label": "Prover", "question": "How far can the party being checked be trusted?", "options": [ { "value": "cooperative", "label": "Cooperative" }, { "value": "semi-trusted", "label": "Semi-trusted" }, { "value": "adversarial", "label": "Adversarial" } ], "rule": "Keeps mechanisms whose threat model holds against at least this prover. Adversarial is the strongest assumption.", "about": "The prover is the party being checked. Semi-trusted designs rely on part of its stack: usually the chip vendor's hardware root of trust, its firmware or counters, or its supply-chain records. Adversarial designs aim to hold even if it cheats wherever the checks allow, within their stated assumptions." }, { "id": "onsite", "label": "Verifier devices on site", "question": "May the verifier install its own hardware at the prover's sites?", "options": [ { "value": "no", "label": "Not allowed" } ], "rule": "\"Not allowed\" removes mechanisms that need a retrofit device, such as a network tap or a sealed sensor.", "about": "Some mechanisms need a device the verifier owns or trusts at the prover's facility, such as a network tap, a bandwidth limiter or a sealed sensor. Choose Not allowed when the setting rules that out. Inspectors are not covered." }, { "id": "coop", "label": "Prover cooperation", "question": "How much must the prover take part?", "options": [ { "value": "partial", "label": "Partial at most" }, { "value": "none", "label": "Not required" } ], "rule": "\"Partial at most\" removes mechanisms that need the prover's active participation. \"Not required\" keeps only those that work without it.", "about": "Required: the prover takes part, for example by logging requests, producing proofs or opening records. Partial: some access, such as installing a device. Not required: works from outside, such as satellite imagery." }, { "id": "chips", "label": "Chips", "question": "May the proposal depend on new chip designs?", "options": [ { "value": "existing", "label": "Existing chips only" } ], "rule": "\"Existing chips only\" removes mechanisms that need changes to future chip designs.", "about": "New chip features take years to reach a deployed fleet and cover only chips made after they ship. Mechanisms that use shipping features, such as trusted execution environments or performance counters, stay." }, { "id": "ready", "label": "Minimum readiness", "question": "How mature must each mechanism be?", "options": [ { "value": "R1", "label": "R1 Proposed" }, { "value": "R2", "label": "R2 Demonstrated" }, { "value": "R3", "label": "R3 In production" }, { "value": "R4", "label": "R4 Deployment-ready" } ], "rule": "Keeps mechanisms whose readiness level is at least this one.", "about": "A level describes the public evidence for a mechanism's stated use, not its cost or feasibility. R3 can still have open critical flaws." }, { "id": "tested", "label": "Attack testing", "question": "How hard has each mechanism been attacked in public?", "options": [ { "value": "analysis", "label": "Published analysis" }, { "value": "red-teamed", "label": "Red-teamed" }, { "value": "independent-red-team", "label": "Independent red-team" } ], "rule": "Keeps mechanisms whose strongest published attack testing is at least this.", "about": "The strongest published attempt to break the mechanism for its verification use: a security analysis, red-teaming by its developers or collaborators, or a red team independent of them." }, { "id": "hide", "label": "Keep hidden from the verifier", "question": "What must the verifier never see?", "options": [ { "value": "weights", "label": "Model weights" }, { "value": "io", "label": "Inputs and outputs" }, { "value": "training", "label": "Training data" } ], "rule": "Removes mechanisms that show the asset to the verifier. Conditional or unspecified exposure stays with a note and needs checking against the privacy requirement.", "about": "Model weights: the checked model's parameters. Inputs and outputs: the requests a deployed model serves and its responses. Training data: what a model was trained on. Each mechanism's exposure is the editors' reading of its record: shown, depends on the design (kept, with a note), hidden, not involved, or unspecified for a selected implementation. Code and configuration are not covered yet." } ], "exposure": "For model weights, inputs and outputs, and training data. This is the editors' reading of each mechanism's record (its threat model, how it works and its limitations), not a field of the record. Shown: the verifier sees it. Depends: on the design or variant, or the verifier sees only samples. Hidden: the verifier sees only commitments, hashes, proofs or results. Not involved: the record does not handle it. Unspecified: the selected implementation has no asset-specific assessment here.", "claim_status": { "addressed": "A mechanism in the proposal is aimed at this claim and is not excluded by the filters.", "partly-addressed": "Only supporting mechanisms, or mechanisms aimed at it that the filters exclude.", "unaddressed": "No mechanism in the proposal addresses this claim." }, "finding_scope": "Evidence scope describes where a finding was demonstrated; it does not establish applicability to every implementation in the mechanism family.", "claim_finding_scope": "open_critical_findings names active findings on the assessed records; open_critical_context names conditional family findings whose implementation applicability is unassessed.", "legacy_status": "The status field retains covered/partial/none for compatibility. It names claim links, never successful verification. Use claim_status and status_label for presentation." }, "filters": { "prover": "", "onsite": "", "coop": "", "chips": "", "ready": "R3", "tested": "", "hide": [] }, "mechanisms_passing_filters": 4, "claims": [], "mechanisms": [ { "id": "M-0018", "title": "Chip location verification", "url": "https://trustbutveri.fyi/mechanisms/chip-location-verification/", "assessment_record": { "id": "M-0018", "title": "Chip location verification", "url": "https://trustbutveri.fyi/mechanisms/chip-location-verification/" }, "selected_implementation": null, "readiness": { "level": "R1", "scope": "bounding how far a chip is from trusted landmark servers when checked", "confidence": "medium", "evidence": [ "S-1400", "S-1401", "S-3570", "S-1402", "S-1404", "S-1403", "S-0056" ] }, "assessed_properties": { "threat_model": "adversarial", "hardware_requirement": "existing-features", "prover_cooperation": "required", "adversarial_evaluation": "analysis" }, "claims": [], "exposure": { "weights": "none", "io": "none", "training": "none", "note": "Times signed replies from chips; it does not handle model data." }, "family_finding_context": [], "filter_issues": [ { "filter": "ready", "level": "exclude", "short": "readiness R1", "text": "Readiness R1 is below the minimum of R3." } ] }, { "id": "M-0008", "title": "TEE remote attestation for AI workloads", "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/", "assessment_record": { "id": "M-0008", "title": "TEE remote attestation for AI workloads", "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/" }, "selected_implementation": null, "readiness": { "level": "R3", "scope": "showing which software ran to a party that distrusts the operator holding the hardware", "confidence": "medium", "evidence": [ "S-0009", "S-0012", "S-0014", "S-1200", "S-1815", "S-1202", "S-1206", "S-1207", "S-1208", "S-1209", "S-1800", "S-1210", "S-1211", "S-1212", "S-1213", "S-3121", "S-3124", "S-3126", "S-3127", "S-3128", "S-3129" ] }, "assessed_properties": { "threat_model": "semi-trusted", "hardware_requirement": "existing-features", "prover_cooperation": "required", "adversarial_evaluation": "independent-red-team" }, "claims": [], "exposure": { "weights": "hidden", "io": "hidden", "training": "hidden", "note": "The enclave keeps what runs inside it from the host and the verifier; the verifier sees signed measurements. This relies on the chip vendor's hardware." }, "family_finding_context": [], "filter_issues": [] } ], "strengths": { "covered": [], "production": [ "M-0008" ], "adversarial": [], "noNewHardware": [ "M-0008" ], "mitigated": [ { "mech": "M-0008", "n": 3, "title": "Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked)", "kind": "demonstrated-attack", "severity": "critical", "status": "mitigated", "evidence_scope": "mechanism", "scope_note": "Critical on affected SEV-SNP platforms before the vendor fixes. These attacks need privileged host software, not physical access. Mitigated records AMD's released updates; it does not establish that a particular deployment installed or enforces them.", "related_finding": null, "description": "Researchers at ETH Zurich showed that a malicious hypervisor can corrupt the Reverse Map Table (RMP) while SEV-SNP initialises it. SEV-SNP uses the RMP to store security metadata for every DRAM page, and a single 8-byte overwrite leaves the whole table compromised. The attack needs no physical access. The authors confirmed it on Zen 3, Zen 4 and Zen 5 processors and state that it affects all AMD processors that support SEV-SNP. They demonstrated forged attestation values, debugging enabled on production confidential VMs, reads and writes of encrypted VM memory, and replay of VM register state.\nAMD assigned CVE-2025-0033. Its bulletin rates the issue medium severity and reports SEV firmware, microcode or platform firmware updates for every affected EPYC server and embedded series, with release dates from June 2025 to February 2026.\nIn Fabricked, researchers from the same ETH Zurich group showed that a host controlling the hypervisor and UEFI firmware can misconfigure the Infinity Fabric interconnect so that the AMD Secure Processor initialises SEV-SNP incorrectly. On a Zen 5 EPYC processor this gave arbitrary reads and writes in the victim VM and forged attestation reports. AMD assigned CVE-2025-54510, rates it medium severity and reports platform firmware updates for its EPYC 7003, 8004, 9004 and 9005 server series, released in November and December 2025.", "response": null, "sources": [ "S-1212", "S-1213", "S-3127", "S-3128" ] } ], "notCounted": [ "M-0018" ] }, "properties": { "covered": [], "production": [ "M-0008" ], "adversarial": [], "noNewHardware": [ "M-0008" ], "mitigated": [ { "mech": "M-0008", "n": 3, "title": "Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked)", "kind": "demonstrated-attack", "severity": "critical", "status": "mitigated", "evidence_scope": "mechanism", "scope_note": "Critical on affected SEV-SNP platforms before the vendor fixes. These attacks need privileged host software, not physical access. Mitigated records AMD's released updates; it does not establish that a particular deployment installed or enforces them.", "related_finding": null, "description": "Researchers at ETH Zurich showed that a malicious hypervisor can corrupt the Reverse Map Table (RMP) while SEV-SNP initialises it. SEV-SNP uses the RMP to store security metadata for every DRAM page, and a single 8-byte overwrite leaves the whole table compromised. The attack needs no physical access. The authors confirmed it on Zen 3, Zen 4 and Zen 5 processors and state that it affects all AMD processors that support SEV-SNP. They demonstrated forged attestation values, debugging enabled on production confidential VMs, reads and writes of encrypted VM memory, and replay of VM register state.\nAMD assigned CVE-2025-0033. Its bulletin rates the issue medium severity and reports SEV firmware, microcode or platform firmware updates for every affected EPYC server and embedded series, with release dates from June 2025 to February 2026.\nIn Fabricked, researchers from the same ETH Zurich group showed that a host controlling the hypervisor and UEFI firmware can misconfigure the Infinity Fabric interconnect so that the AMD Secure Processor initialises SEV-SNP incorrectly. On a Zen 5 EPYC processor this gave arbitrary reads and writes in the victim VM and forged attestation reports. AMD assigned CVE-2025-54510, rates it medium severity and reports platform firmware updates for its EPYC 7003, 8004, 9004 and 9005 server series, released in November and December 2025.", "response": null, "sources": [ "S-1212", "S-1213", "S-3127", "S-3128" ] } ], "notCounted": [ "M-0018" ] }, "attack_testing": [ { "id": "M-0018", "record": "M-0018", "evaluation": "analysis", "in_setting": false }, { "id": "M-0008", "record": "M-0008", "evaluation": "independent-red-team", "in_setting": true } ], "selected_implementations": {}, "weaknesses": { "gaps": [], "excluded": [ { "id": "M-0018", "issues": [ { "filter": "ready", "level": "exclude", "short": "readiness R1", "text": "Readiness R1 is below the minimum of R3." } ] } ], "unlinked": [], "critical": [ { "mech": "M-0008", "n": 1, "title": "DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop)", "kind": "demonstrated-attack", "severity": "critical", "status": "open", "evidence_scope": "mechanism", "scope_note": "Critical when the verifier must resist physical access plus host control on the affected DDR5 platforms. The Intel demonstrations defeat attestation; TEE.fail's AMD demonstration extracts a guest key, not an AMD attestation key. These results do not cover every TEE architecture.", "related_finding": null, "description": "Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges.\n- On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations.\n- On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse and Fabricked from malicious host software.\nA second team, from KU Leuven, ETH Zurich, Durham University and Google, built DDRop, an active DDR5 interposer with a bill of materials of $159. It silently drops memory writes, which memory encryption without freshness protection cannot detect. With brief physical access and control of the host software and BIOS, the researchers forced trust domains into debug mode and forged attestation reports on an up-to-date Intel TDX platform. The same primitive breaks the integrity of Scalable SGX and SEV-SNP, though the authors report no SEV-SNP attestation forgery.\nThe TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation. The DDRop authors report the same position, and that both vendors issued security advisories on disclosure in September 2026. PAL*M lists this attack class as out of its scope, and Tinfoil's documentation acknowledges it. Gloria Z calls key extraction through bus interposition \"relatively low-hanging fruit\" in an international treaty scenario.", "response": null, "sources": [ "S-1202", "S-3126", "S-0012", "S-1206", "S-0014", "S-1210", "S-1212", "S-3127" ], "helps": [ { "by": "M-0009", "how": "A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically." } ] }, { "mech": "M-0008", "n": 2, "title": "DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap)", "kind": "demonstrated-attack", "severity": "critical", "status": "open", "evidence_scope": "mechanism", "scope_note": "Critical for the tested DDR4 SGX and SEV-SNP configurations against a physical host attacker. The authors exclude DDR5 from these demonstrations, including TDX servers; the DDR5 attacks have a separate finding.", "related_finding": null, "description": "Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host.\n- Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time alias checks that AMD and Intel introduced against static aliasing attacks such as BadRAM. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation.\n- WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments.\nBoth attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments.", "response": null, "sources": [ "S-1210", "S-1211" ], "helps": [ { "by": "M-0009", "how": "A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically." } ] } ], "significant": [ { "mech": "M-0018", "n": 1, "title": "Extracting a chip's key lets another device answer for it", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "Ping-based protocols rely on cryptographic keys stored on the chip. Tee and Happel argue that an adversary with physical access could extract these keys and so compromise location verification. They propose GPU fingerprints as a mitigation, so far tested on 24 GPUs. Brass and Aarne assume the keys are stored securely, for example in a TPM.", "response": null, "sources": [ "S-1403", "S-1400" ] }, { "mech": "M-0018", "n": 2, "title": "Added delay can shift an estimated position", "kind": "demonstrated-attack", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "Brass and Aarne cite internet-geolocation research in which artificially increased round-trip times moved the estimated location by up to 1,000 km, with a 74% chance of avoiding detection. Avellar and Grunewald list inflated ping times from circuitous routing as an evasion route. Added delay only loosens a distance bound, and Brass and Aarne propose a hard time limit as the counter: a chip that replies too slowly cannot be ruled out of a restricted location.", "response": null, "sources": [ "S-1400", "S-1402" ] }, { "mech": "M-0018", "n": 3, "title": "Faster-than-assumed network paths", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "Brass and Aarne list dark fibre and other private high-speed interconnects as ways to lower measured delays artificially. They judge that leasing dark fibre would probably not be a considerable challenge for covertly or openly adversarial actors. Avellar and Grunewald note that this can make a chip appear to be somewhere else entirely. A limit set at the vacuum speed of light cannot be beaten, but it makes honest chips fail more often.", "response": null, "sources": [ "S-1400", "S-1402" ] }, { "mech": "M-0018", "n": 4, "title": "Compromised landmarks can falsify measurements", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "A party that controls landmark servers can report false timing. Brass and Aarne cite research in which manipulating a third of the landmarks shifted the estimated location by about 700 km. Avellar and Grunewald note that compromised landmarks let adversaries spoof travel-time measurements directly. The draft specification asks verifiers to require anchors in diverse places, run by several independent operators.", "response": null, "sources": [ "S-1400", "S-1402", "S-1404" ] }, { "mech": "M-0008", "n": 4, "title": "H100 attestation not bound to a specific confidential VM", "kind": "demonstrated-attack", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "The demonstration combines a genuine H100 report with forged Intel TDX evidence. It depends on the CPU attestation already being defeated; a GPU report alone does not demonstrate that an intact CPU-to-GPU trust chain was bypassed.", "related_finding": null, "description": "The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side.", "response": null, "sources": [ "S-1202" ] }, { "mech": "M-0008", "n": 5, "title": "Side channels and other attacks by the host on CPU and GPU TEEs", "kind": "demonstrated-attack", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "The cited studies concern particular CPU and GPU platforms and attack prerequisites. StackWarp has AMD microcode patches; the open class-level entry does not mean every cited defect is unmitigated or applies to every TEE-backed implementation.", "related_finding": null, "description": "PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope. Attestable Audits proposes revoking vulnerable enclave images. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance. New attacks of this kind continue to appear. In StackWarp, researchers at CISPA showed that a malicious hypervisor can shift the stack pointer of an SEV-SNP guest on AMD Zen 1 to Zen 5 processors with simultaneous multithreading enabled, which fully breaks the guest's integrity. AMD released microcode patches. On the GPU side, an independent analysis of NVIDIA's confidential computing by IBM Research and Ohio State University found that bulk command and data transfers are protected, but some metadata, timing behaviour and coordination signals remain in unprotected shared memory. The authors report that these can reveal computational behaviour and in some cases allow manipulation of operations. They disclosed the findings to NVIDIA.", "response": null, "sources": [ "S-0012", "S-0009", "S-0014", "S-3123", "S-3129" ] }, { "mech": "M-0008", "n": 6, "title": "Attestation covers launch state, and measurements can be incomplete", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "A general measurement-boundary limitation. The concrete WhatsApp configuration findings were fixed before launch; Apple's research-environment configuration flaw was also fixed. Their fixes do not remove the need to bind each deployment's runtime inputs.", "related_finding": null, "description": "Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are \"perhaps the most likely failure mode\". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash \"without breaking the hash function itself\". Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged.", "response": null, "sources": [ "S-0013", "S-0014", "S-3121", "S-3124", "S-1804" ] }, { "mech": "M-0008", "n": 7, "title": "Deployment-level attestation does not cover the whole chip", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "A limitation of deployment-level evidence when the claim concerns all activity on a chip. It does not defeat a narrower claim about which software served one attested request.", "related_finding": null, "description": "An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring \"the gaping hole in this plan\". This matters most for negative claims such as the absence of training.", "response": null, "sources": [ "S-0014" ], "helps": [ { "by": "M-0010", "how": "On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give." } ] }, { "mech": "M-0008", "n": 8, "title": "Root of trust concentrated in a few hardware vendors", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "Vendor trust is an assumption of the attestation chain. The root-seed extraction study concerns AMD EPYC Milan and firmware downgrade with privileged host and platform-flash access; it is not evidence of the same failure on Intel, NVIDIA or all AMD generations.", "related_finding": null, "description": "The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip. Attestable Audits notes that the approach holds only \"as long as the vendor of the secure hardware is trusted\". A 2026 preprint reports that a host with root control and the ability to rewrite platform flash can downgrade an AMD EPYC Milan processor to legacy security-processor firmware and extract the hardware root seed from which SEV-SNP attestation keys are derived. The authors state that this lets them forge attestation reports for any firmware version. AMD describes the firmware-loader flaw the attack starts from as a legacy attack mitigated in 2021.", "response": null, "sources": [ "S-0014", "S-0009", "S-3130", "S-3131" ] } ], "criticalMechanisms": [ "M-0008" ], "significantMechanisms": [ "M-0018", "M-0008" ], "familyContext": [], "minor": 0, "minorFindings": [], "minorBy": [], "notDemonstrated": [ "M-0018" ], "newChip": [] }, "findings": [ { "mech": "M-0018", "record": "M-0018", "n": 1, "title": "Extracting a chip's key lets another device answer for it", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "Ping-based protocols rely on cryptographic keys stored on the chip. Tee and Happel argue that an adversary with physical access could extract these keys and so compromise location verification. They propose GPU fingerprints as a mitigation, so far tested on 24 GPUs. Brass and Aarne assume the keys are stored securely, for example in a TPM.", "response": null, "sources": [ "S-1403", "S-1400" ] }, { "mech": "M-0018", "record": "M-0018", "n": 2, "title": "Added delay can shift an estimated position", "kind": "demonstrated-attack", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "Brass and Aarne cite internet-geolocation research in which artificially increased round-trip times moved the estimated location by up to 1,000 km, with a 74% chance of avoiding detection. Avellar and Grunewald list inflated ping times from circuitous routing as an evasion route. Added delay only loosens a distance bound, and Brass and Aarne propose a hard time limit as the counter: a chip that replies too slowly cannot be ruled out of a restricted location.", "response": null, "sources": [ "S-1400", "S-1402" ] }, { "mech": "M-0018", "record": "M-0018", "n": 3, "title": "Faster-than-assumed network paths", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "Brass and Aarne list dark fibre and other private high-speed interconnects as ways to lower measured delays artificially. They judge that leasing dark fibre would probably not be a considerable challenge for covertly or openly adversarial actors. Avellar and Grunewald note that this can make a chip appear to be somewhere else entirely. A limit set at the vacuum speed of light cannot be beaten, but it makes honest chips fail more often.", "response": null, "sources": [ "S-1400", "S-1402" ] }, { "mech": "M-0018", "record": "M-0018", "n": 4, "title": "Compromised landmarks can falsify measurements", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": null, "scope_note": null, "related_finding": null, "description": "A party that controls landmark servers can report false timing. Brass and Aarne cite research in which manipulating a third of the landmarks shifted the estimated location by about 700 km. Avellar and Grunewald note that compromised landmarks let adversaries spoof travel-time measurements directly. The draft specification asks verifiers to require anchors in diverse places, run by several independent operators.", "response": null, "sources": [ "S-1400", "S-1402", "S-1404" ] }, { "mech": "M-0008", "record": "M-0008", "n": 1, "title": "DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop)", "kind": "demonstrated-attack", "severity": "critical", "status": "open", "evidence_scope": "mechanism", "scope_note": "Critical when the verifier must resist physical access plus host control on the affected DDR5 platforms. The Intel demonstrations defeat attestation; TEE.fail's AMD demonstration extracts a guest key, not an AMD attestation key. These results do not cover every TEE architecture.", "related_finding": null, "description": "Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges.\n- On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations.\n- On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse and Fabricked from malicious host software.\nA second team, from KU Leuven, ETH Zurich, Durham University and Google, built DDRop, an active DDR5 interposer with a bill of materials of $159. It silently drops memory writes, which memory encryption without freshness protection cannot detect. With brief physical access and control of the host software and BIOS, the researchers forced trust domains into debug mode and forged attestation reports on an up-to-date Intel TDX platform. The same primitive breaks the integrity of Scalable SGX and SEV-SNP, though the authors report no SEV-SNP attestation forgery.\nThe TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation. The DDRop authors report the same position, and that both vendors issued security advisories on disclosure in September 2026. PAL*M lists this attack class as out of its scope, and Tinfoil's documentation acknowledges it. Gloria Z calls key extraction through bus interposition \"relatively low-hanging fruit\" in an international treaty scenario.", "response": null, "sources": [ "S-1202", "S-3126", "S-0012", "S-1206", "S-0014", "S-1210", "S-1212", "S-3127" ], "helps": [ { "by": "M-0009", "how": "A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically." } ] }, { "mech": "M-0008", "record": "M-0008", "n": 2, "title": "DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap)", "kind": "demonstrated-attack", "severity": "critical", "status": "open", "evidence_scope": "mechanism", "scope_note": "Critical for the tested DDR4 SGX and SEV-SNP configurations against a physical host attacker. The authors exclude DDR5 from these demonstrations, including TDX servers; the DDR5 attacks have a separate finding.", "related_finding": null, "description": "Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host.\n- Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time alias checks that AMD and Intel introduced against static aliasing attacks such as BadRAM. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation.\n- WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments.\nBoth attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments.", "response": null, "sources": [ "S-1210", "S-1211" ], "helps": [ { "by": "M-0009", "how": "A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically." } ] }, { "mech": "M-0008", "record": "M-0008", "n": 3, "title": "Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked)", "kind": "demonstrated-attack", "severity": "critical", "status": "mitigated", "evidence_scope": "mechanism", "scope_note": "Critical on affected SEV-SNP platforms before the vendor fixes. These attacks need privileged host software, not physical access. Mitigated records AMD's released updates; it does not establish that a particular deployment installed or enforces them.", "related_finding": null, "description": "Researchers at ETH Zurich showed that a malicious hypervisor can corrupt the Reverse Map Table (RMP) while SEV-SNP initialises it. SEV-SNP uses the RMP to store security metadata for every DRAM page, and a single 8-byte overwrite leaves the whole table compromised. The attack needs no physical access. The authors confirmed it on Zen 3, Zen 4 and Zen 5 processors and state that it affects all AMD processors that support SEV-SNP. They demonstrated forged attestation values, debugging enabled on production confidential VMs, reads and writes of encrypted VM memory, and replay of VM register state.\nAMD assigned CVE-2025-0033. Its bulletin rates the issue medium severity and reports SEV firmware, microcode or platform firmware updates for every affected EPYC server and embedded series, with release dates from June 2025 to February 2026.\nIn Fabricked, researchers from the same ETH Zurich group showed that a host controlling the hypervisor and UEFI firmware can misconfigure the Infinity Fabric interconnect so that the AMD Secure Processor initialises SEV-SNP incorrectly. On a Zen 5 EPYC processor this gave arbitrary reads and writes in the victim VM and forged attestation reports. AMD assigned CVE-2025-54510, rates it medium severity and reports platform firmware updates for its EPYC 7003, 8004, 9004 and 9005 server series, released in November and December 2025.", "response": null, "sources": [ "S-1212", "S-1213", "S-3127", "S-3128" ] }, { "mech": "M-0008", "record": "M-0008", "n": 4, "title": "H100 attestation not bound to a specific confidential VM", "kind": "demonstrated-attack", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "The demonstration combines a genuine H100 report with forged Intel TDX evidence. It depends on the CPU attestation already being defeated; a GPU report alone does not demonstrate that an intact CPU-to-GPU trust chain was bypassed.", "related_finding": null, "description": "The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side.", "response": null, "sources": [ "S-1202" ] }, { "mech": "M-0008", "record": "M-0008", "n": 5, "title": "Side channels and other attacks by the host on CPU and GPU TEEs", "kind": "demonstrated-attack", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "The cited studies concern particular CPU and GPU platforms and attack prerequisites. StackWarp has AMD microcode patches; the open class-level entry does not mean every cited defect is unmitigated or applies to every TEE-backed implementation.", "related_finding": null, "description": "PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope. Attestable Audits proposes revoking vulnerable enclave images. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance. New attacks of this kind continue to appear. In StackWarp, researchers at CISPA showed that a malicious hypervisor can shift the stack pointer of an SEV-SNP guest on AMD Zen 1 to Zen 5 processors with simultaneous multithreading enabled, which fully breaks the guest's integrity. AMD released microcode patches. On the GPU side, an independent analysis of NVIDIA's confidential computing by IBM Research and Ohio State University found that bulk command and data transfers are protected, but some metadata, timing behaviour and coordination signals remain in unprotected shared memory. The authors report that these can reveal computational behaviour and in some cases allow manipulation of operations. They disclosed the findings to NVIDIA.", "response": null, "sources": [ "S-0012", "S-0009", "S-0014", "S-3123", "S-3129" ] }, { "mech": "M-0008", "record": "M-0008", "n": 6, "title": "Attestation covers launch state, and measurements can be incomplete", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "A general measurement-boundary limitation. The concrete WhatsApp configuration findings were fixed before launch; Apple's research-environment configuration flaw was also fixed. Their fixes do not remove the need to bind each deployment's runtime inputs.", "related_finding": null, "description": "Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are \"perhaps the most likely failure mode\". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash \"without breaking the hash function itself\". Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged.", "response": null, "sources": [ "S-0013", "S-0014", "S-3121", "S-3124", "S-1804" ] }, { "mech": "M-0008", "record": "M-0008", "n": 7, "title": "Deployment-level attestation does not cover the whole chip", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "A limitation of deployment-level evidence when the claim concerns all activity on a chip. It does not defeat a narrower claim about which software served one attested request.", "related_finding": null, "description": "An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring \"the gaping hole in this plan\". This matters most for negative claims such as the absence of training.", "response": null, "sources": [ "S-0014" ], "helps": [ { "by": "M-0010", "how": "On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give." } ] }, { "mech": "M-0008", "record": "M-0008", "n": 8, "title": "Root of trust concentrated in a few hardware vendors", "kind": "theoretical-argument", "severity": "significant", "status": "open", "evidence_scope": "mechanism", "scope_note": "Vendor trust is an assumption of the attestation chain. The root-seed extraction study concerns AMD EPYC Milan and firmware downgrade with privileged host and platform-flash access; it is not evidence of the same failure on Intel, NVIDIA or all AMD generations.", "related_finding": null, "description": "The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip. Attestable Audits notes that the approach holds only \"as long as the vendor of the secure hardware is trusted\". A 2026 preprint reports that a host with root control and the ability to rewrite platform flash can downgrade an AMD EPYC Milan processor to legacy security-processor firmware and extract the hardware root seed from which SEV-SNP attestation keys are derived. The authors state that this lets them forge attestation reports for any firmware version. AMD describes the firmware-loader flaw the attack starts from as a legacy attack mitigated in 2021.", "response": null, "sources": [ "S-0014", "S-0009", "S-3130", "S-3131" ] } ], "possible_additions": [ { "id": "M-0009", "title": "Hardware-enabled guarantees (flexHEG) and guarantee processors", "url": "https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/", "readiness": "R1", "fits_filters": false, "filter_issues": [ { "filter": "ready", "level": "exclude", "short": "readiness R1", "text": "Readiness R1 is below the minimum of R3." } ], "reasons": [ { "kind": "flaw", "mech": "M-0008", "n": 1, "title": "DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop)", "severity": "critical", "how": "A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically." }, { "kind": "flaw", "mech": "M-0008", "n": 2, "title": "DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap)", "severity": "critical", "how": "A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically." }, { "kind": "blocker", "mech": "M-0008", "text": "Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware." } ] }, { "id": "M-0010", "title": "On-chip telemetry from timing, memory and performance counters", "url": "https://trustbutveri.fyi/mechanisms/on-chip-telemetry/", "readiness": "R2", "fits_filters": false, "filter_issues": [ { "filter": "ready", "level": "exclude", "short": "readiness R2", "text": "Readiness R2 is below the minimum of R3." } ], "reasons": [ { "kind": "flaw", "mech": "M-0008", "n": 7, "title": "Deployment-level attestation does not cover the whole chip", "severity": "significant", "how": "On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give." }, { "kind": "blocker", "mech": "M-0008", "text": "Negative claims such as \"no undeclared training\" need chip-wide accounting of all workloads, which attestation does not provide." } ] } ], "goal": null, "design": null, "dependencies": { "prerequisites": [], "shared": [], "blockers": [ { "mech": "M-0018", "n": 1, "text": "No public code or reproducible end-to-end location results are available for the reported H100 prototype.", "theme": "adversarial-validation", "blocked_by": null, "sources": [ "S-1401", "S-3570" ], "inProposal": null }, { "mech": "M-0018", "n": 2, "text": "Per-chip keys must be provisioned and protected against extraction; hardware-integrated, tamper-resistant versions still need R&D.", "theme": "hardware-trust", "blocked_by": null, "sources": [ "S-1400", "S-1403", "S-0007" ], "inProposal": null }, { "mech": "M-0018", "n": 3, "text": "The time limit forces a trade-off: a limit at the speed of light in fibre can be beaten by faster links, while one at the vacuum speed of light makes honest chips fail often.", "theme": "protocol-soundness", "blocked_by": null, "sources": [ "S-1400" ], "inProposal": null }, { "mech": "M-0018", "n": 4, "text": "A trusted landmark network must be built and secured, and who should operate it, under what oversight, is unsettled.", "theme": "access-governance", "blocked_by": null, "sources": [ "S-1400", "S-1402" ], "inProposal": null }, { "mech": "M-0008", "n": 1, "text": "Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware.", "theme": "hardware-trust", "blocked_by": "M-0009", "sources": [ "S-1200", "S-1204", "S-1202", "S-3126", "S-1210", "S-1211" ], "inProposal": false }, { "mech": "M-0008", "n": 2, "text": "Negative claims such as \"no undeclared training\" need chip-wide accounting of all workloads, which attestation does not provide.", "theme": "coverage-hidden-compute", "blocked_by": "M-0010", "sources": [ "S-0014" ], "inProposal": false }, { "mech": "M-0008", "n": 3, "text": "Multi-GPU and multi-node coverage is incomplete, because Hopper leaves NVLink traffic unencrypted and NVIDIA's April 2026 release notes list no multi-node confidential mode.", "theme": "performance-compatibility", "blocked_by": null, "sources": [ "S-1200", "S-3122" ], "inProposal": null }, { "mech": "M-0008", "n": 4, "text": "Rival parties have not agreed on trust roots and key provenance they would accept.", "theme": "access-governance", "blocked_by": null, "sources": [ "S-0014" ], "inProposal": null }, { "mech": "M-0008", "n": 5, "text": "CPU-only enclaves are costly for large models, because in the Attestable Audits prototype CPU inference cost 21.7 times as much per token as GPU inference and the enclave roughly doubled the CPU cost.", "theme": "performance-compatibility", "blocked_by": null, "sources": [ "S-0009" ], "inProposal": null } ] }, "exposure": { "weights": { "shown": [], "partial": [], "hidden": [ "M-0008" ], "none": [ "M-0018" ], "unknown": [] }, "io": { "shown": [], "partial": [], "hidden": [ "M-0008" ], "none": [ "M-0018" ], "unknown": [] }, "training": { "shown": [], "partial": [], "hidden": [ "M-0008" ], "none": [ "M-0018" ], "unknown": [] } }, "implementations": [ { "mechanism": "M-0018", "selected": null, "implementations": [ { "id": "I-0009", "title": "Lucid sovereignty (location) certificates", "url": "https://trustbutveri.fyi/implementations/lucid-location-certificates/" } ] }, { "mechanism": "M-0008", "selected": null, "implementations": [ { "id": "I-0013", "title": "Apple Private Cloud Compute", "url": "https://trustbutveri.fyi/implementations/apple-private-cloud-compute/" }, { "id": "I-0007", "title": "Attestable Audits", "url": "https://trustbutveri.fyi/implementations/attestable-audits/" }, { "id": "I-0023", "title": "Cove", "url": "https://trustbutveri.fyi/implementations/cove/" }, { "id": "I-0022", "title": "PAL*M", "url": "https://trustbutveri.fyi/implementations/palm/" }, { "id": "I-0006", "title": "Tinfoil model identity (Modelwrap)", "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/" } ] } ], "sources": [ { "id": "S-1400", "title": "Location Verification for AI Chips", "authors": "A. Brass & O. Aarne", "year": 2024, "url": "https://www.iaps.ai/research/location-verification-for-ai-chips", "path": "/sources/brass-location-verification-ai-chips/" }, { "id": "S-1401", "title": "Location Verification for AI Chips (issue brief)", "authors": "A. Brass", "year": 2025, "url": "https://static1.squarespace.com/static/64edf8e7f2b10d716b5ba0e1/t/6827b67275666f3757f134ea/1747433075281/Location+Verification+two-pager.pdf", "path": "/sources/brass-location-verification-issue-brief/" }, { "id": "S-3570", "title": "Ping-based Location", "authors": "Ulyssean", "year": 2025, "url": "https://ping-location.info/", "path": "/sources/ulyssean-ping-based-location-demo/" }, { "id": "S-1402", "title": "Near-Term Verification Methods for AI Chip Exports", "authors": "B. Avellar & E. Grunewald", "year": 2026, "url": "https://www.iaps.ai/research/near-term-verification-methods-for-ai-chip-exports", "path": "/sources/avellar-near-term-verification-ai-chip-exports/" }, { "id": "S-1404", "title": "Sovereignty Certificates: draft specification, version 0.1.0", "authors": "Sovereignty Certificates Working Group", "year": 2025, "url": "https://github.com/Lucid-Computing/sovereignty-certificate-specification", "path": "/sources/sovereignty-certificates-specification/" }, { "id": "S-1403", "title": "GPU Fingerprinting for Location Verification", "authors": "W. Tee & J. Happel", "year": 2026, "url": "https://arxiv.org/abs/2605.01930", "path": "/sources/tee-gpu-fingerprinting-location-verification/" }, { "id": "S-0056", "title": "Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced Computing", "authors": "O. Aarne et al.", "year": 2024, "url": "https://www.cnas.org/publications/reports/secure-governable-chips", "path": "/sources/aarne-secure-governable-chips/" }, { "id": "S-0009", "title": "Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments", "authors": "C. Schnabl et al.", "year": 2025, "url": "https://arxiv.org/abs/2506.23706", "path": "/sources/schnabl-attestable-audits/" }, { "id": "S-0012", "title": "PAL*M: Property Attestation for Large Generative Models", "authors": "P. Chantasantitam et al.", "year": 2026, "url": "https://arxiv.org/abs/2601.16199", "path": "/sources/chantasantitam-palm/" }, { "id": "S-0014", "title": "On TEEs for Privacy-Preserving Monitoring in AI Governance", "authors": "Gloria Z", "year": 2026, "url": "https://techgov.intelligence.org/blog/on-tees-for-privacy-preserving-monitoring-in-ai-governance", "path": "/sources/zhao-tees-privacy-preserving-monitoring/" }, { "id": "S-1200", "title": "NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper)", "authors": "NVIDIA", "year": 2025, "url": "https://docs.nvidia.com/nvidia-secure-ai-with-blackwell-and-hopper-gpus-whitepaper.pdf", "path": "/sources/nvidia-secure-ai-blackwell-hopper-whitepaper/" }, { "id": "S-1815", "title": "Now in General Availability: NVIDIA H100 GPUs in Microsoft Azure Confidential Virtual Machines", "authors": "C. Su", "year": 2024, "url": "https://blogs.nvidia.com/blog/azure-confidential-vm-h100-general-availability", "path": "/sources/nvidia-azure-confidential-h100-ga/" }, { "id": "S-1202", "title": "TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition", "authors": "J. Chuang et al.", "year": 2026, "url": "https://tee.fail/", "path": "/sources/chuang-tee-fail/" }, { "id": "S-1206", "title": "A primer on secure enclaves", "authors": "Tinfoil", "year": 2026, "url": "https://docs.tinfoil.sh/verification/secure-enclave-primer", "path": "/sources/tinfoil-docs-secure-enclave-primer/" }, { "id": "S-1207", "title": "Backend infrastructure", "authors": "Tinfoil", "year": 2026, "url": "https://docs.tinfoil.sh/verification/attestation-architecture", "path": "/sources/tinfoil-docs-attestation-architecture/" }, { "id": "S-1208", "title": "How verification works in Tinfoil", "authors": "Tinfoil", "year": 2026, "url": "https://docs.tinfoil.sh/verification/verification-in-tinfoil", "path": "/sources/tinfoil-docs-verification-in-tinfoil/" }, { "id": "S-1209", "title": "modelwrap: Reproducible dm-verity read-only image of Huggingface models", "authors": "Tinfoil", "year": 2026, "url": "https://github.com/tinfoilsh/modelwrap", "path": "/sources/tinfoil-modelwrap-code/" }, { "id": "S-1800", "title": "Private Cloud Compute: A new frontier for AI privacy in the cloud", "authors": "Apple Security Engineering and Architecture (SEAR)", "year": 2024, "url": "https://security.apple.com/blog/private-cloud-compute/", "path": "/sources/apple-private-cloud-compute-2024/" }, { "id": "S-1210", "title": "Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing", "authors": "J. De Meulemeester et al.", "year": 2026, "url": "https://batteringram.eu/", "path": "/sources/de-meulemeester-battering-ram/" }, { "id": "S-1211", "title": "WireTap: Breaking Server SGX via DRAM Bus Interposition", "authors": "A. Seto et al.", "year": 2025, "url": "https://wiretap.fail/", "path": "/sources/seto-wiretap/" }, { "id": "S-1212", "title": "RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP", "authors": "B. Schlüter & S. Shinde", "year": 2025, "url": "https://rmpocalypse.github.io/", "path": "/sources/schluter-rmpocalypse/" }, { "id": "S-1213", "title": "SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020)", "authors": "AMD", "year": 2025, "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3020.html", "path": "/sources/amd-sb-3020-rmp-initialization/" }, { "id": "S-3121", "title": "What we learned about TEE security from auditing WhatsApp's Private Inference", "authors": "Trail of Bits", "year": 2026, "url": "https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/", "path": "/sources/trailofbits-whatsapp-private-inference-audit/" }, { "id": "S-3124", "title": "Meta WhatsApp Private Processing (security review)", "authors": "Trail of Bits", "year": 2025, "url": "https://trailofbits.com/library/meta-whatsapp-private-processing/", "path": "/sources/trailofbits-meta-whatsapp-private-processing-review/" }, { "id": "S-3126", "title": "DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes", "authors": "J. De Meulemeester et al.", "year": 2026, "url": "https://ddropattack.eu/", "path": "/sources/de-meulemeester-ddrop/" }, { "id": "S-3127", "title": "Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP", "authors": "B. Schlüter et al.", "year": 2026, "url": "https://www.usenix.org/conference/usenixsecurity26/presentation/schlueter-1", "path": "/sources/schluter-fabricked/" }, { "id": "S-3128", "title": "SEV-SNP Routing Misconfiguration (AMD-SB-3034)", "authors": "AMD", "year": 2026, "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3034.html", "path": "/sources/amd-sb-3034-sev-snp-routing/" }, { "id": "S-3129", "title": "Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing", "authors": "Z. Gu et al.", "year": 2026, "url": "https://arxiv.org/abs/2507.02770", "path": "/sources/gu-security-look-nvidia-gpu-cc/" }, { "id": "S-3123", "title": "StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine", "authors": "R. Zhang et al.", "year": 2026, "url": "https://www.usenix.org/conference/usenixsecurity26/presentation/zhang-ruiyi", "path": "/sources/zhang-stackwarp/" }, { "id": "S-0013", "title": "How Tinfoil Proves Exactly What Model Is Running", "authors": "Tinfoil Team", "year": 2026, "url": "https://tinfoil.sh/blog/2026-02-03-proving-model-identity", "path": "/sources/tinfoil-proving-model-identity/" }, { "id": "S-1804", "title": "Beyond Prompt Injection: Hacking Apple's Private Cloud Compute", "authors": "D. Selmanaj", "year": 2026, "url": "https://blog.sentry.security/beyond-prompt-injection-hacking-apples-private-cloud-compute/", "path": "/sources/selmanaj-hacking-apple-pcc/" }, { "id": "S-3130", "title": "Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack", "authors": "M. Shen & Y. Qin", "year": 2026, "url": "https://arxiv.org/abs/2605.12990", "path": "/sources/shen-vcek-seed-milan/" }, { "id": "S-3131", "title": "MilanLaunchy Firmware Loader (AMD-SB-3045)", "authors": "AMD", "year": 2026, "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3045.html", "path": "/sources/amd-sb-3045-milanlaunchy/" }, { "id": "S-0007", "title": "Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty Verification", "authors": "S. Ansari", "year": 2026, "url": "https://arxiv.org/abs/2604.04712", "path": "/sources/ansari-hardware-level-governance-ai-compute/" }, { "id": "S-1204", "title": "Technical Options for Flexible Hardware-Enabled Guarantees", "authors": "J. Petrie & O. Aarne", "year": 2025, "url": "https://arxiv.org/abs/2506.03409", "path": "/sources/petrie-technical-options-flexheg/" }, { "id": "S-3122", "title": "NVIDIA Trusted Computing Solutions Release Notes (R595 TRD1)", "authors": "NVIDIA", "year": 2026, "url": "https://docs.nvidia.com/595trd1-trusted-computing-solutions-release-notes.pdf", "path": "/sources/nvidia-trusted-computing-r595-release-notes/" } ] }