Trusted Execution Environment (TEE)

Intel Software Guard Extensions creates encrypted memory regions called enclaves within an application's address space. Code and data inside the enclave are protected from the OS, hypervisor, and other applications.

• Enclave Page Cache (EPC): Limited encrypted memory (up to 512MB/1TB depending on generation)
• Remote Attestation: Proves to a remote party that specific code is running inside a genuine SGX enclave
• Sealing: Encrypts data for persistent storage, bound to the enclave's identity

Commonly used for confidential inference where model weights are decrypted only inside the enclave.

AMD Secure Encrypted Virtualization with Secure Nested Paging encrypts entire virtual machines with per-VM keys. Unlike SGX's application-level enclaves, SEV protects the full guest OS and workload.

• Memory Integrity: Prevents hypervisor from maliciously remapping or replaying encrypted pages
• Reverse Map Table: Hardware structure that prevents alias-based attacks
• Attestation Report: Signed by the Platform Security Processor (PSP) to verify VM state

Ideal for confidential federated learning aggregation servers running in cloud environments.

Amazon's Nitro Enclaves provide isolated compute environments carved from EC2 instances with no persistent storage, no interactive access, and no external networking by default.

• Cryptographic Attestation: Uses the Nitro Security Module to generate signed attestation documents
• vsock Communication: Secure local channel between parent instance and enclave
• No AWS Credentials: Enclaves have no access to instance metadata or IAM roles

Commonly deployed for privacy-preserving model evaluation where the data owner needs cryptographic proof the model was executed as specified.

TEEs enable multiple distrusting parties to jointly train or evaluate models without revealing their private data to each other or the cloud provider.

• Model Aggregation: Each party's updates are decrypted and aggregated inside the enclave
• Attestation Verification: All parties verify the enclave's code identity before sending data
• Policy Enforcement: Enclave code enforces rules like differential privacy noise addition

This architecture replaces cryptographic MPC with hardware trust for orders-of-magnitude performance improvements in collaborative healthcare and financial analytics.

Model providers can deploy proprietary models to untrusted cloud infrastructure while keeping weights encrypted in RAM until decrypted inside a TEE.

• Model Protection: Weights never exposed to cloud operator
• Input Privacy: User queries decrypted only inside enclave
• Attested Outputs: Users receive cryptographic proof the correct model generated the result

This enables IP-protected model serving where neither the infrastructure provider nor the end user can extract the model weights.

Modern TEE implementations incorporate defenses against microarchitectural side-channel attacks that attempt to infer enclave secrets through cache timing, branch prediction, or power analysis.

• Cache Partitioning: Isolates enclave cache lines from untrusted code
• Speculation Barriers: LFENCE and other serializing instructions prevent Spectre-style leaks
• Constant-Time Cryptography: Libraries avoid data-dependent memory access patterns

Security architects must still apply defense-in-depth as TEEs remain vulnerable to physical attacks and sophisticated microarchitectural side channels.