PaperlayerView exact revision on arXiv

Source-linked AI summary

Trusted Model Environment for Private Semantic Computations

Vasisht Duddu, Xi He

arXiv:2609.30032v1cs.CR

TL;DR

Existing primitives do not directly support broad semantic computation over sensitive structured and unstructured data. TME combines generative models in TEEs with output-leakage controls, and its evaluation reports effectiveness, confidentiality, utility preservation, verifiability, efficiency, and scalability.

  • Problem

    Standard cryptographic primitives are not directly applicable to the wide range of semantic computation on unstructured data, motivating private computation over sensitive structured and unstructured data.

    Source: §1 · p. 1, §3.3 · p. 4

  • Method

    TME runs generative models inside TEEs and uses latent adversarial training to suppress verbatim leakage and information-flow control to detect indirect semantic leakage.

    Source: §1 · p. 1, §7 · p. 13

  • Results

    TME’s empirical evaluation demonstrates effectiveness, confidentiality, utility preservation, verifiability, efficiency, and scalability.

    Source: §7 · p. 13

  • Takeaways & Limitations

    TME is presented as a practical primitive for private semantic computation, combining generative models with TEE-based computation confidentiality and verifiability.

    Source: §7 · p. 13

    The work does not develop or evaluate TEE side-channel defenses and assumes the TEE is properly configured with appropriate defenses to minimize leakage.

    Source: §7 · p. 13

Abstract

from arXiv · show

A private semantic computation primitive enables parties to privately compute over structured and unstructured data that requires understanding its semantics, context, and relationships. Standard cryptographic primitives (e.g., multiparty computation) do not readily support such computation. Generative models are well suited for such tasks but typically process data in plaintext, while cryptographic private inference remains inefficient and difficult to scale. Thus, we need a new primitive for private semantic computation. We introduce trusted model environments (TME), the first such primitive that executes generative models inside trusted execution environments (TEEs) while controlling output leakage. TME is designed to be (i) effective (correctly performs the semantic task); (ii) confidential (protects computation and sensitive inputs); (iii) utility-preserving (retains utility on other tasks); (iv) verifiable (provides tamper-resistant evidence of the computations); (v) efficient (incurs low overhead compared to baseline model computations); and (vi) scalable (supports multiple participating parties). Effectiveness follows from the generative models, while TEEs provide confidential computation. For confidentiality of sensitive inputs, we combine adversarial training to resist verbatim leakage with an information flow control module to suppress semantic leakage. For verifiability, we introduce novel attestations that let parties verify TME operations on their data and queries, along with optimizations (e.g., batching) for efficiency and scalability. We design and evaluate the proof-of-concept for TME across three applications, showing that it meets all the requirements.

1. Introduction

Semantic computation over sensitive, structured and unstructured data calls for privacy beyond what standard cryptographic tools readily provide. The paper introduces trusted model environments (TMEs), combining generative models and TEEs with defenses against output leakage.

1. Introduction

  • Motivating tasks include answering a semantic question about a private document, finding shared illicit patterns across confidential sets, and retrieving a relevant patient record without revealing the query or access pattern.The examples require interpreting meaning rather than matching exact data.Source: §1 · p. 1
  • Standard cryptographic primitives do not readily support semantic computation, generative models process data in plaintext, and cryptographic private inference is expensive in practice.These constraints motivate a new private semantic computation primitive.Source: §1 · p. 1
  • TME runs generative models inside TEEs and is designed to be effective, confidential, utility-preserving, verifiable, efficient, and scalable.The paper reports demonstrations across three applications.Source: §1 · pp. 1–2
  • Latent adversarial training suppresses verbatim leakage, while an information flow control module detects and paraphrases outputs flagged for semantic leakage.The paper distinguishes sensitive-input confidentiality from computation confidentiality.Source: §1 · pp. 1–2

2. Background

The background reviews privacy primitives for functions, set intersections, and database retrieval, then describes trusted execution environments and remote attestation. These tools protect different aspects of computation and data access.

2. Background

  • Private function computation includes secure multiparty computation, homomorphic encryption, and functional encryption, which differ in who computes and learns the result.Each is described as limiting what is revealed beyond the function output.Source: §2 · p. 2
  • Private set intersection lets parties compute shared elements while protecting their sets; private record linkage extends matching to noisy or inconsistently formatted records.The passage contrasts approximate record matching with exact set intersection.Source: §2 · p. 2
  • Oblivious RAM hides which database records are accessed, whereas private information retrieval retrieves an entry without the server learning which one.The background distinguishes access-pattern protection from retrieval from an often public, read-only database.Source: §2 · p. 2
  • TEEs isolate trusted applications and provide protected memory and remote attestation to support confidentiality, integrity, and verification of code execution.Remote attestation uses a verifier's fresh nonce to prevent replay of an old attestation.Source: §2 · p. 2

3. Problem Statement

The paper defines private semantic computation over sensitive data held by multiple parties, with correct answers required without revealing sensitive inputs. It considers adversaries, illustrates three application types, and explains why existing approaches do not directly realize the primitive.

3. Problem Statement

  • The goal is a private computation primitive that enables semantic computations over structured and unstructured data.The general setting involves queries over sensitive data held by multiple parties.Source: §3 · p. 2, §3.1 · p. 3

3.1. Threat Model

  • The threat model includes honest-but-curious parties and malicious parties that may deviate or use adversarial queries; the server's TEE is trusted, but outside software is not.Parties trust the hardware manufacturer and can verify expected code through remote attestation; TEE side-channel attacks are out of scope.Source: §3.1 · p. 3

3.2. Illustrative Applications

  • The applications are semantic function computation over private inputs, semantic intersection of parties' sets, and semantic retrieval from a private document database.Their queries and outputs require interpretation of meaning rather than circuit predicates, exact set matches, or record indices.Source: §3.2 · p. 3

3.3. Limitations of Related Work

  • Existing cryptographic primitives target structured data, generative models lack computation confidentiality and can reveal sensitive inputs, and cryptographic private inference has high overhead.The paper identifies its work as the first to design and implement the components needed to realize this primitive.Source: §3.3 · p. 4

4. Trusted Model Environment

TME runs generative models inside TEEs and adds protections and attestations for semantic computation over private data. It instantiates this design for PSFC, PSSP, and PSDR, with a fixed-order carousel for private database retrieval.

4. Trusted Model Environment

  • Table 1 reports TME as the only mechanism satisfying all six requirements, compared with cryptographic primitives, generative models, and private inference.The requirements are effectiveness, confidentiality, utility preservation, verifiability, efficiency, and scalability.Source: Table 1 · p. 4, §4 · p. 4

4.1. Overview: TME for Illustrative Applications

  • PSFC evaluates functions on sensitive inputs, PSSP computes semantic intersections of private sets, and PSDR retrieves relevant records from private databases.PSDR processes records in a carousel and uses query-specific notes to generate answers without retrieving only similar records.Source: §4.1 · p. 4, §4.3 · p. 7

4.2. Components of TME (PSFC and PSSP)

  • LAT trains against adversarial queries to suppress verbatim disclosure, while an IFC monitor detects residual leakage and a paraphraser removes it from flagged outputs.The paraphraser aims to preserve the answer, and the KL term anchors the model to its base behavior for utility.Source: §4.2 · pp. 5–6
  • TEEs protect computation, and fixed-budget decoding makes response timing independent of answer length; TEE-specific side channels may still be possible.Padding is removed before scoring, so it does not affect effectiveness or utility.Source: §4.2 · p. 6
  • Attestations bind model, input, and output hashes to TME computations, while input commitments fix the private data used without revealing its content.Merkle-tree batching lets one hardware attestation cover a batch, with each party verifying its result using an authentication path.Source: §4.2 · p. 6
  • Batching amortizes inference and IFC across queries, while one-time model measurement and an attested in-TEE signing key reduce recurring attestation costs.Each party still has a lightweight input commitment.Source: §4.2 · pp. 6–7

4.3. Additional TME Components for PSDR

  • PSDR scans the entire database in fixed order, producing query-specific notes and an attestation that certifies every record was parsed.The scan gives each lookup a data-independent trace; batching pending queries trades per-query overhead for throughput.Source: §4.3 · p. 7

5. Experiment Setup

The experiments evaluate TME across three applications using application-specific effectiveness and confidentiality measures, separate utility benchmarks, and a defined TEE hardware setup. They also measure added component and attestation costs against in-TEE inference.

5. Experiment Setup

  • Experiments use three local 7–9B instruction-tuned models on Intel TDX with an H100 NVL GPU; Qwen3-8B supplies IFC monitoring and paraphrasing.The three task models are Ministral-8B, gemma-2-9b, and OLMo-2-7B.Source: §5 · p. 7
  • PSFC, PSSP, and PSDR use SQuADv2, DBpedia14, and HotpotQA, respectively; each dataset uses 100/50/100 train-validation-test splits.PII is predefined for evaluation; runtime extraction is future work.Source: §5 · p. 7
  • PSFC and PSDR effectiveness is measured with token-level F1, PSSP with set-level F1, and unrelated-task utility with MMLU and CSQA accuracy.The F1 measures use normalized answers; PSSP predictions are mapped to ontology labels before comparison.Source: §5 · p. 8
  • Confidentiality measures include target-record guessing for PSDR and verbatim and semantic ASR; per-record note-length side channels may remain.Padding is suggested as a possible mitigation for note-length leakage and is left for future work.Source: §5 · p. 8
  • Efficiency and scalability compare added TME costs with single in-TEE model inference, measuring IFC, carousel, and attestation overhead as parties increase.Attestation costs are separated into baseline execution, measurement, and evidence generation; hardware quotes are compared with an in-TEE signing key.Source: §5 · p. 8

6. Evaluation

The evaluation tests TME across private semantic function computation (PSFC), private semantic set processing (PSSP), and private semantic database retrieval (PSDR). It reports confidentiality gains alongside trade-offs in utility, effectiveness, and overhead.

6.1. Private Semantic Function Computation

  • In PSFC, TME’s effectiveness stays close to base models and sensitive-input leakage becomes negligible, with a small utility drop.LAT can reduce token-F1, while IFC largely restores it; LAT and IFC together suppress leakage across benign, adversarial, and indirect queries.Source: §6.1 · p. 9, Table 3 · p. 9, Table 4 · p. 9
  • PSFC utility drops by 5.3 points for Ministral-8B (62.5% →57.2%), 4.4 for gemma-2-9b (72.0% →67.6%), and 0.6 for OLMo-2-7B (65.1% →64.5%).The measure is combined accuracy on MMLU and CSQA.Source: §6.1 · p. 9
  • PSFC batching reduces per-query inference latency from 1.9s to 262ms across batch sizes 1 to 8, while attestation overhead falls as parties share attestations.Hardware attestation adds 0.07–0.13%; in-TEE attestation adds 0.003–0.005%. Figure 2 plots measurement and attestation as a percentage of baseline versus N.Source: §6.1 · p. 10, Figure 2 · p. 10

6.2. Private Semantic Set Processing

  • In PSSP, effectiveness remains similar to the base model for two of three models, with a drop for gemma-2-9b; LAT and IFC reduce leakage to negligible levels.Applying LAT and IFC reduces MMLU+CSQA accuracy by 4.1 points for Ministral-8B (63.0% →58.9%), 4.7 for gemma-2-9b (72.0% →67.3%), and 2.1 for OLMo-2-7B (64.5% → 62.4%).Source: §6.2 · pp. 10–11, Table 5 · p. 10, Table 6 · p. 11
  • PSSP batching keeps inference and IFC checks independent of party count, reducing per-party overhead toward 1/N; attestation overhead remains small as party set sizes grow.For gemma-2-9b, per-party inference drops from 6.0 s at N=2 to 2.0 s at N=6; attestation overhead stays within 7.2–8.5 ms across the evaluated set sizes.Source: §6.2 · p. 11, Figure 3 · p. 11

6.3. Private Semantic Database Retrieval

  • In PSDR, TME maintains effectiveness close to the base model, with utility drops of 3.1 points for Ministral-8B (63.0% →59.9%), 4.5 for gemma-2-9b (72.0% →67.5%), and 2.4 for OLMo-2-7B (64.5% →62.1%).LAT and IFC reduce leakage to negligible levels; the carousel cuts access-pattern recovery from 0.63 for top-k retrieval to 0.05 for a constant full scan.Source: §6.3 · pp. 11–12, Table 7 · p. 12, Table 8 · p. 12
  • In PSDR, the carousel dominates overhead: single-party overhead versus standard RAG is 41% for OLMo-2-7B, 92% for Ministral-8B, and 132% for gemma-2-9b, but batching amortizes cost across parties.The scan cost grows linearly with database size; the evaluation covers a limited range, and scaling the carousel to substantially larger databases remains an open challenge. Figure 4 plots measurement and attestation as a percentage of the standard-RAG baseline versus N.Source: §6.3 · pp. 12–13, Figure 4 · p. 13

7. Discussion and Summary

The discussion concludes that TME is a practical primitive for private semantic computation, while identifying boundaries in its leakage measurements, evaluation scale, and TEE assumptions.

Limitations

  • Reported leakage and attack success rates cover only sensitive inputs identified by Microsoft Presidio, so disclosures of missed inputs are not counted.Quantifying the gap requires human-labeled sensitive inputs, which the authors leave for future work.Source: §7 · p. 13

Scaling to Larger Models; Scaling to Other Modalities

  • Evaluation restricts models to 7–9B parameters to fit the model, monitor, and paraphraser on one 80GB H100 GPU, and focuses on text-based computation.The authors state that TME generalizes to audio, images, and graphs, but those modalities are not the focus of this evaluation.Source: §7 · p. 13

Side-Channel Attacks

  • TME assumes a properly configured TEE with defenses against side-channel leakage; developing and evaluating those defenses is outside this work.The authors describe TEE side-channel mitigation as an orthogonal direction.Source: §7 · p. 13

Other Applications

  • Because TME uses a system prompt for semantic instructions, the authors describe it as readily reconfigurable to other applications, including private record linkage, searchable encryption, voting, and auctions.The paper also cites private non-competition checks, regulator confidentiality audits, and privacy-preserving property monitoring as applications identified by Shumailov et al. [52].Source: §7 · p. 13

Summary: TME contributions and evaluation

  • TME combines generative models and TEEs with protections against verbatim and semantic leakage, and the authors report empirical support for six design requirements.Those requirements are effectiveness, confidentiality, utility preservation, verifiability, efficiency, and scalability.Source: §7 · p. 13

Disclosure of AI Tool-Use

The authors disclose limited use of AI tools for implementation assistance and editorial work, while attributing the research ideas and core research work to themselves.

Disclosure of AI Tool-Use

  • Claude Code assisted with selected implementation tasks and a TikZ figure, while ChatGPT was used selectively for English and grammar editing and concision.The authors state that they independently developed the research ideas, methodology, experiments, and initial manuscript, and verified the implementation assistance.Source: Disclosure of AI Tool-Use · p. 14

Appendix A. Dataset Construction

The appendix constructs three application datasets from public benchmarks, using exact ground truth for deterministic effectiveness scoring and identifying sensitive inputs in source text.

Appendix A. Dataset Construction

  • All three application datasets use public benchmarks for exact ground truth and deterministic effectiveness scoring, with sensitive inputs detected by Microsoft Presidio across five entity types.Records without sensitive inputs and questions whose effectiveness ground truth overlaps with a sensitive input are dropped.Source: Appendix A · p. 16
  • PSFC uses SQuADv2 context passages and five reading-comprehension questions per record, with token-F1 scoring and a 250-record train/validation/test split of 0.4:0.2:0.4.Each question is assigned to one computing party.Source: Appendix A · p. 16
  • PSSP uses DBpedia14 abstracts labeled with one of 14 ontology classes; the exact ground-truth intersection is the set of classes present in every party’s private set.Its 250 balanced records are split 100/50/100 by record, stratified by class, so all classes and semantic domains appear in every split with disjoint documents.Source: Appendix A · p. 16
  • PSDR uses HotpotQA multi-hop passages as the private database and queries whose answers occur in specific records, with 1,000 records and 250 queries split 100/50/100 by query.Source: Appendix A · p. 16

Appendix B. Hyperparameters for Evaluation

The appendices describe the evaluation configuration and the attestations used to bind model execution, party inputs, leakage checks, and oblivious database access to verifiable evidence.

Appendix B. Hyperparameters for Evaluation

  • LAT trains LoRA/RSLoRA adapters while freezing base weights, using latent PGD perturbations at four transformer blocks and a four-term objective balancing leakage suppression with benign-task retention and utility.The configuration uses 60 outer steps, eight PGD steps, and excludes tokens already below a −5.0 log-probability threshold from the away term.Source: Appendix B · p. 16
  • Manyshot uses 24 demonstrations, or 32 for OLMo, while Autodan tries up to three strategies, or five for OLMo; IFC uses shared Qwen3-8B monitor and paraphraser models.Served-model output padding fixes new-token count at 32+16k for a batch of k queries; helper models decode greedily.Source: Appendix B · p. 16

Appendix C. Attestation Descriptions

  • Model measurement hashes the base weights and LAT adapter once at startup, while input commitment hashes each party’s private input so later attestations can verify what computation consumed without revealing it.Inference evidence binds the system prompt, committed inputs, measured model, and output; tampering with the model or an input invalidates the inference attestation and derived attestations.Source: Appendix C · pp. 16–17
  • Monitor and paraphraser attestations bind the relevant helper model and inference evidence to the leakage verdict or sanitized rewrite, respectively.This certifies that the verdict came from the monitor and that released rewritten text came from the paraphraser rather than an arbitrary substitution.Source: Appendix C · p. 17
  • The oblivious-access attestation commits to the database’s Merkle root and records accessed, and verifies that all Ndb records were scanned in fixed order.Checking nacc = Ndb supports the assertion that the access pattern is independent of which records are relevant.Source: Appendix C · p. 17

Appendix D. Monitor Results

The monitor is evaluated on 200 test samples using false-positive, false-negative, precision, and recall measures. The reported overall precision and recall are high, while false positives and false negatives are low.

Appendix D. Monitor Results

  • The monitor’s alarms are evaluated by precision, the fraction corresponding to real leaks, and recall, the fraction of real leaks caught.These measures are reported alongside false-positive and false-negative rates.Source: Appendix D · p. 17
  • False positives are benign non-leaking responses incorrectly flagged, while false negatives are real leaks that the monitor does not flag.Source: Appendix D · p. 17
  • Across 200 test samples, overall precision and recall are high, while false positives and false negatives are low.Table 9 reports these monitor-detection measures on the test split.Source: Appendix D · p. 17, Table 9 · p. 17

Appendix E. IFC-aware Adversary

The appendix evaluates adaptive queries designed to elicit sensitive inputs while evading the information-flow-control monitor. The reported adversarial examples optimized against both the model and monitor are not effective after LAT.

Appendix E. IFC-aware Adversary

  • Table 10 reports Leak, the fraction with a model leak, and Evade, the fraction of disclosures that also evade the monitor.Source: Table 10 · p. 18
  • Carousel has cost linear in both database size and number of parties.Source: Appendix E · p. 18
  • The adaptive adversary optimizes queries against both the model and IFC monitor to elicit sensitive inputs while avoiding paraphrasing and monitor detection.The evaluation reports ASR-Verbatim across applications and models.Source: Appendix E · pp. 17–18
  • After LAT, adversarial examples optimized against the full pipeline are reported as ineffective, indicating resistance to an IFC-aware adversary.Source: Appendix E · p. 18

Appendix F. Asymptotic Cost

TME adds only linear input-dependent hashing overhead beyond model inference, with batching amortizing fixed attestation costs across parties. The applications have different per-party cost profiles, while total costs remain linear in the stated settings.

Appendix F. Asymptotic Cost

  • TME adds no super-linear overhead: hashing is linear in input, output, and Merkle-leaf byte length, alongside model inference costs of O(L^2) attention and O(L) feed-forward computation.The model inference follows the served model’s sequence-length complexity.Source: Appendix F · p. 18
  • Across N parties, one batched inference and one hardware quote amortize fixed evidence, leaving an O(log N) Merkle authentication path per party and total cost O(N).Source: Appendix F · p. 18
  • PSFC has O(N) inference and IFC screening with O(log N) membership proofs; PSSP screens one shared intersection output at O(1) IFC cost in N.Source: Appendix F · p. 18
  • A PSDR carousel cycle serves N parties over an Ndb-record database in O(Ndb + N), or amortized O(Ndb/N) per party.The stated throughput matches a scan-based approach.Source: Appendix F · p. 18
Loading 2609.30032v1…