From: aidotengineer
AI is transforming various sectors like healthcare, finance, automation, and digital marketing [00:00:09]. However, a significant barrier to its widespread adoption is trust [00:00:14]. Confidential AI, which leverages Trusted Execution Environments (TEs), aims to solve this by allowing models to run on sensitive data without exposure, deploying proprietary models without loss of control, and enabling collaboration in non-deterministic environments without relying on blind trust [00:00:21].
What are Trusted Execution Environments (TEs)?
TEs address a critical, often overlooked problem in AI: the vulnerability of data and models during processing (training, fine-tuning, or inference), rather than just during storage or transit [00:01:21].
At the hardware level, a TE is a secure and isolated part of a processor [00:01:43]. Examples include:
- Intel TDX [00:01:47]
- AMD SEV-SMP [00:01:49]
- Nvidia GPU TEs [00:01:51]
A TE creates a “confidential environment” where code and data are protected even during execution [00:01:53]. The chip itself provides isolation using instructions built in during manufacturing [00:02:03]. Once a workload enters this environment, it is protected in memory and is invisible to the host operating system, hypervisor, or anyone with system access, including the hardware owner [00:02:10].
Beyond isolation, a TE also generates a cryptographic attestation [00:02:24]. This is a signed proof that the workload ran inside verified hardware using unmodified code [00:02:30]. This attestation is crucial for two reasons:
- It provides strong assurances that the workload is truly protected by the hardware [00:02:40].
- It allows for verifiable statements about the nature of the workload, confirming it’s a real TE in a properly manufactured TE-capable chip [00:02:47].
In essence, TEs enable sensitive computations to run securely and prove that they ran as intended [00:03:14]. This means AI models can run on sensitive data without exposing either the model or the data [00:03:24]. This capability forms the foundation of confidential AI [00:03:34].
Real-World Problems Solved by Confidential AI
Confidential AI addresses several critical real-world challenges faced by developers:
Healthcare
Building or fine-tuning medical AI models is difficult due to data access [00:03:51]. Hospitals and labs are reluctant to share raw data sets, and clinical data access is tightly controlled, expensive, and often siloed [00:04:06]. Regulations and security policies prevent bringing models to the data [00:04:21]. This can lead to months of negotiation for small datasets, and working across multiple providers’ data sets is often impossible [00:04:28]. Confidential AI can help solve these data sharing obstacles [00:04:41].
Personal AI Agents
Mass adoption of personal AI agents (managing inboxes, calendars, documents) is hindered because they require deep access to private, sensitive data [00:04:50]. Users fear data exposure, developers worry about storage security, and enterprises/regulators demand strong guarantees against misuse or lawsuits [00:05:01]. Confidentiality is the missing piece for their real-world adoption [00:05:34].
Digital Marketing and Custom Analytics
Fine-tuning models on real user behavior data (tracking website and content interactions) is restricted by privacy laws, internal security rules, and ethical considerations [00:05:47]. This creates a significant gap between what is technically possible and what is legally or ethically allowed [00:06:00].
AI Model Monetization
Model owners want to monetize their proprietary models without losing control or giving away their IP [00:06:22]. Concurrently, customers are unwilling to expose their sensitive data for testing or production [00:06:47]. Confidential AI allows both parties to achieve their goals without relinquishing control [00:06:59].
Model Training and Provenance
Proving the origin and training methodology of an AI model, especially when sensitive data is involved, is a typically overlooked problem [00:07:10]. With attested execution (a core feature of TEs), it becomes possible to guarantee a model was truly trained where and how it was stated, ensuring the provenance of data and that inference outputs relate only to original data sets [00:07:37].
Traditional cloud setups, built on trust and legal contracts, fall short in these areas [00:07:56].
Super Protocol’s Implementation of TEs
Super Protocol is a confidential AI cloud and marketplace designed for secure collaboration and monetization of AI models, data, and compute [00:08:26]. It leverages TEs to provide a “GPUless, trustless, limitless” environment [00:00:43].
Key aspects of Super Protocol’s TE implementation:
- TE Agnostic Infrastructure
- Runs on Intel, Nvidia, and AMD TEs [00:08:41].
- Validated ARM confidential computing compatibility, aiming for end-to-end confidential AI from personal edge devices to the cloud [00:09:01].
- Decentralized Architecture
- Built on swarm computing principles, scaling across distributed GPU nodes without a single point of failure and automatic workload redistribution [00:09:27].
- Fully decentralized with no human intervention, orchestrated by smart contracts on BNB chain [00:09:40].
- Zero Barrier to Entry
- Developers don’t need TE expertise to run or attest workloads [00:09:51].
- Open Source Protocol
- All parts of Super Protocol are open source, functioning like HTTPS but for AI, protecting data during processing [00:10:03].
- “Trustless” Means Verifiable by Design
- Every workload produces a cryptographic proof, showing what ran, where, and how, without exposing the actual workload data [00:31:40].
- When a workload runs on Super Protocol, it generates a cryptographic attestation – a signed proof from the hardware itself [00:32:20]. This attestation verifies:
- The model executed in a real TE [00:32:35].
- Unmodified code was used [00:32:43].
- It ran on verified hardware inside a secure open-source runtime [00:32:44].
- Users don’t have to trust the provider or platform; they can verify it [00:32:51].
- If attempts to bypass the TE occur, the protocol prevents the application and data from loading and running, ensuring sensitive data is not exposed [00:32:58].
Multi-Party Collaboration Example
Super Protocol enables secure multi-party collaboration, such as training an AI model for early cancer detection using sensitive data from multiple parties (e.g., Alice’s lab, Bob’s clinic, Carol’s research center) [00:33:13].
- All inputs (data from Alice and Bob, training engine from Carol) run inside a TE [00:33:50].
- No one—not the cloud host, Super Protocol, or even the participants—can access the raw data, source code, or model weights inside the TE [00:34:02].
- Each party retains full custody of their assets outside the TE [00:34:07].
- Training is fully automated and verified by the engine, Super Protocol’s certification center, and smart contracts on BNB chains [00:34:17].
- A Confidential Virtual Machine (CVM) is launched and handles multiple jobs [00:34:49].
- On boot, the CVM contacts an open-source certification authority (also running in confidential mode) for a remote attestation [00:34:57]. If this check passes, a certificate is issued, proving the CVM is genuine and running inside an attested TE [00:35:05].
- Before any data enters, an open-source security mechanism inside the CVM, the “trusted loader,” is attested and gets its own certificate [00:35:17]. It then checks every component, automatically stopping the process if any check fails to safeguard all parties [00:35:31].
- Carol uploads her engine image to her encrypted storage, providing its hash and source code for verification by data owners [00:35:57]. Alice and Bob upload their encrypted data sets [00:36:40]. They grant access to the specified CVM using the verified engine’s hash [00:37:16]. Only that CVM has the private key to decrypt the data [00:37:37].
- When the job is submitted, the trusted loader verifies all hashes. Only if every hash matches does training start inside the TE [00:37:56]. Data and the engine are only decrypted inside the TE, protected from all parties, including the system owner [00:38:13].
- Only Carol receives the encrypted output (the newly trained model and artifacts) [00:38:27]. Encryption keys never leave the TE [00:38:35].
- Before training begins, an integrity report is signed inside the TE and later published on OPBNB as part of the order report [00:39:53]. This provides public, tamper-proof evidence that the job ran in a certified environment with approved inputs [00:40:06].
- After every job, all raw inputs are wiped [00:41:07].
Benefits of TEs in AI
TEs, particularly through platforms like Super Protocol, offer several key benefits for AI development and deployment:
- Data and Model Protection: Ensures data and models remain secure during execution, protected from host operators and even the platform itself [00:01:53].
- Enhanced Collaboration: Enables secure collaboration on sensitive data sets and proprietary models among multiple parties without exposing their underlying assets [00:01:02].
- Regulatory Compliance: Addresses privacy laws (like GDPR, CCPA) and internal security rules, allowing the use of sensitive data for training and analytics [00:06:00].
- Model Monetization: Allows model owners to monetize their IP without relinquishing control, while customers can use models on their sensitive data securely [00:06:59].
- Verifiable Execution: Provides cryptographic proof (attestation) that workloads ran as intended on verified hardware with unmodified code, replacing blind trust with provable guarantees [00:03:14]. This addresses trust issues in AI benchmark systems and proves provenance.
- Unlocks Siloed Data: By ensuring provable data privacy, TEs facilitate access to previously locked, sensitive data, leading to better models and business impact [00:14:53].
- Reduced Barriers: Simplifies complex multi-party workflows, removing the need for extensive legal paperwork, manual audits, or deep expertise in confidential computing [00:34:36].
- Performance and Scalability: Enables distributed inference across multiple GPU servers using overlay networks, improving memory efficiency and throughput while maintaining confidentiality [00:26:37].
Confidential AI using TEs is not just a concept but a practical path forward for developers to run, scale, and monetize AI workloads securely [00:00:50].