TEE remote attestation for AI workloads

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.

Also called Confidential computing; GPU confidential computing; Remote attestation; Confidential VM attestation

R2Demonstrated ⚠ Open critical flaw Provider-reported

Summary

TEE remote attestation lets a remote party check which software processed an AI workload. A trusted execution environment (TEE) isolates a workload from the machine's operator and signs a report of the code and configuration it loaded. NVIDIA's Hopper and Blackwell GPUs support this when paired with Intel TDX or AMD SEV-SNP confidential virtual machines. Research prototypes use it to show which model produced a result without revealing weights, and Tinfoil reports running a production inference service on it. It is not ready for verification between rival states, where the party being checked holds the hardware. The chip vendors treat sophisticated physical attacks as out of scope. Independent researchers with memory-bus devices costing under $50 to under $1000 forged Intel and AMD attestations, and a software-only attack forged AMD attestations until AMD patched it. An attestation covers one deployment at launch, and trust rests on a few hardware vendors.

ReadinessR2Demonstratedmedium confidence · rubric v1.0 · 2026-09-23

R2. Working implementations run on current GPUs, but the independent evaluations left critical flaws open. Assessed for verification by a party that does not trust the operator, including one that physically holds the hardware, and not for commercial confidentiality against software-only attackers.

Rubric assessment

R1 met: designs with stated claims and assumptions are published for audits, property attestation and policy enforcement ⁸ ⁹ ¹¹.
R2 met through Tinfoil's model-identity chain. It is an open-source production deployment on NVIDIA H100, H200 or B200 GPUs with AMD SEV-SNP or Intel TDX (provider-reported) ¹⁸ ²⁰ ²¹. Attestable Audits and PAL*M add end-to-end results against stated adversaries ⁸ ⁹.
R3 not met. The first criterion, production-grade availability, holds in the commercial sense, because GPU confidential computing is a documented product feature ¹. The second criterion fails. The independent public evaluations (TEE.fail, Battering RAM, WireTap and RMPocalypse) all found critical flaws, and the three that need physical access remain open. TEE.fail used physical access, root privileges and under $1000 of equipment to extract a CPU's Intel attestation signing key and forge TDX attestations. Paired with relayed H100 attestations, the forgeries let a workload outside TEE protection pass both checks ³. On DDR4 servers, Battering RAM and WireTap forged SGX attestations with interposers costing under $50 and under $1000, and Battering RAM also broke SEV-SNP attestation ⁴ ⁵. These physical attacks defeat the main claim when the prover controls the hardware. NVIDIA lists sophisticated physical attacks as out of scope ¹. Intel and AMD treat interposer and other physical attacks on memory as out of scope, according to the researchers ³ ⁴ ⁵. RMPocalypse forged SEV-SNP attestations from a malicious hypervisor, with no physical access ⁶. AMD reports firmware fixes for it ⁷. The breaks do not invalidate the R2 evidence, which concerns working implementations on realistic hardware.

Gaps to the next level

Attestation that survives an attacker who physically holds the hardware, for example through memory integrity and freshness protection or tamper-responsive enclosures, confirmed by independent red-teaming.
GPU attestation cryptographically bound to the specific confidential VM it serves.
Coverage of whole-chip and multi-node activity, beyond a single deployment.
Roots of trust and key provenance that rival parties accept, beyond one vendor's certificate authority.
Measurement of runtime configuration as well as launch state.

How it works

A trusted execution environment (TEE) is a hardware-enforced boundary around a computation. TEEs aim to protect confidentiality and integrity even from an attacker who controls all of the host's software ³. In a confidential virtual machine (CVM), the CPU encrypts the VM's memory so that the hypervisor and other privileged software cannot read or tamper with it ¹⁹.

The hardware measures each piece of software before it runs. It signs a report of those measurements with keys that chain to the manufacturer ¹⁸. A remote verifier checks the signature chain back to the vendor's root certificate. It then compares the measurements with expected values, which may come from reproducible builds published to a transparency log ¹⁹.

NVIDIA extends attestation to its GPUs. In NVIDIA's description, an on-die root of trust checks the GPU's fused identity key and permits only signed firmware. The driver then opens an authenticated session with the GPU and obtains a signed attestation report ¹ ². The GPU must be paired with a CPU TEE, either Intel TDX or AMD SEV, and NVIDIA recommends SEV-SNP ¹.

Other designs attest the accelerator alone. GuardAIn gives a discrete neural processing unit (NPU) measured boot and task attestation without relying on a CPU TEE ¹².

Several verification schemes build on these reports:

Attestable Audits has the model provider and the auditor each send encrypted inputs to an enclave. The enclave runs the audit and publishes an attestation that links the model hash, the audit and the result. Later inference is checked against the audited hash ⁸.
PAL*M attests dataset, training, fine-tuning, evaluation and inference operations on Intel TDX with an H100 ⁹.
Tinfoil binds the served weights to the attestation, as described under Model identity attestation ¹⁰.
Gloria Z proposes running auditable, reproducibly built software inside a CVM to enforce access control, audit logging and safety classifiers ¹¹.
The Future of Life Institute (FLI) and Mithril Security built an Intel SGX proof of concept for leasing a model with protected weights, usage telemetry and an off-switch ¹⁶.

What it establishes

An attestation can show two things, provided the hardware is sound and the vendor's keys are not compromised:

A specific, measured software stack produced a given output from inputs identified by hash ⁹.
The stack ran on genuine vendor hardware in confidential mode ¹⁹.

This supports positive claims, such as which model answered (The declared model is the one being served) or which policy code wrapped it (Declared safeguards were applied during inference).

An attestation has three gaps:

It reflects the launch state, so it does not cover weights or other data loaded afterwards. These must be bound separately ¹⁰.
It does not cover anything that was never measured. Gloria Z calls gaps in measuring feature flags, environment variables and invocation arguments "perhaps the most likely failure mode" ¹¹.
It covers one deployment, not everything the chip does ¹¹. Chip-level signals that bear on negative claims, such as that no training happened, are covered in On-chip telemetry from timing, memory and performance counters and Workload classification from telemetry and side channels.

Threat model

TEE designs treat the operator's software as hostile, including the host operating system, the hypervisor and the cloud stack ¹⁸ ⁹. They trust the hardware and its vendor ¹⁸ ⁸. Each vendor and research design lists attacks it does not defend against:

NVIDIA lists software, basic physical, rollback, cryptographic and replay attacks as in scope. Sophisticated physical attacks and denial of service are out of scope ¹.
Intel and AMD consider memory-bus interposer attacks and other physical attacks on memory out of scope, according to the TEE.fail, Battering RAM and WireTap authors ³ ⁴ ⁵.
PAL*M excludes side channels and physical attacks such as memory-bus interposition or swapping GPUs ⁹.
GuardAIn excludes side channels and denial of service ¹².

International verification faces a stronger adversary. Gloria Z describes it as a nation-state that may have advance physical access to data centres and leverage over hardware vendors ¹¹. Other analysts also doubt that TEEs hold up against physical access:

The flexHEG authors judge TEE-backed software "probably not secure against sophisticated actors if they have unrestricted physical access" ¹⁷.
The Center for a New American Security (CNAS) says existing features need hardening before they can be relied on in adversarial settings ¹⁴.
RAND notes that an attacker with physical access may be able to extract both the keys and the protected data ¹⁵.

Evidence

NVIDIA documents confidential computing for Hopper and Blackwell GPUs ¹.
Tinfoil reports support for H100, H200 and B200 GPUs ¹⁸ and a production inference deployment ²⁰. Its model-identity tool is open source ²¹.
PAL*M reports under 11% overhead for common operations on Intel TDX with an H100. For inference attestation across three models, total observed overhead was 3.8–11.4% for multi-turn sessions and 45.5–66.4% for single prompts. Its code is "to be released after peer review" ⁹.
Attestable Audits ran its prototype on CPU-only AWS Nitro Enclaves with a 4-bit Llama-3.1-8B. CPU inference cost 21.7 times as much per token as GPU inference, and the enclave roughly doubled the CPU cost. The authors expect a production version on confidential-computing GPUs to have "an overhead as small as 5×" ⁸.
GuardAIn reports under 0.1% inference overhead for Llama variants on a Huawei Ascend 910A ¹².
FLI and Mithril call their SGX prototype "not necessarily deployable as is", because of performance and hardware attacks that need mitigation ¹⁶.

Limitations

A physical attacker can forge attestations. In TEE.fail, independent researchers with physical access, root privileges and equipment costing under $1000 extracted a per-CPU Intel attestation signing key from an up-to-date machine and forged TDX attestations. They paired the forgeries with genuine H100 attestations relayed from rented hardware, and a workload outside TEE protection passed both checks ³. On DDR4 servers, Battering RAM and WireTap forged SGX attestations with interposers costing under $50 and under $1000, and Battering RAM also broke AMD SEV-SNP attestation ⁴ ⁵.
A software attacker has forged attestations too. In RMPocalypse, a malicious hypervisor faked SEV-SNP attestation on Zen 3, Zen 4 and Zen 5 processors without physical access ⁶. AMD reports firmware fixes ⁷.
Software side channels remain. PAL*M and Attestable Audits cite earlier software attacks on CPU TEEs ⁹ ⁸. NVIDIA disables performance counters in confidential mode because they could provide an avenue for side-channel attacks ¹. Gloria Z notes that counters have leaked secrets from TEEs ¹¹.
Coverage of large systems is incomplete. Hopper does not encrypt NVLink, and in mid-2025 NVIDIA's early-access release lacked multi-node support ¹ ¹⁷. O'Gara et al. ask what changes would be needed to use TEEs for verifying AI training at scale ¹³.
The root of trust rests with a few vendors (AMD, Intel and NVIDIA) ¹¹.

Known flaws

Published flaws, with their severity, kind and status. How flaws are rated.

DDR5 memory-bus interposer forges Intel TDX attestations and leaks SEV-SNP secrets (TEE.fail)CriticalDemonstrated attackOpen
Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges ³.
- On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations ³.
- On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key ³. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse from a malicious hypervisor ⁴ ⁶.
The TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation ³. PAL*M lists this attack class as out of its scope ⁹, and Tinfoil's documentation acknowledges it ¹⁸. Gloria Z calls key extraction through bus interposition "relatively low-hanging fruit" in an international treaty scenario ¹¹.
DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap)CriticalDemonstrated attackOpen
Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host ⁴ ⁵.
- Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time firmware mitigations that AMD and Intel introduced against software-based aliasing attacks. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation ⁴.
- WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments ⁵.
Both attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work ⁴ ⁵. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products ⁴. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments ⁵.
Software-only forgery of SEV-SNP attestation (RMPocalypse)CriticalDemonstrated attackMitigated
Researchers at ETH Zurich showed that a malicious hypervisor can corrupt the Reverse Map Table (RMP) while SEV-SNP initialises it. SEV-SNP uses the RMP to store security metadata for every DRAM page, and a single 8-byte overwrite leaves the whole table compromised. The attack needs no physical access. The authors confirmed it on Zen 3, Zen 4 and Zen 5 processors and state that it affects all AMD processors that support SEV-SNP. They demonstrated forged attestation values, debugging enabled on production confidential VMs, reads and writes of encrypted VM memory, and replay of VM register state ⁶.

AMD assigned CVE-2025-0033 ⁶. Its bulletin rates the issue medium severity and reports SEV firmware, microcode or platform firmware updates for every affected EPYC server and embedded series, with release dates from June 2025 to February 2026 ⁷.
H100 attestation not bound to a specific confidential VMSignificantDemonstrated attackOpen
The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side ³.
Software side channels and controlled-channel attacks on CPU TEEsSignificantDemonstrated attackOpen
PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope ⁹. Attestable Audits proposes revoking vulnerable enclave images ⁸. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance ¹¹.
Attestation covers launch state, and measurements can be incompleteSignificantTheoretical argumentOpen
Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately ¹⁰. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are "perhaps the most likely failure mode". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash "without breaking the hash function itself" ¹¹.
Deployment-level attestation does not cover the whole chipSignificantTheoretical argumentOpen
An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring "the gaping hole in this plan" ¹¹. This matters most for negative claims such as the absence of training.
Root of trust concentrated in a few hardware vendorsSignificantTheoretical argumentOpen
The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip ¹¹. Attestable Audits notes that the approach holds only "as long as the vendor of the secure hardware is trusted" ⁸.

Blockers

Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware.

Hardware trustBlocked by: Hardware-enabled guarantees (flexHEG) and guarantee processors [1][17][3][4][5]
Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide.

Coverage & hidden computeBlocked by: On-chip telemetry from timing, memory and performance counters [11]
Multi-GPU and multi-node coverage is incomplete, because Hopper leaves NVLink traffic unencrypted and NVIDIA's early-access release supported only single nodes in mid-2025.

Performance & compatibility[1][17]
Rival parties have not agreed on trust roots and key provenance they would accept.

Access & governance[11]
CPU-only enclaves are costly for large models, because in the Attestable Audits prototype CPU inference cost 21.7 times as much per token as GPU inference and the enclave roughly doubled the CPU cost.

Performance & compatibility[8]

Technical detail

Show technical detail

NVIDIA describes the GPU attestation chain as follows. An on-die root of trust verifies the identity key fused into the GPU and permits only NVIDIA-signed firmware at boot. The driver then opens an SPDM session with the GPU, using a Diffie-Hellman exchange to set up a session key ¹. The GPU presents a device identity certificate signed with a device-unique ECC-384 key, which chains to the NVIDIA certificate authority. It then returns a signed set of measurements ².

Other details of NVIDIA's design:

Traffic between the confidential VM and the GPU is protected with AES-GCM through encrypted bounce buffers. NVIDIA states that in future, hosts with TDISP/IDE-compatible CPUs and Blackwell B100/B200 GPUs can use inline encryption instead ¹.
Hopper's protected-PCIe mode passes all eight GPUs of an HGX node to one confidential VM, but NVLink traffic between them stays unencrypted. Blackwell also encrypts NVLink, for up to eight GPUs per confidential VM ¹.
Performance counters are disabled in full CC-On mode. They are available only in a CC-DevTools development mode ¹.
At launch, NVIDIA reported that H100 compute and HBM bandwidth were at par with non-confidential mode. CPU–GPU transfers were limited to roughly 4 GB/s by CPU encryption ².

Three systems bind application data to a report:

PAL*M sets the Intel TDX REPORTDATA field to the concatenation of the operation, a verifier challenge and hashes of the inputs and outputs. It models the protocol in the Tamarin prover ⁹.
Attestable Audits publishes attestations that bind the model hash, the audit code and data, and the result to a transparency log ⁸.
Tinfoil puts a dm-verity root hash of the weights on the measured kernel command line ¹⁰.

Sources

BNVIDIA (2025). NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper). NVIDIA documentation. Source recordSupports: GPU CC architecture, CPU-TEE pairing, multi-GPU modes, threat model scope, performance counters in CC mode and NVIDIA's side-channel reason · pp. 6-18
CE. Apsey et al. (2023). Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AI. NVIDIA Technical Blog. Source recordSupports: H100 root of trust, device identity key, attestation report, launch performance · blog, sections on root of trust and performance
AJ. Chuang et al. (2026). TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition. 2026 IEEE Symposium on Security and Privacy (SP). Source recordSupports: TEE design aim; memory-bus interposition attack; Intel PCK extraction and forged SGX/TDX attestations; SEV-SNP OpenSSL key recovery; H100 attestation relay; disclosure and vendor positions · Abstract; §1.1-1.2; §3; §8.3; §10.2; site FAQ
AJ. De Meulemeester et al. (2026). Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing. 47th IEEE Symposium on Security and Privacy (S&P 2026). Source recordSupports: Battering RAM: DDR4 interposer cost; Scalable SGX plaintext access and provisioning-key extraction; SEV-SNP attestation breach by launch-digest replay; DDR4-only scope; Intel and AMD positions · Abstract; §1 contributions; site FAQ
AA. Seto et al. (2025). WireTap: Breaking Server SGX via DRAM Bus Interposition. 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25). Source recordSupports: WireTap: DDR4 interposer cost; extraction of the SGX Quoting Enclave attestation key and forged quotes; DDR5 Xeons not affected; Intel position and mitigation · Abstract; site FAQ
AB. Schlüter & S. Shinde (2025). RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP. 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25). Source recordSupports: RMPocalypse: software-only RMP corruption by a malicious hypervisor; forged SEV-SNP attestation, debug, memory access and register replay; affected Zen generations; CVE · Abstract; site; responsible disclosure
BAMD (2025). SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020). AMD product security bulletin. Source recordSupports: AMD's severity rating and firmware mitigations for CVE-2025-0033 (vendor-reported) · Mitigation tables; revision history
BC. Schnabl et al. (2025). Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments. ICML 2025 Workshop on Technical AI Governance. Source recordSupports: audit protocol, AWS Nitro prototype, overheads, vendor trust, cited TEE attacks and image revocation · §2, §3, §5 Table 2, §7
BP. Chantasantitam et al. (2026). PAL*M: Property Attestation for Large Generative Models. arXiv. Source recordSupports: property attestation on TDX + H100, REPORTDATA binding, overheads, threat model exclusions, code status · Abstract; §3-§6, Tables 2-6
CTinfoil Team (2026). How Tinfoil Proves Exactly What Model Is Running. Tinfoil. Source recordSupports: launch-state vs runtime; dm-verity weight binding · sections on the challenge and the three phases
CGloria Z (2026). On TEEs for Privacy-Preserving Monitoring in AI Governance. MIRI Technical Governance Team. Source recordSupports: international threat model, vendor root of trust, measurement incompleteness, hashing-scheme warning, deployment vs chip-wide gap, process-level enforcement, counter side channels
AA. Dhar et al. (2025). GuardAIn: Protecting Emerging Generative AI Workloads on Heterogeneous NPU. 2025 IEEE Symposium on Security and Privacy. Source recordSupports: device-only NPU TEE with task attestation; overheads; threat model · Abstract; threat model; evaluation
BA. O'Gara et al. (2025). Hardware-Enabled Mechanisms for Verifying Responsible AI Development. arXiv. Source recordSupports: open question on TEEs for verifying AI training at scale · §2.2.4
BO. Aarne et al. (2024). Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced Computing. Center for a New American Security. Source recordSupports: existing technologies need hardening for adversarial settings · Key findings
BG. Kulp et al. (2024). Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090. RAND Corporation. Source recordSupports: physical-access key extraction caveat for encrypted memory · p. 20
CFuture of Life Institute (2023). Exploration of secure hardware solutions for safe AI deployment. Future of Life Institute. Source recordSupports: FLI and Mithril SGX proof-of-concept and its stated limitations
BJ. Petrie & O. Aarne (2025). Technical Options for Flexible Hardware-Enabled Guarantees. arXiv. Source recordSupports: TEE-backed software vs physical access; early-access CC lacked multi-node · sections on software/TEE options
BTinfoil (2026). A primer on secure enclaves. Tinfoil documentation. Source recordSupports: Tinfoil hardware, trust model, report signing keys, documented limitations (provider-reported) · Supported hardware; Trust model; Limitations
BTinfoil (2026). Backend infrastructure. Tinfoil documentation. Source recordSupports: memory encryption against host software, reproducible builds and transparency log, client verification (provider-reported)
BTinfoil (2026). How verification works in Tinfoil. Tinfoil documentation. Source recordSupports: production deployment of Tinfoil's inference enclaves (provider-reported) · In-band vs. out-of-band verification
BTinfoil (2026). modelwrap: Reproducible dm-verity read-only image of Huggingface models. GitHub. Source recordSupports: public open-source implementation (v0.3.0)

Category	On-chip & hardware-enabled also Cryptographic & computational
Threat model	Semi-trusted prover
Adversarial evaluation	Independent red-team
Hardware needed	Existing features
Prover cooperation	Required
Confidentiality	Preserving
Challenge themes	Hardware trust, Evidence binding, Coverage & hidden compute, Adversarial validation, Performance & compatibility