Source · Tier A · Peer-reviewedSource · TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition
TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition
J. Chuang, A. Seto, N. Berrios, S. van Schaik, C. Garman, D. Genkin. 2026. 2026 IEEE Symposium on Security and Privacy (SP).
| Original | https://tee.fail/ |
|---|---|
| DOI | 10.1109/SP63933.2026.00101 |
| Version | Read the authors' site and the paper PDF linked from it (https://tee.fail/files/paper.pdf) on 2026-09-23. |
| Accessed | 2026-10-13 |
| Note | Independent attack paper. Venue confirmed on 2026-09-23: the authors' site lists the 47th IEEE Symposium on Security and Privacy (IEEE S&P '26), co-author C. Garman's publication list gives IEEE Symposium on Security and Privacy (SP) 2026, and the IEEE Computer Society Digital Library lists it among the SP 2026 proceedings articles (https://www.computer.org/csdl/proceedings-article/sp/2026/606500b876/2bojwtctN28). Crossref, checked on 2026-10-17, lists the DOI recorded here and pp. 4408–4426. The site (re-read 2026-09-25) links an Intel security announcement of 2025-10-28 and AMD bulletin AMD-SB-3040; it states that both vendors treat interposer attacks as out of scope and that there are no mitigations on the NVIDIA side. Cited by S-0012 (as TEE.fail) and discussed in S-0014 and the Tinfoil documentation. |
Cited by
- Confidential multi-party verificationMechanism
- Hardware-attested weight bindingMechanism
- Safeguard attestationMechanism
- TEE remote attestation for AI workloadsMechanism
- Apple Private Cloud ComputeImplementation
- PySyft double-blind evaluationsImplementation
- Tinfoil model identity (Modelwrap)Implementation
- WhatsApp Private ProcessingImplementation
- The declared model is the one being servedClaim