Confidential Computing Across Edge‐To‐Cloud for Machine Learning: A Survey Study

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The service provider and enclave owner could execute the attestation directly.

“Also, the service provider and enclave owner could execute the attestation directly [26].”

• cites [26] 26. F. Mo, Z. Tarkhani, and H. Haddadi, "SOK: Machine Learning With Confidential Computing," 2022 arXiv preprint arXiv:2208.10134. sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

An attestation server could be launched by the processor manufacturer, as with Intel's SGX attestation service, which is distinct from the cloud service provider.

“An attestation server could be launched by the processor manufacturer, as with Intel's SGX attestation service [27], which is distinct from the cloud service provider.”

• cites [27] 27. G. Chen, S. Chen, Y. Xiao, Y. Zhang, Z. Lin, and T. H. Lai, "SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution," in Proceedings of European Symposium on Security and Privacy (EuroS&P) (Stockhome, Sweden: IEEE, 2019), 142-157. sourcePartly supported

  The ‘Defense via Centralized Attestation Services’ section says Intel’s attestation service arbitrates attestation requests from the ISV, supporting the Intel SGX example. Our copy does not establish the claimed distinction between that service and a cloud service provider. (LLM, conf=0.82)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

Intel SGX employs a memory encryption engine to provide assured secrecy, integrity, and freshness of CPU-DRAM traffic within enclave memory ranges.

“Intel Software Guard Extensions (SGX) [27] employs a memory encryption engine to provide assured secrecy, integrity, and freshness of the CPU-DRAM traffic within the enclave memory ranges.”

• cites [27] 27. G. Chen, S. Chen, Y. Xiao, Y. Zhang, Z. Lin, and T. H. Lai, "SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution," in Proceedings of European Symposium on Security and Privacy (EuroS&P) (Stockhome, Sweden: IEEE, 2019), 142-157. sourcePartly supported

  Section B, “Intel SGX” (page not available), identifies memory encryption as an SGX primitive and says enclave memory is protected for confidentiality and integrity. Our copy does not establish the more specific claim that a memory encryption engine assures freshness of CPU–DRAM traffic. (LLM, conf=0.84)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

Intel SGX is an extension to the x86-64 instruction set that provides a facility for executing select portions of an application within a hardware-assisted TEE, specifically within a secure enclave.

“Intel SGX, an extension to the x86-64 instruction set, provides a facility for executing select portions of an application within a hardware-assisted TEE, specifically within a secure enclave, as noted in Figure 4.”

• cites [31] 31. S. Weiser and M. Werner, "SGXio: Generic Trusted i/o Path for Intel SGX," in Proceedings of 7th ACM on Conference on Data and Application Security and Privacy (New York: ACM, 2017), 261-268. sourcePartly supported

  Section 3 (p. 2) says SGX adds x86 instructions that let applications designate parts of their virtual address space as secure enclaves, with CPU-enforced protection. This supports the enclave-execution claim, but our copy calls the instructions x86, not specifically x86-64. (LLM, conf=0.82)

  Experimental — accuracy not yet measured

May combine two claims.

Within an Intel SGX enclave, both application code and data are preserved in an encrypted state and are decrypted solely within the CPU, which guarantees confidentiality.

“Within this trusted environment, both the application code and data are preserved in an encrypted state and are decrypted solely within the CPU, which guarantees confidentiality.”

• cites [31] 31. S. Weiser and M. Werner, "SGXio: Generic Trusted i/o Path for Intel SGX," in Proceedings of 7th ACM on Conference on Data and Application Security and Privacy (New York: ACM, 2017), 261-268. sourcePartly supported

  Section 3 (p. 2) says SGX encrypts enclave memory when writing it to DRAM and prevents non-enclave access, supporting protection of code and data in memory. But Section 3 (p. 3) also says enclave code is public; the paper does not support the unqualified claim that encrypting code and data guarantees their confidentiality, or explicitly state that decryption occurs solely within the CPU. (LLM, conf=0.85)

  Experimental — accuracy not yet measured

May combine two claims.

Prominent implementations of TEE are Intel SGX, AMD SEV, and ARM TrustZone.

“Prominent implementations of TEE, namely Intel Software Guard Extension (SGX) [31], AMD Secure Encrypted Virtualization (SEV) [32], and ARM TrustZone [28], are studied in Section 4.1.”

• cites [31] 31. S. Weiser and M. Werner, "SGXio: Generic Trusted i/o Path for Intel SGX," in Proceedings of 7th ACM on Conference on Data and Application Security and Privacy (New York: ACM, 2017), 261-268. sourceSupported
• cites [32] 32. "AMD SEV-SNP: Strengthening VM Isolation With Integrity Protec- tion and More," 2022, https://www.amd.com/en/processors/amd-secure -encrypted-virtualization.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

A third party, besides the user and host, could perform the attestation.

“A third party, besides the user and host, could perform the attestation [26,29].”

• cites [26] 26. F. Mo, Z. Tarkhani, and H. Haddadi, "SOK: Machine Learning With Confidential Computing," 2022 arXiv preprint arXiv:2208.10134. sourceSupported
• cites [29] 29. J. Ménétrey, C. Göttel, M. Pasin, P. Felber, and V. Schiavoni, "An Exploratory Study of Attestation Mechanisms for Trusted Execution Envi- ronments," 2022, arXiv preprint arXiv:2204.06790. sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Remote attestation enables the owner to authenticate the hardware, validate the trusted state of a distant TEE, and determine whether the intended program is operating securely within the TEE.

“It enables the owner to authenticate the hardware, validate the trusted state of a distant TEE, and determine whether the intended program is operating securely within the TEE.”

• cites [25] 25. S. Fei, Z. Yan, W. Ding, and H. Xie, "Security Vulnerabilities of SGX and Countermeasures: A Survey," ACM Computing Surveys (CSUR) 54, no. 6 (2021): 1-36. sourceNot checked — no full text of the source
• cites [29] 29. J. Ménétrey, C. Göttel, M. Pasin, P. Felber, and V. Schiavoni, "An Exploratory Study of Attestation Mechanisms for Trusted Execution Envi- ronments," 2022, arXiv preprint arXiv:2204.06790. sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing).

Based on the hardware access control mechanism, any unauthorized access to Intel SGX enclave memory is deemed a page-fault.

“Based on the hardware access control mechanism, any unauthorized access to the enclave memory is deemed as a page-fault.”

• cites [31] 31. S. Weiser and M. Werner, "SGXio: Generic Trusted i/o Path for Intel SGX," in Proceedings of 7th ACM on Conference on Data and Application Security and Privacy (New York: ACM, 2017), 261-268. sourcePartly supported

  Section 3, “Software Guard Extensions” (p. 2), says the CPU generally prohibits non-enclave access to enclave memory, supporting the hardware access-control part of the claim. It does not say that unauthorized access is treated as a page fault; the same section (p. 3) also notes that the OS can access debug enclaves through specific instructions. (LLM, conf=0.87)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

Remote attestation serves as a verification protocol for the service provider to evaluate the health of enclave(s) created at a remote location.

“Remote attestation serves as a verification protocol for the service provider to evaluate the health of enclave(s) created at a remote location [27,53,54].”

• cites [27] 27. G. Chen, S. Chen, Y. Xiao, Y. Zhang, Z. Lin, and T. H. Lai, "SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution," in Proceedings of European Symposium on Security and Privacy (EuroS&P) (Stockhome, Sweden: IEEE, 2019), 142-157. sourceSupported
• cites [53] 53. S. Mofrad, F. Zhang, S. Lu, and W. Shi, "A Comparison Study of Intel SGX and AMD Memory Encryption Technology," in Proceedings of 7th International Workshop on Hardware and Architectural Support for Secu- rity and Privacy (New York: ACM, 2018), 1-8. sourceSupported
• cites [54] 54. J. Van Bulck, M. Minkin, O. Weisse, et al., "Foreshadow: Extracting the Keys to the Intel SGX Kingdom With Transient Out-of-Order Execu- tion," in Proceedings of 27th USENIX Security Symposium USENIX Secu- rity (Maryland: ACM, 2018), 991-1008.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Intel SGX allows code inside the enclave to directly access memory outside EPC; however, such memory accesses are controlled by the operating system memory management system.

“SGX allows the code inside the enclave to directly access the memory outside EPC; however, such memory accesses are controlled by the operating system (OS) memory management system [31].”

• cites [31] 31. S. Weiser and M. Werner, "SGXio: Generic Trusted i/o Path for Intel SGX," in Proceedings of 7th ACM on Conference on Data and Application Security and Privacy (New York: ACM, 2017), 261-268. sourceSupported

Probably not a substantial claim: may not pass S3 (load-bearing).

SGX creates a limited size encrypted memory region, the Enclave Page Cache (EPC), where all enclaves are created.

“SGX creates a limited size of the encrypted memory region, referred to as Enclave Page Cache (EPC), where all the enclaves are created.”

• cites [31] 31. S. Weiser and M. Werner, "SGXio: Generic Trusted i/o Path for Intel SGX," in Proceedings of 7th ACM on Conference on Data and Application Security and Privacy (New York: ACM, 2017), 261-268. sourcePartly supported

  Section 3, p. 2, says SGX creates secure enclaves and encrypts enclave memory when writing it to DRAM. It does not identify an Enclave Page Cache (EPC), say that it has limited size, or state that all enclaves are created there. (LLM, conf=0.84)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

Intel SGX supports multi-threading within enclaves to accelerate parallel execution of trusted applications.

“SGX supports multi-threading within enclaves to accelerate the parallel execution of trusted applications.”

• cites [31] 31. S. Weiser and M. Werner, "SGXio: Generic Trusted i/o Path for Intel SGX," in Proceedings of 7th ACM on Conference on Data and Application Security and Privacy (New York: ACM, 2017), 261-268. sourcePartly supported

  The Enclave Programming Model section (p. 5) explicitly says SGX supports multithreading and describes secure user applications running in enclaves. It does not say that multithreading accelerates their parallel execution; that performance claim is unsupported by the cited passage. (LLM, conf=0.86)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Comprehensive IoT standardization will be pivotal in fully realizing the potential of confidential computing at the IoT tier [102].

“Ultimately, the comprehensive IoT standardization will be pivotal in fully realizing the potential of confidential computing at the IoT tier [102].”

• cites [102] 102. L. Kugler, "Standards to Secure the Sensors That Power IoT," Com- munications of the ACM 66, no. 6 (2023): 14-16. sourcePartly supported

  The section “Standards Are Absolutely Essential for Security” describes IoT security standards as important, and “Standards to Secure the Sensors That Power IoT” says existing standards leave gaps. The paper does not address confidential computing or say that comprehensive standardization is pivotal to realizing its potential at the IoT tier. (LLM, conf=0.85)

  Experimental — accuracy not yet measured

May combine two claims.

Intel SGX provides a remote attestation policy that evaluates the enclave identity, the integrity of the code inside it, and guarantees the authenticity of the Intel processor.

“Intel SGX provides remote attestation policy that evaluates the enclave identity, integrity of the code inside of it, and guarantees the authenticity of the Intel processor.”

• cites [27] 27. G. Chen, S. Chen, Y. Xiao, Y. Zhang, Z. Lin, and T. H. Lai, "SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution," in Proceedings of European Symposium on Security and Privacy (EuroS&P) (Stockhome, Sweden: IEEE, 2019), 142-157. sourcePartly supported

  The Remote Attestation section (page not provided) says attestation is used to prove that a claimed enclave runs on an SGX-enabled processor, supporting the enclave and processor-verification aspects. It does not explicitly say that attestation evaluates the integrity of the code inside the enclave. The Extracting attestation key section also demonstrates that a stolen key can produce a valid quote without running the enclave on SGX, so processor authenticity is not guaranteed without qualification. (LLM, conf=0.86)

  Experimental — accuracy not yet measured
• cites [53] 53. S. Mofrad, F. Zhang, S. Lu, and W. Shi, "A Comparison Study of Intel SGX and AMD Memory Encryption Technology," in Proceedings of 7th International Workshop on Hardware and Architectural Support for Secu- rity and Privacy (New York: ACM, 2018), 1-8. sourceSupported
• cites [54] 54. J. Van Bulck, M. Minkin, O. Weisse, et al., "Foreshadow: Extracting the Keys to the Intel SGX Kingdom With Transient Out-of-Order Execu- tion," in Proceedings of 27th USENIX Security Symposium USENIX Secu- rity (Maryland: ACM, 2018), 991-1008.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Distributed inference approaches can keep the source data and perform pre-processing on the source trusted machine, then perform neural network processing on a normal potentially untrusted machine.

“For such applications, approaches based on distributed inference [136] can be achieved that keep the source data (e.g., captured images) and perform the pre-processing step on the source (trusted) machine, and then the neural network processing can be performed on a normal (potentially untrusted) machine [76].”

• cites [136] 136. S. Hosseinalipour, S. S. Azam, C. G. Brinton, et al., "Multi-Stage Hybrid Federated Learning over Large-Scale D2D-Enabled Fog Net- works," 2020, arXiv preprint arXiv:2007.09511. sourceCould not verify

  The Introduction (p. 1) describes keeping data on devices during federated model training, not performing neural-network inference on a potentially untrusted machine. The Machine Learning Task section (p. 4) likewise concerns local training and model aggregation. Searches for distributed inference, preprocessing, and trusted or untrusted machines found no passage addressing the part of the sentence attributed to this source. (LLM, conf=0.75)

  Experimental — accuracy not yet measured
• cites [76] 76. D. G. Samani and S. M. Amini, "Exploring the Impact of Virtualization on the Usability of the Deep Learning Applications," in Proceedings of 22th International Symposium on Cluster, Cloud and Internet Computing CCGrid (Taormina, Italy: IEEE/ACM, 2022). sourcePartly supported

  The Introduction (p. 1) says inference runs a DNN model and can take place on systems ranging from Cloud servers to Edge devices. It does not say that pre-processing stays on a trusted source machine while neural-network processing is transferred to a potentially untrusted machine; the paper evaluates execution platforms rather than that distributed, trust-based arrangement. (LLM, conf=0.81)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

A correctly constructed feature extractor can reduce the feature dimension while still capturing critical information, enabling a compact classifier to perform well.

“In fact, a correctly constructed feature extractor can reduce the feature dimension while still capturing critical information, enabling a compact classifier to perform well.”

• cites [116] 116. V. J. Lawhern, A. J. Solon, N. R. Waytowich, S. M. Gordon, C. P. Hung, and B. J. Lance, "EEGNet: A Compact Convolutional Neural Network for EEG-Based Brain-Computer Interfaces," Journal of Neural Engineering 15, no. 5 (2018): 056013. sourceSupported

May combine two claims.

Dynamic memory isolation reduces exposure to timing-based attacks and improves the security of confidential processing.

“This approach reduces exposure to timing-based attacks and improves the security of the confidential processing [27].”

• cites [27] 27. G. Chen, S. Chen, Y. Xiao, Y. Zhang, Z. Lin, and T. H. Lai, "SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution," in Proceedings of European Symposium on Security and Privacy (EuroS&P) (Stockhome, Sweden: IEEE, 2019), 142-157. sourcePartly supported

  The paper’s “Leaking Secrets via Side Channels” section (page unavailable) says enclave memory is not shared with the outside world, preventing ordinary FLUSH+RELOAD attacks. But it also explains how SGXPECTRE can use that timing-based channel despite the separation. The copy does not establish that dynamic memory isolation, as an approach, improves the security of confidential processing. (LLM, conf=0.78)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

ML as a Service with proper remote attestation and verification can securely handle a wide range of workloads.

“Although this approach constrains the trust boundary and no one can physically breach the GPU, there are also other possible approaches such as ML as a Service (MLaaS) [26] with proper remote attestation and verification for securely handling a wide range of workloads.”

• cites [26] 26. F. Mo, Z. Tarkhani, and H. Haddadi, "SOK: Machine Learning With Confidential Computing," 2022 arXiv preprint arXiv:2208.10134. sourcePartly supported

  Section 4.1 (p. 11) describes server-side inference and training services and says data or model owners remotely attest the TEE before provisioning them. But Section 7.5 (p. 25) says protecting the full ML pipeline remains intractable without multiple TEEs and that new security challenges are not fully explored. The paper therefore supports the proposed approach, not an unqualified assurance that it securely handles a wide range of workloads. (LLM, conf=0.86)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

Control-flow integrity prevents control-flow hijacking in TEEs by tracking valid control flows and interrupting unauthorized branches.

“Another study [150] introduces control-flow integrity (CFI) to prevent control-flow hijacking in TEEs.By tracking valid control flows and interrupting unauthorized branches, CFI can mitigate risks of unauthorized code execution within the secure environment.”

• cites [150] 150. G. Yeo, Y. Kim, S. Song, and D. Kwon, "Efficient CFI Enforcement for Embedded Systems Using ARM TrustZone-M," Journal of IEEE Access 10 (2022): 132675-132684. sourcePartly supported

  The Introduction says CFI checks control-transfer targets to detect and thwart control-flow hijacking, and the Edge Regulator section says CEST terminates the program when an indirect-call target is invalid. But the Discussion says this implementation patches and evaluates only the non-secure user area. It uses TrustZone-M's secure area for checking; it does not establish protection against unauthorized code execution within the secure environment. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S3 (load-bearing).

Intel SGX proposes dynamic memory isolation to limit potential damage from side-channel attacks by isolating memory regions during execution phases.

“Intel SGX proposes dynamic memory isolation to limit the potential damage from side-channel attacks by isolating memory regions during the execution phases.”

• cites [27] 27. G. Chen, S. Chen, Y. Xiao, Y. Zhang, Z. Lin, and T. H. Lai, "SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution," in Proceedings of European Symposium on Security and Privacy (EuroS&P) (Stockhome, Sweden: IEEE, 2019), 142-157. sourcePartly supported

  The Intel SGX section describes enclave memory isolation during execution, and the Introduction says it protects code and data from other software. Neither section describes the isolation as dynamic or says it is proposed to limit damage from side-channel attacks; the paper’s “Leaking Secrets via Side Channels” section instead describes how such attacks can leak enclave information. Page numbers are unavailable in our copy. (LLM, conf=0.86)

  Experimental — accuracy not yet measured

Probably not a substantial claim: may not pass S4 (based).

Although numerous studies have been undertaken to improve real-timeness and scalability across the edge-to-cloud, comparatively less attention has been paid to confidential computing across heterogeneous tiers of the continuum.

“Although numerous studies have been undertaken to improve the real-timeness and scalability across the edge-to-cloud, comparatively less attention has been paid to the confidential computing across heterogeneous tiers of the continuum.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

According to recent research [94,95], around 54% serverless applications contain only one function, whereas 50% of them have less than one second of executing latency.

“According to the recent research [94,95], around 54% serverless applications contain only one function, whereas 50% of them have less than one second of executing latency.”

• cites [94] 94. M. Shahrad, R. Fonseca, Í. Goiri, et al., "Serverless in the Wild: Char- acterizing and Optimizing the Serverless Workload at a Large Cloud Provider," in Proceedings of USENIX Annual Technical Conference (Vir- tual: ACM, 2020), 205-218.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [95] 95. M. Li, Y. Xia, and H. Chen, "Confidential Serverless Made Efficient With Plug-in Enclaves," in Proceedings of 48th Annual International Sym- posium on Computer Architecture (ISCA) (Virtual: IEEE, 2021), 306-318. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

As we move from the cloud to user premises, communication latency decreases, but trustworthiness increases [7].

“As we move from the cloud to user premises, communication latency decreases, but trustworthiness increases [7].”

• cites [7] 7. S. Zobaed, "AI-Driven Confidential Computing across Edge-to-Cloud Continuum," 2023 arXiv preprint arXiv:2301.00928. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

In another incident [75], confidential information of over three billion Yahoo users was leaked.

“In another incident [75], confidential information of over three billion Yahoo users was leaked.”

• cites [75] 75. "Every Single Yahoo Account Was Hacked -3 Billion in All," https://www.money.cnn.com/2017/10/03/technology/business/yahoo -breach-3-billion-accounts/index.html.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

SGX lacks support for multiple address spaces and privileged and unprivileged mode separation.

“Lack of support for multiple address spaces and privileged and unprivileged mode separation.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Cloud providers often rely on Intel SGX and AMD SEV to offer confidential computing in the execution of trusted applications [87].

“At the hardware level, making use of a trusted execution environment (TEE) is a must and, for that purpose, cloud providers often rely on Intel SGX and AMD SEV to offer confidential computing in the execution of trusted applications [87].”

• cites [87] 87. "Securing Applications On Bare-metal Instances," https://www .anjuna.io/blog/securing-applications-on-bare-metal-instances.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Shadow enclave system is capable of scale to thousands of concurrent secure enclaves with proper resource utilization and reducing the start-up latency by three orders of magnitude [100].

“Their experimental evaluations indicate that the shadow enclave system is capable of scale to thousands of concurrent secure enclaves with proper resource utilization and reducing the start-up latency by three orders of magnitude [100].”

• cites [100] 100. E. Feng, X. Lu, D. Du, et al., "Scalable Memory Protection in the PENGLAI Enclave," in Proceedings of 15th USENIX Symposium on Operating Systems Design and Implementation (California: ACM, 2021), 275-294.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Plugin enclave-based serverless can scale up to 10× enclave instances than existing SGX hardware while reducing ≈ 96% overhead of function startup latency [95].

“They show that the plugin enclave-based serverless can scale up to 10× enclave instances than existing SGX hardware while reducing ≈ 96% overhead of function startup latency.”

• cites [95] 95. M. Li, Y. Xia, and H. Chen, "Confidential Serverless Made Efficient With Plug-in Enclaves," in Proceedings of 48th Annual International Sym- posium on Computer Architecture (ISCA) (Virtual: IEEE, 2021), 306-318. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

At present, AMD-SEV is only available in AMD's EPYC series processors that are intended only for servers.

“At present, AMD-SEV is only available in AMD's EPYC series processors that are intended only for servers.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Li et al. conclude that the design technology of the current SGX is the reason for the high latency overhead [95].

“Li et al. conclude that the design technology of the current SGX is the reason for the high latency overhead.”

• cites [95] 95. M. Li, Y. Xia, and H. Chen, "Confidential Serverless Made Efficient With Plug-in Enclaves," in Proceedings of 48th Annual International Sym- posium on Computer Architecture (ISCA) (Virtual: IEEE, 2021), 306-318. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Trust in TEEs is considered semi-dynamic: the TEE is not expected to change its trust level while running due to the protection provided by the separation kernel.

“As such, the trust in TEEs is considered semi-dynamic-the TEE is not expected to change its trust level while running due to the protection provided by the separation kernel.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The reliability of the trust score for TEEs hinges on the integrity measurement definitions.

“The reliability of this trust score hinges on the integrity measurement definitions.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Confidential computing fundamentally ensures trustworthy code execution through the strategic isolation of enclaves, or TEEs, from untrusted environments.

“Confidential computing fundamentally ensures trustworthy code execution through the strategic isolation of enclaves, or Trusted Execution Environments (TEEs), from untrusted environments [25].”

• cites [25] 25. S. Fei, Z. Yan, W. Ding, and H. Xie, "Security Vulnerabilities of SGX and Countermeasures: A Survey," ACM Computing Surveys (CSUR) 54, no. 6 (2021): 1-36. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The encryption and decryption processes for memory encryption are carried out within the CPU, making the procedure transparent to applications and not requiring software modifications.

“The encryption and decryption processes are carried out within the CPU, making the procedure transparent to applications and do not require any modifications to the software.”

Classified as probably not a substantial claim. May combine two claims.

TEE provides a hardware-assisted, fully isolated execution environment that is deemed the core of confidential computing.

“Hardware vendors, such as Intel, AMD, and ARM, have come forward with Trusted Execution Environment (TEE) [15] technology that provides a hardware-assisted, fully isolated execution environment that is deemed as the core of confidential computing.”

• cites [15] 15. C. Shepherd, G. Arfaoui, I. Gurulian, et al., Secure and Trusted Exe- cution: Past, Present, and Future-A Critical Review in the Context of the Internet of Things and Cyber-Physical Systems (In: Proceedings of Trust- com/BigDataSE/ISPA, 2016), 168-177. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Secure space and memory encryption technologies are not mutually exclusive and can often be combined to provide multiple layers of security.

“The secure space and memory encryption technologies are not mutually exclusive and can often be combined in various ways to provide multiple layers of security, enhancing the overall security posture of the system.”

May combine two claims.

TEE offers a tamper-resistant processing environment, running in a separate kernel, providing an acceptable level of originality, integrity, and confidentiality for the data and code to be executed.

“TEE offers a tamper-resistant processing environment, running in a separate kernel providing an acceptable level of originality, integrity, and confidentiality for the data and code to be executed [12,15,16].”

• cites [12] 12. Z. Ning, J. Liao, F. Zhang, and W. Shi, "Preliminary Study of Trusted Execution Environments on Heterogeneous Edge Platforms," in Pro- ceedings of Symposium on Edge Computing (Bellevue, WA: ACM, 2018), 421-426. sourceNot checked — no full text of the source
• cites [15] 15. C. Shepherd, G. Arfaoui, I. Gurulian, et al., Secure and Trusted Exe- cution: Past, Present, and Future-A Critical Review in the Context of the Internet of Things and Cyber-Physical Systems (In: Proceedings of Trust- com/BigDataSE/ISPA, 2016), 168-177. sourceNot checked — no full text of the source
• cites [16] 16. M. Sabt, M. Achemlal, and A. Bouabdallah, "Trusted Execution Environment: What it is, and What it is Not," in Proceedings of Trust- com/BigDataSE/ISPA, vol. 1 (Helsinki, Finland: IEEE, 2015), 57-64. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Sabt et al. proposed a trust function f(TEE, protection profile, RoT, measurements) that returns the trust level of a given TEE based on the certifying protection profile, the reliability of RoT, and the integrity measurements.

“This function returns the trust level of a given TEE based on three parameters: the certifying protection profile, the reliability of RoT, and the integrity measurements.”

• cites [16] 16. M. Sabt, M. Achemlal, and A. Bouabdallah, "Trusted Execution Environment: What it is, and What it is Not," in Proceedings of Trust- com/BigDataSE/ISPA, vol. 1 (Helsinki, Finland: IEEE, 2015), 57-64. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Technologies such as Intel SGX and ARM TrustZone utilize the secure space concept, creating isolated secure spaces where sensitive code and data can operate in a controlled, confidential manner.

“Technologies such as Intel SGX [52] and ARM TrustZone [28] utilize this concept, creating isolated secure spaces where sensitive code and data can operate in a controlled, confidential manner.”

• cites [52] 52. V. Costan and S. Devadas, "Intel SGX Explained," IACR Cryptology ePrint Archive 2016, no. 86 (2016): 1-118.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Memory encryption is widely used in AMD's SEV, where all memory contents of a virtual machine are encrypted, ensuring security of data from external threats.

“This technology is widely used in AMD's Secure Encrypted Virtualization (SEV) [32] where all the memory contents of a virtual machine are encrypted, ensuring the security of data from any possible external threats.”

• cites [32] 32. "AMD SEV-SNP: Strengthening VM Isolation With Integrity Protec- tion and More," 2022, https://www.amd.com/en/processors/amd-secure -encrypted-virtualization.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

By encrypting data within memory, memory encryption makes it difficult for an attacker to make sense of any data they might access, preserving the confidentiality and integrity of the data.

“By encrypting the data within memory, this technology makes it incredibly difficult for an attacker to make sense of any data they might access, effectively preserving the confidentiality and integrity of the data.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

ARM TrustZone utilizes distinct page tables, hardware privilege layers (e.g., EL3 and Secure EL2/EL1/EL0), and a TrustZone address space controller (TZASC4) for its implementation.

“In contrast, ARM TrustZone [28] utilizes distinct page tables, hardware privilege layers (e.g., EL3 and Secure EL2/EL1/EL0), and a TrustZone address space controller (TZASC4) for its implementation.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Secure Modules include two main classes: Trusted Platform Module (TPM) and Secure Element (SE).

“The other hardware category, Secure Modules, includes two main classes: Trusted Platform Module (TPM) and Secure Element (SE), which are elaborated in Section 4.2.”

• cites [30] 30. "What is a Hardware Security Module (HSM)?" https://www.entrust .com/resources/hsm/faq/what-are-hardware-security-modules.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Edge-cloud systems have emerged to reduce the latency of accessing compute service and to enable maintaining sensitive user data on-premise at the edge.

“To mitigate the threats introduced by the cloud services, edge-cloud systems have emerged not only to reduce the latency of accessing compute service but also to enable maintaining sensitive user data on-premise (i.e., at the edge) [12][13][14].”

• cites [12][13][14]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The interplay of machine learning and confidential computing has given birth to a new research field called confidential ML.

“Last but not least, at the application level, in Section 6.1.1,we pay specific attention to the interplay of machine learning (ML) and confidential computing that has given birth to a new research field, called confidential ML.”

Probably not a substantial claim: may not pass S3 (load-bearing).

TEE systems embody a hybrid form of trust encompassing both static and semi-dynamic aspects.

“TEE systems embody a hybrid form of trust-encompassing both static and semi-dynamic aspects.”

May combine two claims.

There is yet to be consensus on IoT standards, and this discrepancy is the Achilles' heel for confidential computing across the entire continuum.

“However, there is yet to be a consensus on these standards, and this discrepancy is the Achilles' heel for the confidential computing across the entire continuum.”

• AssumptionRests on an assumption: There is yet to be consensus on IoT standards.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

ARM TrustZone is a secure space-based TEE hardware architecture that extends the security aspect to the entire system design, allowing any part of the system to be protected.

“ARM TrustZone is another secure space-based TEE hardware architecture that extends the security aspect to the entire system design, allowing any part of the system to be protected.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Intel SGX offers an enclave sealing mechanism that encrypts the enclave to be safely stored in an untrusted storage medium for later use.

“SGX also offers an enclave sealing mechanism that encrypts the enclave to be safely stored in an untrusted storage medium, such as a hard drive, for later use.”

• cites [52] 52. V. Costan and S. Devadas, "Intel SGX Explained," IACR Cryptology ePrint Archive 2016, no. 86 (2016): 1-118.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [54] 54. J. Van Bulck, M. Minkin, O. Weisse, et al., "Foreshadow: Extracting the Keys to the Intel SGX Kingdom With Transient Out-of-Order Execu- tion," in Proceedings of 27th USENIX Security Symposium USENIX Secu- rity (Maryland: ACM, 2018), 991-1008.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

ARM TrustZone architecture can be isolated in two logical states: a secure/trusted world and a normal (insecure) world.

“ARM TrustZone architecture can be isolated in two logical states: a secure/trusted world and a normal (i.e., insecure) world Figure 5.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

May combine two claims.

While Intel SGX fulfills most objectives set forth by GlobalPlatform TEE, such as secure storage and isolated execution, it does not provide a native trusted User Interface (UI) or network communication directly from the enclaves.

“While Intel SGX fulfills most of the objectives set forth by the GlobalPlatform TEE, such as secure storage and isolated execution, it does not provide a native trusted User Interface (UI) or network communication directly from the enclaves.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The isolation of ARM TrustZone memory partitions is enforced by the memory controller providing access control for memory regions based on the current state.

“This isolation is enforced by the memory controller providing access control for memory regions based on the current state.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

An ARM-based device only has one TrustZone with the processor.

“Hence, an ARM-based device only has one TrustZone with the processor.”

• AssumptionRests on an assumption: ARM technology is predominantly used in single-purpose systems, such as IoT and edge computing, where the chip is specific to the target market.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

ARM TrustZone can separate physical memory into two partitions, with one partition exclusively accessible by the secure world.

“To facilitate secure world processing, TrustZone can separate physical memory into two partitions, with one partition being exclusively accessible by the secure world.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The overhead associated with context switching and memory copying in and out of TEEs can significantly slow down application response times.

“For instance, the overhead associated with context switching and memory copying in and out of TEEs can significantly slow down application response times.”

Probably not a substantial claim: may not pass S3 (load-bearing).

All other CPU cores of a multi-core ARM TrustZone system can remain in normal-world mode uninterruptedly.

“All other CPU cores of a multi-core system can remain in normal-world mode uninterruptedly.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

When an application executes in an ARM TrustZone secure world, TrustZone can isolate parts of the memory for its use by preventing access to these locations by applications executing in the real world.

“Therefore, when an application executes in a secure world, TrustZone can isolate parts of the memory for its use via preventing access to these locations by the applications executing in the real world [28].”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

May combine two claims.

SGX's isolated memory regions are ideal for small-TCB services, even though using them to run confidential VMs is challenging.

“SGX's isolated memory regions are ideal for small-TCB (Trusted Computing Base) services, even though using them to run confidential VMs is challenging.”

Probably not a substantial claim: may not pass S3 (load-bearing).

BM users have full control over the allocated servers, including their processing, storage, and networking subsystems [86].

“Consequently, BM users have full control over the allocated servers, including their processing, storage, and networking subsystems [86].”

• cites [86] 86. "Bare Metal Cloud vs IaaS: What are the Differences?," 2022, https://phoenixnap.com/blog/bare-metal-cloud-vs-iaas.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Intel SGX sealing helps the enclave retrieve data and secrets from the sealed file without performing a new remote attestation.

“It also helps the enclave while retrieving data and secrets from the sealed file without performing a new remote attestation [52,54].”

• cites [52] 52. V. Costan and S. Devadas, "Intel SGX Explained," IACR Cryptology ePrint Archive 2016, no. 86 (2016): 1-118.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [54] 54. J. Van Bulck, M. Minkin, O. Weisse, et al., "Foreshadow: Extracting the Keys to the Intel SGX Kingdom With Transient Out-of-Order Execu- tion," in Proceedings of 27th USENIX Security Symposium USENIX Secu- rity (Maryland: ACM, 2018), 991-1008.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In ARM TrustZone, the normal world cannot access memory allocated to the secure world, while the secure world can access normal-world memory.

“While the normal world cannot access memory allocated to the secure world, the secure world can access normal-world memory.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

When an SMC instruction is invoked from the normal world, the CPU core performs a context switch to the secure world and freezes its normal-world execution.

“When an SMC instruction is invoked from the normal world, the CPU core performs a context switch to the secure world and freezes its normal-world execution.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

May combine two claims.

More rigorous security measures often require additional computational overhead, which can adversely affect the performance and sometimes the accuracy of the system.

“This trade-off is particularly evident as more rigorous security measures often require additional computational overhead, which can adversely affect the performance and sometimes the accuracy of the system.”

• AssumptionRests on an assumption: More rigorous security measures require additional computational overhead.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Intel SGX takes advantage of multiple enclaves, unlike ARM-based devices.

“This is unlike Intel SGX, which takes advantage of multiple enclaves.”

Probably not a substantial claim: may not pass S3 (load-bearing).

BM servers do not use any form of virtualization and hypervisor [85].

“The important point is that BM servers do not use any form of virtualization and hypervisor [85].”

• cites [85] 85. X. Zhang, X. Zheng, Z. Wang, H. Yang, Y. Shen, and X. Long, "High-density Multi-tenant Bare-metal Cloud," in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Pro- gramming Languages and Operating Systems (Lausanne, Switzerland: ACM, 2020), 483-495. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

Communication with the ARM TrustZone secure world occurs from the insecure world through the Secure Monitor Call (SMC) instruction.

“Communication with the secure world occurs from the insecure world through the Secure Monitor Call (SMC) instruction.”

• cites [28] 28. D. C. G. Valadares, N. C. Will, M. A. Spohn, S. S. dDF, A. Perkusich, and K. C. Gorgonio, "Trusted Execution Environments for Cloud/Fog-based Internet of Things Applications," in Proceedings of International Conference on Cloud Computing and Services Science (CLOSER) (Virtual: IEEE, 2021), 111-121. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Latency introduced during data transfer between partitions can delay real-time analytics, affecting the timeliness and relevance of model outputs.

“Moreover, latency introduced during data transfer between partitions can delay real-time analytics, affecting the timeliness and relevance of the model outputs.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Selective execution in feature-based partitioning ensures that only the parts of the application that handle confidential information are subject to the security overhead of TEEs.

“This selective execution ensures that only the parts of the application that handle confidential information are subject to the security overhead of TEEs.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Functional encryption enables the computation of specific functions on encrypted data and returns only the result, restricting information exposure more tightly than homomorphic encryption.

“Functional Encryption (FE): FE goes a step further by enabling the computation of specific functions on encrypted data and returning only the result.This restricts the information exposure even more tightly than HE.Chotard et al. [119].”

• cites [119] 119. J. Chotard, E. Dufour-Sans, R. Gay, D. H. Phan, and D. Pointcheval, "Dynamic Decentralized Functional Encryption," Journal of Annual International Cryptology Conference Springer 12170 (2020): 747-775. sourceNot checked — no full text of the source

May combine two claims.

In vertical splitting, only the intermediate feature vector has to be transferred across fogs, which reduces data-transfer overhead and preserves sensitive data at the trusted machine.

“More importantly, in vertical splitting, only the intermediate feature vector has to be transferred across fogs, which has two benefits: (A) reducing the amount of data-transfer overhead and (B) preserving the sensitive data at the trusted machine.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Wu et al. propose a dynamic partitioning approach that optimizes the distribution of tasks between mobile devices and cloud or edge servers under variable network conditions and hardware capabilities.

“Wu et al. propose a dynamic partitioning approach that optimizes the distribution of tasks between mobile devices and cloud or edge servers under variable network conditions and hardware capabilities [121].”

• cites [121] sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Confidential containers can mitigate the limitation of confidential VMs by offering a finer degree of control and ensuring faster and secure execution of containerized applications.

“Confidential containers can mitigate the limitation of confidential VMs by offering a finer degree of control and ensuring faster and secure execution of containerized applications.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

HElib is an open-source library that implements the Brakerski-Gentry-Vaikuntanathan HE scheme along with several optimizations to enhance performance.

“HElib [147] is an open-source library that implements Brakerski-Gentry-Vaikuntanathan HE scheme along with several optimizations to enhance performance in Smart-Vercauteren ciphertext packing techniques, efficient recryption methods, and so forth.”

• cites [147] 147. S. Halevi and V. Shoup, "Design and Implementation of HElib: A homomorphic Encryption Library," Cryptology ePrint Archive 1481 (2020), 1-42.Not checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Recent advancements in TEEs in both high-end and low-end mobile devices make them a prime contender for achieving confidentiality and integrity in ML.

“Recent advancements in TEEs in both high-end and low-end mobile devices make them a prime contender for achieving confidentiality and integrity in ML.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Zhou et al. introduce CNN-leveraged application partitioning to accelerate IoT task executions.

“Likewise, Zhou et al. introduce CNN-leveraged application partitioning to accelerate IoT task executions [123].”

• cites [123] 123. L. Zhou, H. Wen, R. Teodorescu, and D. H. Du, "Distributing Deep Neural Networks With Containerized Partitions at the Edge," in Proceed- ings of 2nd USENIX Workshop on Hot Topics in Edge Computing (HotEdge 19) (Washington: IEEE, 2019).Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Layered partitioning simplifies the development process and allows for better resource allocation by only using TEEs where it is absolutely vital.

“The layered partitioning not only simplifies the development process but also allows for better resource allocation by only using TEEs where it is absolutely vital.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Differential privacy has generalization challenges, defined as the capacity of a privacy-preserving algorithm to maintain its efficacy when applied to data beyond the initial training dataset.

“However, DP has generalization challenges, which is defined as the capacity of a privacy-preserving algorithm to maintain its efficacy when applied to data beyond the initial training dataset.”

Classified as probably not a substantial claim. May combine two claims.

The two ConfML procedures ensure that the ML service never has access to the original data, while the data owners obtain the necessary networks.

“These two procedures ensure that the ML service never has access to the original data, while the data owners obtain the necessary networks.”

May combine two claims.

IoT devices are categorized as embedded systems [40] that often have their own custom firmware.

“In practice, IoT devices are categorized as embedded systems [40] that often have their own custom firmware.”

• cites [40] 40. G. Ayoade, A. El-Ghamry, V. Karande, L. Khan, M. Alrahmawy, and M. Z. Rashad, "Secure Data Processing for IoT Middleware Systems," Journal of Supercomputing 75, no. 8 (2019): 4684-4709. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The loosely coupled and independently developed properties of microservice-based applications are instrumental in achieving confidential computing, while monolithic applications are inflexible and often do not provide much room to boost confidential computing.

“While monolithic applications are inflexible and often do not provide much room to boost confidential computing, the loosely coupled and independently developed properties of microservice-based applications are instrumental in achieving confidential computing.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Component-based partitioning can be adjusted to operate at a high granularity level, contributing to an application's overall maintainability and scalability.

“Component-based partitioning can be adjusted to operate at a high granularity level, thereby contributing to an application's overall maintainability and scalability.”

May combine two claims.

Using encryption for ML requires decrypting the data before the start of training, which implies data vulnerability until the end of training.

“Using encryption for ML, however, requires decrypting the data before the start of training, which implies data vulnerability until the end of training.”

May combine two claims.

Model quantization and pruning can reduce the computational burden on TEEs but often at the expense of slight decreases in model accuracy.

“Techniques such as model quantization and pruning can be employed to reduce the computational burden on TEEs but often, at the expense of slight decreases in model accuracy [106].”

• cites [106] 106. S. Zobaed, A. Mokhtari, J. P. Champati, M. Kourouma, and S. M. Amini, "Edge-MultiAI: Multi-Tenancy of Latency-Sensitive Deep Learn- ing Applications on Edge," 2021, arXiv preprint arXiv:2211.07130. sourceNot checked — no full text of the source

May combine two claims.

The ConfML protocol has been proposed for data owners to adhere to when they share training data with an ML service, and it protects the privacy of training data during the training process.

“Towards that, Confidential Machine Learning, a.k.a.ConfML protocol, has been proposed that the data owners must adhere to when they share training data with an ML service [107].This protocol protects the privacy of training data during the training process.”

• cites [107] 107. T. Graepel, K. Lauter, and M. Naehrig, "ML Confidential: Machine Learning on Encrypted Data," Proceedings of International conference on information security and cryptology (Seol, South Korea: Springer, 2012): 1-21. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing).

A high batch size results in a substantial memory footprint because each sample in the batch generates its own activations for all the neural network model layers.

“A high batch size results in a substantial memory footprint, as each sample in the batch generates its own activations for all the neural network model layers.”

Probably not a substantial claim: may not pass S3 (load-bearing).

TenSEAL provides tools for performing tensor operations on encrypted data, facilitating the integration of HE into existing tensor-based ML models.

“TenSEAL [117] provides tools for performing tensor operations on encrypted data, facilitating the integration of HE into existing tensor-based ML models (e.g., TensorFlow, PyTorch).”

• cites [117] 117. A. Benaissa, B. Retiat, B. Cebere, and A. E. Belfedhal, "Tenseal: A Library for Encrypted Tensor Operations Using Homomorphic Encryp- tion," 2021, arXiv preprint arXiv:2104.03152. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Advanced data encoding methods can minimize the computational overhead associated with encryption while maintaining the integrity and confidentiality of the data.

“In addition, advanced data encoding methods can minimize the computational overhead associated with encryption while maintaining the integrity and confidentiality of the data.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

FaaS focuses on the front-end development of functions, BaaS focuses on the transparent and isolated execution of the functions [90].

“While FaaS focuses on the front-end development of functions, BaaS focuses on the transparent and isolated execution of the functions [90].”

• cites [90] 90. C. Denninnart, T. Chanikaphon, and S. M. Amini, "Efficiency in the Serverless Cloud Paradigm: A Survey on the Reusing and Approxima- tion Aspects," Journal of Software-Practice and Experience (SPE), 53, no. 10 (2023). sourceNot checked — no full text of the source

May combine two claims.

Runtime protection does not guarantee the confidentiality of workloads executed on an SEV-enabled VM because clouds are deemed as untrusted providers who can modify a VM while it is being deployed.

“Nevertheless, because clouds are deemed as untrusted providers who can modify a VM while it is being deployed, the runtime protection does not”

• AssumptionRests on an assumption: Clouds are untrusted providers who can modify a VM while it is being deployed.

Probably not a substantial claim: may not pass S3 (load-bearing).

Latency in homomorphic operations is primarily due to the complex mathematical operations involved in the addition and multiplication of ciphertexts.

“Likewise, the latency in homomorphic operations is primarily due to the complex mathematical operations involved in the addition and multiplication of ciphertexts.”

May combine two claims.

Many ML-based applications are location-dependent because they are tightly coupled to sensor input data, have privacy concerns in outsourcing sensor data, and perform inference based on large neural network models whose migration imposes a prohibitively large overhead.

“In fact, many ML-based applications are considered location-dependent, because (i) they are tightly coupled to the sensor input data (e.g., captured images from a camera); (ii) there are privacy concerns in outsourcing the sensor data; and (iii) they perform inference based on large neural network (NN) models whose migration imposes a prohibitively large overhead.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Xu et al. propose a probabilistic method to manage service migration for maintaining service continuity and quality in mobile scenarios.

“Xu et al. propose a probabilistic method to manage service migration for maintaining service continuity and quality in mobile scenarios [122].”

• cites [122] 122. M. Xu, Q. Zhou, H. Wu, W. Lin, K. Ye, and C. Xu, "PDMA: Probabilis- tic service migration approach for delay-aware and mobility-aware mobile edge computing," Software: Practice and Experience 52, no. 2 (2022): 394-414. sourceNot checked — no full text of the source

May combine two claims.

Adjusting DP granularity from the sample level to the feature level can theoretically enhance privacy protection against gradient-based attacks but is likely to significantly impact model performance.

“While such adjustments can theoretically enhance privacy protection against gradient-based attacks, it is also likely to significantly impact the model's performance.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

PySyft is a flexible, open-source framework for encrypted, privacy-preserving machine learning that extends PyTorch and TensorFlow to enable multi-party computations and HE.

“PySyft [146] is a flexible, open-source framework for encrypted, privacy-preserving machine learning.PySyft extends PyTorch and TensorFlow to enable multi-party computations (MPC) and HE.”

• cites [146] 146. A. Ziller, A. Trask, A. Lopardo, et al., PySyft: A Library for Easy Fed- erated Learning (Federated Learning Systems: Towards Next-Generation AI, 2021), 111-139. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Enhancements in enclave paging systems and the introduction of more granular control over data access and processing have been shown to lessen performance penalties while safeguarding data confidentiality.

“For example, enhancements in enclave paging systems and the introduction of more granular control over data access and processing have shown to lessen the performance penalties while safeguarding data confidentiality.”

Classified as probably not a substantial claim. May combine two claims.

Confidential computing has become a vital research area due to exponentially increasing data volume, off-premises third-party processing across the edge-to-cloud continuum, and prevalence of data-driven ML applications that process confidential information.

“Confidential computing has become a vital research area due to (a) the exponentially increasing volume of data generated by various sources, ranging from IoT-based sensors to social media activities; (b) data processing commonly occurs off-premises and on third-party servers-across the edge-to-cloud continuum-where the need for secure processing of sensitive data is of paramount importance; and (c”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Despite considerable progress in confidential computing, several challenges and research opportunities have remained unexplored.

“Despite the considerable progress made in the field of confidential computing, several challenges and research opportunities have remained unexplored.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Distributing trust across multiple entities can mitigate the risk of single points of failure and provide more resilient protection of sensitive data compared to centralized trust authorities.

“While traditional trust models often rely on centralized trust authorities, which can become bottlenecks and introduce vulnerabilities, distributing trust across multiple entities can mitigate the risk of single points of failure and provide more resilient protection of sensitive data.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The decentralized nature of blockchain can provide an immutable and tamper-proof record of all data and computations, while confidential computing can protect the data and computations themselves from unauthorized access and tampering.

“For instance, the decentralized nature of blockchain can provide an immutable and tamper-proof record of all data and computations, while confidential computing can protect the data and computations themselves from unauthorized access and tampering.”

May combine two claims.

Integrating advanced parallelization features within TEEs could enhance their performance for LLM-based applications but also increases the Trusted Computing Base size, expanding the potential attack surface.

“Integrating these features within TEEs could enhance their performance for LLM-based applications, but it also increases the Trusted Computing Base (TCB) size, thereby expanding the potential attack surface.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

TEE architectures specifically designed for different ML workloads can strike a balance between computational efficiency and security.

“The advent of TEE architectures specifically designed for different ML workloads can strike a balance between computational efficiency and security.”

May combine two claims.

TEE technologies such as Intel SGX, ARM TrustZone, and AMD SEV offer strong data security measures but are not immune to attacks.

“While these technologies offer strong data security measures, they are not immune to attacks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

One approach to limit the trust boundary is physically isolating one ML accelerator from the rest of the motherboard and processing system, with accelerators accessed exclusively through secure buses linked to TEE-enabled CPUs.

“One approach is similar to the way TPM operates: one ML accelerator (GPU/TPU) is physically isolated from the rest of the motherboard and the processing system.In this model, the accelerators would be accessed exclusively through secure buses linked to TEE-enabled CPUs, which ensures sensitive data remains within a trusted boundary.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Address masking places non-secure user-space and kernel-space programs within predefined memory regions, providing an additional layer of security by limiting exploitable address spaces.

“Address masking involves placing non-secure user-space and kernel-space programs within predefined memory regions, providing an additional layer of security via limiting the exploitable address spaces.”

• cites [148] 148. Z. Ma, X. Tan, L. Ziarek, N. Zhang, H. Hu, and Z. Zhao, "Return-to-Non-Secure Vulnerabilities on ARM Cortex-M TrustZone: Attack and Defense," in Proceedings of 60th ACM/IEEE Design Automa- tion Conference (DAC) (CA, USA: ACM/IEEE, 2023), 1-6. sourceNot checked — no full text of the source
• cites [149] 149. K. A. Kumari, A. Sharma, C. Chakraborty, and M. Ananyaa, "Pre- serving Health Care Data Security and Privacy Using Carmichael's theorem-Based Homomorphic Encryption and Modified Enhanced Homomorphic Encryption Schemes in Edge Computing Systems," Jour- nal of Big Data 10, no. 1 (2022): 1-17. sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Solutions based on distributed trust have the potential to be integrated with and enhance the security and scalability of confidential computing.

“Solutions based on distributed trust have the potential to be integrated with and enhance the security and scalability of confidential computing.”

May combine two claims.

Synchronization bugs can cause severe vulnerability, as demonstrated by prior work on SGX, and similar risks may emerge in GPU-TEEs.

“Moreover, synchronization bugs can cause severe vulnerability, as demonstrated by prior work on SGX [156] and similar risks may emerge in GPU-TEEs.”

• cites [156] 156. T. Cloosters, M. Rodler, and L. Davi, "TeeRex: Discovery and Exploitation of Memory Corruption Vulnerabilities in SGX Enclaves," in Proceedings of the 29th USENIX Conference on Security Symposium (Cam- bridge, Massachusetts: ACM, 2020), 841-858.Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Distributed trust can provide secure multiparty computation, enabling multiple parties to securely and privately collaborate on sensitive data and computations while preserving privacy and security.

“Additionally, distributed trust can provide secure multiparty computation, enabling multiple parties to securely and privately collaborate on sensitive data and computations while preserving the privacy and security of the underlying data.”

Classified as probably not a substantial claim.

Confidential computing has mainly emerged to deal with the security of data in use while being processed.

“While other types of security have been extensively explored, confidential computing has mainly emerged to deal with the security of data in use (while being processed).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Efficient execution of general ML tasks and large language models requires modern computer architectures equipped with advanced parallelization features such as multi-threading on CPUs and accelerators.

“Efficient execution of both General Machine Learning (ML) tasks and Large Language Models (LLMs) requires modern computer architectures equipped with advanced parallelization features, such as multi-threading on CPUs and accelerators (e.g., GPU, TPU, etc.).”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Secure multi-tenancy models within TEEs allow for efficient resource sharing while providing strong isolation for concurrent ML and LLM tasks.

“Moreover, introducing secure multi-tenancy models within TEEs allows for efficient resource sharing while providing strong isolation for concurrent ML and LLM tasks.”