Proposal Explorer

Add claims to see which ones the mechanisms address.

In production

• R3 TEE remote attestation for AI workloads for showing which software ran to a party that distrusts the operator holding the hardware

No new hardware needed

TEE remote attestation for AI workloads

Flaws since mitigated

• Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked) in TEE remote attestation for AI workloads ^{14 15 19 20}

Not counted

Excluded by your filters: Hardware-enabled guarantees (flexHEG) and guarantee processors and Chip registries and manufacturing records

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• TEE remote attestation for AI workloads: Independent red-team
• Hardware-enabled guarantees (flexHEG) and guarantee processors: Analysis · excluded by filters
• Chip registries and manufacturing records: Analysis · excluded by filters

Excluded by your filters

• Hardware-enabled guarantees (flexHEG) and guarantee processors Readiness R1 is below the minimum of R2.
• Chip registries and manufacturing records Readiness R1 is below the minimum of R2.

Open critical flaws

• DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop) in TEE remote attestation for AI workloads

  Critical when the verifier must resist physical access plus host control on the affected DDR5 platforms. The Intel demonstrations defeat attestation; TEE.fail's AMD demonstration extracts a guest key, not an AMD attestation key. These results do not cover every TEE architecture.

  Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges.

  • On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations.
  • On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse and Fabricked from malicious host software.

  A second team, from KU Leuven, ETH Zurich, Durham University and Google, built DDRop, an active DDR5 interposer with a bill of materials of $159. It silently drops memory writes, which memory encryption without freshness protection cannot detect. With brief physical access and control of the host software and BIOS, the researchers forced trust domains into debug mode and forged attestation reports on an up-to-date Intel TDX platform. The same primitive breaks the integrity of Scalable SGX and SEV-SNP, though the authors report no SEV-SNP attestation forgery.

  The TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation. The DDRop authors report the same position, and that both vendors issued security advisories on disclosure in September 2026. PAL*M lists this attack class as out of its scope, and Tinfoil's documentation acknowledges it. Gloria Z calls key extraction through bus interposition "relatively low-hanging fruit" in an international treaty scenario. ^{2 3 6 7 12 14 18 19}

  Demonstrated attack · Critical · Open · Mechanism-class evidence. On the record

  Related mechanism R1 Hardware-enabled guarantees (flexHEG) and guarantee processors: A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically. A pointer, not evidence that this flaw is mitigated. In the proposal.

• DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap) in TEE remote attestation for AI workloads

  Critical for the tested DDR4 SGX and SEV-SNP configurations against a physical host attacker. The authors exclude DDR5 from these demonstrations, including TDX servers; the DDR5 attacks have a separate finding.

  Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host.

  • Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time alias checks that AMD and Intel introduced against static aliasing attacks such as BadRAM. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation.
  • WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments.

  Both attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments. ^{12 13}

  Demonstrated attack · Critical · Open · Mechanism-class evidence. On the record

  Related mechanism R1 Hardware-enabled guarantees (flexHEG) and guarantee processors: A tamper-protected enclosure around the chip is the proposed answer when the party that holds the hardware may attack it physically. A pointer, not evidence that this flaw is mitigated. In the proposal.

Open significant flaws

14 flaws in 3 mechanisms

• H100 attestation not bound to a specific confidential VM in TEE remote attestation for AI workloads

  The demonstration combines a genuine H100 report with forged Intel TDX evidence. It depends on the CPU attestation already being defeated; a GPU report alone does not demonstrate that an intact CPU-to-GPU trust chain was bypassed.

  The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side. ⁶

  Demonstrated attack · Significant · Open · Mechanism-class evidence. On the record

• Side channels and other attacks by the host on CPU and GPU TEEs in TEE remote attestation for AI workloads

  The cited studies concern particular CPU and GPU platforms and attack prerequisites. StackWarp has AMD microcode patches; the open class-level entry does not mean every cited defect is unmitigated or applies to every TEE-backed implementation.

  PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope. Attestable Audits proposes revoking vulnerable enclave images. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance. New attacks of this kind continue to appear. In StackWarp, researchers at CISPA showed that a malicious hypervisor can shift the stack pointer of an SEV-SNP guest on AMD Zen 1 to Zen 5 processors with simultaneous multithreading enabled, which fully breaks the guest's integrity. AMD released microcode patches. On the GPU side, an independent analysis of NVIDIA's confidential computing by IBM Research and Ohio State University found that bulk command and data transfers are protected, but some metadata, timing behaviour and coordination signals remain in unprotected shared memory. The authors report that these can reveal computational behaviour and in some cases allow manipulation of operations. They disclosed the findings to NVIDIA. ^{1 2 3 21 22}

  Demonstrated attack · Significant · Open · Mechanism-class evidence. On the record

• Attestation covers launch state, and measurements can be incomplete in TEE remote attestation for AI workloads

  A general measurement-boundary limitation. The concrete WhatsApp configuration findings were fixed before launch; Apple's research-environment configuration flaw was also fixed. Their fixes do not remove the need to bind each deployment's runtime inputs.

  Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are "perhaps the most likely failure mode". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash "without breaking the hash function itself". Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged. ^{3 16 17 23 24}

  Theoretical argument · Significant · Open · Mechanism-class evidence. On the record

• Deployment-level attestation does not cover the whole chip in TEE remote attestation for AI workloads

  A limitation of deployment-level evidence when the claim concerns all activity on a chip. It does not defeat a narrower claim about which software served one attested request.

  An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring "the gaping hole in this plan". This matters most for negative claims such as the absence of training. ³

  Theoretical argument · Significant · Open · Mechanism-class evidence. On the record

  Related mechanism R2 On-chip telemetry from timing, memory and performance counters: On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give. A pointer, not evidence that this flaw is mitigated. Add

• Root of trust concentrated in a few hardware vendors in TEE remote attestation for AI workloads

  Vendor trust is an assumption of the attestation chain. The root-seed extraction study concerns AMD EPYC Milan and firmware downgrade with privileged host and platform-flash access; it is not evidence of the same failure on Intel, NVIDIA or all AMD generations.

  The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip. Attestable Audits notes that the approach holds only "as long as the vendor of the secure hardware is trusted". A 2026 preprint reports that a host with root control and the ability to rewrite platform flash can downgrade an AMD EPYC Milan processor to legacy security-processor firmware and extract the hardware root seed from which SEV-SNP attestation keys are derived. The authors state that this lets them forge attestation reports for any firmware version. AMD describes the firmware-loader flaw the attack starts from as a legacy attack mitigated in 2021. ^{1 3 25 26}

  Theoretical argument · Significant · Open · Mechanism-class evidence. On the record

• State attackers can likely defeat current secure enclosures in Hardware-enabled guarantees (flexHEG) and guarantee processors

  The flexHEG authors write that "nation-state attackers can likely compromise the best current secure enclosures", and that the marginal cost of circumvention per device is hard to estimate. RAND similarly judges that anti-tamper measures "would not be insurmountable for a determined and well-resourced adversary", although they raise costs and can reveal tampering. ^{28 30}

  Theoretical argument · Significant · Open. On the record

• Firmware-only retrofits rely on Secure Boot, which fault injection can bypass in Hardware-enabled guarantees (flexHEG) and guarantee processors

  Part II notes that the most common attack on Secure Boot replaces the firmware and applies a voltage glitch while the signature is being checked. It also notes that sophisticated actors may use microprobing or laser voltage probing to read key registers. ²⁸

  Theoretical argument · Significant · Open. On the record

• Many important rules cannot be checked on-chip in Hardware-enabled guarantees (flexHEG) and guarantee processors

  Malicious intent "is not a technical property observable on-chip", and misuse depends on what is done with a computation's results. A guarantee processor cannot easily tell whether a network is the whole system or one expert in a mixture-of-experts system. Part III judges that a fully local ruleset "may not be entirely feasible" for the same reason. ^{27 29}

  Theoretical argument · Significant · Open. On the record

• FLOP accounting can be laundered through external data in Hardware-enabled guarantees (flexHEG) and guarantee processors

  Results of earlier or parallel workloads could be hidden in the "external data" fed to a device, which would falsify the total FLOP count unless the inputs are explained or time delays are imposed. ²⁸

  Theoretical argument · Significant · Open. On the record

• Supply-chain diversion and hidden backdoors in Hardware-enabled guarantees (flexHEG) and guarantee processors

  Components could be diverted before a guarantee processor is added, and backdoors could be introduced during design or manufacturing. Open-source designs and physical scans of randomly selected chips are proposed as countermeasures. Part III proposes international oversight of production and extensive testing of a random sample of finished devices. ^{28 29}

  Open question · Significant · Open. On the record

  Related mechanism R1 Chip registries and manufacturing records: Records each chip's identity and owner from the fab onwards, which bears on diversion before a guarantee processor is fitted. It does not address hidden backdoors. A pointer, not evidence that this flaw is mitigated. In the proposal.

• Coverage stops at flexHEG-equipped chips in Hardware-enabled guarantees (flexHEG) and guarantee processors

  Motivated actors will always be able to use some compute that is not flexHEG-equipped. Recalling existing consumer GPUs would likely be impractical, and reaching perfect coverage, or conclusively proving that no secret government data centres exist, would be "practically quite difficult". ^{27 29}

  Open question · Significant · Open. On the record

  Related mechanism R1 Chip registries and manufacturing records: Accounts for which chips exist and who holds them. A pointer, not evidence that this flaw is mitigated. In the proposal.

  Related mechanism R1 Remote detection of data centres: Looks for undeclared facilities that hold other chips. A pointer, not evidence that this flaw is mitigated. Add

• Records cover only chips that were recorded in Chip registries and manufacturing records

  A registry or commitment accounts only for chips entered into it. Cankaya asks how a verifier would know it had found all chips, or how much "dark compute" remains, and notes that a fraudulent original record would mean unregistered chips had been made in advance. Halstead and Larsen propose reconstructing earlier production by auditing upstream suppliers. ^{35 37}

  Theoretical argument · Significant · Open. On the record

  Related mechanism R1 Remote detection of data centres: Looks for large data centres that were never declared, which a registry cannot show. A pointer, not evidence that this flaw is mitigated. Add

• Documents and serial numbers can be forged in Chip registries and manufacturing records

  Avellar and Grunewald note that export documents can be forged, that companies can hide information behind obscure corporate structures, and that it may be possible to forge serial numbers on chips and racks. They recommend cryptographic attestation of a powered-on chip as an extra check. ³⁴

  Theoretical argument · Significant · Open. On the record

• Insiders could alter records before they are fixed in Chip registries and manufacturing records

  Cankaya argues that insiders who can photograph process secrets could also tamper with production records. A commitment makes changes after publication detectable, but it cannot show that the records were accurate when committed. ³⁵

  Theoretical argument · Significant · Open. On the record

Not yet demonstrated

R1 Hardware-enabled guarantees (flexHEG) and guarantee processors and R1 Chip registries and manufacturing records

Need new chip designs

Hardware-enabled guarantees (flexHEG) and guarantee processors

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• R2 On-chip telemetry from timing, memory and performance counters Add
  • Bears on the open significant flaw “Deployment-level attestation does not cover the whole chip” in TEE remote attestation for AI workloads. On-chip counters are a proposed route to evidence about everything a chip runs, which attestation of one workload does not give.
  • TEE remote attestation for AI workloads waits on it. Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide.
• R2 Tamper evidence for verifier devices Add
  • Hardware-enabled guarantees (flexHEG) and guarantee processors waits on it. State-level attackers who hold the hardware can likely compromise the best current secure enclosures.
• R1 Remote detection of data centres Add

  Excluded by filters: readiness R1

  • Bears on the open significant flaw “Coverage stops at flexHEG-equipped chips” in Hardware-enabled guarantees (flexHEG) and guarantee processors. Looks for undeclared facilities that hold other chips.
  • Bears on the open significant flaw “Records cover only chips that were recorded” in Chip registries and manufacturing records. Looks for large data centres that were never declared, which a registry cannot show.

Blockers

13 blockers recorded

• TEE remote attestation for AI workloads
  • Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware. Hardware trust. Waits on Hardware-enabled guarantees (flexHEG) and guarantee processors ^{4 6 12 13 18 28}
  • Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide. Coverage & hidden compute. Waits on On-chip telemetry from timing, memory and performance counters ³
  • Multi-GPU and multi-node coverage is incomplete, because Hopper leaves NVLink traffic unencrypted and NVIDIA's April 2026 release notes list no multi-node confidential mode. Performance & compatibility ^{4 38}
  • Rival parties have not agreed on trust roots and key provenance they would accept. Access & governance ³
  • CPU-only enclaves are costly for large models, because in the Attestable Audits prototype CPU inference cost 21.7 times as much per token as GPU inference and the enclave roughly doubled the CPU cost. Performance & compatibility ¹
• Hardware-enabled guarantees (flexHEG) and guarantee processors
  • Integrated flexHEG needs substantial help from the accelerator manufacturer, and the authors estimate 3.7–7.9 years, from when the manufacturer starts work, for such hardware to displace other accelerators in frontier development. Access & governance ²⁸
  • State-level attackers who hold the hardware can likely compromise the best current secure enclosures. Hardware trust. Waits on Tamper evidence for verifier devices ^{28 30}
  • Rival states would need to trust the design and manufacture of guarantee processors and enclosures, for example through open design, redundant processors from each side or oversight of production. Hardware trust ^{27 29}
  • Restricting future rule updates would need a formal language for rules, which the authors judge most likely infeasible for early flexHEG versions. Protocol soundness ²⁷
  • Governing all relevant chips depends on knowing where they are, through chip registries and detection of undeclared facilities. Coverage & hidden compute. Waits on Chip registries and manufacturing records ²⁹
• Chip registries and manufacturing records
  • No AI chip registry operates, and covering re-exports would need cooperation from re-exporters and foreign governments that may not be feasible everywhere. Access & governance ^{33 34}
  • Linking records to physical chips needs hard-to-spoof unique IDs and inspections. Hardware trust ^{33 34 35}
  • Chips produced before a registry starts must be reconstructed from supplier records. Coverage & hidden compute ^{35 37}

From the family or selected implementation's record. ?

Model weights

Hidden by TEE remote attestation for AI workloads and Hardware-enabled guarantees (flexHEG) and guarantee processors.

Not involved: Chip registries and manufacturing records.

Inputs and outputs

Hidden by TEE remote attestation for AI workloads and Hardware-enabled guarantees (flexHEG) and guarantee processors.

Not involved: Chip registries and manufacturing records.

Training data

Hidden by TEE remote attestation for AI workloads and Hardware-enabled guarantees (flexHEG) and guarantee processors.

Not involved: Chip registries and manufacturing records.

TEE remote attestation for AI workloads

• R3 Apple Private Cloud Compute Product
• R2 Attestable Audits Research prototype, University of Cambridge
• R2 Cove Open-source project
• R2 PAL*M Research prototype, University of Waterloo
• R3 Tinfoil model identity (Modelwrap) Product, Tinfoil

Hardware-enabled guarantees (flexHEG) and guarantee processors

None on the map

Chip registries and manufacturing records

None on the map

1. Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments, C. Schnabl et al. (2025). Original
2. PAL*M: Property Attestation for Large Generative Models, P. Chantasantitam et al. (2026). Original
3. On TEEs for Privacy-Preserving Monitoring in AI Governance, Gloria Z (2026). Original
4. NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper), NVIDIA (2025). Original
5. Now in General Availability: NVIDIA H100 GPUs in Microsoft Azure Confidential Virtual Machines, C. Su (2024). Original
6. TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, J. Chuang et al. (2026). Original
7. A primer on secure enclaves, Tinfoil (2026). Original
8. Backend infrastructure, Tinfoil (2026). Original
9. How verification works in Tinfoil, Tinfoil (2026). Original
10. modelwrap: Reproducible dm-verity read-only image of Huggingface models, Tinfoil (2026). Original
11. Private Cloud Compute: A new frontier for AI privacy in the cloud, Apple Security Engineering and Architecture (SEAR) (2024). Original
12. Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing, J. De Meulemeester et al. (2026). Original
13. WireTap: Breaking Server SGX via DRAM Bus Interposition, A. Seto et al. (2025). Original
14. RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP, B. Schlüter & S. Shinde (2025). Original
15. SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020), AMD (2025). Original
16. What we learned about TEE security from auditing WhatsApp's Private Inference, Trail of Bits (2026). Original
17. Meta WhatsApp Private Processing (security review), Trail of Bits (2025). Original
18. DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes, J. De Meulemeester et al. (2026). Original
19. Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP, B. Schlüter et al. (2026). Original
20. SEV-SNP Routing Misconfiguration (AMD-SB-3034), AMD (2026). Original
21. Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing, Z. Gu et al. (2026). Original
22. StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine, R. Zhang et al. (2026). Original
23. How Tinfoil Proves Exactly What Model Is Running, Tinfoil Team (2026). Original
24. Beyond Prompt Injection: Hacking Apple's Private Cloud Compute, D. Selmanaj (2026). Original
25. Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack, M. Shen & Y. Qin (2026). Original
26. MilanLaunchy Firmware Loader (AMD-SB-3045), AMD (2026). Original
27. Flexible Hardware-Enabled Guarantees for AI Compute, J. Petrie et al. (2025). Original
28. Technical Options for Flexible Hardware-Enabled Guarantees, J. Petrie & O. Aarne (2025). Original
29. International Security Applications of Flexible Hardware-Enabled Guarantees, O. Aarne & J. Petrie (2025). Original
30. Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090, G. Kulp et al. (2024). Original
31. Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced Computing, O. Aarne et al. (2024). Original
32. Hardware-Enabled Mechanisms for Verifying Responsible AI Development, A. O'Gara et al. (2025). Original
33. Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment, M. Baker et al. (2025). Original
34. Near-Term Verification Methods for AI Chip Exports, B. Avellar & E. Grunewald (2026). Original
35. TSMC most definitely has a golden record of all AI chips it made, N. Cankaya (2025). Original
36. Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty Verification, S. Ansari (2026). Original
37. Covert AI Projects, B. Halstead & T. Larsen (2026). Original
38. NVIDIA Trusted Computing Solutions Release Notes (R595 TRD1), NVIDIA (2026). Original