TEE remote attestation for AI workloads

How it works

A trusted execution environment (TEE) is a hardware-enforced boundary around a computation. TEEs aim to protect confidentiality and integrity even from an attacker who controls all of the host's software ³. In a confidential virtual machine (CVM), the CPU encrypts the VM's memory so that the hypervisor and other privileged software cannot read or tamper with it ¹⁹.

At launch, the CPU measures the confidential VM's initial state and signs the measurements with keys that chain to the manufacturer ^{10 18}. A remote verifier checks the signature chain back to the vendor's root certificate. It then compares the measurements with expected values, which may come from reproducible builds published to a transparency log ¹⁹.

NVIDIA extends attestation to its GPUs. In NVIDIA's description, an on-die root of trust checks the GPU's fused identity key and permits only signed firmware. The driver opens an authenticated session and obtains a signed report on the GPU's firmware and configuration ^{1 2}. The GPU must be paired with a CPU TEE, either Intel Trust Domain Extensions (TDX) or AMD Secure Encrypted Virtualization (SEV). For AMD CPUs, NVIDIA recommends SEV-SNP ¹.

Other designs attest the accelerator alone. GuardAIn gives a discrete neural processing unit (NPU) measured boot and task attestation without relying on a CPU TEE ¹².

Several verification schemes build on these reports:

• Attestable Audits has the model provider and the auditor each send encrypted inputs to an enclave. The enclave runs the audit and publishes an attestation that links the model hash, the audit and the result. Later inference is checked against the audited hash ⁸.
• PAL*M attests dataset, training, fine-tuning, evaluation and inference operations on Intel TDX with an H100 ⁹.
• Tinfoil binds the served weights to the attestation, as described under Hardware-attested weight binding ¹⁰.
• Gloria Z, author of a June 2026 MIRI Technical Governance Fellowship post, proposes running auditable, reproducibly built software inside a CVM to enforce access control, audit logging and safety classifiers ¹¹.
• The Future of Life Institute (FLI) and Mithril Security built an Intel SGX proof of concept for leasing a model with protected weights, usage telemetry and an off-switch ¹⁶.

What it establishes

An attestation can show two things, provided the hardware is sound and the vendor's keys are not compromised:

• A specific, measured software stack produced a given output from inputs identified by hash, when the protocol puts those hashes in the signed report, as PAL*M does ⁹.
• The stack ran on genuine vendor hardware in confidential mode ¹⁹.

This supports positive claims, such as which model answered or which policy code wrapped it.

An attestation has three gaps:

• It reflects the launch state, so it does not cover weights or other data loaded afterwards. These must be bound separately ¹⁰.
• It does not cover anything that was never measured. Gloria Z calls gaps in measuring feature flags, environment variables and invocation arguments "perhaps the most likely failure mode" ¹¹.
• It covers one deployment, not everything the chip does ¹¹. Chip-level signals that bear on negative claims, such as that no training happened, are covered in On-chip telemetry from timing, memory and performance counters and Workload classification from telemetry and side channels.

Threat model

TEE designs treat the operator's software as hostile, including the host operating system, the hypervisor and the cloud stack ^{9 18}. They trust the hardware and its vendor ^{8 18}. Each vendor and research design lists attacks it does not defend against:

• NVIDIA lists software, basic physical, rollback, cryptographic and replay attacks as in scope. Sophisticated physical attacks and denial of service are out of scope ¹. NVIDIA states that the H100's on-package HBM is not encrypted, and considers it secure against everyday physical attack tools ².
• Intel and AMD consider memory-bus interposer attacks and other physical attacks on memory out of scope, according to the TEE.fail, DDRop, Battering RAM and WireTap authors ^{3 4 5 33}.
• PAL*M excludes side channels and physical attacks such as memory-bus interposition or swapping GPUs ⁹.
• GuardAIn excludes side channels and denial of service ¹².

International verification faces a stronger adversary. Gloria Z describes it as a nation-state that may have advance physical access to data centres and leverage over hardware vendors ¹¹. Other analysts also doubt that TEEs hold up against physical access:

• The flexHEG authors judge TEE-backed software "probably not secure against sophisticated actors if they have unrestricted physical access" ¹⁷.
• The Center for a New American Security (CNAS) says existing features need hardening before they can be relied on in adversarial settings ¹⁴.
• RAND notes that an attacker with physical access may be able to extract both the keys and the protected data ¹⁵.