Confidential Retrieval-Augmented Generation (Confidential RAG)

User queries enter the TEE through a secure channel established after remote attestation verifies the enclave's identity and integrity. The query is decrypted only inside the enclave boundary, ensuring the host operating system, hypervisor, and cloud provider never see the plaintext question. This prevents query logging and metadata leakage at the infrastructure layer.

The embedding model runs entirely within the enclave, converting the query into a vector representation without exposing it. The vector database—often an encrypted vector store—is queried over a secure channel. Retrieved document chunks are decrypted inside the TEE, ensuring that even the most relevant context remains opaque to external observers.

The language model executes within the same TEE, receiving the query and retrieved context directly in encrypted memory. Key protections include:

• Model weight confidentiality: Proprietary model parameters never leave the enclave in plaintext
• Context isolation: Retrieved documents are inaccessible to the host
• Output encryption: The generated response is encrypted before leaving the enclave, bound to the original attestation session

Before retrieval or generation begins, the system performs model provenance attestation—cryptographic verification that the exact model (identified by a known hash and training lineage) is loaded inside the TEE. This assures clients that:

• No model substitution has occurred
• The model has not been tampered with
• The agreed-upon version is serving the request

Frequently retrieved document embeddings and intermediate results can be cached inside the enclave and sealed to disk using enclave sealing. The sealed cache is bound to the specific enclave identity, meaning:

• Cached data can only be decrypted by the same application on the same platform
• Host-level access to the cache file yields only ciphertext
• Subsequent queries benefit from reduced latency without sacrificing confidentiality

Confidential RAG implementations incorporate side-channel resistance techniques to prevent attackers from inferring query content or retrieved documents through indirect observation. Defenses include:

• Constant-time cryptographic operations within the enclave
• Memory access pattern obfuscation during vector similarity search
• Padding and batching to normalize execution timing across queries of varying complexity

The protection of data while it is actively being processed in CPU registers and memory. Unlike data-at-rest (disk encryption) or data-in-transit (TLS), data-in-use encryption shields computation from privileged system layers. For Confidential RAG, this means:

• The user's natural language query is encrypted in RAM
• Retrieved context documents are never exposed in plaintext to the host
• The model's generation output is protected until delivered to the authorized client

A model serving endpoint that runs entirely within a TEE, ensuring that both client input data and proprietary model parameters are invisible to the cloud provider. In a Confidential RAG architecture, this service:

• Receives encrypted queries from authenticated clients
• Performs vector search and document retrieval inside the enclave
• Executes the LLM generation step without exposing weights or prompts
• Returns encrypted responses that only the client can decrypt

A specialized storage system that indexes high-dimensional embeddings while maintaining cryptographic privacy over the stored vectors. For Confidential RAG, the vector database must:

• Store document embeddings encrypted at rest
• Perform similarity search operations within the TEE boundary
• Prevent the infrastructure operator from inferring document content from access patterns This ensures that even the semantic index of proprietary knowledge remains confidential.

A key management system that integrates with TEEs, releasing decryption keys only after successful attestation. In a Confidential RAG deployment:

• The vector database encryption key is released only to a verified enclave
• Model weights are decrypted only inside the attested inference environment
• Session keys for client communication are bound to the enclave's identity This prevents unauthorized access even if the host infrastructure is compromised.