Literature Survey: Confidential Computing

Domain: Cybersecurity & Applied Cryptography
Topic Search: confidential computing
Timeframe: 2023 - 2026

This is a curated survey of recent publications focusing on confidential computing. Results are filtered for top-tier journals and prominent conferences.

📚 Curated Peer-Reviewed Publications

1. Confidential Computing with Heterogeneous Devices at Cloud-Scale

Venue: ACSAC | Year: 2024 | Citations: 4 Authors: Aritra Dhar, Supraja Sridhara, Shweta Shinde, Srdjan Capkun, Renzo Andri et al.

Cloud-centric workloads increasingly leverage domain-specific accelerators (DSAs) such as GPU, NPU, FPGA, etc., to achieve massive speedup over general-purpose CPUs. These workloads compute sensitive data; furthermore, the programs can be proprietary business secrets such as high-performance AI models. Therefore, several confidential cloud solutions have recently emerged to protect against the attacker-controlled software stack (OS/VMM) and the cloud service providers or CSPs themselves. CPU-centric trusted execution environments, or TEEs, have been around for decades and are deployed commercially. However, despite some recent proposals, most nodes lack TEE capability and, therefore, are unprotected against malicious CSP and software stack.We address this gap by proposing a new dedicated hardware module, the security controller (SC), that acts as the TEE proxy for the legacy non-TEE DSA nodes in a data center across racks. SC enforces access control and attestation mechanisms and protects the non-TEE nodes even from a physical attacker. This way, SC enables new-generation TEE-enabled nodes and legacy non-TEE nodes to be used in a data center simultaneously while ensuring security. We implement and synthesize SC hardware and evaluate it with real-world cloud-centric workloads with heterogeneous DSAs. Our evaluation shows that, on average, SC introduces 1.5-5% overhead while running AI, Redis, and file system workloads and scales well with an increasing number of DSA nodes (up to 2236 concurrent NPUs running CNNs).

2. Identity Crisis in Confidential Computing: Formal Analysis of Attested TLS

Venue: AsiaCCS | Year: 2026 | Citations: 2 Authors: Muhammad Usama Sardar, Mariam Moustafa, Tuomas Aura

Remote attestation is increasingly being composed with different protocols to provide endpoint security. Transport Layer Security (TLS) is the most widely used among those protocols, and the composition of TLS with remote attestation is known as attested TLS protocol. Such protocols are used in security-critical applications, e.g., they serve as the backbone of an emerging computing paradigm, Confidential Computing (CC). In this work, we explore the identity crisis that results from ambiguous notions of identity for attested TLS protocols in CC. We present a formal approach with a set of comprehensive security goals and a generic template for the comparison of the security strengths of attested TLS protocols. Using the approach, we discover vulnerabilities in two state-of-the-art protocols. The Confidential Computing Consortium (CCC) attestation Special Interest Group (SIG) and TLS working group have acknowledged the vulnerabilities. To mitigate the vulnerabilities, we present a formally verified solution for vulnerabilities and propose several potential solutions, which are under discussion for standardization at the Internet Engineering Task Force (IETF).

3. CAGE-V: Confidential Computing Architecture supporting Guest Enclaves for RISC-V

Venue: AsiaCCS | Year: 2026 | Citations: 0 Authors: Moritz Waser, Paul Gollob, Martin Unterguggenberger, Stefan Mangard

Confidential VMs enable cloud service providers to operate a secure and trustworthy multi-tenant cloud infrastructure. The confidential computing architecture enforces strong isolation for mutually untrusted tenants, i.e., guest VMs, and protects tenants against an untrusted hypervisor. While confidential VMs ensure comprehensive protection for cloud workloads, such heavy-weight isolation is often omitted for serverless applications that co-locate thousands of cloud workers within the same process to optimize FaaS overheads through efficient context switches. In this work, we present CAGE-V, a novel confidential computing architecture that supports lightweight enclave-based isolation for individual cloud workers running inside confidential VMs. We achieve this lightweight isolation through the use of tagged memory that allows to associate metadata, e.g., Domain Identifiers, with pages. Moreover, the guest enclaves support fast context switches within the confidential VM, as TLB entries are tagged with the Domain Identifiers, eliminating context switch overheads from TLB flushes. We implement a CAGE-V prototype, consisting of a hardware extension for the CORE-V CVA6 processor and a small security monitor, and evaluate our design in terms of system performance, demonstrating a minor performance impact.

4. [Transparent Attested DNS for Confidential Computing Services](No link available.)

Venue: USENIX Security Symposium | Year: 2025 | Citations: 0 Authors: Antoine Delignat-Lavaud, Cédric Fournet, Kapil Vaswani, Manuel Costa, Sylvan Clebsch et al.

No abstract available.

5. [ACAI: Protecting Accelerator Execution with Arm Confidential Computing Architecture](No link available.)

Venue: USENIX Security Symposium | Year: 2024 | Citations: 0 Authors: Supraja Sridhara, Andrin Bertschi, Benedict Schlüter, Mark Kuhne, Fabio Aliberti et al.

No abstract available.

⚡ Latest Pre-Prints

1. Confidential High-Performance Computing in the Public Cloud

Published: 2022-12-05 Authors: Keke Chen

High-Performance Computing (HPC) in the public cloud democratizes the supercomputing power that most users cannot afford to purchase and maintain. Researchers have studied its viability, performance, and usability. However, HPC in the cloud has a unique feature – users have to export data and computation to somewhat untrusted cloud platforms. Users will either fully trust cloud providers to protect from all kinds of attacks or keep sensitive assets in-house instead. With the recent deployment of the Trusted Execution Environment (TEE) in the cloud, confidential computing for HPC in the cloud is becoming practical for addressing users’ privacy concerns. This paper discusses the threat models, unique challenges, possible solutions, and significant gaps, focusing on TEE-based confidential HPC computing. We hope this discussion will improve the understanding of this new topic for HPC in the cloud and promote new research directions.

2. Machine Learning with Confidential Computing: A Systematization of Knowledge

Published: 2022-08-22 Authors: Fan Mo, Zahra Tarkhani, Hamed Haddadi

Privacy and security challenges in Machine Learning (ML) have become increasingly severe, along with ML’s pervasive development and the recent demonstration of large attack surfaces. As a mature system-oriented approach, Confidential Computing has been utilized in both academia and industry to mitigate privacy and security issues in various ML scenarios. In this paper, the conjunction between ML and Confidential Computing is investigated. We systematize the prior work on Confidential Computing-assisted ML techniques that provide i) confidentiality guarantees and ii) integrity assurances, and discuss their advanced features and drawbacks. Key challenges are further identified, and we provide dedicated analyses of the limitations in existing Trusted Execution Environment (TEE) systems for ML use cases. Finally, prospective works are discussed, including grounded privacy definitions for closed-loop protection, partitioned executions of efficient ML, dedicated TEE-assisted designs for ML, TEE-aware ML, and ML full pipeline guarantees. By providing these potential solutions in our systematization of knowledge, we aim to build the bridge to help achieve a much stronger TEE-enabled ML for privacy guarantees without introducing computation and system costs.

3. AI-Driven Confidential Computing across Edge-to-Cloud Continuum

Published: 2023-01-03 Authors: SM Zobaed

With the meteoric growth of technology, individuals and organizations are widely adopting cloud services to mitigate the burdens of maintenance. Despite its scalability and ease of use, many users who own sensitive data refrain from fully utilizing cloud services due to confidentiality concerns. Maintaining data confidentiality for data at rest and in transit has been widely explored but data remains vulnerable in the cloud while it is in use. This vulnerability is further elevated once the scope of computing spans across the edge-to-cloud continuum. Accordingly, the goal of this dissertation is to enable data confidentiality by adopting confidential computing across the continuum. Towards this goal, one approach we explore is to separate the intelligence aspect of data processing from the pattern-matching aspect. We present our approach to make confidential data clustering on the cloud, and then develop confidential search service across edge-to-cloud for unstructured text data. Our proposed clustering solution named ClusPr, performs topic-based clustering for static and dynamic datasets that improves cluster coherency up to 30%-to-60% when compared with other encryption-based clustering techniques. Our trusted enterprise search service named SAED, provides context-aware and personalized semantic search over confidential data across the continuum. We realized that enabling confidential computing across edge-to-cloud requires major contribution from the edge tiers particularly to run multiple Deep Learning (DL) services concurrently. This raises memory contention on the edge tier. To resolve this, we develop Edge-MultiAI framework to manage Neural Network (NN) models of DL applications such that it can meet the latency constraints of the DL applications without compromising inference accuracy.

4. Confidential Computing across Edge-to-Cloud for Machine Learning: A Survey Study

Published: 2023-07-31 Authors: SM Zobaed, Mohsen Amini Salehi

Confidential computing has gained prominence due to the escalating volume of data-driven applications (e.g., machine learning and big data) and the acute desire for secure processing of sensitive data, particularly, across distributed environments, such as edge-to-cloud continuum. Provided that the works accomplished in this emerging area are scattered across various research fields, this paper aims at surveying the fundamental concepts, and cutting-edge software and hardware solutions developed for confidential computing using trusted execution environments, homomorphic encryption, and secure enclaves. We underscore the significance of building trust in both hardware and software levels and delve into their applications particularly for machine learning (ML) applications. While substantial progress has been made, there are some barely-explored areas that need extra attention from the researchers and practitioners in the community to improve confidentiality aspects, develop more robust attestation mechanisms, and to address vulnerabilities of the existing trusted execution environments. Providing a comprehensive taxonomy of the confidential computing landscape, this survey enables researchers to advance this field to ultimately ensure the secure processing of users’ sensitive data across a multitude of applications and computing tiers.

5. Confidential Serverless Computing

Published: 2025-04-30 Authors: Patrick Sabanic, Masanori Misono, Teofil Bodea, Julian Pritzi, Michael Hackl, Dimitrios Stavrakakis, Pramod Bhatotia

Although serverless computing offers compelling cost and deployment simplicity advantages, a significant challenge remains in securely managing sensitive data as it flows through the network of ephemeral function executions in serverless computing environments within untrusted clouds. While Confidential Virtual Machines (CVMs) offer a promising secure execution environment, their integration with serverless architectures currently faces fundamental limitations in key areas: security, performance, and resource efficiency. We present WALLET, a confidential computing system for secure serverless deployments to overcome these limitations. By employing nested confidential execution and a decoupled guest OS within CVMs, WALLET runs each function in a minimal “trustlet”, significantly improving security through a reduced Trusted Computing Base (TCB). Furthermore, by leveraging a data-centric I/O architecture built upon a lightweight LibOS, WALLET optimizes network communication to address performance and resource efficiency challenges. Our evaluation shows that compared to CVM-based deployments, WALLET has 4.3x smaller TCB, improves end-to-end latency (15-93%), achieves higher function density (up to 907x), and reduces inter-function communication (up to 27x) and function chaining latency (16.7-30.2x); thus, WALLET offers a practical system for confidential serverless computing.

6. PIM-Enclave: Bringing Confidential Computation Inside Memory

Published: 2021-11-05 Authors: Kha Dinh Duy, Hojoon Lee

Demand for data-intensive workloads and confidential computing are the prominent research directions shaping the future of cloud computing. Computer architectures are evolving to accommodate the computing of large data better. Protecting the computation of sensitive data is also an imperative yet challenging objective; processor-supported secure enclaves serve as the key element in confidential computing in the cloud. However, side-channel attacks are threatening their security boundaries. The current processor architectures consume a considerable portion of its cycles in moving data. Near data computation is a promising approach that minimizes redundant data movement by placing computation inside storage. In this paper, we present a novel design for Processing-In-Memory (PIM) as a data-intensive workload accelerator for confidential computing. Based on our observation that moving computation closer to memory can achieve efficiency of computation and confidentiality of the processed information simultaneously, we study the advantages of confidential computing \emph{inside} memory. We then explain our security model and programming model developed for PIM-based computation offloading. We construct our findings into a software-hardware co-design, which we call PIM-Enclave. Our design illustrates the advantages of PIM-based confidential computing acceleration. Our evaluation shows PIM-Enclave can provide a side-channel resistant secure computation offloading and run data-intensive applications with negligible performance overhead compared to baseline PIM model.

7. CoVE: Towards Confidential Computing on RISC-V Platforms

Published: 2023-04-12 Authors: Ravi Sahita, Atish Patra, Vedvyas Shanbhogue, Samuel Ortiz, Andrew Bresticker, Dylan Reid, Atul Khare, Rajnesh Kanwal

Multi-tenant computing platforms are typically comprised of several software and hardware components including platform firmware, host operating system kernel, virtualization monitor, and the actual tenant payloads that run on them (typically in a virtual machine, container, or application). This model is well established in large scale commercial deployment, but the downside is that all platform components and operators are in the Trusted Computing Base (TCB) of the tenant. This aspect is ill-suited for privacy-oriented workloads that aim to minimize the TCB footprint. Confidential computing presents a good stepping-stone towards providing a quantifiable TCB for computing. Confidential computing [1] requires the use of a HW-attested Trusted Execution Environments for data-in-use protection. The RISC-V architecture presents a strong foundation for meeting the requirements for Confidential Computing and other security paradigms in a clean slate manner. This paper describes a reference architecture and discusses ISA, non-ISA and system-on-chip (SoC) requirements for confidential computing on RISC-V Platforms. It discusses proposed ISA and non-ISA Extension for Confidential Virtual Machine for RISC-V platforms, referred to as CoVE.

8. The Serialized Bridge: Understanding and Recovering LLM Serving Performance under Blackwell GPU Confidential Computing

Published: 2026-06-22 Authors: Hang Yin, Kevin Wang

GPU Confidential Computing (GPU-CC) now preserves GPU-local performance: on NVIDIA B300, BF16 matmul runs at 0.998x of non-confidential performance. Yet LLM serving under Intel TDX plus GPU-CC still loses 13-27% of throughput, and KV-cache restore latency can more than double. This paper studies that gap on two Blackwell platforms, RTX Pro 6000 and B300 HGX, and identifies its dominant cause: the confidential VM-GPU bridge, not GPU compute. We find that GPU-CC turns host/device movement into a serialized, high-setup-cost channel. Secure copies do not gain CUDA-stream concurrency within a context, asynchronous transfers block at the runtime boundary, and small crossings pay a fixed toll. This violates the assumptions of modern inference runtimes, where DMA is expected to be cheap, concurrent, and asynchronous. In vLLM dense decode, the gap closes around 44x-slower small alloc-and-copy operations; targeted patches reject alternative explanations. A scheduling flag recovers 57% of the gap, while a worker-thread drain recovers up to 92% in qualified high-concurrency runs. The same bridge model explains a +131% KV-restore penalty and a 34x model-load slowdown. Blackwell also changes the confidential tenancy unit. We qualify confidential multi-GPU NVSwitch tenants on B300, including 510 GB/s NVLink P2P inside a CVM and concurrent isolated tenants, and identify the remaining fabric-attestation gap for production confidential AI platforms.

9. Privacy-Preserving Decentralized AI with Confidential Computing

Published: 2024-10-17 Authors: Dayeol Lee, Jorge António, Hisham Khan

This paper addresses privacy protection in decentralized Artificial Intelligence (AI) using Confidential Computing (CC) within the Atoma Network, a decentralized AI platform designed for the Web3 domain. Decentralized AI distributes AI services among multiple entities without centralized oversight, fostering transparency and robustness. However, this structure introduces significant privacy challenges, as sensitive assets such as proprietary models and personal data may be exposed to untrusted participants. Cryptography-based privacy protection techniques such as zero-knowledge machine learning (zkML) suffers prohibitive computational overhead. To address the limitation, we propose leveraging Confidential Computing (CC). Confidential Computing leverages hardware-based Trusted Execution Environments (TEEs) to provide isolation for processing sensitive data, ensuring that both model parameters and user data remain secure, even in decentralized, potentially untrusted environments. While TEEs face a few limitations, we believe they can bridge the privacy gap in decentralized AI. We explore how we can integrate TEEs into Atoma’s decentralized framework.

10. HasTEE+ : Confidential Cloud Computing and Analytics with Haskell

Published: 2024-01-17 Authors: Abhiroop Sarkar, Alejandro Russo

Confidential computing is a security paradigm that enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs). By integrating TEEs with a Remote Attestation protocol, confidential computing allows a third party to establish the integrity of an \textit{enclave} hosted within an untrusted cloud. However, TEE solutions, such as Intel SGX and ARM TrustZone, offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. Moreover, the toolchains involve complex multi-project hierarchies and the deployment of hand-written attestation protocols for verifying \textit{enclave} integrity. We address the above with HasTEE+, a domain-specific language (DSL) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety. HasTEE+ assists in multi-tier cloud application development by (1) introducing a \textit{tierless} programming model for expressing distributed client-server interactions as a single program, (2) integrating a general remote-attestation architecture that removes the necessity to write application-specific cross-cutting attestation code, and (3) employing a dynamic information flow control mechanism to prevent explicit as well as implicit data leaks. We demonstrate the practicality of HasTEE+ through a case study on confidential data analytics, presenting a data-sharing pattern applicable to mutually distrustful participants and providing overall performance metrics.

🧠 Architectural & Methodological Insights

Trajectory: The field is moving from “protect the CPU enclave” toward a holistic, heterogeneous confidentiality fabric that spans accelerators, memory, edge nodes, and serverless runtimes. Architectural research now emphasizes lightweight, composable isolation primitives (tagged memory, nested enclaves, DSL‑driven attestation) and formal identity models to guarantee security across protocol stacks. Performance work is converging on bridge‑level optimizations as the next frontier for scaling confidential AI workloads.

🚀 Critical Research Gaps

1. Unified Attestation Across Heterogeneous Enclaves

   • Confidential Computing with Heterogeneous Devices at Cloud‑Scale proposes a Security Controller (SC) but evaluates only per‑device attestation; there is no end‑to‑end protocol that jointly attests a CPU enclave, accelerator proxies, and memory‑side enclaves. The lack of a cross‑domain attestation calculus hampers composable security guarantees.

2. Side‑Channel Resilience for In‑Memory and Accelerator Enclaves

   • PIM‑Enclave claims side‑channel resistance but evaluates only baseline PIM performance; systematic leakage analysis (e.g., page‑fault, power, or DRAM‑row‑hammer) is missing. Similarly, ACAI and CAGE‑V introduce new hardware paths (tagged TLBs, security monitors) without a rigorous side‑channel threat model.

3. Formal Identity Semantics Beyond TLS

   • Identity Crisis in Confidential Computing: Formal Analysis of Attested TLS uncovers identity ambiguities for TLS‑based attestation, yet the framework does not extend to non‑TLS protocols (e.g., gRPC, QUIC, custom RPCs) that are increasingly used in confidential AI pipelines. The gap limits the applicability of the formal model to real‑world microservice stacks.

4. Performance Modeling of the Confidential VM‑GPU Bridge

   • The Serialized Bridge isolates the bridge as the primary bottleneck for LLM serving, but the study is limited to two Blackwell GPUs and a handful of microbenchmarks. A generalizable performance model that predicts bridge overhead for varying batch sizes, multi‑tenant NVLink fabrics, and emerging interconnects (e.g., CXL) is absent.

💡 High‑Impact Open Problems

1. Cross‑Domain Attestation Protocol (CDAP)
   Problem: Design a cryptographic protocol that simultaneously attests a CPU enclave, a set of accelerator proxies (e.g., SC‑protected GPUs/NPUs), and a PIM‑based memory enclave, producing a single composable attestation token verifiable by a remote verifier.
   Requirements:

   • Formal security proof (integrity, freshness, and identity binding).
   • Minimal hardware extensions (e.g., a unified measurement register).
   • Compatibility with existing remote‑attestation standards (e.g., IETF RATS).
     Impact: Enables end‑to‑end confidentiality guarantees for heterogeneous AI pipelines, closing the gap identified in #1.

2. Side‑Channel Hardened Tagged‑Memory Architecture
   Problem: Extend the tagged‑memory approach of CAGE‑V and the in‑memory enclave model of PIM‑Enclave with hardware‑level mitigations (e.g., deterministic cache line allocation, noise injection, constant‑time tag checks) and develop a formal leakage‑budget analysis.
   Methodology:

   • Build a cycle‑accurate simulator that injects realistic microarchitectural leakage sources.
   • Quantify information leakage using mutual‑information metrics across a suite of representative workloads (AI inference, Redis, file‑system ops).
   • Propose a minimal set of ISA extensions that enforce the mitigations without degrading the 1.5‑5 % overhead reported in Confidential Computing with Heterogeneous Devices at Cloud‑Scale.
     Impact: Provides the first systematic side‑channel evaluation for lightweight enclave mechanisms, addressing gap #2.

3. Formal Identity Framework for Multi‑Protocol Confidential Services
   Problem: Generalize the identity‑analysis methodology of Identity Crisis in Confidential Computing to cover gRPC, QUIC, and custom RPC frameworks used in confidential ML serving stacks.
   Approach:

   • Define a parametric identity model that captures principal, enclave, and session attributes across protocol layers.
   • Implement a verification toolchain that automatically checks protocol specifications (e.g., protobuf‑defined services) against the model.
   • Validate on a real confidential AI pipeline (e.g., LLM serving under GPU‑CC) to demonstrate detection of identity ambiguities beyond TLS.
     Impact: Supplies a reusable formal foundation for securing the entire communication stack of confidential cloud services, filling gap #3.

These problems are scoped to be tractable within a PhD timeline yet promise substantial advances in the security, performance, and composability of confidential computing ecosystems.