Video summary
The video demonstrates a secure end-to-end AI pipeline that leverages NVIDIA GPUs alongside Intel's Trust Domain Extensions (TDX) for confidential computing. The primary objective of this demonstration is to illustrate how an unauthorized user can attempt to extract sensitive data by dumping the memory of a virtual machine running an AI model, and subsequently show how TDX prevents such attacks. Initially, the system operates without any form of confidential computing protection, presenting a standard environment where both the CPU and GPU are unprotected against external scrutiny.
In this initial scenario, a user logs into a web interface to issue a query about trust domain extensions. As the AI processes this request on the server, it generates load across the memory space utilized by both the processor and the graphics card. When security researchers attempt to dump the entire virtual machine's memory for analysis without TDX enabled, they successfully locate the original user prompt within the data stream in red text. This discovery highlights a critical vulnerability where sensitive information regarding queries and assistant responses is actively leaked into plain sight within the unencrypted memory of an unprotected NVIDIA GPU environment.
To address this security gap, the demonstration proceeds by shutting down the vulnerable virtual machine and respawning it with confidential computing fully activated on both the CPU and GPU components. Once the system restarts in its secure configuration, a new query is issued through the same web interface to test the defenses again. As the AI processes the request under these protected conditions, researchers repeat their attempt to dump the memory of the running virtual machine to see if any sensitive data can be extracted from it this time.
The final results confirm that activating confidential computing effectively neutralizes the threat by encrypting all memory traffic between the CPU and GPU using a custom bounce buffer driver unique to Intel and NVIDIA integration. When the unauthorized party attempts to scan the dumped memory file, no matches for the user's query are found because the entire dump is filled with zeros rather than readable data. This outcome proves that TDX successfully blocks access from invalid users by encrypting memory addresses, thereby preventing hackers from scanning or extracting valuable information even when they possess direct access to the physical machine's memory contents.
Read the full video transcript
Today, we're demonstrating end-to-end AI
pipeline using NVIDIA GPUs, a secure
end-to-end pipeline using Intel TDX in
conjunction with those GPUs. What we're
going to illustrate here today is a user
essentially leveraging an AI
web interface to create a query. And
what we'll see on the back end is
the actual activity here on the
right-hand side of the screen. The goal
of this is to prove that TDX delivers
security to help protect models like
this. And so, the front end is is what
the user sees. They go ahead and they
log in, and I'm going to fast-forward us
a little bit.
And they issue a query into that AI
using the web interface. Can an
unauthorized person dump virtual machine
memory?
Okay? When we up-level that query and
send it to the AI model, what we
actually see is that some load is
generated on the server. Both the GPU
and the memory get exercised. Now, by
virtue of that, we can try to dump the
CPU's memory
and see if we can find any of this data
in that dump. Now, remember, we don't
have any confidential computing active.
This is a plain Jane VM with a just a
standard NVIDIA unprotected GPU.
And we're scanning the dump right now.
It's a large file. It's the entire
memory space of the VM.
And what we will find in a moment here
is that in red, we actually found the
query. We actually see the user prompt.
We see the assistant's response. And so,
essentially, without confidential
computing, this VM is actively leaking
data. Okay? Now, the next move will be
to activate confidential computing. What
will happen here is the VM that's
running will be shut down and respawned
with confidential computing active. Both
the CPU and the GPU
will actually any have confidential
computing enabled and they can securely
communicate to one another using a
custom bounce buffer driver that's
unique to Intel and Nvidia.
So as we wait for this to come up, let
me just fast forward a little here.
Okay, our user's going to sign in to the
web AI again.
And when they do they're going to issue
another query. You can see give me the
definition of trust domain extensions
and key features.
As Minstrel responds, you'll see again
load on the CPU and G GPU and the
memory.
And then we're going to go ahead and do
another memory dump search.
So basically we're going to dump the RAM
of the running VM and search for that
same query just like we did last time.
And so as the machine dumps the memory
and we start scanning it,
you might be able to predict that thanks
to confidential computing, we're going
to see that no matches were found in the
entire file. And so essentially the
memory encryption protecting the CPU and
GPU have prevented this would-be hacker
from scanning the memory dump and
finding any information of value. The
dump itself is filled entirely with
zeros because the memory addresses are
essentially blocked because this user is
not the correct user, the valid user to
access those items and therefore is
prohibited from doing so.