Trusted Execution Environment (TEE)

A TEE creates a secure enclave—a physically isolated region of the processor and memory. This isolation is enforced by the CPU itself, not by software. The enclave's memory is encrypted and inaccessible to the host OS, hypervisor, DMA attacks, or even other enclaves. This guarantees that sensitive model weights and inference data remain confidential even if the host is fully compromised.

• Memory Encryption: All enclave memory is transparently encrypted by a memory encryption engine within the memory controller.
• Hardware Root of Trust: Trust is anchored in the silicon, not in a vulnerable software layer.
• Attestation: The CPU can generate a cryptographically signed report proving the exact code and data running inside the enclave to a remote party.

TEEs enable confidential AI by protecting models and data during runtime—a state traditionally left vulnerable when data moves from storage or transit into active memory. This allows organizations to run proprietary models on untrusted cloud infrastructure or perform multi-party inference on sensitive data without exposing it to the cloud provider or other parties.

• Model IP Protection: Prevents cloud operators from stealing proprietary model weights.
• Private Inference: A client can send encrypted data to a model in a TEE, receive an encrypted result, and the host never sees the plaintext input.
• Secure Multi-Party ML: Multiple parties can combine sensitive datasets for training or inference inside an enclave without revealing data to each other.

Remote attestation is the cryptographic mechanism that allows a remote client to verify the identity and integrity of the software running inside a TEE before sending secrets. The CPU generates a signed attestation report containing a hash of the enclave's initial code and data. This report is verified against the manufacturer's trusted certificate chain.

• Verifiable Identity: Proves the exact code hash running in the enclave.
• Trusted Channel Establishment: Attestation is used to bootstrap a secure, encrypted channel directly into the enclave.
• Freshness Guarantees: Reports include nonces and timestamps to prevent replay attacks.

A TEE dramatically reduces the Trusted Computing Base (TCB)—the set of all hardware, firmware, and software components critical to security. In a traditional stack, the TCB includes the entire OS and hypervisor (millions of lines of code). In a TEE, the TCB is reduced to the enclave code itself and the processor package.

• Attack Surface Reduction: Excludes the OS, drivers, and hypervisor from the trust boundary.
• Formal Verification Feasibility: A smaller TCB makes rigorous mathematical verification of security properties practical.
• Defense-in-Depth: Even if the OS is pwned via a zero-day, the enclave remains secure.

Sealing is the mechanism by which a TEE securely persists sensitive data to untrusted storage. Data is encrypted with a key derived from the enclave's identity and the CPU's unique hardware key. This ensures that sealed data can only be decrypted by the exact same enclave on the exact same CPU.

• Identity-Bound Encryption: Sealed blobs are bound to the specific enclave author and CPU.
• Monotonic Counters: TEEs provide hardware-backed counters to prevent rollback attacks on sealed state.
• Secure Checkpointing: Enables long-running confidential workloads to persist state across reboots without exposing secrets.

Modern TEEs incorporate hardware and microarchitectural defenses against side-channel attacks—attacks that infer secrets by observing physical byproducts like execution time, power consumption, or cache access patterns. While no TEE claims absolute immunity, designs include cache partitioning, constant-time cryptographic instructions, and speculative execution barriers.

• Cache Isolation: Prevents an attacker OS from priming and probing cache lines used by the enclave.
• Speculation Controls: Mitigations against Spectre-class vulnerabilities that leak data via speculative execution.
• Data-Independent Execution: Cryptographic libraries within the TEE are written to avoid secret-dependent branches and memory accesses.