Ranked reading list
Training privacyPaperCCS 2016
Deep Learning with Differential Privacy arxiv.org · PDF
Martín Abadi et al.
Introduces DP-SGD: per-example gradient clipping plus Gaussian noise, with a 'moments accountant' that gives much tighter privacy-loss tracking than earlier composition bounds. Trains deep networks on MNIST and CIFAR-10 under single-digit epsilon with modest accuracy loss on MNIST.
Limits: Per-example clipping and noise reduce accuracy and raise compute and memory cost, and the gap grows on harder tasks such as CIFAR-10.
Score 74Abstract page
Training privacyPaperAISTATS 2017
Communication-Efficient Learning of Deep Networks from Decentralized Data arxiv.org · PDF
H. Brendan McMahan et al.
Introduces federated learning and the FederatedAveraging algorithm, which trains a shared model by averaging updates computed locally on devices so raw data never leaves them. Reports 10-100x fewer communication rounds than synchronized SGD on image and language tasks.
Limits: Keeping data on-device does not by itself prevent leakage: model updates can reveal training data unless combined with secure aggregation or differential privacy.
Score 74Abstract page
NVIDIA docsReference docsNVIDIA Attestation documentation
Architecture Overview — NVIDIA Attestation Quick Start Guide docs.nvidia.com
NVIDIA
Describes the GPU attestation pipeline: the client SDK and local verifier pull measurements and certificates from the GPU via NVML, the RIM Service serves signed golden measurements, an OCSP service checks certificate revocation, and NRAS appraises evidence and returns a signed EAT token. Local verification and remote verification through NRAS are both supported.
Limits: Relying parties must trust NVIDIA's device certificates, reference manifests and revocation service, and, when using NRAS, NVIDIA's cloud verifier itself.
Score 72Abstract page
Confidential computingSystem designApple Security Research
Private Cloud Compute: A new frontier for AI privacy in the cloud security.apple.com
Apple Security Engineering and Architecture et al.
Design of Apple's server-side LLM inference on custom Apple silicon nodes: stateless processing with keys reset on reboot, no remote shell or general logging, requests encrypted only to attested nodes, OHTTP relays and blind-signature credentials for non-targetability, and a public transparency log of every production software image that devices check before sending data.
Limits: Apple silicon, the Secure Enclave, Apple's signing and hardware supply chain must be trusted; non-targetability assumes the relay and load balancer are not both compromised.
Score 71
NVIDIA docsReference docsNVIDIA Confidential Computing documentation (v1.0.0)
Deploy Confidential Virtual Machines docs.nvidia.com
NVIDIA
Step-by-step guide for running Hopper and Blackwell GPUs inside Intel TDX or AMD SEV-SNP confidential VMs: BIOS and host setup, binding GPUs to VFIO and setting CC or PPCIe mode, launching the CVM, installing the guest driver, and attesting the GPU before it accepts work. The companion Trust and Threat Model page lists the CPU TEE, guest stack, GPU firmware and attestation/key services as the TCB and the host OS and hypervisor as untrusted.
Limits: The CPU vendor, NVIDIA, the OEM and the verifier and key-release operators remain trusted; invasive physical attacks, availability, and MIG/MPS/GPUDirect RDMA are outside the supported configuration.
Score 70Abstract page
NVIDIA docsReference docsNVIDIA whitepaper WP-11459-001 v1.0
Confidential Compute on NVIDIA Hopper H100 images.nvidia.com · PDF
Rob Nertney (NVIDIA)
The original technical description of H100 confidential computing: an SPDM/Diffie-Hellman session between the CVM and the GPU, AES-256-GCM encrypted bounce buffers in shared memory for all CPU-GPU traffic, and attestation of the GPU's NVIDIA-signed identity and measurements via NRAS. It states that GPU compute and HBM bandwidth are at parity with CC off, while CPU-GPU transfers are limited to about 4 GB/s by CPU-side encryption.
Limits: NVIDIA's on-die root of trust and signed firmware plus the CPU vendor's TEE (TDX or SEV-SNP) must be trusted; it is an early-access document, on-package HBM is not encrypted, and sophisticated physical attacks are out of scope.
Score 68
Training privacyPaperCCS 2017
Practical Secure Aggregation for Privacy Preserving Machine Learning eprint.iacr.org · PDF
Keith Bonawitz et al.
A cryptographic protocol that lets a server learn only the sum of many users' model updates, not any individual update, while tolerating users dropping out mid-protocol. Designed for mobile federated learning, with communication overhead small enough for very high-dimensional vectors.
Limits: Protects individual updates from the server but not what the aggregate model itself may memorize, and adds rounds and per-client cost.
Score 68Abstract page
Training privacyPaperIEEE S&P 2017
Membership Inference Attacks against Machine Learning Models arxiv.org · PDF
Reza Shokri et al.
Shows that an attacker with only black-box query access can tell whether a given record was in a model's training set, using 'shadow models' trained to mimic the target. Demonstrated against commercial ML-as-a-service APIs (Google, Amazon) and on sensitive datasets such as hospital discharge records.
Limits: Attack strength depends heavily on overfitting and on how well shadow data matches the target distribution.
Score 68Abstract page
Confidential computingPaperarXiv preprint
Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark Study arxiv.org · PDF
Jianwei Zhu et al.
Measures LLM inference with H100 CC enabled versus disabled across models and sequence lengths. Overhead stays under 7% for most typical queries and approaches zero for larger models and longer sequences; most of the cost comes from encrypted CPU-GPU transfers over PCIe rather than GPU computation.
Limits: Performance study only; assumes the NVIDIA and CPU TEE trust chain holds and does not examine security or attestation cost.
Score 68Abstract page
NVIDIA docsReference docsGitHub repository (Apache-2.0)
NVIDIA/nvtrust: Ancillary open source software to support confidential computing on NVIDIA GPUs github.com
NVIDIA
NVIDIA's open-source tooling for GPU CC: host tools to set CC and PPCIe modes, sample KVM scripts for launching CVMs, a Python attestation SDK and local GPU verifier, and a PPCIe verifier for multi-GPU Hopper systems. The Python SDK and local verifier are now marked deprecated in favour of NVIDIA's C++ SDK and CLI.
Limits: The tools verify evidence against NVIDIA-issued certificates and reference values, so NVIDIA remains the root of trust; the GPU firmware and driver they measure are closed-source.
Score 65
Confidential computingPaperarXiv preprint
Benchmarking Confidential Computing Performance on NVIDIA Blackwell GPUs arxiv.org · PDF
Amean Asad, Ansgar Grunseid
Measures 8x B200 GPUs in an Intel TDX host with encrypted NVLink. With a correctly configured stack, confidential inference costs about 1.5-3.6% throughput (TP4/TP8) and 8-GPU training about 10-13%; NCCL collectives lose about 10% bandwidth. Stock serving stacks can lose 30-40% because synchronous token readback and eager execution remove compute/copy overlap.
Limits: Performance only, from authors at a confidential-AI company; assumes the Intel TDX and NVIDIA trust chain holds and does not measure attestation or TDISP.
Score 65Abstract page
MPCPaperPETS 2024
SIGMA: Secure GPT Inference with Function Secret Sharing eprint.iacr.org · PDF
Kanav Gupta, Neha Jawalkar, Ananta Mukherjee et al.
Uses function secret sharing with GPU acceleration to run decoder-only transformers in a two-party setting with preprocessing, with new protocols for GELU, softmax and LayerNorm. Reports 11-19x lower latency than prior GPU/preprocessing work, GPT-2 in 1.6 s and LLaMA2-13B in 44 s.
Limits: Needs a trusted dealer to generate large FSS keys offline and two non-colluding semi-honest GPU servers; key material grows with model size.
Score 64Abstract page
FHEPaperJournal of Cryptology (full version of ASIACRYPT 2016/2017)
TFHE: Fast Fully Homomorphic Encryption over the Torus eprint.iacr.org · PDF
Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, Malika Izabachène
Torus-based FHE with fast gate bootstrapping, cutting bootstrapping time from 690 ms to 13 ms on one core and the bootstrapping key from 1 GB to 16 MB, plus circuit bootstrapping in 137 ms. Its programmable bootstrapping later became the basis of Zama's TFHE-rs and Concrete ML for exact nonlinear functions on encrypted data.
Limits: Operates on small-precision integers per ciphertext, so large matrix workloads such as LLM layers are slow without heavy quantization. At today’s LLM scale the scheme alone is not practical for private inference.
Score 63Abstract page
MPCPaperIEEE S&P 2017
SecureML: A System for Scalable Privacy-Preserving Machine Learning eprint.iacr.org · PDF
Payman Mohassel, Yupeng Zhang
Two-server protocols for training linear regression, logistic regression and small neural networks on secret-shared data, with MPC-friendly replacements for the logistic and softmax functions. Reported orders-of-magnitude speedups over earlier privacy-preserving regression and the first system for privacy-preserving neural network training in this setting.
Limits: Assumes two non-colluding, semi-honest servers, and the neural network results are for small models far from today's scale.
Score 63Abstract page
FHEPaperICML 2016
CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy proceedings.mlr.press · PDF
Nathan Dowlin, Ran Gilad-Bachrach, Kim Laine et al.
First demonstration of neural network inference on homomorphically encrypted inputs, using a leveled scheme and square activations in place of ReLU. Achieved 99% accuracy on MNIST and about 59,000 predictions per hour on one PC via batching, with 250 s latency per batch of 4,096.
Limits: Tiny network with polynomial activations and no bootstrapping, so depth is fixed and the approach does not extend directly to modern models.
Score 63Abstract page
FHEPaperASIACRYPT 2017
Homomorphic Encryption for Arithmetic of Approximate Numbers eprint.iacr.org · PDF
Jung Hee Cheon, Andrey Kim, Miran Kim, Yongsoo Song
Introduces the CKKS scheme, which treats encryption noise as part of approximate fixed-point arithmetic and rescales after multiplication, enabling efficient SIMD computation on encrypted real-valued vectors. CKKS is the basis of nearly all current FHE transformer and LLM inference work.
Limits: Results are approximate, so precision must be managed; deep circuits need costly bootstrapping, and the IND-CPA-D attack (Li-Micciancio) shows decryption results must be handled carefully. At today’s LLM scale the scheme alone is not practical for private inference.
Score 63Abstract page
FHESurveyIACR ePrint preprint
SoK: Private LLM Inference using Approximate Homomorphic Encryption eprint.iacr.org · PDF
Ahmad Al Badawi, Andreea Alexandru, Yuriy Polyakov, Vinod Vaikuntanathan
Systematizes 21 CKKS-based frameworks that have shown end-to-end private LLM inference (up to 8B parameters), organizing them by packing/model-preservation and by hardware, compiler and bootstrapping choices, and proposes a standard reporting card (PLCS) plus an open-source model-preserving reference framework (POLARIS). Finds only 5 of 21 run unmodified models and a gap of about four orders of magnitude between encrypted and plaintext runtime.
Limits: Covers only non-interactive CKKS approaches; authors are from Duality, which builds FHE products, and the reference framework is evaluated on BERT-family models.
Score 63Abstract page
NVIDIA docsReference docsNVIDIA Confidential Computing documentation (v1.1.0)
NVIDIA Confidential Containers Reference Architecture docs.nvidia.com
NVIDIA
Architecture for Kubernetes-native confidential GPU workloads: Kata Containers runs each pod in a TDX or SEV-SNP utility VM, the GPU Operator handles CC mode and VFIO passthrough, and Trustee plus NRAS perform composite CPU+GPU attestation before releasing secrets. Release 1.1.0 (August 2026) adds HGX B300; 1.0.0 (April 2026) covers B200, RTX Pro 6000 BSE, and H100/H200 including Protected PCIe multi-GPU.
Limits: The CPU TEE vendor, NVIDIA and the Trustee/key-broker operator must be trusted; application bugs inside the pod, most physical attacks and availability are out of scope.
Score 62Abstract page
Training privacyPaperICLR 2025
Scalable Extraction of Training Data from (Production) Language Models arxiv.org · PDF
Milad Nasr et al.
Shows that gigabytes of training data can be extracted from open, semi-open and closed models. A 'divergence attack' (for example, asking ChatGPT to repeat a word indefinitely) caused aligned ChatGPT to emit training data at about 150x the rate seen under normal behavior.
Limits: The specific ChatGPT divergence prompt was mitigated after disclosure; verification relies on matching outputs against a large public web corpus.
Score 61Abstract page
Training privacyPaperUSENIX Security 2021
Extracting Training Data from Large Language Models arxiv.org · PDF
Nicholas Carlini et al.
Shows that querying GPT-2 and ranking outputs by likelihood-based membership signals recovers verbatim training sequences, including names, phone numbers, email addresses and code. The authors confirmed hundreds of memorized sequences, some of which appeared in only a single training document.
Limits: Demonstrated on GPT-2 with confirmation via OpenAI's training data; the extracted fraction is small relative to the full dataset.
Score 61Abstract page
Confidential computingSystem designGoogle technical brief
Google Private AI Compute: Enabled with Secure Server-Side Memory services.google.com · PDF
Google
Describes Gemini inference with CPU workloads in AMD SEV-SNP TEEs and TPU workloads in Titanium Intelligence Enclaves, Noise and ALTS channels with bi-directional attestation, IP-blinding relays and anonymous tokens, and a per-user memory store whose records are encrypted with keys released only to attested enclaves. Open-source Oak components, reproducible builds and a public digest ledger link source to production binaries.
Limits: AMD, Google's TPU platform and Titan chip, and Google's reference values must be trusted; independent client-side validation of server attestation evidence is listed as future work, and the TPU enclave is described as comparable to, not equal to, a standard TEE.
Score 61
NVIDIA docsReference docsNVIDIA whitepaper WP-12554-001 v1.3
NVIDIA Secure AI with Blackwell and Hopper GPUs docs.nvidia.com · PDF
NVIDIA
Describes the CC modes across Hopper and Blackwell: single-GPU passthrough with bounce buffers or with TDISP/IDE (TEE-I/O) on compatible CPUs, Hopper's multi-GPU Protected PCIe mode (8 GPUs in one CVM, NVLink traffic unencrypted), and Blackwell multi-GPU mode where NVLink traffic is also encrypted. It explains the chain of trust, key handling and the rule that CUDA work runs only after attestation; it contains no quantitative performance figures.
Limits: NVIDIA hardware and firmware and the CPU TEE vendor must be trusted, and TEE-I/O with a PCIe switch requires a switch that supports IDE flow-through; sophisticated physical attacks and denial of service are out of scope.
Score 61
FHEPaperarXiv preprint
Scaling up FHE-based Privacy-Preserving ML: Higher Throughput, Longer Inputs for LLama-3-8B arxiv.org · PDF
Jaiyoung Park, Sejin Park, Jai Hyun Park et al.
End-to-end CKKS inference for Llama-3-8B, using prefix tokens and orthogonal rotations to suppress activation outliers and a faster homomorphic softmax for sparsely packed ciphertexts. With 128 encrypted tokens on 8 RTX PRO 6000 GPUs it reports 20 s for summarization and 18 s per generated token; for 4,096-token inputs with only the last 128 encrypted, 64 s and 22 s/token.
Limits: The long-input mode leaves the prefix in plaintext, the server holds open model weights in the clear, accuracy was measured by noise simulation rather than full encrypted runs, and it needs a multi-GPU server.
Score 61Abstract page
Confidential computingPaperarXiv preprint
Confidential LLM Inference: Performance and Cost Across CPU and GPU TEEs arxiv.org · PDF
Marcin Chrapek et al.
Compares full Llama2 inference (7B-70B) in Intel TDX/SGX with AMX against H100 confidential GPUs. CPU TEEs show under 10% throughput and under 20% latency overhead; H100 CC shows 4-8% throughput overhead that shrinks with batch and input size. At small batches confidential GPUs can cost up to 2x more per token than CPU TEEs, with parity around batch 128.
Limits: Assumes Intel and NVIDIA roots of trust; cost figures depend on cloud pricing at the time and side channels are not evaluated.
Score 61Abstract page
Data caseCaseRegulator decision
Italy's Garante fines OpenAI €15M over ChatGPT training data garanteprivacy.it
Garante per la protezione dei dati personali · OpenAI
Concluding the investigation opened in March 2023, the Garante fined OpenAI €15 million for processing users' personal data to train ChatGPT without an adequate legal basis, transparency failures, lack of age verification, and not notifying a March 2023 data breach. It also ordered a six-month public information campaign on how data is used for training and how to object.
Status: Annulled: the Rome Tribunal upheld OpenAI's appeal (judgment no. 4153/2026, published 18 March 2026), and the Garante has temporarily removed the decision from its site; continuing matters passed to the Irish DPC as lead authority.
Score 60
Data caseCaseRegulator decision
Italy's Garante orders temporary limitation of ChatGPT over training-data legal basis garanteprivacy.it
Garante per la protezione dei dati personali · OpenAI
On 30 March 2023 the Garante ordered an urgent provisional limitation on OpenAI's processing of personal data of people in Italy, citing no privacy notice, no adequate legal basis for collecting data to train ChatGPT, inaccurate outputs, and no age verification (alleged breaches of GDPR Articles 5, 6, 8, 13 and 25). OpenAI made ChatGPT unavailable in Italy in response.
Status: Service resumed in Italy in April 2023 after OpenAI added a privacy notice, an objection mechanism and age checks; the investigation continued into the 2024 fine.
Score 60
MPCPaperNeurIPS 2021
CrypTen: Secure Multi-Party Computation Meets Machine Learning arxiv.org · PDF
Brian Knott, Shubho Sengupta, Shobha Venkataraman et al.
An open-source PyTorch-based framework from Meta AI that exposes secret-shared tensors with a familiar ML API, supports GPU execution, and runs both secure inference and training. It became a common baseline and prototyping tool for MPC-based ML, including many later private transformer papers.
Limits: Semi-honest security, and by default relies on a trusted third party to generate multiplication triples; nonlinear functions use approximations that cost accuracy and rounds.
Score 60Abstract page
Data caseCaseCourt order / Company statement
Court order in NYT v. OpenAI requires indefinite retention of ChatGPT and API logs openai.com
OpenAI (company statement on S.D.N.Y. order) · OpenAI
In the New York Times copyright case, a May 2025 preservation order required OpenAI to retain consumer ChatGPT (Free, Plus, Pro, Team) and non-ZDR API content indefinitely, including deleted chats; Enterprise, Edu and Zero Data Retention API customers were excluded. OpenAI opposed the order on privacy grounds.
Status: OpenAI says the obligation ended on 26 September 2025, but it continues to hold a limited set of April-September 2025 data under restricted access.
Score 59
MPCPaperIEEE S&P 2025
Comet: Accelerating Private Inference for Large Language Model by Predicting Activation Sparsity arxiv.org · PDF
Guang Yan, Yuhui Zhang, Zimu Guo et al.
Predicts which neurons will be zero after ReLU-style activations and skips their computation inside MPC, with a cache-refilling strategy to keep the KV cache consistent. On OPT-1.3B to LLaMA2(ReLU)-7B it reports 1.87-2.63x speedup and 1.94-2.64x less communication than six prior systems.
Limits: Semi-honest, non-colluding MPC servers plus a trusted third party for correlated randomness; gains depend on ReLU-style (or ReLUfied) models with high activation sparsity.
Score 59Abstract page
Data caseCaseCompany announcement / Regulator statement
Meta resumes training AI on EU adults' public posts and Meta AI interactions about.fb.com
Meta · Meta
On 14 April 2025 Meta announced it would train its models on EU adults' public posts and comments and on interactions with Meta AI, excluding private messages and data from under-18 accounts, with an objection form. On 21 May 2025 the Irish DPC said Meta had added safeguards (updated notices, an easier objection form, de-identification and filtering) ahead of training from 27 May 2025 and required a report by October 2025.
Status: Training is under way with opt-out; a German consumer group's injunction bid was rejected by the Cologne Higher Regional Court in May 2025.
Score 58Abstract page
Confidential computingPaperMLSys 2026
Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing arxiv.org · PDF
Zhongshu Gu et al.
Reconstructs how NVIDIA GPU CC is built and boots (security engines, GSP, firmware chain) and tests whether CPU-GPU data paths stay protected. Bulk data and command payloads are encrypted and integrity-checked, but RPC metadata, some queue pointers and semaphores remain plaintext, and transfer sizes leak through timing; findings were disclosed to NVIDIA.
Limits: Analysis is limited by closed-source firmware, CUDA runtime and user-mode driver, so parts of the stack could not be assessed; NVIDIA remains the root of trust.
Score 57Abstract page
Data caseCaseRegulator statement
LinkedIn defaults users into generative AI training; pauses for UK after ICO concerns ico.org.uk
Information Commissioner's Office (UK) · LinkedIn (Microsoft)
In September 2024 LinkedIn added a setting, on by default for most users, allowing member data to train content-creation AI models, reportedly before updating its privacy policy; EU, EEA and Swiss users were excluded. On 20 September 2024 the ICO said LinkedIn had paused such training on UK users' data after the regulator raised concerns.
Status: LinkedIn later resumed with an opt-out: the ICO's September 2025 update notes the restart for UK users, and LinkedIn's updated terms from 3 November 2025 extend generative AI training to EEA members under legitimate interests, with an objection setting.
Score 57Abstract page
Data caseCaseRegulator statement
Meta pauses plan to train LLMs on EU/EEA users' public Facebook and Instagram content dataprotection.ie
Data Protection Commission (Ireland) · Meta
On 14 June 2024 the Irish DPC welcomed Meta's decision to pause plans to train its large language models on public content shared by adults on Facebook and Instagram in the EU/EEA, following intensive engagement with the regulator. Meta had notified users and relied on legitimate interests with an objection form.
Status: Superseded: Meta resumed EU training in May 2025 with additional safeguards (see 2025 entry).
Score 56
Data caseCaseCompany policy
Google's Gemini Apps privacy notice: human review of chats and up to 3-year retention support.google.com
Google · Google
Google's Gemini Apps Privacy Hub states that a subset of chats is reviewed by human reviewers, including service providers, after being disconnected from the account, and that reviewed chats are kept for up to three years even if the user deletes their activity. With 'Keep Activity' on, activity is used to improve services including training generative AI models; with it off, chats are held for 72 hours and not used for training unless feedback is submitted.
Status: Current policy; users can turn off Keep Activity or use temporary chats, but already-reviewed chats are not deleted.
Score 56
Data caseCaseCourt order
Judge affirms order for OpenAI to produce 20 million de-identified ChatGPT logs in NYT case abajournal.com
ABA Journal (reporting S.D.N.Y. ruling) · OpenAI
On 5 January 2026 U.S. District Judge Sidney Stein affirmed Magistrate Judge Ona Wang's orders requiring OpenAI to produce a sample of 20 million de-identified ChatGPT logs to the news-publisher plaintiffs, rejecting OpenAI's privacy objections. The ruling cited the sample cap, de-identification and an existing protective order limiting access.
Status: Discovery ruling only, not a finding on infringement; plaintiffs said they may seek a larger sample.
Score 55
Training privacyPaperarXiv (tech report)
VaultGemma: A Differentially Private Gemma Model arxiv.org · PDF
Amer Sinha et al. (Google)
A 1B-parameter Gemma-family model pretrained from scratch with DP-SGD on the Gemma 2 data mixture, with a sequence-level guarantee of epsilon <= 2.0 and delta <= 1.1e-10 over 1,024-token sequences. Google reports no detectable memorization in 50-token prefix/suffix tests and utility roughly comparable to non-private models from about five years earlier, such as GPT-2 1.5B.
Limits: Sequence-level DP does not bound leakage about a person whose data spans many sequences, and utility trails current non-private models of the same size.
Score 55Abstract page
MPCPaperarXiv preprint
PUMA: Secure Inference of LLaMA-7B in Five Minutes arxiv.org · PDF
Ye Dong, Wen-jie Lu, Yancheng Zheng et al.
A three-party replicated-secret-sharing framework (built on SecretFlow-SPU) with accurate approximations for GeLU and softmax and protocols for embedding and LayerNorm, so pretrained models run without retraining. About 2x faster than MPCFormer, and generates one LLaMA-7B token in roughly 5 minutes.
Limits: Assumes three servers with an honest majority and semi-honest behavior; minutes per token is far from interactive use.
Score 55Abstract page
Data caseCaseCompany policy
Anthropic changes consumer terms to use Claude chats for training unless users opt out anthropic.com
Anthropic · Anthropic
On 28 August 2025 Anthropic announced that chats and coding sessions from Claude Free, Pro and Max accounts (including Claude Code on those plans) would be used for model training if users allow it, with retention extended from 30 days to five years for those who do. Existing users had to choose by 8 October 2025; commercial, government, education and API use are excluded.
Status: In effect; users can turn training off in privacy settings, but data already used in training is not removed from trained models.
Score 54
MPC + FHESurveyUSENIX Security (per ePrint listing)
SoK: Private Transformer-Based Model Inference eprint.iacr.org · PDF
Yuntian Chen, Tianpei Lu, Zhanyong Tang et al.
Systematizes MPC, HE and hybrid protocols for private transformer inference, comparing computation, communication and accuracy trade-offs and the assumptions each relies on. It also checks reproducibility of prior systems and re-benchmarks representative ones under standardized configurations.
Limits: Scoped to inference only, and the abstract gives no headline numbers, so readers need the full paper for the benchmark comparisons.
Score 54Abstract page
Data caseCaseRegulator decision
Irish DPC opens inquiry into X's use of EU users' posts to train Grok dataprotection.ie
Data Protection Commission (Ireland) · X / xAI
On 11 April 2025 the DPC opened a statutory inquiry under Section 110 of the Data Protection Act 2018 into X Internet Unlimited Company's processing of personal data in EU/EEA users' public posts to train xAI's Grok models. The inquiry examines the lawfulness and transparency of that processing under several GDPR provisions.
Status: Inquiry ongoing; no decision has been published.
Score 53
Training privacyPaperICML 2025
Scaling Laws for Differentially Private Language Models arxiv.org · PDF
Ryan McKenna et al.
Fits scaling laws for DP language-model training that relate compute budget, privacy budget and data to final utility. Gives a picture of the compute-privacy-utility trade-off and of optimal training configurations, which Google's VaultGemma work builds on.
Limits: Laws are fitted on specific architectures and DP-SGD settings and may not transfer to other model families or privacy units.
Score 53Abstract page
MPC + FHEPaperUSENIX Security 2022
Cheetah: Lean and Fast Secure Two-Party Deep Neural Network Inference eprint.iacr.org · PDF
Zhicong Huang, Wen-jie Lu, Cheng Hong, Jiansheng Ding
Combines lattice-based homomorphic encryption for linear layers (avoiding expensive rotations via polynomial coefficient encoding) with silent OT-based protocols for nonlinear layers. ResNet-50 inference over WAN takes under 2.5 minutes and about 2.3 GB, roughly 5.6x faster and 12.9x less communication than CrypTFlow2.
Limits: Semi-honest two-party model; designed for CNNs, so transformer nonlinearities (softmax, GELU, LayerNorm) required follow-on work.
Score 53Abstract page
Training privacyPaperICLR 2023
Quantifying Memorization Across Neural Language Models arxiv.org · PDF
Nicholas Carlini et al.
Measures verbatim memorization (whether a training prefix elicits the exact suffix) across model families and finds three log-linear trends: memorization grows with model size, with how often an example is duplicated, and with prompt length. Concludes memorization is more common than previously thought and likely to increase with scale without mitigation.
Limits: Measures exact-match extraction with known prefixes, which undercounts approximate or paraphrased leakage.
Score 53Abstract page
Training privacyPaperICLR 2022
Large Language Models Can Be Strong Differentially Private Learners arxiv.org · PDF
Xuechen Li et al.
Shows that DP fine-tuning of large pretrained language models, with suitable hyperparameters and objectives aligned to pretraining, approaches strong non-private baselines on moderate-size NLP tasks. Introduces 'ghost clipping', which avoids materializing per-example gradients so DP training of Transformers costs roughly the same memory as non-private training.
Limits: Protects only the fine-tuning data, assumes the public pretraining data is itself unproblematic, and still loses some accuracy at small epsilon.
Score 53Abstract page
Confidential computingSystem designIndustry report v1.0
Confidential Inference Systems: Design principles and security risks www-cdn.anthropic.com · PDF
Pattern Labs and Anthropic
Lays out a reference architecture for protecting both model weights and user data during inference: an enclave loader that decrypts weights and inputs only after a KMS verifies its measured-boot attestation, envelope-encrypted weight provisioning with three KMS placement options, and reproducible, audited enclave builds. It enumerates the security risks at each component.
Limits: Lists what remains trusted: the hardware root of trust, accelerator memory isolation, the hypervisor and enclave driver, the build supply chain and the KMS operator.
Score 53Abstract page
Confidential computingPaperarXiv preprint
Performance of Confidential Computing GPUs arxiv.org · PDF
Antonio Martínez Ibarra et al.
Evaluates H100 CC for batch inference with frequent model swapping in a single confidential VM. Compared with CC off, confidential mode had 20-30% higher latency, 15-20% lower SLA attainment and 45-70% lower throughput, mainly from encrypting model weights during loading.
Limits: Single-GPU, single-workload setup; trusts NVIDIA and the CPU TEE vendor and does not assess security.
Score 53Abstract page
Confidential computingPaperOSDI 2018
Graviton: Trusted Execution Environments on GPUs usenix.org · PDF
Stavros Volos, Kapil Vaswani, Rodrigo Bruno
Proposes GPU TEEs built by changing only the command processor and PCIe control engine: page-table updates go through new commands that track page ownership in hidden memory, per-channel keys secure host-GPU traffic, and a fused endorsement key supports remote attestation. Using emulation plus a modeled hardware encryption engine, the authors estimate 17-33% overhead for compute-bound workloads, mostly from authenticated encryption of commands and data between CPU and GPU.
Limits: Requires trusting the GPU vendor's hardware and command-processor firmware; evaluated by emulation, and physical and side-channel attacks are out of scope.
Score 51Abstract page
Data caseCaseRegulator press release / Court proceedings
Irish DPC goes to High Court; X agrees to stop using EU users' posts to train Grok dataprotection.ie
Data Protection Commission (Ireland) · X / xAI
The DPC made an urgent High Court application under Section 134 of the Data Protection Act 2018, its first use of that power, over X's processing of EU/EEA users' public posts from 7 May to 1 August 2024 to train Grok. X agreed to suspend the processing, and on 4 September 2024 the case was struck out after X made the undertaking permanent; the DPC also requested an EDPB opinion on AI model training.
Status: Court case concluded on X's permanent undertaking; lawfulness of the earlier processing became the subject of a 2025 DPC inquiry.
Score 51Abstract page
Training privacyPaperICLR 2025
Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning arxiv.org · PDF
Shengyuan Hu et al.
Shows that models put through popular approximate unlearning methods can recover the 'forgotten' knowledge after light fine-tuning on small, loosely related public data. Across three unlearning benchmarks, relearning restored hazardous knowledge and verbatim memorized text, suggesting these methods mostly suppress outputs rather than remove information.
Limits: Evaluates approximate unlearning methods; it does not cover exact retraining-based unlearning, which remains costly at LLM scale.
Score 51Abstract page
MPCPaperACM CCS 2020
CrypTFlow2: Practical 2-Party Secure Inference eprint.iacr.org · PDF
Deevashwer Rathee, Mayank Rathee, Nishant Kumar et al.
New two-party protocols for millionaires' comparison, ReLU, truncation and division based on oblivious transfer, enabling exact secure inference on ImageNet-scale CNNs such as ResNet-50. On prior benchmarks it uses about an order of magnitude less communication and 20-30x less time than the previous state of the art.
Limits: Semi-honest two-party setting; communication still reaches tens of GB for large CNNs, and it predates transformer workloads.
Score 51Abstract page
MPC + FHEPaperUSENIX Security 2025
Breaking the Layer Barrier: Remodeling Private Transformer Inference with Hybrid CKKS and MPC eprint.iacr.org · PDF
Tianshi Xu, Wen-jie Lu, Jiangrui Yu et al.
BLB splits transformer layers into fine-grained operators and fuses adjacent linear ones to reduce HE-to-MPC conversions, with a secure conversion protocol between CKKS and MPC. On BERT-base, BERT-large and GPT2-base it reports 21x and 2x less communication than BOLT and BumbleBee, and with GPUs 13x and 1.8x lower latency.
Limits: Semi-honest two-party setting; evaluated up to GPT2-base and BERT-large, not multi-billion-parameter LLMs.
Score 51Abstract page
FHEPaperACM CCS 2026
Tricycle: Private Transformer Inference with Tricyclic Encodings eprint.iacr.org · PDF
Lawrence Lim, Vikas Kalagi, Julia Novick et al.
A CKKS packing scheme (tricyclic encodings) that supports batched matrix multiplication at optimal multiplicative depth, combined with lazy relinearization, complexification and statistical max estimation to stabilize encrypted softmax, on a GPU CKKS pipeline. BERT-base with 128 tokens runs in 100.5 s on one GPU, about 6x faster than THOR and 3.4x faster than Powerformer.
Limits: Results are for BERT-scale encoders; softmax relies on statistical max estimation rather than exact computation.
Score 51Abstract page
NVIDIA docsReference docsNVIDIA Technical Blog
Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AI developer.nvidia.com
Emily Apsey, Phil Rogers, Michael O'Connor, Rob Nertney (NVIDIA)
NVIDIA's public overview of H100 CC: measured boot from an on-die root of trust, an SPDM session with the CPU TEE driver, signed attestation reports, and three modes (CC-Off, CC-On with performance counters disabled, CC-DevTools). Most CUDA applications run unchanged in CC-On; compute and HBM bandwidth are at parity, CPU-GPU bandwidth is about 4 GB/s.
Limits: Trust rests on NVIDIA's root of trust and signing keys and on AMD SEV-SNP or Intel TDX on the host CPU; the post is an overview, not a security specification.
Score 49
Data caseCaseRegulator press release
FTC and DOJ charge Amazon over retaining children's Alexa recordings and using them to train algorithms ftc.gov
U.S. Federal Trade Commission · Amazon
The FTC and DOJ alleged Amazon kept children's Alexa voice recordings indefinitely, undermined parents' deletion requests, and used unlawfully retained recordings to improve the Alexa algorithm, including training it to understand children's speech. The proposed order set a $25 million civil penalty, required deletion of certain data, and barred using data subject to deletion requests to train algorithms.
Status: Settled; Amazon agreed to the order without admitting the allegations.
Score 49
Training privacyPaperPoPETs 2026
Chatbot Confessions: Large-Scale Analysis of Private Data Disclosure in Shared AI Chatbot Conversations petsymposium.org · PDF
Majid Mollaeefar et al.
Analyzes 100,342 publicly shared conversations from ChatGPT, Microsoft Copilot and Google Gemini and finds about 8% (8,131) disclose private or sensitive data, most often user identifiers (49%) and location (40%), with financial, health and authentication data at roughly 3-4% each. About 60% of disclosures in long conversations occur in their final quarter.
Limits: Covers only conversations users chose to share via public links, which may not represent private chat logs.
Score 49Abstract page
FHEPaperACM CCS 2025
THOR: Secure Transformer Inference with Homomorphic Encryption eprint.iacr.org · PDF
Jungho Moon, Dongwoo Yoo, Xiaoqian Jiang, Miran Kim
Non-interactive CKKS transformer inference with new packing for plaintext-ciphertext and ciphertext-ciphertext matrix multiplication. Reports 5.3x faster plaintext-ciphertext and 9.7x faster ciphertext-ciphertext matrix multiplication than prior work, and BERT-base (128 tokens) inference in about 10 minutes on one GPU with GLUE accuracy comparable to plaintext.
Limits: Minutes per BERT-base input on a GPU; nonlinear functions are approximated and the work is limited to encoder-scale models.
Score 48Abstract page
FHEPaperICLR 2025
Encryption-Friendly LLM Architecture arxiv.org · PDF
Donghwan Rho, Taeseong Kim, Minje Park et al.
Modifies the transformer for CKKS by replacing softmax with a Gaussian kernel and using LoRA so only small adapters are updated, enabling encrypted fine-tuning as well as inference. Reports 6.94x faster fine-tuning and 2.3x faster inference under HE than the unmodified baseline, with accuracy comparable to plaintext.
Limits: Requires an architecture change and retraining, and experiments use a small BERT-style encoder rather than a production LLM.
Score 48Abstract page
Training privacyPaperNeurIPS 2025
Exploring the limits of strong membership inference attacks on large language models arxiv.org · PDF
Jamie Hayes et al.
Scales the strong LiRA membership inference attack to GPT-2-style models from 10M to 1B parameters, training reference models on over 20B tokens of C4. Strong attacks do succeed on pretrained LLMs, but AUC stays below 0.7 in practical settings and many per-example decisions are no better than chance because of training randomness.
Limits: Requires training many reference models, which is impractical for most attackers and was only feasible up to 1B parameters.
Score 47Abstract page
Confidential computingPaperarXiv preprint
EnclaveX: End-to-End Confidential AI with CPU/GPU TEEs arxiv.org · PDF
Robert Schambach et al.
Adds application-level attestation and secret release (SCONE plus a policy-driven attestation service) on top of TDX/SEV-SNP CVMs and NVIDIA GPU attestation, so a Kubernetes administrator with exec access cannot reach model keys. On TDX with an H200 and Llama-3.1-8B, the extra layer adds no measurable inference overhead and about 1.3% to attestation time, though CC itself cost 35-63% throughput across batch sizes 1-64 (highest at small batches) in this setup.
Limits: Trusts Intel, NVIDIA and the attestation service (which users must attest and configure); evaluation is pre-production with some quote checks skipped, and side channels are out of scope.
Score 47Abstract page
Confidential computingPaperICML 2025 Workshop on Technical AI Governance
Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments arxiv.org · PDF
Christoph Schnabl et al.
Runs model audits inside a TEE so that a model provider and an auditor who do not trust each other can obtain an attested result proving which model was evaluated, without revealing model weights or the benchmark set. The prototype runs Llama-3.1-8B on CPU-only AWS Nitro Enclaves and is feasible but slow (about 1.8 tokens/s versus 202 tokens/s on a non-enclave GPU).
Limits: Trusts AWS Nitro hardware and hypervisor; GPU TEEs are left to future work, so cost and speed are far from production inference.
Score 46Abstract page
FHEPaperarXiv preprint
Private LoRA Fine-tuning of Open-Source LLMs with Homomorphic Encryption arxiv.org · PDF
Jordan Frery, Roman Bredehoft, Jakub Klemsa, Arthur Meyre, Andrei Stoian
Client-server LoRA fine-tuning where the server computes the frozen base-model linear layers on encrypted, 8-bit quantized activations while the client keeps LoRA weights and runs nonlinear layers locally. In cleartext simulation, 8-bit quantized fine-tuning of Llama-3.2-1B reached perplexity 1.2391 versus 1.2381 in FP32, and one encrypted training step (16 tokens) took about 58 minutes on a laptop GPU.
Limits: Honest-but-curious server, public base weights, and an interactive protocol where the client computes nonlinear layers; per-step cost is far from practical training throughput.
Score 46Abstract page
FHEPaperNDSS 2025
Secure Transformer Inference Made Non-interactive eprint.iacr.org · PDF
Jiawen Zhang, Xinpeng Yang, Lipeng He et al.
NEXUS runs the whole transformer under FHE (CKKS with bootstrapping) so the client sends one encrypted query and receives one encrypted result, with no interaction mid-inference. Reports 372.5x less bandwidth than BOLT and 53.6x less than BumbleBee; the GPU version runs BERT-base inference in 37.3 s using 164 MB.
Limits: Server is semi-honest and sees the model in plaintext; nonlinear layers rely on polynomial approximations and results are for BERT-scale encoders.
Score 46Abstract page
MPC + FHEPaperIEEE S&P 2024
BOLT: Privacy-Preserving, Accurate and Efficient Inference for Transformers eprint.iacr.org · PDF
Qi Pang, Jinhao Zhu, Helen Möllering, Wenting Zheng, Thomas Schneider
Two-party transformer inference that uses HE for matrix multiplication with compact packing and OT-based protocols with accurate approximations for softmax, GELU and LayerNorm, plus word elimination to cut tokens mid-network. Reports 10.91x lower communication and 4.8-9.5x faster inference than the prior state of the art on BERT-base.
Limits: Semi-honest two-party model; evaluated on BERT-scale encoders, with minutes-scale latency and GB-scale communication per input.
Score 46Abstract page
MPC + FHEPaperNDSS 2025
BumbleBee: Secure Two-party Inference Framework for Large Transformers eprint.iacr.org · PDF
Wen-jie Lu, Zhicong Huang, Zhen Gu et al.
Two-party HE+OT framework that cuts matrix multiplication communication by 80-90% and nonlinear activation communication by 80-95% versus prior techniques. Benchmarked on five transformers; LLaMA-7B generates one token in about 14 minutes on CPUs, over 10x faster than Iron and 3x faster than BOLT with one-tenth the communication.
Limits: Semi-honest two-party model; CPU-based token latency in minutes.
Score 45Abstract page
Data caseCaseRegulator guidance
FTC warns that quietly changing terms to use customer data for AI may be unfair or deceptive ftc.gov
FTC Office of Technology and Division of Privacy and Identity Protection · Industry-wide
FTC staff stated that a company adopting more permissive data practices, such as using previously collected data for AI training, through a surreptitious or retroactive change to its privacy policy or terms may be acting unfairly or deceptively. The post cites earlier cases (Gateway Learning 2004, a 2023 genetic-testing case) and says the FTC will act against such changes.
Status: Staff guidance rather than a rule or enforcement action; applies existing Section 5 law.
Score 44
Data caseCaseCompany policy
Slack clarifies it trains non-generative models on customer data by default, with email opt-out slack.com
Slack (Salesforce) · Slack
In May 2024 users drew attention to Slack's privacy principles, which allow it to analyze customer data (messages, content, files) to build global models for features such as channel and emoji recommendations and search ranking. Slack said it does not train generative AI models on customer data and that workspaces are opted in by default, with opt-out available only by emailing Slack.
Status: Policy unchanged in substance; opt-out of global non-generative models remains by email request from workspace owners.
Score 43Abstract page
MPC + FHEPaperUSENIX Security 2020
Delphi: A Cryptographic Inference Service for Neural Networks eprint.iacr.org · PDF
Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasan et al.
A hybrid client-server inference protocol that moves homomorphic encryption work into a preprocessing phase, uses secret sharing for linear layers online and garbled circuits for ReLUs, and uses architecture search to replace some ReLUs with cheaper polynomial approximations. Reports a 22x improvement in online latency over the prior state of the art.
Limits: Semi-honest client model, heavy offline preprocessing per query, and evaluated on CNNs rather than transformers.
Score 42Abstract page
Data caseCaseCompany policy
Zoom revises terms to state customer content will not be used to train AI models zoom.com
Zoom · Zoom
After public criticism of March 2023 terms that appeared to permit broad use of customer content, including for machine learning, Zoom revised its terms in August 2023. The revised terms state Zoom does not use customer audio, video, chat, screen sharing, attachments or other communications to train Zoom's or third-party AI models.
Status: Resolved by a terms change; no regulatory action was reported.
Score 42
Training privacyPaperarXiv
Extracting books from production language models arxiv.org · PDF
Ahmed Ahmed et al.
Tests long-form extraction from Claude 3.7 Sonnet, GPT-4.1, Gemini 2.5 Pro and Grok 3 using an initial probe (with a Best-of-N jailbreak where needed) followed by repeated continuation prompts. Gemini 2.5 Pro and Grok 3 reached 76.8% and 70.3% near-verbatim recall of a popular novel without jailbreaking; jailbroken Claude 3.7 Sonnet reached 95.8%, while GPT-4.1 refused after about 4.0%.
Limits: Focuses on widely duplicated copyrighted books, so results indicate memorization capacity rather than direct leakage of private user data.
Score 41Abstract page
Confidential computingPaperarXiv preprint
Characterization of GPU TEE Overheads in Distributed Data Parallel ML Training arxiv.org · PDF
Jonghyun Lee et al.
Studies multi-GPU data-parallel training when every gradient exchanged between GPU TEEs must be AES-GCM encrypted and authenticated. With four GPU TEEs, per-iteration time rises 8x on average and up to 41.6x, because ring all-reduce multiplies encryption steps; larger gradient buckets reduce but do not remove the cost (GPT2-XL still about 3x slower).
Limits: Multi-GPU encryption is emulated with custom CUDA kernels on H100 because native multi-GPU CC training drivers were unavailable; trusts only the CPU and GPU packages.
Score 40Abstract page
TEE breakAttack paperIEEE S&P 2026
TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition tee.fail · PDF
Jalen Chuang et al. · Affects Intel TDX, Intel SGX, AMD SEV-SNP, NVIDIA H100 CC (attestation relay)
A DDR5 memory-bus interposer observes the deterministic memory encryption used by Intel TDX/SGX and AMD SEV-SNP (including with Ciphertext Hiding). The authors extract attestation keys from Intel's Provisioning Certification Enclave, allowing forged TDX and SGX quotes, and recover ECDSA signing keys from an SEV-SNP VM. Because NVIDIA GPU attestation is not bound to a specific CVM, the stolen keys also let an attacker present GPU attestations relayed from other machines; the setup needs physical access, root, and hobbyist-level soldering, at an estimated cost under $1,000.
Response: Intel and AMD consider memory-bus interposers out of their threat models and do not plan fixes (Intel advisory 2025-10-28-001, AMD-SB-3040); the only mitigation is physical security of the server.
Score 37Abstract page
TEE breakAttack paperUSENIX Security 2026
StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU's Stack Engine stackwarpattack.com · PDF
Ruiyi Zhang et al. · Affects AMD SEV-SNP (EPYC Milan, Genoa, Turin; Zen 3-5)
A malicious hypervisor toggles an undocumented core-scoped MSR bit that controls the CPU's stack engine from the sibling SMT thread, shifting an SEV-SNP guest's stack pointer by an attacker-chosen amount. The bit behaves the same on Zen 1 through Zen 5, and the authors demonstrate RSA-CRT key recovery, OpenSSH password-authentication bypass, sudo privilege escalation and kernel code execution inside a confidential VM on Zen 4. It is software-only but requires hypervisor control and SMT enabled.
Response: AMD tracks it as CVE-2025-29943 (AMD-SB-3027) and released hot-loadable microcode before disclosure; disabling SMT for CVMs is a stopgap.
Score 37Abstract page
TEE breakAttack paperACM CCS 2025
RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP rmpocalypse.github.io · PDF
Benedict Schlüter et al. · Affects AMD SEV-SNP (Zen 3/4/5)
During SEV-SNP initialization the hypervisor can leave dirty cache lines pointing at RMP memory that are later flushed to DRAM without RMP checks. A single 8-byte write is enough to corrupt the whole RMP, after which the authors forge attestation values, enable debug mode, read and write encrypted CVM memory, and replay register state. It is software-only, requiring a malicious hypervisor.
Response: AMD assigned CVE-2025-0033 (AMD-SB-3020) and released SEV firmware/microcode and AGESA fixes for Milan, Genoa and Turin through OEM BIOS updates.
Score 36Abstract page
TEE breakAttack paperACM CCS 2025
Heracles: Chosen Plaintext Attack on AMD SEV-SNP heracles-attack.github.io · PDF
Benedict Schlüter et al. · Affects AMD SEV-SNP
A malicious hypervisor moves encrypted guest pages in DRAM and observes the deterministic re-encryption, building a chosen-plaintext oracle that leaks guest memory at block and then byte granularity. The authors leak kernel memory, cryptographic keys and user passwords and hijack web sessions. It is software-only, requiring hypervisor control and the ability to read guest ciphertext.
Response: AMD treated its response as a feature update restricting page moves (SEV-SNP ABI 1.58, May 2025) rather than a fix; Zen 5 Ciphertext Hiding is intended to remove ciphertext visibility.
Score 36Abstract page
MPCPaperICLR 2026
SecP-Tuning: Efficient Privacy-Preserving Prompt Tuning for Large Language Models via MPC arxiv.org · PDF
Jinglong Luo, Zhuo Zhang, Yehong Zhang et al.
Private prompt tuning under MPC that avoids secure backpropagation through forward-only (gradient-free) tuning and replaces softmax attention with a privacy-preserving random feature attention. Reports about 12x speedup and 17x less communication than full-parameter fine-tuning under MPC, and about 16x/20x versus gradient-based prompt tuning, with comparable few-shot accuracy.
Limits: Two non-colluding semi-honest servers plus a trusted third party; evaluated on RoBERTa-large classification tasks, not generative LLMs, and the attention change alters the model.
Score 36Abstract page
TEE breakAttack paperIEEE S&P 2025
BadRAM: Practical Memory Aliasing Attacks on Trusted Execution Environments badram.eu · PDF
Jesse De Meulemeester et al. · Affects AMD SEV-SNP
A DIMM whose SPD chip is reprogrammed to report more memory than it has creates aliased physical addresses that bypass CPU access control. On AMD SEV-SNP this lets an attacker read, replay and modify ciphertext and tamper with the unencrypted RMP, which breaks attestation (launch-digest replay). The hardware costs under $10 (e.g. a Raspberry Pi Pico) and needs one-time physical access, or none if the BIOS exposes the SPD to software.
Response: AMD shipped firmware that validates memory configuration at boot (CVE-2024-21944, AMD-SB-3015); Intel TDX and Scalable SGX already had countermeasures, though Battering RAM later bypassed boot-time checks.
Score 35Abstract page
TEE breakAttack paperUSENIX Security 2026
Jailbreaking the AMD Secure Processor: Enabling Live Analysis of SEV-SNP's Undocumented Security Boundaries (ASPBreaker) usenix.org · PDF
Muyan Shen et al. · Affects AMD SEV-SNP (AMD Secure Processor firmware, Zen 3 tested)
Combines BadRAM-style memory aliasing of the Secure Processor's DRAM with a race in hot firmware updates to get code execution on the AMD Secure Processor, the root of trust for SEV-SNP. From there the authors decrypt guest memory after a firmware downgrade (the guest-context key is static across updates), carry a compromise across firmware updates while attestation reports a fresh TCB, and forge attestation reports. The attacker is a host administrator able to update or downgrade firmware; the aliasing step needs one-time DIMM SPD modification, or software access to the SPD.
Response: Demonstrated on EPYC Milan (Zen 3) only; AMD acknowledged the findings in August 2025 and requested an embargo, and no CVEs are listed in the paper.
Score 34Abstract page
TEE breakAttack paperIEEE S&P 2026
Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing batteringram.eu · PDF
Jesse De Meulemeester et al. · Affects Intel Scalable SGX, AMD SEV-SNP (DDR4 platforms)
A custom DDR4 interposer (bill of materials about $50) switches address lines at runtime to create memory aliases after the boot-time alias checks added in response to BadRAM have run. It gives arbitrary plaintext read/write of Intel Scalable SGX enclave memory, enough to extract the platform provisioning key and undermine DCAP attestation, and it revives BadRAM-style replay against fully patched AMD SEV-SNP. The attacker needs root plus brief physical access to install the interposer.
Response: Intel, AMD and Arm treat physical attacks as out of scope (AMD-SB-3024); there is no firmware fix, and the attack applies to DDR4 platforms only, with TDX on DDR5 analyzed only in theory.
Score 32Abstract page
Data caseCaseNews report
Samsung restricts staff use of generative AI after employees upload sensitive code to ChatGPT cnbc.com
CNBC (reporting Bloomberg) · Samsung / OpenAI
Samsung temporarily restricted generative AI tools on company computers after Bloomberg reported that some staff had uploaded sensitive code to ChatGPT. An internal memo advised employees not to enter personal or company information into such services, reflecting concern that prompts sent to consumer AI services may be retained or used for training.
Status: An internal corporate policy response, not a regulatory finding; no evidence was reported that the uploaded data appeared in model outputs.
Score 30
Data caseCaseCompany policy
Adobe updates terms of use after concerns over access to customer content for AI blog.adobe.com
Scott Belsky and Dana Rao (Adobe) · Adobe
A required re-acceptance of Adobe's terms in June 2024 led users to worry Adobe could access and train on their work. Adobe stated it has never trained generative AI on customer content, that Firefly is trained on licensed (e.g. Adobe Stock) and public-domain content, and that it would add the no-training commitment to its terms by 18 June 2024.
Status: Resolved by clarified terms; no regulatory action was reported.
Score 30
TEE breakAttack paperUSENIX Security 2024
Heckler: Breaking Confidential VMs with Malicious Interrupts ahoi-attacks.github.io · PDF
Benedict Schlüter et al. · Affects Intel TDX, AMD SEV-SNP
A malicious hypervisor injects interrupts (int 0x80, and signals on SEV-SNP) whose handlers change register and program state inside a confidential VM. The authors bypass OpenSSH authentication and escalate privileges via sudo in Intel TDX and AMD SEV-SNP guests. It is software-only; the authors' follow-up attack WeSee targets SEV-SNP through the #VC exception.
Response: Intel and AMD attributed it to guest software; Linux kernel patches block externally injected int 0x80 (CVE-2024-25744, CVE-2024-25743), but there is no general fix for the signal variant on SEV-SNP, and Azure CVMs use restricted interrupt injection modes.
Score 29Abstract page
TEE breakAttack paperUSENIX Security 2024
CacheWarp: Software-based Fault Injection using Selective State Reset cachewarpattack.com · PDF
Ruiyi Zhang et al. · Affects AMD SEV-ES, AMD SEV-SNP
A malicious hypervisor uses the INVD instruction to drop modified cache lines, reverting a guest's memory writes at single-store granularity. This lets the attacker hijack control flow, bypass authentication and escalate privileges inside SEV-ES and SEV-SNP VMs. It is software-only and requires hypervisor control.
Response: AMD fixed it by microcode (CVE-2023-20592, AMD-SB-3005).
Score 28Abstract page
TEE breakAttack paperUSENIX Security 2025
TDXploit: Novel Techniques for Single-Stepping and Cache Attacks on Intel TDX usenix.org · PDF
Fabian Rauscher et al. · Affects Intel TDX
Revives single-stepping against Intel TDX despite the TDX module 1.5.06 mitigation, by using an attacker-controlled trust domain to learn and predict the mitigation's internal state, reaching over 99.99% single-step accuracy. The authors attack ECDSA in OpenSSL and show that clflush enables Flush+Flush attacks on guest memory without shared pages, leaking AES T-table keys and TOTP secrets. It is software-only, requiring control of the host VMM.
Response: Intel confirmed the issue in January 2025; the paper does not report a specific fix, and side channels are partly the responsibility of constant-time guest software.
Score 27Abstract page
TEE breakAttack paperNDSS 2025
CounterSEVeillance: Performance-Counter Attacks on AMD SEV-SNP ndss-symposium.org · PDF
Stefan Gast et al. · Affects AMD SEV-SNP
A malicious hypervisor reads 228 performance-counter events while single-stepping an SEV-SNP guest, recovering instruction-level traces of secret-dependent control flow. The authors extract an RSA-4096 key from Mbed TLS in under 8 minutes and recover TOTP codes. It is software-only and works on fully patched systems.
Response: AMD published AMD-SB-3013 and points to PMC virtualization, which was not available on the authors' Zen 3/4 machines; Intel TDX already virtualizes counters.
Score 26Abstract page
TEE breakAttack paperTechnical report
SGAxe: How SGX Fails in Practice sgaxe.com · PDF
Stephan van Schaik et al. · Affects Intel SGX (client)
Uses the CacheOut transient-execution leak to extract the private attestation keys from Intel's production quoting enclave. With those keys an attacker can sign fake SGX quotes that pass remote attestation. It is software-only, running on the same machine.
Response: Intel issued microcode updates (CVE-2020-0549) followed by a TCB recovery that invalidated previous attestation keys.
Score 22Abstract page
TEE breakAttack paperUSENIX Security 2022
ÆPIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture aepicleak.com · PDF
Pietro Borrello et al. · Affects Intel SGX
An architectural CPU bug: reading undefined APIC MMIO registers returns stale data from the superqueue, so a privileged attacker can read SGX enclave data, including keys, without relying on a side channel. It is software-only but needs root.
Response: Intel fixed it with microcode and SGX SDK updates (CVE-2022-21233); it affected Ice Lake and Alder Lake-era parts.
Score 22Abstract page
TEE breakAttack paperIEEE S&P 2020
Plundervolt: Software-based Fault Injection Attacks against Intel SGX plundervolt.com · PDF
Kit Murdock et al. · Affects Intel SGX
A privileged attacker undervolts the CPU through a software-accessible MSR, inducing faults in SGX enclave computation. The authors recover AES and RSA keys from enclaves and induce memory-safety errors. It is software-only but needs root.
Response: Intel released microcode and BIOS updates that let the undervolting interface be disabled, with that state reflected in attestation (CVE-2019-11157, INTEL-SA-00289).
Score 16Abstract page
TEE breakAttack paperUSENIX Security 2018
Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution foreshadowattack.eu · PDF
Jo Van Bulck et al. · Affects Intel SGX
A transient-execution (L1 Terminal Fault) attack that reads SGX enclave memory through the L1 data cache. The authors extract SGX sealing and attestation keys, which undermines the attestation of the whole SGX ecosystem. It is software-only; the follow-up Foreshadow-NG extended it to VMs and the kernel.
Response: Intel mitigated it with microcode plus OS/hypervisor updates and a TCB recovery (CVE-2018-3615, INTEL-SA-00161).
Score 16Abstract page
Bring us a question worth checking.
Research collaborations
Discuss researchThreat models, benchmarks and private-inference prototypes.