confidential computing
In plain wordsRunning computations inside a hardware-sealed compartment of a chip, so that data and AI models stay protected even from the cloud company or administrator operating the machine.
Hardware-based protection for code and data while they are being processed, the stage that encryption at rest and in transit leaves exposed. The workload runs inside an isolated trusted execution environmenttrusted execution environment, n.: A sealed-off part of a computer chip that runs programs which the rest of the machine, even its operating system, cannot spy on or interfere with. that can prove what software it is running, so the host operating system, hypervisor, cloud operator and other tenants can neither read nor alter it. Since NVIDIA's H100 generation, GPUsGPU, abbr.: A computer chip first designed to draw video-game graphics that turned out to be ideal for AI, because it can do thousands of simple calculations at the same time. can join a CPU-based confidential virtual machine, extending protection to AI workloads. Uses include inference on sensitive user data with remote attestationremote attestation, n.: A way for a computer to prove to someone far away exactly what software it is running, using a signature built into its hardware, so they can decide whether to trust it. proving to users what software will see their data, joint training across organizations, and protecting model weightsmodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model. from the infrastructure they run on. Unlike cryptographic methods such as homomorphic encryptionhomomorphic encryption, n.: A way of locking data so that a computer can still work with it while it stays locked: the computer never sees the real numbers, and only the owner can open the answer., it runs at near-native speed but relies on trusting the hardware vendor and on the absence of side-channel and physical attacks.
The hospital agreed to the pilot only if inference ran under confidential computing with attestation.
Origin
The term was popularized by Microsoft's September 2017 announcement of Azure confidential computing (earlier uses, if any, are not established) and institutionalized by the Linux Foundation's Confidential Computing Consortium (2019), whose definition — protecting data in use in an attested hardware environment — is widely cited. Confidential GPU computing arrived with NVIDIA's H100 in 2022–2023.
Related
- trusted execution environmenttrusted execution environment, n.: A sealed-off part of a computer chip that runs programs which the rest of the machine, even its operating system, cannot spy on or interfere with.
- remote attestationremote attestation, n.: A way for a computer to prove to someone far away exactly what software it is running, using a signature built into its hardware, so they can decide whether to trust it.
- model weight securitymodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model.
- homomorphic encryptionhomomorphic encryption, n.: A way of locking data so that a computer can still work with it while it stays locked: the computer never sees the real numbers, and only the owner can open the answer.
- secure multi-party computationsecure multi-party computation, n.: Cryptographic methods that let several parties compute a result from their combined private data — say, an average salary — without any of them revealing its own data to the others.
- GPUGPU, abbr.: A computer chip first designed to draw video-game graphics that turned out to be ideal for AI, because it can do thousands of simple calculations at the same time.
- homomorphic encryptionhomomorphic encryption, n.: A way of locking data so that a computer can still work with it while it stays locked: the computer never sees the real numbers, and only the owner can open the answer.
Sources
- Confidential Computing Consortium (2022). A Technical Analysis of Confidential Computing, v1.3. Linux Foundation.
Mentioned in
AI securityAI security, n.: Protecting AI systems — their data, models and surrounding software — from being attacked, stolen or tricked, and dealing with the ways AI itself can be used to attack others., model weight securitymodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model., privacy-preserving machine learningprivacy-preserving machine learning, n.: The family of techniques for training and using AI models while keeping the underlying personal or confidential data hidden — from adding careful noise to computing on encrypted data., weight exfiltrationweight exfiltration, n.: Copying an AI model's core files out of the place they are supposed to stay — by hackers, by an insider or, in a scenario researchers worry about, by the AI itself., homomorphic encryptionhomomorphic encryption, n.: A way of locking data so that a computer can still work with it while it stays locked: the computer never sees the real numbers, and only the owner can open the answer., on-chip governance mechanismson-chip governance mechanisms, n.: Features built into AI chips that could check or enforce rules about how they are used — for example, proving which country a chip is in, or refusing to run without a valid license., remote attestationremote attestation, n.: A way for a computer to prove to someone far away exactly what software it is running, using a signature built into its hardware, so they can decide whether to trust it., secure multi-party computationsecure multi-party computation, n.: Cryptographic methods that let several parties compute a result from their combined private data — say, an average salary — without any of them revealing its own data to the others., trusted execution environmenttrusted execution environment, n.: A sealed-off part of a computer chip that runs programs which the rest of the machine, even its operating system, cannot spy on or interfere with.