01 / The mechanism and its boundary
What the technique establishes
Trusted execution environment (TEE) remote attestation lets a remote party check which software processed an AI workload. A TEE isolates a workload from the machine's operator and signs a report of the code and configuration it loaded. NVIDIA's Hopper and Blackwell GPUs support this paired with Intel TDX or AMD SEV-SNP confidential virtual machines. Research prototypes use it to show which model produced a result without revealing weights. Tinfoil, Apple and Meta report using it in production AI services. It is not ready for verification between rival states, where the party being checked holds the hardware. Chip vendors treat sophisticated physical attacks as out of scope. Independent researchers with memory-bus devices costing under $50 to under $1000 defeated Intel and AMD attestation, and software-only attacks forged AMD attestations on platforms without AMD's firmware fixes. An attestation covers one deployment at launch, and trust rests on a few hardware vendors.
- Threat model
- Semi-trusted prover
- Adversarial evaluation
- Independent red-team
- Hardware needed
- Existing hardware features
- Prover cooperation
- Required
- Confidentiality
- Preserving
- Category
- On chip & hardware
Technical detail and cited results
NVIDIA describes the GPU attestation chain as follows. An on-die root of trust verifies the identity key fused into the GPU and permits only NVIDIA-signed firmware at boot. The driver then opens an SPDM session with the GPU, using a Diffie-Hellman exchange to set up a session key S-1200. The GPU presents a device identity certificate signed with a device-unique ECC-384 key, which chains to the NVIDIA certificate authority. It then returns a signed set of measurements S-1201.
Other details of NVIDIA's design:
- Traffic between the confidential VM and the GPU is protected with AES-GCM through encrypted bounce buffers. NVIDIA states that in future, hosts with TDISP/IDE-compatible CPUs and Blackwell B100/B200 GPUs can use inline encryption instead S-1200.
- Hopper's protected-PCIe mode passes all eight GPUs of an HGX node to one confidential VM, but NVLink traffic between them stays unencrypted. Blackwell also encrypts NVLink, for up to eight GPUs per confidential VM S-1200.
- Performance counters are disabled in full CC-On mode. They are available only in a CC-DevTools development mode S-1200.
- At launch, NVIDIA reported that H100 compute and HBM bandwidth were at par with non-confidential mode. CPU–GPU transfers were limited to roughly 4 GB/s by CPU encryption S-1201.
Three systems bind application data to a report:
- PAL*M sets the Intel TDX REPORTDATA field to the concatenation of the operation, a verifier challenge and hashes of the inputs and outputs. It models the protocol in the Tamarin prover S-0012.
- Attestable Audits publishes attestations that bind the model hash, the audit code and data, and the result to a transparency log S-0009.
- Tinfoil puts a dm-verity root hash of the weights on the measured kernel command line S-0013.
Claims and scope
A direct link identifies the intended claim. A supporting link supplies part of the evidence. Neither establishes that a complete verification system has been demonstrated.
The declared evaluation was run (upstream draft)
Measures the enclave software and supplies the hardware root for evaluation attestations. Attestable Audits additionally binds model, audit and result (S-0009); enclave launch attestation alone does not establish the full evaluation claim.
The declared model is the one being served
Attests the software stack that produced responses, and the model too when paired with a weight commitment (see M-0012).
Declared safeguards were applied during inference
Can attest that measured policy software, such as filters and logging, wrapped the model (S-0014). The evaluation variant is I-0007.
This compute runs inference, not training
Attests a declared inference deployment, but not that the same chips ran no other workloads (S-0014).
A training run stayed within declared limits
PAL*M attests single-node training and fine-tuning operations (S-0012). Distributed training is left open.
Readiness for a stated use
Assessed use: showing which software ran to a party that distrusts the operator holding the hardware
medium confidence · current · assessed 2026-09-25 · rubric 1.1
This is the source map’s editorial assessment. Production use is not evidence of resistance to every adversary.
Tinfoil relies on the attestation of commercial GPU confidential computing in production, but the independent evaluations left critical flaws open.
- R1 met: designs with stated claims and assumptions are published for audits, property attestation and policy enforcement S-0009 S-0012 S-0014.
- R2 met through Tinfoil's model-identity chain. It is an open-source production deployment on NVIDIA H100, H200 or B200 GPUs with AMD SEV-SNP or Intel TDX (provider-reported) S-1206 S-1208 S-1209. Attestable Audits and PAL*M add end-to-end results against stated adversaries S-0009 S-0012.
- R3 met through reliance by another party. Tinfoil, which did not build the TEEs, relies on the attestation in production: its service checks each GPU's attestation at boot and does not start if the check fails S-1207 S-1208. Apple Private Cloud Compute is another production deployment (provider-reported) S-1800. As context, GPU confidential computing is a documented product feature S-1200, and NVIDIA reports that Azure's confidential H100 virtual machines became generally available in 2024 S-1815.
- R4 not met. The independent public evaluations of the underlying TEEs (TEE.fail, DDRop, Battering RAM, WireTap, RMPocalypse and Fabricked) all found critical flaws, and the four that need physical access remain open. TEE.fail used physical access, root privileges and under $1000 of equipment to extract a CPU's Intel provisioning certification key, which anchors SGX and TDX attestation, and forge TDX attestations. Paired with relayed H100 attestations, the forgeries let a workload outside TEE protection pass both checks S-1202. DDRop forged TDX attestation reports on an up-to-date platform with a DDR5 interposer costing under $200 S-3126. On DDR4 servers, Battering RAM and WireTap forged SGX attestations with interposers costing under $50 and under $1000, and Battering RAM also broke SEV-SNP attestation S-1210 S-1211. These physical attacks defeat the main claim when the prover controls the hardware. NVIDIA lists sophisticated physical attacks as out of scope S-1200. Intel and AMD treat interposer and other physical attacks on memory as out of scope, according to the researchers S-1202 S-3126 S-1210 S-1211. RMPocalypse and Fabricked forged SEV-SNP attestations from malicious host software, with no physical access S-1212 S-3127. AMD reports firmware fixes for both S-1213 S-3128. An independent analysis of NVIDIA's GPU confidential computing found residual metadata and timing leaks but reported no attestation break S-3129. Trail of Bits' pre-launch audit of WhatsApp's deployment found high-severity implementation flaws that Meta fixed, and notes that SEV-SNP does not fully protect against advanced physical attacks S-3121 S-3124. The breaks do not invalidate the R2 and R3 evidence, which concerns working implementations and production use.
Evidence needed for the next level
Attestation that survives an attacker who physically holds the hardware, for example through memory integrity and freshness protection or tamper-responsive enclosures, confirmed by independent red-teaming.
GPU attestation cryptographically bound to the specific confidential VM it serves.
Coverage of whole-chip and multi-node activity, beyond a single deployment.
Roots of trust and key provenance that rival parties accept, beyond one vendor's certificate authority.
Measurement of runtime configuration as well as launch state.
Limitations, flaws, and blockers
These are attributed assessments from the source map. Absence of a listed flaw is not a security guarantee.
critical / open / demonstrated attack
DDR5 memory-bus interposers forge Intel TDX attestations and break SEV-SNP protections (TEE.fail, DDRop)
Independent researchers placed an interposer, built for under $1000, on the DDR5 memory bus of servers running Intel TDX and AMD SEV-SNP. Server TEEs encrypt memory deterministically, without integrity or freshness protection, and the researchers exploited this to recover secrets. The attack needs physical access and root privileges S-1202.
- On Intel, they extracted the provisioning certification key from a machine that Intel's service rated fully up to date. This per-CPU key signs the keys used in SGX and TDX attestation. With it they forged SGX and TDX attestations S-1202.
- On AMD SEV-SNP with ciphertext hiding enabled, they recovered an ECDSA private key used by OpenSSL inside the virtual machine. It was not an AMD attestation key S-1202. Other independent attacks did break SEV-SNP attestation. Battering RAM did so with a DDR4 interposer, and RMPocalypse and Fabricked from malicious host software S-1210 S-1212 S-3127.
A second team, from KU Leuven, ETH Zurich, Durham University and Google, built DDRop, an active DDR5 interposer with a bill of materials of $159. It silently drops memory writes, which memory encryption without freshness protection cannot detect. With brief physical access and control of the host software and BIOS, the researchers forced trust domains into debug mode and forged attestation reports on an up-to-date Intel TDX platform. The same primitive breaks the integrity of Scalable SGX and SEV-SNP, though the authors report no SEV-SNP attestation forgery S-3126.
The TEE.fail authors report that Intel and AMD consider interposer attacks out of scope, which leaves physical security as the only mitigation S-1202. The DDRop authors report the same position, and that both vendors issued security advisories on disclosure in September 2026 S-3126. PAL*M lists this attack class as out of its scope S-0012, and Tinfoil's documentation acknowledges it S-1206. Gloria Z calls key extraction through bus interposition "relatively low-hanging fruit" in an international treaty scenario S-0014.
critical / open / demonstrated attack
DDR4 memory-bus interposers forge SGX and SEV-SNP attestation (Battering RAM, WireTap)
Two independent teams broke server TEE attestation on DDR4 memory with interposers they built themselves. Both attacks need physical access to install the device and root privileges on the host S-1210 S-1211.
- Battering RAM, by researchers at KU Leuven and the Universities of Birmingham and Durham, uses an interposer with a bill of materials of $47.62. It creates memory aliases at runtime, which bypasses the boot-time alias checks that AMD and Intel introduced against static aliasing attacks such as BadRAM. On Intel Scalable SGX it gained arbitrary read and write access to enclave plaintext and extracted SGX's platform provisioning key, which lets an attacker forge attestation certificates for arbitrary quoting enclaves. On up-to-date AMD SEV-SNP servers it captured the launch digests of genuine VMs and replayed them into modified VMs, so that backdoored VMs pass attestation S-1210.
- WireTap, by researchers at Purdue University and Georgia Tech, uses an interposer built for under $1000 that records DDR4 bus traffic. On a Xeon Scalable server in fully trusted status it recovered the ECDSA attestation key of SGX's Quoting Enclave in 45 minutes and forged SGX quotes. The authors then showed end-to-end attacks on SGX-based blockchain deployments S-1211.
Both attacks are limited to DDR4 systems. The Battering RAM authors state that all commercial TDX machines use DDR5, and the WireTap authors state that 4th and 5th generation Xeon Scalable processors need DDR5 and are not affected by their current work S-1210 S-1211. According to the Battering RAM authors, Intel and AMD acknowledged the findings but consider physical attacks on DRAM out of scope for their current products S-1210. The WireTap authors report that Intel considers their attack outside the SGX threat model, and that there is no mitigation besides running servers in secure physical environments S-1211.
critical / mitigated / demonstrated attack
Software-only forgery of SEV-SNP attestation (RMPocalypse, Fabricked)
Researchers at ETH Zurich showed that a malicious hypervisor can corrupt the Reverse Map Table (RMP) while SEV-SNP initialises it. SEV-SNP uses the RMP to store security metadata for every DRAM page, and a single 8-byte overwrite leaves the whole table compromised. The attack needs no physical access. The authors confirmed it on Zen 3, Zen 4 and Zen 5 processors and state that it affects all AMD processors that support SEV-SNP. They demonstrated forged attestation values, debugging enabled on production confidential VMs, reads and writes of encrypted VM memory, and replay of VM register state S-1212.
AMD assigned CVE-2025-0033 S-1212. Its bulletin rates the issue medium severity and reports SEV firmware, microcode or platform firmware updates for every affected EPYC server and embedded series, with release dates from June 2025 to February 2026 S-1213.
In Fabricked, researchers from the same ETH Zurich group showed that a host controlling the hypervisor and UEFI firmware can misconfigure the Infinity Fabric interconnect so that the AMD Secure Processor initialises SEV-SNP incorrectly. On a Zen 5 EPYC processor this gave arbitrary reads and writes in the victim VM and forged attestation reports S-3127. AMD assigned CVE-2025-54510, rates it medium severity and reports platform firmware updates for its EPYC 7003, 8004, 9004 and 9005 server series, released in November and December 2025 S-3128.
significant / open / demonstrated attack
H100 attestation not bound to a specific confidential VM
The TEE.fail authors fetched genuine H100 confidential-computing attestations from a rented server running their TDX VM. They combined these with forged TDX quotes. A proxy running outside any TEE then passed both the TDX and the GPU attestation checks. The authors attribute this to NVIDIA not binding the H100 to the identities of specific VMs. Their site states more generally that NVIDIA's attestation reports are not bound to a specific confidential VM or CPU. Intel, AMD, NVIDIA and the affected deployments acknowledged the findings, according to the authors, and the affected deployments were working on mitigations. The attack does not target NVIDIA's confidential-computing components directly, so the authors state that there are no mitigations on the NVIDIA side S-1202.
significant / open / demonstrated attack
Side channels and other attacks by the host on CPU and GPU TEEs
PAL*M and Attestable Audits cite published side-channel, single-stepping, interrupt-injection and memory-aliasing attacks on Intel TDX and AMD SEV, including T-Time, TDXploit, CIPHER-LEAKS, Heckler and BadRAM. PAL*M treats them as out of scope S-0012. Attestable Audits proposes revoking vulnerable enclave images S-0009. Gloria Z notes that performance counters have themselves been used as a side channel, for example in CounterSEVeillance S-0014. New attacks of this kind continue to appear. In StackWarp, researchers at CISPA showed that a malicious hypervisor can shift the stack pointer of an SEV-SNP guest on AMD Zen 1 to Zen 5 processors with simultaneous multithreading enabled, which fully breaks the guest's integrity. AMD released microcode patches S-3123. On the GPU side, an independent analysis of NVIDIA's confidential computing by IBM Research and Ohio State University found that bulk command and data transfers are protected, but some metadata, timing behaviour and coordination signals remain in unprotected shared memory. The authors report that these can reveal computational behaviour and in some cases allow manipulation of operations. They disclosed the findings to NVIDIA S-3129.
significant / open / theoretical argument
Attestation covers launch state, and measurements can be incomplete
Attestation measures launch state, not runtime state. Data loaded later, such as model weights, must be bound separately S-0013. Gloria Z argues that gaps in measuring feature flags, environment variables and invocation arguments are "perhaps the most likely failure mode". She also warns that a badly designed hashing scheme could let two models with significantly different properties share a hash "without breaking the hash function itself" S-0014. Independent reviews of production systems have found such gaps. In WhatsApp's deployment, Trail of Bits found environment variables and ACPI tables loaded outside the measurement, and rated both high severity. Meta fixed them S-3121 S-3124. On an Apple PCC node running in Apple's research environment, a researcher reports that tampered configuration files left the attestation unchanged S-1804.
significant / open / theoretical argument
Deployment-level attestation does not cover the whole chip
An attestation shows what one confidential VM runs. It does not show what else the hypervisor runs on the same hardware. Gloria Z calls the difference between deployment-level attestation and chip-wide monitoring "the gaping hole in this plan" S-0014. This matters most for negative claims such as the absence of training.
significant / open / theoretical argument
Root of trust concentrated in a few hardware vendors
The root of trust is the certificate authorities of a small number of vendors (AMD, Intel and NVIDIA), which generate the keys and fuse them onto the chips. Gloria Z notes that whoever has access to a hardware key, or can certify one, can in principle produce valid reports for arbitrary measurements without the physical chip S-0014. Attestable Audits notes that the approach holds only "as long as the vendor of the secure hardware is trusted" S-0009. A 2026 preprint reports that a host with root control and the ability to rewrite platform flash can downgrade an AMD EPYC Milan processor to legacy security-processor firmware and extract the hardware root seed from which SEV-SNP attestation keys are derived. The authors state that this lets them forge attestation reports for any firmware version S-3130. AMD describes the firmware-loader flaw the attack starts from as a legacy attack mitigated in 2021 S-3131.
What still blocks use or stronger assurance
Vendor threat models exclude sophisticated physical attacks, but in international verification the prover holds the hardware.
Dependency: Hardware-enabled guarantees (flexHEG) and guarantee processors
S-1200S-1204S-1202S-3126S-1210S-1211Negative claims such as "no undeclared training" need chip-wide accounting of all workloads, which attestation does not provide.
Dependency: On-chip telemetry from timing, memory and performance counters
S-0014- S-1200S-3122
Multi-GPU and multi-node coverage is incomplete, because Hopper leaves NVLink traffic unencrypted and NVIDIA's April 2026 release notes list no multi-node confidential mode.
- S-0014
Rival parties have not agreed on trust roots and key provenance they would accept.
- S-0009
CPU-only enclaves are costly for large models, because in the Attestable Audits prototype CPU inference cost 21.7 times as much per token as GPU inference and the enclave roughly doubled the CPU cost.
Connections in the research map
Complementary techniques
Alternative approaches
Concepts used
Organizations and developers
Implementations
The Consortium’s case files
Related editorial reviews use the Consortium’s own descriptive scores and review dates. Their scores are separate from the atlas readiness rubric.
FM-04 / ControlMandatory firmware enlightenmentRead case file ↗WV-06 / WorkloadInspect everything, reveal nothingRead case file ↗RT-09 / AttestationTamperproof certificates, continuouslyRead case file ↗Sources and provenance
- S-1200 / Tier B
NVIDIA Secure AI with Blackwell and Hopper GPUs (White Paper) ↗
NVIDIA · 2025 · NVIDIA documentation
Supports: GPU CC architecture, CPU-TEE pairing, multi-GPU modes, threat model scope, performance counters in CC mode and NVIDIA's side-channel reason
Locator: pp. 6-18
Version and catalogue details - S-1201 / Tier C
Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AI ↗
E. Apsey, P. Rogers, M. O'Connor, R. Nertney · 2023 · NVIDIA Technical Blog
Supports: H100 root of trust, device identity key, attestation report, launch performance
Locator: blog, sections on root of trust and performance
Version and catalogue details - S-1202 / Tier A
TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition ↗
J. Chuang, A. Seto, N. Berrios, S. van Schaik, C. Garman, D. Genkin · 2026 · 2026 IEEE Symposium on Security and Privacy (SP)
Supports: TEE design aim; memory-bus interposition attack; Intel PCK extraction and forged SGX/TDX attestations; SEV-SNP OpenSSL key recovery; H100 attestation relay; disclosure and vendor positions
Locator: Abstract; §1.1-1.2; §3; §8.3; §10.2; site FAQ
Version and catalogue details - S-1210 / Tier A
Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing ↗
J. De Meulemeester, D. Oswald, I. Verbauwhede, J. Van Bulck · 2026 · 47th IEEE Symposium on Security and Privacy (S&P 2026)
Supports: Battering RAM: DDR4 interposer cost; Scalable SGX plaintext access and provisioning-key extraction; SEV-SNP attestation breach by launch-digest replay; DDR4-only scope; Intel and AMD positions
Locator: Abstract; §1 contributions; site FAQ
Version and catalogue details - S-1211 / Tier A
WireTap: Breaking Server SGX via DRAM Bus Interposition ↗
A. Seto, O. K. Duran, S. Amer, J. Chuang, S. van Schaik, D. Genkin, C. Garman · 2025 · 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25)
Supports: WireTap: DDR4 interposer cost; extraction of the SGX Quoting Enclave attestation key and forged quotes; DDR5 Xeons not affected; Intel position and mitigation
Locator: Abstract; site FAQ
Version and catalogue details - S-1212 / Tier A
RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP ↗
B. Schlüter, S. Shinde · 2025 · 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25)
Supports: RMPocalypse: software-only RMP corruption by a malicious hypervisor; forged SEV-SNP attestation, debug, memory access and register replay; affected Zen generations; CVE
Locator: Abstract; site; responsible disclosure
Version and catalogue details - S-1213 / Tier B
SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020) ↗
AMD · 2025 · AMD product security bulletin
Supports: AMD's severity rating and firmware mitigations for CVE-2025-0033 (vendor-reported)
Locator: Mitigation tables; revision history
Version and catalogue details - S-0009 / Tier B
Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments ↗
C. Schnabl, D. Hugenroth, B. Marino, A. R. Beresford · 2025 · ICML 2025 Workshop on Technical AI Governance
Supports: audit protocol, AWS Nitro prototype, overheads, vendor trust, cited TEE attacks and image revocation
Locator: §2, §3, §5 Table 2, §7
Version and catalogue details - S-0012 / Tier B
PAL*M: Property Attestation for Large Generative Models ↗
P. Chantasantitam, A. I. Caulfield, V. Duddu, L. J. Gunn, N. Asokan · 2026 · arXiv
Supports: property attestation on TDX + H100, REPORTDATA binding, overheads, threat model exclusions, code status
Locator: Abstract; §3-§6, Tables 2-6
Version and catalogue details - S-0013 / Tier C
How Tinfoil Proves Exactly What Model Is Running ↗
Tinfoil Team · 2026 · Tinfoil
Supports: launch-state vs runtime; dm-verity weight binding
Locator: sections on the challenge and the three phases
Version and catalogue details - S-0014 / Tier C
On TEEs for Privacy-Preserving Monitoring in AI Governance ↗
Gloria Z · 2026 · MIRI Technical Governance Team
Supports: international threat model, vendor root of trust, measurement incompleteness, hashing-scheme warning, deployment vs chip-wide gap, process-level enforcement, counter side channels
Version and catalogue details - S-0010 / Tier A
GuardAIn: Protecting Emerging Generative AI Workloads on Heterogeneous NPU ↗
A. Dhar, C. Thorens, L. M. Lazier, L. Cavigelli · 2025 · 2025 IEEE Symposium on Security and Privacy
Supports: device-only NPU TEE with task attestation; overheads; threat model
Locator: Abstract; threat model; evaluation
Version and catalogue details - S-0006 / Tier B
Hardware-Enabled Mechanisms for Verifying Responsible AI Development ↗
A. O'Gara, G. Kulp, W. Hodgkins, J. Petrie, V. Immler, A. Aysu, K. Basu, S. Bhasin, S. Picek, A. Srivastava · 2025 · arXiv
Supports: open question on TEEs for verifying AI training at scale
Locator: §2.2.4
Version and catalogue details - S-0056 / Tier B
Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced Computing ↗
O. Aarne, T. Fist, C. Withers · 2024 · Center for a New American Security
Supports: existing technologies need hardening for adversarial settings
Locator: Key findings
Version and catalogue details - S-0057 / Tier B
Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090 ↗
G. Kulp, D. Gonzales, E. Smith, L. Heim, P. Puri, M. J. D. Vermeer, Z. Winkelman · 2024 · RAND Corporation
Supports: physical-access key extraction caveat for encrypted memory
Locator: p. 20
Version and catalogue details - S-1203 / Tier C
Exploration of secure hardware solutions for safe AI deployment ↗
Future of Life Institute · 2023 · Future of Life Institute
Supports: FLI and Mithril SGX proof-of-concept and its stated limitations
Version and catalogue details - S-1204 / Tier B
Technical Options for Flexible Hardware-Enabled Guarantees ↗
J. Petrie, O. Aarne · 2025 · arXiv
Supports: TEE-backed software vs physical access; early-access CC lacked multi-node
Locator: sections on software/TEE options
Version and catalogue details - S-1206 / Tier B
A primer on secure enclaves ↗
Tinfoil · 2026 · Tinfoil documentation
Supports: Tinfoil hardware, trust model, report signing keys, documented limitations (provider-reported)
Locator: Supported hardware; Trust model; Limitations
Version and catalogue details - S-1207 / Tier B
Backend infrastructure ↗
Tinfoil · 2026 · Tinfoil documentation
Supports: memory encryption against host software, reproducible builds and transparency log, client verification, boot-time GPU attestation check (provider-reported)
Version and catalogue details - S-1208 / Tier B
How verification works in Tinfoil ↗
Tinfoil · 2026 · Tinfoil documentation
Supports: production deployment of Tinfoil's inference enclaves (provider-reported)
Locator: In-band vs. out-of-band verification
Version and catalogue details - S-1209 / Tier B
modelwrap: Reproducible dm-verity read-only image of Huggingface models ↗
Tinfoil · 2026 · GitHub
Supports: public open-source implementation (v0.3.0)
Version and catalogue details - S-1815 / Tier C
Now in General Availability: NVIDIA H100 GPUs in Microsoft Azure Confidential Virtual Machines ↗
C. Su · 2024 · NVIDIA Blog
Supports: general availability of Azure confidential VMs with H100 GPUs (vendor-reported)
Version and catalogue details - S-1816 / Tier C
Private AI Compute: our next step in building private and helpful AI ↗
J. Yagnik · 2025 · Google blog (The Keyword)
Supports: Google Private AI Compute: remote attestation to a sealed TPU environment (provider-reported)
Version and catalogue details - S-1800 / Tier C
Private Cloud Compute: A new frontier for AI privacy in the cloud ↗
Apple Security Engineering and Architecture (SEAR) · 2024 · Apple Security Research blog
Supports: Apple PCC: devices send requests only to nodes attesting to software in a public transparency log (provider-reported)
Version and catalogue details - S-1802 / Tier C
Expanding Private Cloud Compute ↗
Apple Security Engineering and Architecture (SEAR) · 2026 · Apple Security Research blog
Supports: Apple PCC extended to Google Cloud on NVIDIA confidential computing and Intel TDX (provider-reported)
Version and catalogue details - S-1804 / Tier C
Beyond Prompt Injection: Hacking Apple's Private Cloud Compute ↗
D. Selmanaj · 2026 · Sentry blog
Supports: independent finding that a PCC node with tampered configuration passed attestation; fix
Version and catalogue details - S-1817 / Tier C
Confidential Inference via Trusted Virtual Machines ↗
Anthropic, Pattern Labs · 2025 · Anthropic research
Supports: Anthropic's confidential inference design sketch (provider-reported)
Version and catalogue details - S-3120 / Tier B
Private Processing for WhatsApp: Technical White Paper and Security Guide ↗
Meta · 2026 · Meta
Supports: WhatsApp Private Processing hardware and client attestation checks (provider-reported)
Version and catalogue details - S-3121 / Tier C
What we learned about TEE security from auditing WhatsApp's Private Inference ↗
Trail of Bits · 2026 · Trail of Bits blog
Supports: Trail of Bits audit of WhatsApp Private Processing: finding counts, unmeasured configuration data, missing freshness, fixes, SEV-SNP physical-attack caveat
Version and catalogue details - S-3124 / Tier B
Meta WhatsApp Private Processing (security review) ↗
Trail of Bits · 2025 · Trail of Bits publications library
Supports: Trail of Bits' finding counts by severity and titles of the eight high-severity findings, including unmeasured environment variables and ACPI tables and unverified GPU attestation
Version and catalogue details - S-3122 / Tier B
NVIDIA Trusted Computing Solutions Release Notes (R595 TRD1) ↗
NVIDIA · 2026 · NVIDIA documentation
Supports: confidential modes generally available in NVIDIA's R595 release (April 2026); no multi-node mode listed (vendor-reported)
Version and catalogue details - S-3123 / Tier A
StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine ↗
R. Zhang, T. Hornetz, D. Weber, F. Thomas, M. Schwarz · 2026 · 35th USENIX Security Symposium (USENIX Security '26)
Supports: StackWarp: software-only integrity break of SEV-SNP guests on Zen 1-5; AMD microcode patches
Version and catalogue details - S-3126 / Tier A
DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes ↗
J. De Meulemeester, S. Gloor, P. Jattke, D. Moghimi, D. Oswald, M. Thompson, K. Razavi, I. Verbauwhede, J. Van Bulck · 2026 · 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS '26)
Supports: DDRop: active DDR5 interposer cost; debug-mode forcing and forged attestation reports on up-to-date TDX; SGX and SEV-SNP integrity breaks; vendor positions and advisories
Locator: Abstract; threat model; case studies; site FAQ
Version and catalogue details - S-3127 / Tier A
Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP ↗
B. Schlüter, C. Wech, S. Shinde · 2026 · 35th USENIX Security Symposium (USENIX Security '26)
Supports: Fabricked: software-only Infinity Fabric misconfiguration; arbitrary read and write and forged SEV-SNP attestation on Zen 5
Locator: Abstract; evaluation
Version and catalogue details - S-3128 / Tier B
SEV-SNP Routing Misconfiguration (AMD-SB-3034) ↗
AMD · 2026 · AMD product security bulletin
Supports: AMD's severity rating and firmware mitigations for CVE-2025-54510 (vendor-reported)
Locator: Summary; mitigation tables
Version and catalogue details - S-3129 / Tier A
Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing ↗
Z. Gu, E. Valdez, S. Ahmed, J. J. Stephen, M. V. Le, H. Jamjoom, S. Zhao, Z. Lin · 2026 · Proceedings of the 9th MLSys Conference (MLSys 2026)
Supports: independent security analysis of NVIDIA GPU confidential computing: residual metadata, timing and coordination leaks; disclosure to NVIDIA
Locator: Abstract; conclusion
Version and catalogue details - S-3130 / Tier B
Insecure Despite Proven Updated: Extracting the Root VCEK Seed on EPYC Milan via a Software-Only Attack ↗
M. Shen, Y. Qin · 2026 · arXiv
Supports: software-only extraction of the SEV-SNP VCEK root seed on EPYC Milan via firmware downgrade; forged reports for any firmware version
Locator: Abstract; contributions; disclosure
Version and catalogue details - S-3131 / Tier B
MilanLaunchy Firmware Loader (AMD-SB-3045) ↗
AMD · 2026 · AMD product security bulletin
Supports: AMD's view of MilanLaunchy as a legacy attack mitigated in 2021 (vendor-reported)
Locator: Summary
Version and catalogue details
- Source review date
- 2026-09-25
- Drafted by (source map)
- ai
- Review handles (source map)
- codex-review