Secure Enclaves (e.g., SGX, TrustZone)

Secure Enclaves create a hardware-rooted trust boundary that isolates a protected memory region (the enclave) from all other software on the system, including the privileged operating system and hypervisor. This is achieved through CPU-level access controls and memory encryption.

• Intel SGX: Creates private memory regions called Enclave Page Cache (EPC).
• ARM TrustZone: Divides the system into a Normal World and a secure Secure World.
• AMD SEV-SNP: Encrypts entire virtual machine memory spaces, isolating them from the hypervisor.

The isolation ensures that even if the host OS is compromised, the enclave's contents—such as a local model and its training data—remain inaccessible.

Remote Attestation is a cryptographic protocol that allows a remote verifier (e.g., a federated learning server) to cryptographically confirm the identity and integrity of the software running inside a secure enclave on a client device.

• Proves Trust: The server receives a signed report from the enclave's hardware, verifying:
  • The correct initial code (measurement) is loaded.
  • The code is running within a genuine enclave on authentic hardware.
  • The enclave has not been tampered with.
• Use in FL: Before accepting a model update, the server can attest that the client's update was computed by a verified, unmodified training algorithm within a trusted enclave, mitigating risks from malicious client-side code.

Sealed Storage allows a secure enclave to persistently encrypt data to a unique hardware key derived from the enclave's identity and the specific platform. This data can only be decrypted by the same enclave (or a designated successor) on the same physical hardware.

• Key Derivation: Uses a hardware-unique Root Seal Key fused into the CPU during manufacturing.
• Federated Learning Application: Enables secure checkpointing of a client's local model state between training rounds. The model's state can be saved to untrusted disk, encrypted and bound to the enclave, preventing offline inspection or theft of the intermediate model parameters.

Confidential Computing is the paradigm of performing computations on data while it remains encrypted in memory. Secure Enclaves are the primary hardware mechanism enabling this, as they use Memory Encryption Engines to transparently encrypt/decrypt data only within the CPU cache.

• Data-in-Use Protection: Protects against physical attacks like cold-boot attacks and against privileged software attempting to read enclave memory via Direct Memory Access (DMA).
• For Model Updates: In federated learning, the local training data, model parameters, and gradients are encrypted when in RAM and are only decrypted inside the CPU's execution units, ensuring end-to-end confidentiality during the entire local computation phase.

The Trusted Computing Base (TCB) is the set of all hardware, firmware, and software components that must be trusted for a system's security to hold. A core design goal of secure enclaves is to minimize the TCB.

• Excludes the OS & Hypervisor: The host OS, drivers, BIOS, and system management software are explicitly excluded from the TCB. A compromise in these massive codebases does not breach the enclave.
• Limited to CPU Microcode & Enclave Code: The TCB is reduced to the CPU's security logic and the few thousand lines of code running inside the enclave itself (e.g., the federated learning client algorithm). This drastically reduces the attack surface.

Secure Enclaves provide mechanisms to establish encrypted and authenticated communication channels between the enclave and trusted remote parties, bypassing the untrusted host OS.

• Secure Channel Establishment: After successful remote attestation, the enclave and the verifier can derive a shared session key.
• Protected Data Path: This key is used to encrypt all communications (e.g., model updates, global model parameters). The host OS can only see ciphertext.
• Federated Learning Flow:
  1. Server sends the global model encrypted for the attested enclave.
  2. Enclave decrypts, trains locally.
  3. Enclave encrypts the update for the server and sends it. This ensures model update privacy during transmission, complementing secure aggregation.

Before accepting updates, a federated learning server can use remote attestation to verify a client's integrity. This process cryptographically proves that:

• The client is running genuine, unmodified code within a valid secure enclave.
• The correct training algorithm is being executed.
• The enclave's initial state (measurement) is trusted. This prevents malicious clients from substituting the training logic with poisoned code and ensures that privacy guarantees are upheld by verified hardware. It is a foundational mechanism for establishing trust in a decentralized system.

In commercial federated learning, the global model is a valuable asset. Secure enclaves allow the model owner to deliver encrypted model weights to client devices. The model is only decrypted inside the client's trusted enclave for local training or inference. This prevents unauthorized extraction, reverse engineering, or theft of the proprietary model architecture and parameters from the device's main memory, enabling secure model deployment to untrusted edge environments.

Secure enclaves are often combined with cryptographic techniques like homomorphic encryption (HE) or secure multi-party computation (SMPC) to create layered defenses. For example:

• Clients can train locally within an enclave.
• Updates are further encrypted using HE before leaving the enclave.
• The server aggregates them under encryption.
• The final encrypted aggregate is decrypted within a server-side enclave. This defense-in-depth approach mitigates the risk of a single point of failure and provides stronger guarantees against sophisticated adversaries.

For sectors like healthcare (HIPAA) and finance (GDPR, PCI-DSS), secure enclaves provide a hardware-rooted mechanism for compliance. They enable federated learning on sensitive patient health records or financial transaction data by ensuring data is never exposed in plaintext outside the certified TEE during processing. This creates a verifiable audit trail for regulators, demonstrating that data privacy was technically enforced at the hardware level, not just through policy.

A cryptographic protocol that allows a central server to compute the sum or average of client model updates without learning the value of any individual contribution. This prevents the server from performing model inversion or membership inference attacks on a single client's data.

• Secure Multi-Party Computation (MPC) and homomorphic encryption are common underlying techniques.
• Often used in conjunction with secure enclaves, where the aggregation logic itself runs inside a protected enclave on the server.

A security protocol where the central server cryptographically verifies the integrity and authenticity of a client's software and hardware environment before accepting its model update. This ensures the client is running genuine, unmodified code within a trusted execution environment (TEE) like Intel SGX.

• Uses remote attestation to provide a hardware-signed proof of the software's identity and state.
• Critical for establishing a root of trust in a decentralized system with potentially malicious devices.

A class of algorithms designed to produce a correct global model update even when a fraction of participating clients are malicious or faulty and send arbitrary or adversarial updates. These defenses are algorithmic and complement hardware-based isolation.

• Key algorithms include Krum, Bulyan, Trimmed Mean, and Median Aggregation.
• They operate by statistically filtering out updates that are geometric outliers from the consensus.

A privacy model where each client perturbs their data or model update with calibrated noise before sending it to the server. This provides a strong, distributed privacy guarantee without needing to trust the central aggregator.

• Protects against a curious or compromised server.
• The Gaussian Mechanism and Laplace Mechanism are standard techniques for adding this noise.
• Contrasts with central differential privacy, where noise is added after aggregation.

The structured process of identifying, assessing, and mitigating security and privacy threats specific to a federated learning system. It defines the trust boundaries and attack surfaces that defenses like secure enclaves are designed to protect.

• Common threats include data poisoning, model inversion, membership inference, free-riding, and Sybil attacks.
• A threat model dictates whether hardware TEEs are necessary for client-side computation, server-side aggregation, or both.

The broader hardware and software architecture that provides isolated execution of sensitive code. A secure enclave (like an SGX enclave) is a specific, dynamically instantiated region within a TEE.

• Intel SGX and ARM TrustZone are the two dominant TEE implementations for CPUs.
• Key guarantees include confidentiality (memory encryption), integrity (preventing tampering), and attestation (proving the environment is genuine).