Implementation · PAL*M · Draft
Evidence & limits
On this page
R2Demonstrated for attesting declared model operations on a confidential CPU–GPU prototype
Published end-to-end experiments specify operations, models, datasets and commercial hardware.
- R1 met: the paper defines measured properties, the attestation protocol and the host adversary 1.
- R2 met through reproducible published results on Intel TDX and an H100, including training, fine-tuning, evaluation and inference. The code is planned for release after peer review 1.
- R3 not met: the paper describes a research prototype and does not document a production service or another party's reliance on its attestations 1.
Assessed use: attesting declared model operations on a confidential CPU–GPU prototype
Rubric assessment
- A production-grade, available property-attestation implementation, or documented reliance by another party on its attestations.
Assessed 2026-10-08 against rubric v1.1.
Evidence
- The prototype uses Intel TDX and an H100 NVL with confidential computing enabled. Experiments average five runs 1.
- Evaluation and inference experiments use Llama-3.1-8B, Gemma-3-4B and Phi-4-Mini. Training uses the 124-million-parameter GPT-2 1.
- MMLU evaluation overhead was 0.93–2.46% of total instrumented runtime with in-memory data and 7.69–11.24% with memory-mapped data. The comparison is with the same TDX environment without PAL*M measurement 1.
- The authors model the protocol in Tamarin under their stated adversary assumptions. They plan to release the prototype after peer review 1.
Limitations
The design trusts the TDX module, CPU and H100 hardware while treating the host software and external storage as hostile. It excludes denial of service, physical attacks and side-channel attacks 1. Costs vary by operation. Memory-mapped dataset preprocessing and attribute-distribution overhead accounted for 37.64–42.50% of total instrumented runtime. Single-prompt inference took 1.8–3 times its baseline 1.
Known flaws
Blockers
The paper plans prototype code release after peer review.
Overhead in memory-mapped dataset preprocessing and attribute-distribution experiments accounted for 37.64–42.50% of total instrumented runtime.