This PhD thesis will investigate how server-side confidential-computing technologies can be used to secure training and inference in decentralized machine-learning systems.
Processing distributed data, whether for inference or for training a shared model, offers the prospect of more privacy-preserving forms of machine learning. Rather than relying on a small number of service providers that collect and centralize user data, decentralized approaches can allow data to remain on user devices or distributed storage nodes. However, decentralization does not in itself guarantee privacy or security: in a distributed environment, any participating node may be compromised or behave maliciously.
Against this background, the integration of confidential computing into artificial-intelligence systems is becoming increasingly important, particularly as AI is increasingly used to process sensitive data in domains such as healthcare, finance, and defence. Retrieval-Augmented Generation (RAG) systems, which combine information retrieval with generative models such as large language models (LLMs), are now widely used for applications including document analysis, conversational assistants, and recommendation systems. These systems are commonly deployed in cloud environments, where they may be exposed to risks such as data leakage, intellectual-property theft, malicious infrastructure operators, and model tampering.
Recent hardware technologies such as Intel Trust Domain Extensions (TDX) and AMD Secure Encrypted Virtualization–Secure Nested Paging (SEV-SNP) provide promising foundations for securing such workloads. They make it possible to isolate virtual machines, models, and data within trusted execution environments (TEEs), even when the underlying cloud infrastructure is not fully trusted. These mechanisms protect data while it is being processed and provide cryptographic attestation mechanisms that can be used to verify the identity and integrity of the execution environment [2,3].
The PhD student will build on the WIDE team’s expertise in operating systems, hypervisors, trusted execution environments [4], and decentralized machine learning [5,6]. The central objective will be to design new virtualization mechanisms and a trusted Virtual Machine Monitor (VMM) for confidential AI workloads, with RAG systems serving as a principal use case.
The thesis will primarily make systems contributions at the intersection of operating systems, virtualization, distributed systems, and hardware-assisted security. It will involve the design, implementation, and experimental evaluation of low-level mechanisms. The implementation work will require strong low-level programming skills, particularly in C or C++, and may also involve Rust depending on the selected system components and research directions. Although the work targets AI workloads, its main scientific and technical focus is not the design of machine-learning models, but the construction of secure and efficient systems infrastructure for their execution.
A first challenge is to provide strong security guarantees while preserving compatibility with existing guest operating systems and application stacks. The VMM should offer services such as isolation, attestation, secure resource management, and controlled communication without requiring invasive changes to the guest operating system or forcing applications to be aware of the underlying confidential-computing mechanisms. Achieving such transparency is essential for practical deployment, but raises significant questions regarding the trusted computing base, the placement of security mechanisms, and the trade-offs between transparency, performance, and assurance.
A second challenge arises from the heterogeneity of the available infrastructure. Not all participating servers will support confidential-computing technologies, and some may be untrusted or incompatible with technologies such as TDX or SEV-SNP. The thesis will therefore investigate hybrid architectures that combine trusted and untrusted computing resources.
A naive distribution of an AI workload across heterogeneous nodes could expose sensitive data, intermediate representations, model parameters, or computation results to malicious participants. The thesis will explore mechanisms for partitioning data and computation between protected and unprotected environments. This may involve splitting models, data, or execution stages so that sensitive components remain confined to trusted nodes, while less sensitive computation is delegated to untrusted resources.
The resulting system will need to determine which components must execute within trusted environments, how protected and unprotected nodes can cooperate securely, and which security guarantees can be maintained under different threat models. Particular attention will be paid to low-level VMM and systems-software design, secure communication between execution domains, attestation, memory and resource management, and the performance and scalability of the resulting architecture. The work will therefore require substantial implementation effort, including low-level programming, debugging, performance analysis, and experimentation on modern virtualization and confidential-computing platforms.
