3 ms·
They use the TEE to check that the model and code is untampered with. That's a good, valid approach and should work (I've done similar things on AWS with their
by nl 6mo ago
They use the TEE to check that the model and code is untampered with. That's a good, valid approach and should work (I've done similar things on AWS with their TEE)
The key question here is how they avoid the outside computer being able to view the memory of the internal process:
> An in-process inference design that embeds the in-
ference engine directly in a hardened process, elimi-
nating all inter-process communication channels that
could be observed, with optional hypervisor mem-
ory isolation that extends protection from software-
enforced to hardware-enforced via ARM Stage 2 page
tables at zero performance cost.[1]
I was under the impression this wasn't possible if you are using the GPU. I could be misled on this though.
[1] https://github.com/Layr-Labs/d-inference/blob/master/papers/dginf-private-inference.pdf https://github.com/Layr-Labs/d-inference/blob/master/papers/...
- flockonus 6mo agoWhile they do make this argument, realistically anyone sending their prompt/data to an external server should assume there will be some level of retention. And more so in particular, anyone using Darkbloom with commercial intents should only really send non-sensitive data (no tokens, customer data, ...) I'd say only classification tasks, imagine generation, etc.
- joelthelion 6mo agoThere's a difference between trusting Anthropic and trusting random mac owners.
- flockonus 6mo agoI know where my answer lies in that; but i don't claim to be an objective truth. For example OpenAI has been caught sharing data with the gov. agencies.
- ramoz 6mo agoMacs do not have an accessible hardware TEE. Macs have secure enclaves.
- nl 6mo agoGood point! But they argue that: > PT_DENY_ATTACH (ptrace constant 31): Invoked at process startup before any sensitive data is loaded. Instructs the macOS kernel to permanently deny all ptracerequests against this process, including from root. This blocks lldb, dtrace, and Instruments. > Hardened Runtime: The binary is code-signed with hardened runtime options and explicitly without the com.apple.security.get-task-allow entitlement. The kernel denies task_for_pid() and mach_vm_read()from any external process. > System Integrity Protection (SIP): Enforces both of the above at the kernel level. With SIP enabled, root cannot circumvent Hardened Runtime protections, load unsigned kernel extensions, or modify protected sys- tem binaries. Section 5.1 proves that SIP, once verified, is immutable for the process lifetime. gives them memory protection. To me that is surprising.
- ramoz 6mo agoI'm not arguing anything. This is how it works. There is no but. Protection here is conditional, best-effort. There are no true guarantees, nor actual verifiability.
- dinobones 6mo agoCouldn't someone just uhh... patch their macOS/kernel, mock these things out, then behold, you can now access all the data? If it's not running fully end to end in some secure enclave, then it's always just a best effort thing. Good marketing though.
- saagarjha 6mo agoYes. Running attested workloads on macOS if you are not Apple is nontrivial.
- vrockdub 6mo ago[dead]
- mike_hearn 6mo ago
- nitros 6mo agoThis entire paper smells of LLM, I'm sure even the most distinguished academic would refrain from using notation to prove that the SIP status cannot change during operation.
- mike_hearn 6mo agoApple Silicon systems have unified memory between CPU and GPU. The hypervisor page table trick is thus claimed to protect GPU memory from RDMA.