Intel SGX

The core unit of SGX is the enclave, a protected region of memory established using the ECREATE instruction. Key isolation mechanisms include:

• Hardware-enforced memory encryption: All enclave data in DRAM is encrypted with a memory encryption engine (MEE) using a key accessible only to the CPU.
• Access control via the Enclave Page Cache (EPC): The CPU's Memory Management Unit (MMU) enforces that only code running inside the enclave can access its EPC pages.
• Protection from privileged software: The operating system, BIOS, System Management Mode (SMM), and even hypervisors are prevented from reading or modifying enclave memory, providing defense against a compromised host.

SGX provides a cryptographic protocol for a remote party to verify the identity and integrity of an enclave before trusting it with sensitive data. This process involves:

• Local attestation: One enclave on a platform can verify another, using a platform-specific key.
• Remote attestation: An external relying party (e.g., a service provider) verifies the enclave's measurement (cryptographic hash of its initial code and data) and that it is running on genuine Intel SGX hardware. This relies on an attestation service (like Intel's Provisioning Certification Service) to issue a quote signed by the processor's Enhanced Privacy ID (EPID).
• Sealing: Enclaves can encrypt (seal) persistent data to a key derived from the enclave's identity or the platform, ensuring data can only be unsealed by the same or an authorized enclave.

SGX manages transitions between the enclave and untrusted code via Asynchronous Enclave Exit (AEX). This mechanism ensures state confidentiality during interrupts, exceptions, or system calls.

• State Save: Upon exit, the CPU's register state is securely saved inside the enclave's protected memory and replaced with a synthetic state.
• State Restore: Upon re-entry, the saved state is restored, ensuring no sensitive register contents are leaked to the OS.
• This protects against controlled-channel attacks where an adversary might infer enclave activity by monitoring page faults or interrupt timing.

The Memory Encryption Engine is the hardware component that transparently encrypts and decrypts all data flowing between the CPU and DRAM for enclave pages.

• Uses a transient session key: Derived from a fuse-based root key unique to each processor.
• Encryption granularity: Operates at the cache-line level (typically 64 bytes).
• Integrity protection (Total Memory Encryption - Multi-Tenant): Advanced versions (SGX2 with TDX) include integrity trees to detect tampering, preventing replay attacks where an adversary might swap encrypted memory blocks. This ensures confidentiality even if physical memory is snooped or the DIMMs are removed.

The Enclave Page Cache (EPC) is a limited physical memory resource (e.g., 128MB per package) reserved for enclave use. The OS manages EPC allocation through the SGX driver.

• EPC Paging: To support enclaves larger than the EPC, the OS can page encrypted enclave pages to untrusted storage (e.g., disk). The hardware provides version arrays (VA) to store cryptographic metadata (MACs) for paged pages, ensuring their integrity is verified upon reloading.
• Swapping cost: EPC paging involves a costly eviction and reloading process secured by the CPU, creating a performance trade-off between enclave size and execution speed.

SGX2, introduced in later Intel CPUs, added critical flexibility for dynamic memory management and concurrent execution.

• Dynamic memory allocation: Enclaves can dynamically add (EADD), remove (EREMOVE), and modify (EMOD) pages after creation, enabling more complex applications like database operations within an enclave.
• Enclave threading: Multiple hardware threads can execute within the same enclave concurrently. SGX provides atomic instructions for secure synchronization inside the enclave, avoiding costly exits for lock management.
• These features reduce the trusted computing base (TCB) by moving memory management logic into the enclave itself, away from the untrusted OS.

In federated learning, SGX secures the central aggregation server. Client devices train on local data and send encrypted model updates (gradients) to this server. The SGX enclave decrypts the updates, performs the secure aggregation algorithm, and updates the global model—all without the server operator or any attacker being able to inspect individual client contributions. This strengthens the privacy guarantees of federated learning beyond cryptographic secure aggregation alone, protecting against a malicious or compromised server.

• Role: Provides a verifiably trusted execution environment for the aggregation function.
• Benefit: Prevents reconstruction of individual training data from model updates.

SGX allows the full training cycle of a model—including data loading, forward/backward passes, and optimizer steps—to occur within an enclave. This is used when training must occur on a consolidated, highly sensitive dataset (e.g., across multiple hospitals) in a cloud environment deemed untrusted. While computationally intensive due to enclave memory constraints (Enclave Page Cache limits), it provides the strongest isolation guarantee for the training data and the resulting model. Techniques like model partitioning can be used to fit larger models.

• Scenario: Training a diagnostic model on combined, regulated patient data in a public cloud.
• Challenge: Requires careful management of limited EPC memory (~128MB-512MB per enclave).

Autonomous AI agents that perform tool calling and API execution often require access to secrets like database passwords or API keys. SGX enclaves provide a hardened root of trust for managing these credentials. The agent's core logic can run inside the enclave, which securely stores keys and uses them to sign external API requests. This prevents credential leakage even if the host OS is compromised, enabling agents to operate securely in adversarial environments.

• Function: Acts as a hardware-backed Hardware Security Module (HSM) for AI workflows.
• Application: Securing multi-agent systems that interact with external financial or operational APIs.

SGX's remote attestation feature allows a client to cryptographically verify that a specific, unmodified AI application is running inside a genuine Intel SGX enclave on a remote server. This creates trusted AI pipelines for regulated industries. An auditor or client can receive a signed report proving that a privacy-preserving RAG system or a compliant model training script is executing as intended, with no unauthorized modifications, ensuring adherence to governance policies.

• Mechanism: Produces a quote signed by the CPU, verifiable by Intel's Attestation Service.
• Business Value: Enables algorithmic audits and compliance with standards like GDPR or HIPAA in cloud deployments.

Secure Multi-Party Computation (MPC) is a cryptographic protocol that enables multiple parties to jointly compute a function over their private inputs while keeping those inputs concealed from each other. Only the final output of the computation is revealed.

• Core Idea: Parties collaborate to compute an output without exposing their individual secret data, using techniques like secret sharing and garbled circuits.
• Distinction from SGX: MPC is a protocol between multiple distrusting entities. SGX is a hardware mechanism for a single entity to protect computation from its own host system.
• Example: Two hospitals can compute the average patient salary without revealing any individual patient's records to each other.

Differential Privacy (DP) is a rigorous mathematical framework for quantifying and limiting the privacy loss incurred when an individual's data is included in a statistical analysis. It ensures the output of an algorithm does not reveal whether any specific individual's data was in the input dataset.

• Method: Adds carefully calibrated statistical noise (e.g., via the Laplace Mechanism) to query results or model outputs.
• Relationship to SGX: DP protects the output; SGX protects the computation. They are complementary: SGX can provide a secure environment for applying DP algorithms to sensitive raw data.
• Key Parameter: The privacy budget (ε) quantifies the maximum allowable privacy loss; a smaller ε means stronger privacy.

Federated Learning (FL) is a decentralized machine learning paradigm where a global model is trained collaboratively across multiple client devices or siloed data servers. Only model updates (e.g., gradients) are shared with a central coordinator, not the raw training data.

• Privacy Advantage: Keeps raw user data on the local device (e.g., smartphone, hospital server).
• Synergy with SGX: The central aggregation server can use a TEE like SGX to perform secure aggregation, ensuring the coordinator cannot inspect any individual client's model update, only the encrypted sum.
• Use Case: Training a next-word prediction model on millions of users' phones without collecting their typing history to a central server.