AMD SEV-SNP

The predecessor to SEV-SNP and the first generation of AMD's memory encryption for virtual machines. SEV encrypts VM memory with a key unique to each guest, isolating it from the hypervisor. However, it lacks integrity protection—a malicious hypervisor could replay or remap encrypted memory pages without detection. SEV-SNP adds the Reverse Map Table (RMT) to close this gap, providing full confidentiality and integrity.

The cryptographic process by which a relying party verifies that a workload is running inside a genuine AMD SEV-SNP environment. The AMD Secure Processor signs an attestation report containing the VM's launch measurement, platform firmware version, and policy flags. A remote verifier checks this signature against AMD's certificate chain. Without attestation, a client has no proof that their data is actually protected by a TEE rather than a simulated environment.

Intel's competing hardware TEE technology that, like SEV-SNP, provides full VM-level confidentiality and integrity. Key architectural differences include:

• TDX uses a Secure Arbitration Mode (SEAM) module as an intermediary between the hypervisor and TDX VMs
• SEV-SNP relies on the AMD Secure Processor for key management and attestation
• Both resist hypervisor-based attacks but have different Trusted Computing Bases (TCBs)
• Multi-vendor confidential computing strategies often deploy both to avoid single-supplier lock-in

A virtual machine instance backed by hardware memory encryption, typically using AMD SEV-SNP or Intel TDX. In sovereign AI deployments, CVMs ensure that model weights and inference data remain encrypted in use, invisible to the cloud provider's hypervisor. Major cloud platforms offer CVM instance types:

• AWS EC2 C6a/C7a instances with SEV-SNP
• Azure Confidential VMs with SEV-SNP or TDX
• GCP Confidential VMs with SEV-SNP

A cryptographic hash—typically SHA-384 in SEV-SNP—computed over the initial VM state including firmware, kernel, and initrd. This measurement serves as the VM's unique identity fingerprint during attestation. Any modification to the boot chain produces a different measurement, alerting verifiers to tampering. In production pipelines, known-good measurements are embedded in deployment policies so that only verified VM images receive decryption keys from a Confidential KMS.

A RAG architecture where both the vector retrieval and LLM inference steps execute inside SEV-SNP-protected CVMs. This guarantees:

• User queries never appear in plaintext to the infrastructure provider
• Retrieved context documents remain encrypted in memory
• The model's proprietary weights are protected from extraction
• The entire pipeline is verifiable via attestation before any data is released This pattern is critical for sovereign AI deployments handling regulated data.