4 ms·

> the inference provider still has the ability to access the prompt and response plaintext Folks may underestimate the difficulty of providing compute that the

> the inference provider still has the ability to access the prompt and response plaintext Folks may underestimate the difficulty of providing compute that the provider “cannot”* access to reveal even at gunpoint. BYOK does cover most of it, but oh look, you brought me and my code your key, thanks… Apple's approach, and certain other systems such as AWS's Nitro Enclaves, aim at this last step of the problem: - https://security.apple.com/documentation/private-cloud-compute https://security.apple.com/documentation/private-cloud-compu... - https://aws.amazon.com/confidential-computing/ https://aws.amazon.com/confidential-computing/ NCC Group verified AWS's approach and found: 1. There is no mechanism for a cloud service provider employee to log in to the underlying host. 2. No administrative API can access customer content on the underlying host. 3. There is no mechanism for a cloud service provider employee to access customer content stored on instance storage and encrypted EBS volumes. 4. There is no mechanism for a cloud service provider employee to access encrypted data transmitted over the network. 5. Access to administrative APIs always requires authentication and authorization. 6. Access to administrative APIs is always logged. 7. Hosts can only run tested and signed software that is deployed by an authenticated and authorized deployment service. No cloud service provider employee can deploy code directly onto hosts. - https://aws.amazon.com/blogs/compute/aws-nitro-system-gets-independent-affirmation-of-its-confidential-compute-capabilities/ https://aws.amazon.com/blogs/compute/aws-nitro-system-gets-i... Points 1 and 2 are more unusual than 3 - 7. Folks who enjoy taking things apart to understand them can hack at Apple's here: https://security.apple.com/blog/pcc-security-research/ https://security.apple.com/blog/pcc-security-research/ * Except by, say, withdrawing the system (see Apple in UK) so users have to use something less secure, observably changing the system, or other transparency trippers.

amelius 1y ago
> Folks may underestimate the difficulty of providing compute that the provider “cannot”* access to reveal even at gunpoint. It's even harder to do this plus the hard requirement of giving the NSA access. Or alternatively, give the user a verifiable guarantee that nobody has access.
- astrange 1y ago
  That's what non-targetability is for.
7e 1y ago
At the end if the day, Nitro Enclaves are still “trust Amazon”, which is a poor guarantee. NVIDIA+AMD offers hardware backed enclave features for their GPUs which is the superior solution here.
- iancarroll 1y ago
  Aren’t they both hardware backed, just changing the X in “trust X”?
- almostgotcaught 1y ago
  be sure to let us know when you can run eg nginx on a GPU in said enclave.
- Terretta 11mo ago
  You think Nitro Enclaves aren't hardware backed?
sublimefire 1y ago
Yes but at the end of the day you need to trust the cloud provider tools which expands the trust boundary from just hardware root of trust. Who is to guarantee they will not create a malicious tool update and push it then retract it? It is nowhere captured and you cannot prove it.
- avianlyric 1y ago
  You can detect and prove it because the hardware attestation signature will change. You might not know what change was made, or have any prior warning of the change. But you will be able to detect it happening. Which means an operator only gets to play that card once, after which nobody will trust them again.
jiggawatts 1y ago
My logic is that these "confidential compute" problems suffer from some of the same issues as "immutable storage in blockchain". I.e.: If the security/privacy guarantees really are as advertised, then ipso facto someone could store child porn in the system and the provider couldn't detect this. Then by extension, any truly private system is exposing themselves to significant business, legal, and moral risk of being tarred and feathered along with the pedos that used their system. It's a real issue, and has come up regularly with blockchain based data storage. If you make it "cencorship proof", the by definition you can't scrub it of illegal data! Similarly, if cloud providers allow truly private data hosting, then they're exposing themselves to the risk of hosting data that is being stored with that level of privacy guarantees precisely because it is so very, very illegal. (Or substitute: Stolen state secrets that will have the government come down on you like a ton of bricks. Stolen intellectual property. Blackmail information on humourless billionaires. Illegal gambling sites. Nuclear weapons designs. So on, and so forth.)
- bangaladore 1y ago
  > I.e.: If the security/privacy guarantees really are as advertised, then ipso facto someone could store child porn in the system and the provider couldn't detect this. But what they would be storing in this case is not illegal content. Straight up. Encrypted bits without a key are meaningless. There is nothing stopping a criminal from uploading illegal content to Google drive as an encrypted blob. There's nothing Google can do about it, and there is no legal repercussion (to my knowledge) of holding such a blob.
  - saithound 1y ago
    You're simply wrong about this. "I don't know the key" is not legal defense even against hosting an encrypted blob of copyright infringing contemt, much less an encrypted blob of illegal pornography.
    - bangaladore 1y ago
      If this were the case nobody would ever offer file hosting services (eg. Google Drive). Do you have any case history to show any company getting prosecuted for unknowingly hosting encrypted blobs of illegal material? Obviously if they have to ability to know material is illegal, that's a problem. And exactly what algorithm can you provide to me that takes an encrypted blob as an input and returns whether it is not illegal material. Clearly that doesn't exist, so your point makes zero sense. You may be conflating "I forgot the key" vs "I've never been provided the key"
michaelt 1y ago
> 3. There is no mechanism for a cloud service provider employee to access customer content stored on instance storage and encrypted EBS volumes. Are you telling me customer services can't reset a customer's forgotten console login password?
- Terretta 11mo ago
  In these systems secured to this degree, yes.

amelius 1y ago

> Folks may underestimate the difficulty of providing compute that the provider “cannot”* access to reveal even at gunpoint. It's even harder to do this plus the hard requirement of giving the NSA access. Or alternatively, give the user a verifiable guarantee that nobody has access.

astrange 1y ago
That's what non-targetability is for.

7e 1y ago

At the end if the day, Nitro Enclaves are still “trust Amazon”, which is a poor guarantee. NVIDIA+AMD offers hardware backed enclave features for their GPUs which is the superior solution here.

iancarroll 1y ago
Aren’t they both hardware backed, just changing the X in “trust X”?
almostgotcaught 1y ago
be sure to let us know when you can run eg nginx on a GPU in said enclave.
Terretta 11mo ago
You think Nitro Enclaves aren't hardware backed?

sublimefire 1y ago

Yes but at the end of the day you need to trust the cloud provider tools which expands the trust boundary from just hardware root of trust. Who is to guarantee they will not create a malicious tool update and push it then retract it? It is nowhere captured and you cannot prove it.

avianlyric 1y ago
You can detect and prove it because the hardware attestation signature will change. You might not know what change was made, or have any prior warning of the change. But you will be able to detect it happening. Which means an operator only gets to play that card once, after which nobody will trust them again.

jiggawatts 1y ago

My logic is that these "confidential compute" problems suffer from some of the same issues as "immutable storage in blockchain". I.e.: If the security/privacy guarantees really are as advertised, then ipso facto someone could store child porn in the system and the provider couldn't detect this. Then by extension, any truly private system is exposing themselves to significant business, legal, and moral risk of being tarred and feathered along with the pedos that used their system. It's a real issue, and has come up regularly with blockchain based data storage. If you make it "cencorship proof", the by definition you can't scrub it of illegal data! Similarly, if cloud providers allow truly private data hosting, then they're exposing themselves to the risk of hosting data that is being stored with that level of privacy guarantees precisely because it is so very, very illegal. (Or substitute: Stolen state secrets that will have the government come down on you like a ton of bricks. Stolen intellectual property. Blackmail information on humourless billionaires. Illegal gambling sites. Nuclear weapons designs. So on, and so forth.)

bangaladore 1y ago
> I.e.: If the security/privacy guarantees really are as advertised, then ipso facto someone could store child porn in the system and the provider couldn't detect this. But what they would be storing in this case is not illegal content. Straight up. Encrypted bits without a key are meaningless. There is nothing stopping a criminal from uploading illegal content to Google drive as an encrypted blob. There's nothing Google can do about it, and there is no legal repercussion (to my knowledge) of holding such a blob.
- saithound 1y ago
  You're simply wrong about this. "I don't know the key" is not legal defense even against hosting an encrypted blob of copyright infringing contemt, much less an encrypted blob of illegal pornography.
  - bangaladore 1y ago
    If this were the case nobody would ever offer file hosting services (eg. Google Drive). Do you have any case history to show any company getting prosecuted for unknowingly hosting encrypted blobs of illegal material? Obviously if they have to ability to know material is illegal, that's a problem. And exactly what algorithm can you provide to me that takes an encrypted blob as an input and returns whether it is not illegal material. Clearly that doesn't exist, so your point makes zero sense. You may be conflating "I forgot the key" vs "I've never been provided the key"

michaelt 1y ago

> 3. There is no mechanism for a cloud service provider employee to access customer content stored on instance storage and encrypted EBS volumes. Are you telling me customer services can't reset a customer's forgotten console login password?

Terretta 11mo ago
In these systems secured to this degree, yes.