Wiki Home

PAL*M: Property Attestation for Large Generative Models

Paper: arXiv:2601.16199

High-level overview

Emerging regulation, such as the EU AI Act, asks for verifiable evidence that a deployed model meets stated requirements about its accuracy, training data, provenance, and inference, even when the dataset and weights stay confidential. Property attestation supplies that evidence: a model provider produces a hardware-signed statement that some property holds of an operation it ran, and a verifier, a regulator, auditor, or customer, checks the statement without re-running the operation or seeing the confidential inputs. It rests on remote attestation, in which a hardware root of trust signs a measurement of the code and data that ran. PAL*M is a property-attestation framework that carries this from small CPU-only classifiers to large generative models, using large language models as its illustration.

Earlier hardware-assisted property attestation ran the whole machine-learning operation inside a single CPU enclave (Duddu et al., 2024). Large generative models break that arrangement: their training and inference span a CPU and a GPU, and their datasets are too large to hold in enclave memory, so frameworks memory-map them and sample records on demand from untrusted storage. PAL*M runs operations inside a confidential virtual machine, a trusted execution environment holding an entire VM, paired with a TEE-aware GPU so the accelerator’s work is itself measured and attested, and it measures out-of-order dataset reads with an order-independent hash. On this basis it defines property measurements for a catalogue of operations from preprocessing through training, fine-tuning, evaluation, and chat inference. The output is a verifiable property card: a model card, datasheet, or inference card. The prototype runs on commodity Intel TDX and an NVIDIA H100, reports under 11% overhead on common operations, and its attestation protocol is machine-checked in the Tamarin prover. PAL*M roots verifiability in trusted hardware, the counterpart to cryptographic schemes that certify the same properties with a zero-knowledge proof or secure computation.

Threat Model: A prover, the model provider that trains or serves a model, attests properties of its operations to a verifier, mediated by an initiator that requests an operation and forwards the evidence; the verifier may obtain reference values for a property from a trusted authority such as the hardware vendor. The adversary is a dishonest prover with the standard Intel TDX powers: it controls the host, the virtual machine manager, and the disk, so it can read and tamper with anything outside the trust boundary, including memory-mapped datasets in external storage, and it is a Dolev-Yao network adversary that can inject or modify protocol messages. It may try to forge a quote, either by learning the signing key or by tampering with code and data undetected. The trusted set is small and named: the Intel TDX module and the TDX-aware CPU, trusted to be implemented correctly, to isolate the confidential VM from the host and from other VMs, and to produce a hardware-signed quote over what ran; and the NVIDIA H100’s hardware, trusted to measure its own configuration and report it honestly. Trust in that sense reaches no further. The confidential VM is created by the adversary-controlled virtual machine manager, and the GPU is assigned by that same manager, its interface outside the VM’s protection until the assignment is made, so neither the VM nor the assigned device is assumed to be in the state it should be. Each is therefore attested rather than trusted: the VM through its quote, the GPU through an attestation token the VM obtains and checks before relying on the device. What an attestation carries is a property of an operation over its inputs and outputs, measured and extended into the signed quote; the model and the dataset stay confidential and never enter the quote. Denial of service, side-channel attacks on the hardware, and physical attacks, including memory-bus interposition and physically swapping the GPU, are out of scope.

Basic Background

Large generative models and their operations

A large language model is a transformer with billions of parameters, pretrained to predict the next token and then adapted to tasks (Vaswani et al., 2017). Adaptation is usually parameter-efficient fine-tuning, which updates a small subset of weights or small added modules rather than retraining the whole model, with low-rank adaptation (LoRA) the common instance (Hu et al., 2022). Post-training also includes quantization, which lowers the numerical precision of weights to shrink memory and compute. Quality is reported on benchmarks such as MMLU for knowledge and BLEU for translation. Because the datasets dwarf main memory, training libraries memory-map them, mapping a file into virtual memory and loading records from disk on demand instead of holding the whole dataset resident, and they sample records in random order.

Trusted execution environments and confidential VMs

A trusted execution environment (TEE) isolates code and data from the rest of the system, including a privileged operating system, and offers remote attestation of the loaded code. The early commodity TEEs were user-space enclaves (Intel SGX) or a two-world split (Arm TrustZone). Confidential virtual machines place an entire VM inside the trust boundary, so an unmodified operating system runs in the enclave; Intel TDX, AMD SEV-SNP, and Arm Realms are examples, and the isolation builds on hardware virtualization. PAL*M assumes the standard Intel TDX adversary model, in which the host and the virtual machine manager are untrusted (Aktas et al., 2023). TEE-aware GPUs, such as the NVIDIA H100 in confidential-computing mode, extend isolation and attestation to the accelerator, so a CPU enclave and the GPU can form one attested environment.

Remote attestation and property attestation

In remote attestation a hardware root of trust signs a measurement of what code loaded, and a remote verifier checks the signature and the measurement (De Oliveira Nunes et al., 2024). Property-based attestation certifies that a configuration has a property rather than a specific configuration: the verifier compares the signed measurement against reference values supplied by a trusted authority (Sadeghi and Stüble, 2004). Carried to machine learning, a measurer hashes the inputs and outputs of an operation, and the attestations populate verifiable property cards, a model card, a datasheet, or an inference card.

Order-independent integrity for sampled data

An incremental multiset hash is a cryptographic primitive that produces a fixed-size value over an unordered collection and can be updated one element at a time. Because it is insensitive to insertion order, two runs that read the same records in different orders produce the same hash, which is what makes it suited to integrity checking of data sampled out of order from memory or disk (Clarke et al., 2003).

Verifiable machine learning without trusted hardware

The cryptographic route to verifiable machine learning removes trust in the prover’s hardware. A zero-knowledge proof certifies that a computation on a secret witness was performed correctly while revealing nothing else, and secure multiparty computation lets parties jointly compute over private inputs revealing only the output. A cryptographic commitment binds a value, such as a model, so later proofs refer to one fixed object. These are the alternative roots of trust against which a hardware-attestation scheme is measured.

Reading guidance

• Section 3.2, the paragraph on the GPU: the H100’s hardware is trusted, the device the VMM assigns to the confidential VM is not, and one attestation token separates the two. Find the sentence that does the work of bringing the GPU inside the trust boundary.
• Section 4.3, the per-operation property measurements: for each operation, what the measurement commits to and what it hashes rather than carries. That omission is what keeps the model and the dataset confidential.
• Section 6.1.3, Table 6: attesting one inference against attesting a session of many. Note what changes between the two and therefore when the framework is affordable.