SAGE: Software-based Attestation for GPU Execution
summary
Software-only attestation that runs on NVIDIA A100 (Ampere) GPUs and pairs with a CPU SGX verifier to prove code and data integrity and secrecy. Implements a hand-crafted, reverse-engineered 428-instruction verification function that fills registers and caches, runs in parallel across SMs, and detects single-instruction tampering by timing a 100,000 iterations checksum loop. Prototype achieves ~0.494 s verification (99% peak) but tougher cache-coherency defenses push some variants to ~12 s; end-to-end ML overheads stay below ~13%.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:48Software-based GPU attestation
- 3:36Root of trust in SAGE
- 5:43GPU attestation challenges
- 7:29SAGE architecture
- 9:17Verification function design
- 12:07Parallel checksum in SAGE
- 14:13Single-instruction attack detection
- 16:43Memory copy attack defense
- 18:48Performance trade-offs
- 20:12Performance evaluation
- 21:39Conclusion
related talks
25mAttesting NVIDIA GPUs in a confidential computing environment
44mGPU-less, Trust-less, Limit-less: Reimagining the Confidential AI Cloud
18mNVIDIA Confidential Computing Attestation for Next-Generation AI
42mSponsored Session: Confidential Computing - New Capabilities for New Workloads- 42mSponsored Session: Confidential Computing - New Capabilities for New Workloads
25mDemystifying remote attestation
14mHoneycomb: Secure and Efficient GPU Executions via Static Validation
36mSecurity for AI and Multi-Party Collaboration with Confidential Computing (Oh, and...