Model Protection

Model parameters are encrypted at rest and in transit, only decrypted inside the Trusted Execution Environment (TEE). This prevents extraction by the host operating system, hypervisor, or cloud provider. The model is typically encrypted using a key derived from the enclave's identity, ensuring it cannot be decrypted on any other platform. Data Sealing binds the model to a specific enclave measurement, so even if the storage is compromised, the model remains cryptographically protected.

Before a client sends sensitive data or a model owner provisions a model, the enclave must prove its identity and integrity through Remote Attestation. The enclave generates a cryptographic report—signed by the hardware—containing its MRENCLAVE measurement. A remote verifier checks this against a known-good hash. Only after successful attestation are decryption keys provisioned, establishing a Hardware Root of Trust for the inference session.

The Data-in-Use Protection paradigm ensures model weights and intermediate activations remain encrypted in RAM during computation. Technologies like Intel TDX and AMD SEV-SNP transparently encrypt the entire virtual machine's memory space. This defeats cold-boot attacks, DMA attacks, and malicious hypervisor snooping. The model is never in plaintext outside the CPU package, closing the final gap in the data lifecycle.

Interaction with the protected model occurs through a strictly defined interface using ECALLs and OCALLs. ECALLs are controlled entry points for inference requests; OCALLs allow the enclave to make necessary system calls to the untrusted host. This minimizes the attack surface. The model's architecture and weights are never exposed to the calling application, preventing model extraction even if the client application is compromised.

NVIDIA Confidential Computing extends TEE protections to GPU workloads. This enables high-performance private inference on large models without exposing weights to the host. The GPU's firmware attests to its security state, and a secure channel is established between the CPU enclave and the GPU. This is critical for protecting large language models and diffusion models where inference latency must remain low while maintaining strict confidentiality.

Model protection extends to the update lifecycle. New model versions are delivered encrypted and can only be decrypted by an enclave matching the authorized MRSIGNER identity. This prevents rollback attacks and ensures only authenticated, integrity-verified models are loaded. The enclave's Data Sealing mechanism can persist version state to untrusted storage, cryptographically binding the update history to the specific hardware platform.

The application of Confidential Computing hardware to protect the confidentiality and integrity of machine learning models, training data, and inference inputs during active computation. This paradigm ensures that proprietary model weights are only decrypted inside a hardware-isolated enclave, preventing exposure to the cloud provider, malicious insiders, or unauthorized processes on the host.

• Key Benefit: Protects intellectual property during inference
• Mechanism: Combines runtime memory encryption with remote attestation
• Use Case: Serving proprietary models to untrusted clients without revealing weights

A machine learning serving paradigm where a client's input data and the server's model weights remain mutually confidential during the inference computation. The model is loaded into a Trusted Execution Environment, and attestation proves to the client that their data will only be processed within the secure enclave.

• Dual Protection: Hides the model from the user and the user's query from the host
• Attestation Requirement: Client must verify the enclave's measurement before sending data
• Threat Model Addressed: Malicious cloud operators and tenant-side extraction attacks

A hardware-isolated memory region within a processor that protects application code and data from inspection or modification by any software outside the enclave, including the operating system and hypervisor. For model protection, the enclave serves as a cryptographically sealed vault where model weights are decrypted and inference is executed.

• Isolation Boundary: Enforced by the CPU's memory encryption engine
• Integrity Guarantee: Any tampering attempt results in immediate access denial
• Lifecycle: Created, attested, used for computation, and destroyed without leaving plaintext artifacts

A protocol enabling a Trusted Execution Environment on one machine to prove its identity and software integrity to a remote verifier. Before a model owner provisions encrypted weights to an enclave, they demand a signed attestation report confirming the enclave is running the exact expected inference code.

• MRENCLAVE Verification: Confirms the hash of the loaded code matches the expected measurement
• MRSIGNER Trust Model: Alternatively, trusts any enclave signed by a specific vendor key
• DCAP Infrastructure: Allows enterprises to run private attestation services without third-party reliance

A mechanism that cryptographically binds data to a specific enclave's identity and security version. This allows a model serving enclave to securely persist encrypted model weights to untrusted local storage and retrieve them only on the same platform or enclave identity.

• Sealing Policy: Can bind to MRENCLAVE (exact code version) or MRSIGNER (vendor identity)
• Anti-Rollback: Prevents loading sealed data into outdated, vulnerable enclave versions
• Use Case: Caching encrypted models locally for fast restart without remote provisioning

The transparent, hardware-level encryption of a process's or virtual machine's entire memory space. Technologies like Intel TDX and AMD SEV-SNP ensure that model weights and intermediate activations remain encrypted even when loaded into RAM, protecting against cold-boot attacks and physical memory snooping.

• Transparent to Application: No code changes required for VM-level solutions
• Protection Scope: Guards against malicious hypervisors and infrastructure admins
• Performance: Hardware-accelerated AES encryption minimizes overhead