Newshot Original text(via HN AI)
| Tell HN: Hardware flaws to confidential AI are probably worse than they let on | ||
|---|---|---|
| 1 point by arboles 36 minutes ago │ hide │ past │ favorite │ 1 comment | ||
| By "they", I mean services that advertise private AI inference running in confidential computing environments like Intel SGX/TDX. My point is: I've seen arguments that RAM interposition showcased in tee.fail would probably be too obvious in a reputable data center, but you can seemingly just extract a key through a physical attack once and pretend to be that CPU in software thereafter.[1] I'm not very knowledgeable in this topic, but how are users of this service meant to verify that the TDX verifications quotes aren't forged from a key extracted from a processor as seen in tee.fail? [1] https://tee.fail/#:~:text=Recovering%20Attestation%20Keys%20from%20Intel%20Machines |
My point is: I've seen arguments that RAM interposition showcased in tee.fail would probably be too obvious in a reputable data center, but you can seemingly just extract a key through a physical attack once and pretend to be that CPU in software thereafter.[1]
I'm not very knowledgeable in this topic, but how are users of this service meant to verify that the TDX verifications quotes aren't forged from a key extracted from a processor as seen in tee.fail?
[1] https://tee.fail/#:~:text=Recovering%20Attestation%20Keys%20from%20Intel%20Machines
| arboles 25 minutes ago [–] Some examples of private AI inference that have had threads on HN are Tinfoil.sh and Confer.to reply | arboles 25 minutes ago [–] Some examples of private AI inference that have had threads on HN are Tinfoil.sh and Confer.to reply | ||
|---|---|---|---|
| arboles 25 minutes ago [–] Some examples of private AI inference that have had threads on HN are Tinfoil.sh and Confer.to reply |