Pith. sign in

REVIEW 1 major objections 47 references

EnclaveX: End-to-End Confidential AI with CPU/GPU TEEs

T0 review · 1 major / 0 minor · reviewed 2026-07-01 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read EnclaveX workflow combines CPU and GPU TEEs to run AI without trusting cloud providers.

desk verdict EnclaveX sketches a combined CPU/GPU TEE workflow for confidential AI and flags Kubernetes admin access as a real threat, but the abstract supplies no performance numbers or security evidence. read the letter →

arxiv 2606.31408 v1 pith:D7NYD2PQ submitted 2026-06-30 cs.CR cs.OS

Robert Schambach (TU Dresden) , Quoc Do Le (STACKIT Cloud) , Sergei Arnautov (Scontain GmbH) , Christof Fetzer (TU Dresden , Scontain GmbH) This is my paper · ORCID
classification cs.CRcs.OS
keywords confidentialAItrustedexecutionenvironmentsCPUTEEGPUIntelTDXNVIDIAH200cloudsecurityLLMprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes a complete workflow for executing large language models on public cloud infrastructure while keeping both the model weights and the input data private. It integrates hardware TEEs on CPUs such as Intel TDX and AMD SEV-SNP with GPU TEEs such as NVIDIA H200, adding extra controls at the VM and application layers. The authors identify and close specific gaps, including the ability of Kubernetes administrators to inspect confidential VM memory. This matters because current AI deployments force organizations to hand sensitive code and data to cloud operators they cannot fully audit. The evaluation measures the resulting performance cost on industry benchmarks for the Intel TDX plus H200 configuration.

What carries the argument

The end-to-end CPU-GPU TEE workflow with VM-level and application-level confidentiality mechanisms.

What would settle it

A demonstration that a Kubernetes administrator can still read model weights or input data inside an EnclaveX-protected VM running on the described hardware would falsify the confidentiality claim.

Watch

Extended reading notes

Core claim

The authors present an end-to-end workflow that combines CPU TEEs (Intel TDX and AMD SEV-SNP) and GPU TEEs (NVIDIA H200) with mechanisms to enforce confidentiality and integrity at both the VM level and the application level, addressing vulnerabilities such as Kubernetes administrators' access to confidential VM contents.

Load-bearing premise

The hardware TEEs together with the added mechanisms actually prevent the listed threats, including Kubernetes administrator access, without introducing new side channels or integration flaws.

Editorial extensions

If this is right

  • Organizations can run sensitive LLM workloads on public clouds while retaining control over their data and code.
  • Remote attestation becomes available to verify the integrity of the combined CPU and GPU environment before execution.
  • Performance overhead remains measurable and bounded for the Intel TDX plus NVIDIA H200 setup on standard AI benchmarks.
  • Application-level protections close gaps that VM-level TEEs alone leave open in container orchestration systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same pattern could support fine-tuning workflows that keep both the base model and the private dataset hidden from the cloud operator.
  • Attestation chains spanning CPU and GPU TEEs may need new tooling for automated verification in production pipelines.
  • If the approach scales, regulated sectors could shift more AI inference away from on-premise hardware.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

1 major / 0 minor

Summary. The paper presents EnclaveX, an end-to-end workflow integrating CPU TEEs (Intel TDX, AMD SEV-SNP) and GPU TEEs (NVIDIA H200) for confidential AI/LLM applications in untrusted clouds. It proposes mechanisms to enforce confidentiality and integrity at both VM and application levels, identifies vulnerabilities such as Kubernetes administrators accessing confidential VM contents, and claims to evaluate performance overhead using industry benchmarks.

Significance. If the proposed mechanisms deliver the claimed security properties without introducing new vulnerabilities and if the performance evaluation demonstrates acceptable overhead, the work could provide a concrete, deployable approach to reducing trust in cloud providers for sensitive AI workloads, addressing a noted gap in integrated CPU/GPU TEE systems.

major comments (1)
  1. [Abstract] Abstract: The text states that performance overhead was evaluated with industry benchmarks but supplies no data, methods, error bars, results, or figures; the central claims about security guarantees and overhead cannot be assessed.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for their feedback. We address the single major comment below.

read point-by-point responses

  1. Referee: [Abstract] Abstract: The text states that performance overhead was evaluated with industry benchmarks but supplies no data, methods, error bars, results, or figures; the central claims about security guarantees and overhead cannot be assessed.

    Authors: We agree that the current abstract summarizes the evaluation at a high level without quantitative results, which limits immediate assessment of the overhead and security claims. The body of the manuscript contains the detailed benchmark methodology, results (including overhead measurements for Intel TDX + NVIDIA H200 configurations), and security analysis. To address the concern, we will revise the abstract to include key performance figures and a concise statement of the security guarantees. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity

full rationale

This is a systems paper describing an end-to-end workflow for confidential AI using CPU TEEs (Intel TDX, AMD SEV-SNP) and GPU TEEs (NVIDIA H200), along with proposed mechanisms for VM- and application-level confidentiality and performance benchmarks. No equations, derivations, fitted parameters, predictions, or mathematical claims appear in the provided text. The work contains no self-definitional steps, fitted-input predictions, load-bearing self-citations, uniqueness theorems, or ansatz smuggling; all content is descriptive and externally falsifiable via implementation and measurement.

Assumptions & free parameters 0 free parameters · 1 assumptions · 1 invented entities

Review is abstract-only; ledger reflects only assumptions stated or implied in the provided text.

assumptions (1)
  • domain assumption Trusted Execution Environments from Intel, AMD, and NVIDIA provide confidentiality and integrity as claimed by their vendors
    The entire proposal rests on this hardware guarantee to enable confidential AI.
invented entities (1)
  • EnclaveX
    purpose: End-to-end workflow combining CPU and GPU TEEs with additional application-level protections
    New system name and integration approach introduced in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EnclaveX: End-to-End Confidential AI with CPU/GPU TEEs." pith.science (2026). https://pith.science/paper/D7NYD2PQ

@misc{pith2026260631408,
  author       = {Pith},
  title        = {Pith review of: EnclaveX: End-to-End Confidential AI with CPU/GPU TEEs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D7NYD2PQ}},
  note         = {Machine review of arXiv:2606.31408}
}
read the original abstract

Large Language Models (LLMs) have rapidly proliferated, driving widespread adoption of AI applications. Most deployments rely on centralized infrastructures such as Microsoft Azure, Google Cloud, or AWS, requiring users to share sensitive data and training or fine-tuning code. This dependence raises significant security and privacy concerns, as cloud providers must be trusted to ensure confidentiality and integrity. Trusted Execution Environments (TEEs) e.g., Intel SGX/TDX, AMD SEV-SNP, and ARM CCA have been introduced to mitigate these risks. More recently, NVIDIA has developed GPU TEEs (e.g., H100/H200), yet comprehensive evaluations of end-to-end workflows that integrate CPU and GPU TEEs remain limited. Critical aspects, including performance overhead, remote attestation, and security guarantees for AI/LLM applications, have not been sufficiently studied. This paper addresses this gap by presenting an end-to-end workflow that combines CPU and GPU TEEs. We propose mechanisms to ensure confidentiality and integrity at both the VM level (via Intel TDX and AMD SEV-SNP) and the application level, highlighting vulnerabilities such as Kubernetes administrators' ability to access confidential VM contents. Finally, we evaluate the performance overhead of our system using industry benchmarks, focusing on configurations that integrate Intel TDX with NVIDIA H200 GPUs.

Figures

Figures reproduced from arXiv: 2606.31408 by the authors.

Figure 1
Figure 1. Secure AI/ML system design of EnclaveX using SCONE applications with secrets after successful attestation and disables memory dumping in the Guest kernel. Hence, this architecture ensures the protection of sensitive data and com￾putations throughout the ML lifecycle, including inference, training, and fine-tuning. To facilitate robust remote attestation of ML applications, a custom kernel module is implemented withi… view at source ↗
Figure 2
Figure 2. LLM inference benchmarking results on the SYS-322GA-NR. We measure performance across three modes: (1) native, wherein the Guest is a native VM and the GPU is not in CC mode, (2) cvm, wherein the Guest is a TDX, the GPU is in CC mode, and (3) scone, consisting of the the EnclaveX-modified TDX and GPU in CC mode. We issue 500 × 𝑏𝑎𝑡𝑐ℎ_𝑠𝑖𝑧𝑒 requests per benchmark, e.g., 32000 requests for batch size 64. The bar graphs … view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 47 canonical work pages

  1. [1]

    Whitepaper

    Advanced Micro Devices, Inc.AMD SEV-TIO: Trusted I/O for Secure Encrypted Virtualization, 2023. Whitepaper

    work page 2023

  2. [2]

    In Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 4 (2023), ACM

    Ahmad, A., Ou, B., Liu, C., Zhang, X., and Fonseca, P.Veil: A protected services framework for confidential virtual machines. In Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 4 (2023), ACM

    work page 2023

  3. [3]

    L., Goltzsche, D., Eyers, D., Kapitza, R., Pietzuch, P., and Fetzer, C.SCONE: Secure linux containers with intel SGX

    Arnautov, S., Trach, B., Gregor, F., Knauth, T., Martin, A., Priebe, C., Lind, J., Muthukumaran, D., O’Keeffe, D., Stillwell, M. L., Goltzsche, D., Eyers, D., Kapitza, R., Pietzuch, P., and Fetzer, C.SCONE: Secure linux containers with intel SGX. In12th USENIX Symposium on Operating Systems Design and Implementation (OSDI) (2016), USENIX Association

    work page 2016

  4. [4]

    Remote attestation procedures (RATS) architecture

    Birkholz, H., Thaler, D., Richardson, M., Smith, N., and Pan, W. Remote attestation procedures (RATS) architecture. RFC 9334, 2023

    work page 2023

  5. [5]

    In11th {USENIX} Workshop on Offensive Technologies (WOOT)(2017), USENIX Association

    Brasser, F., Müller, U., Dmitrienko, A., Kostiainen, K., Capkun, S., and Sadeghi, A.-R.Software grand exposure: {SGX} cache attacks are practical. In11th {USENIX} Workshop on Offensive Technologies (WOOT)(2017), USENIX Association

    work page 2017

  6. [6]

    Borg, Omega, and Kubernetes.Communications of the ACM(2016)

    Burns, B., Grant, B., Oppenheimer, D., Brewer, E., and Wilkes, J. Borg, Omega, and Kubernetes.Communications of the ACM(2016)

    work page 2016

  7. [7]

    InProceedings of the Eighteenth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)(2013), ACM

    Checkoway, S., and Shacham, H.Iago attacks: Why the system call API is a bad untrusted RPC interface. InProceedings of the Eighteenth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)(2013), ACM

    work page 2013

  8. [8]

    H.SgxPec- tre: Stealing intel secrets from SGX enclaves via speculative execution

    Chen, G., Chen, S., Xiao, Y., Zhang, Y., Lin, Z., and Lai, T. H.SgxPec- tre: Stealing intel secrets from SGX enclaves via speculative execution. InIEEE European Symposium on Security and Privacy (Euro S&P)(2019), IEEE

    work page 2019

Show all 47 references
  1. [9]

    In2025 IEEE International Symposium on Workload Characterization (IISWC)(2025), IEEE

    Chrapek, M., Copik, M., Mettaz, E., and Hoefler, T.Confidential LLM inference: Performance and cost across CPU and GPU TEEs. In2025 IEEE International Symposium on Workload Characterization (IISWC)(2025), IEEE

    2025

  2. [10]

    Confidential computing: Hardware-based trusted execution for applications and data

    Confidential Computing Consortium. Confidential computing: Hardware-based trusted execution for applications and data. Tech. rep., Confidential Computing Consortium, 2022

    2022

  3. [11]

    Confidential Containers.https: //confidentialcontainers.org/, 2022

    Confidential Containers Project. Confidential Containers.https: //confidentialcontainers.org/, 2022

    2022

  4. [12]

    Trustee: Confidential containers attestation agent.https://github.com/confidential-containers/trustee,

    Confidential Containers Project. Trustee: Confidential containers attestation agent.https://github.com/confidential-containers/trustee,

  5. [13]

    {AEX- Notify}: Thwarting precise {Single-Stepping} attacks through inter- rupt awareness for intel {SGX} enclaves

    Constable, S., V an Bulck, J., Cheng, X., Xiao, Y., Xing, C., Alexan- drovich, I., Kim, T., Piessens, F., Vij, M., and Silberstein, M. {AEX- Notify}: Thwarting precise {Single-Stepping} attacks through inter- rupt awareness for intel {SGX} enclaves. In32nd USENIX Security Symp...

    2023

  6. [14]

    C.On the security of public key protocols

    Dolev, D., and Y ao, A. C.On the security of public key protocols. In Proceedings of the 22nd Annual Symposium on Foundations of Computer Science (SFCS)(1981), IEEE

    1981

  7. [15]

    L., and Fetzer, C.SinClave: Hardware-assisted singletons for TEEs

    Gregor, F., Krahn, R., Quoc, D. L., and Fetzer, C.SinClave: Hardware-assisted singletons for TEEs. InProceedings of the 24th International Middleware Conference(2023), ACM

    2023

  8. [16]

    In50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)(2020), IEEE

    Gregor, F., Ozga, W., V aucher, S., Pires, R., Arnautov, S., Martin, A., Schiavoni, V., Felber, P., Fetzer, C., et al.Trust management as a service: Enabling trusted execution in the face of byzantine stakehold- ers. In50th Annual IEEE/IFIP International Conference on Dependab...

    2020

  9. [17]

    J., Le, M., Jamjoom, H., Zhao, S., and Lin, Z.NVIDIA GPU confidential computing demystified, 2025

    Gu, Z., V aldez, E., Ahmed, S., Stephen, J. J., Le, M., Jamjoom, H., Zhao, S., and Lin, Z.NVIDIA GPU confidential computing demystified, 2025

    2025

  10. [18]

    M., Stephen, J

    Ibarra, A. M., Stephen, J. J., Vidal, A. G., Jayaram, K. R., and Góomez, A. F. S.Performance of confidential computing GPUs. In2025 IEEE 45th International Conference on Distributed Computing Systems Workshops (ICDCSW)(2025), IEEE

    2025

  11. [19]

    Intel Corporation.Intel®Trust Domain Extensions (Intel®TDX),

  12. [20]

    Software enabling for intel®TDX in support of TEE-I/O, 2022

    Intel Corporation. Software enabling for intel®TDX in support of TEE-I/O, 2022. Whitepaper

    2022

  13. [21]

    Intel Software Guard Extensions

    Intel Corporation. Intel Software Guard Extensions. https://www.intel.com/content/www/us/en/developer/tools/ software-guard-extensions/overview.html, 2024

    2024

  14. [22]

    Intel(r) confidential computing TEE DCAP repos- itory.https://github.com/intel/confidential-computing.tee.dcap, 2025

    Intel Corporation. Intel(r) confidential computing TEE DCAP repos- itory.https://github.com/intel/confidential-computing.tee.dcap, 2025. Version 1.24

    2025

  15. [23]

    Whitepaper, Advanced Micro Devices, Inc., 2020

    Kaplan, D.AMD SEV-SNP: Strengthening VM isolation with integrity protection and more. Whitepaper, Advanced Micro Devices, Inc., 2020

    2020

  16. [24]

    In 40th IEEE Symposium on Security and Privacy (S&P’19)(2019), IEEE

    Kocher, P., Horn, J., Fogh, A., Genkin, D., Gruss, D., Haas, W., Hamburg, M., Lipp, M., Mangard, S., Prescher, T., Schwarz, M., and Yarom, Y.Spectre attacks: Exploiting speculative execution. In 40th IEEE Symposium on Security and Privacy (S&P’19)(2019), IEEE

    2019

  17. [25]

    InPro- ceedings of the 21st International Middleware Conference (Middleware) (2020), ACM

    Le Quoc, D., Gregor, F., Arnautov, S., Kunkeland, R., Bhatotia, P., and Fetzer, C.secureTF: A secure TensorFlow framework. InPro- ceedings of the 21st International Middleware Conference (Middleware) (2020), ACM

    2020

  18. [26]

    InThe World Wide Web Conference (WWW) (2019), ACM

    Le Quoc, D., Gregor, F., Singh, J., and Fetzer, C.Sgx-pyspark: Secure distributed data analytics. InThe World Wide Web Conference (WWW) (2019), ACM

    2019

  19. [27]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783(2024)

    Llama Team, AI@Meta. The llama 3 herd of models.arXiv preprint arXiv:2407.21783(2024)

    2024 arXiv

  20. [28]

    M.Securing AI inference in the cloud: Is CPU-GPU confidential computing ready? In2024 IEEE 17th International Conference on Cloud Computing (CLOUD)(2024), IEEE

    Mohan, A., Ye, M., Franke, H., Srivatsa, M., Liu, Z., and Gonzalez, N. M.Securing AI inference in the cloud: Is CPU-GPU confidential computing ready? In2024 IEEE 17th International Conference on Cloud Computing (CLOUD)(2024), IEEE

    2024

  21. [29]

    Whitepa- per, NVIDIA Corporation, 2023

    Nertney, R.Confidential compute on NVIDIA hopper H100. Whitepa- per, NVIDIA Corporation, 2023

    2023

  22. [30]

    TensorRT-LLM.https://github.com/NVIDIA/ TensorRT-LLM, 2023

    NVIDIA Corporation. TensorRT-LLM.https://github.com/NVIDIA/ TensorRT-LLM, 2023. Version 0.17.0

    2023

  23. [31]

    GenAI-Perf: Generative AI performance benchmark tool.https://github.com/triton-inference-server/perf_ analyzer/tree/main/genai-perf, 2024

    NVIDIA Corporation. GenAI-Perf: Generative AI performance benchmark tool.https://github.com/triton-inference-server/perf_ analyzer/tree/main/genai-perf, 2024. Version 2.54.0 (NVIDIA Release 25.01, Build 138762431)

    2024

  24. [32]

    Llama-3.1-8b-instruct-fp8.https:// huggingface.co/nvidia/Llama-3.1-8B-Instruct-FP8, 2024

    NVIDIA Corporation. Llama-3.1-8b-instruct-fp8.https:// huggingface.co/nvidia/Llama-3.1-8B-Instruct-FP8, 2024

    2024

  25. [33]

    NVIDIA H200 GPU: Supercharging AI and HPC workloads, 2024

    NVIDIA Corporation. NVIDIA H200 GPU: Supercharging AI and HPC workloads, 2024

    2024

  26. [34]

    NVIDIA confidential computing.https://www

    NVIDIA Corporation. NVIDIA confidential computing.https://www. nvidia.com/en-in/data-center/solutions/confidential-computing/, 2025

    2025

  27. [35]

    NVIDIA Corporation.NVIDIA Online Certificate Status Protocol (OCSP) Service, 2025

    2025

  28. [36]

    [37]NVIDIA Corporation.NVIDIA Trusted Computing Solutions Release Notes, 2025

    NVIDIA Corporation.NVIDIA Reference Integrity Manifest (RIM) Service, 2025. [37]NVIDIA Corporation.NVIDIA Trusted Computing Solutions Release Notes, 2025. Version 590

    2025

  29. [37]

    Triton inference server.https://github.com/ triton-inference-server/server, 2025

    NVIDIA Corporation. Triton inference server.https://github.com/ triton-inference-server/server, 2025. Version 2.54.0 (NVIDIA Release 25.01, Build 138762431)

    2025

  30. [38]

    InProceedings of the USENIX Annual Technical Conference (USENIX ATC)(2018), USENIX Association

    Oleksenko, O., Trach, B., Krahn, R., Silberstein, M., and Fetzer, C.Varys: Protecting SGX enclaves from practical side-channel attacks. InProceedings of the USENIX Annual Technical Conference (USENIX ATC)(2018), USENIX Association

    2018

  31. [39]

    RFC 9397, 7 2023

    Pei, M., Tschofenig, H., Thaler, D., and Wheeler, D.Trusted execution environment provisioning (TEEP) architecture. RFC 9397, 7 2023

    2023

  32. [40]

    Version 1.20.0

    Peter, D.hyperfine.https://github.com/sharkdp/hyperfine, 2025. Version 1.20.0

    2025

  33. [41]

    IoT SuperServer SYS-322GA-NR.https://www

    SuperMicro. IoT SuperServer SYS-322GA-NR.https://www. supermicro.com/en/products/system/iot/3u/sys-322ga-nr, 2025

    2025

  34. [42]

    In2024 IEEE Interna- tional Symposium on Parallel and Distributed Processing with Applica- tions (ISPA)(2024), IEEE

    Tan, Y., and Mi, Z.Performance analysis and optimization of nvidia H100 confidential computing for AI workloads. In2024 IEEE Interna- tional Symposium on Parallel and Distributed Processing with Applica- tions (ISPA)(2024), IEEE

    2024

  35. [43]

    A.Leaky cauldron on the dark land: Understanding memory side-channel hazards in SGX

    W ang, W., Chen, G., Pan, X., Zhang, Y., W ang, X., Bindschaedler, V., Tang, H., and Gunter, C. A.Leaky cauldron on the dark land: Understanding memory side-channel hazards in SGX. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS)(2017), ACM

    2017

  36. [44]

    InProceedings 2025 Network and Distributed System Security Symposium(2025), Internet Society

    Wang, W., Song, L., Mei, B., Liu, S., Zhao, S., Yan, S., Wang, X., Meng, D., and Hou, R.The road to trust: Building enclaves within confidential VMs. InProceedings 2025 Network and Distributed System Security Symposium(2025), Internet Society

    2025

  37. [45]

    In2025 IEEE Inter- national Symposium on Performance Analysis of Systems and Software (ISPASS)(2025)

    Yang, Y., Sonji, M., and Jog, A.Dissecting performance overheads of confidential computing on GPU-based systems. In2025 IEEE Inter- national Symposium on Performance Analysis of Systems and Software (ISPASS)(2025)

    2025

  38. [46]

    In2022 IEEE Symposium on Security and Privacy (SP)(2022), IEEE

    Zhao, S., Li, M., Zhangyz, Y., and Lin, Z.vSGX: Virtualizing SGX enclaves on AMD SEV. In2022 IEEE Symposium on Security and Privacy (SP)(2022), IEEE

    2022

  39. [47]

    arXiv preprint arXiv:2409.03992(2024)

    Zhu, J., Yin, H., Deng, P., Almeida, A., and Zhou, S.Confidential computing on NVIDIA hopper GPUs: A performance benchmark study. arXiv preprint arXiv:2409.03992(2024). 8

    2024

Pith tools

Reviewed July 1, 2026 · model on record in the stance chip above.