Metraipolis › archive › dc_dcdffde1ccf6

Bilateral Protection for Private LoRA Inference with Intel TDX — arXiv:2611.04311

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.04311
License (as archived): CC0-1.0
Archived: 2026-11-04T21:49:40.871Z
SHA-256 of the archived text: ab377e404fa1c16d176c284de5be282d9370af6544e7065ef1afe24b882731cd
Stable URL of this page: https://metraipolis.com/documento/dc_dcdffde1ccf6

How to cite

Bilateral Protection for Private LoRA Inference with Intel TDX — arXiv:2611.04311 — arXiv (en), https://arxiv.org/abs/2611.04311 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_dcdffde1ccf6 (Metraipolis archive dc_dcdffde1ccf6, sha256 ab377e404fa1c16d176c284de5be282d9370af6544e7065ef1afe24b882731cd)

BibTeX

@misc{dcdcdffde1ccf6,
  title = {Bilateral Protection for Private LoRA Inference with Intel TDX — arXiv:2611.04311},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.04311},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_dcdffde1ccf6; sha256 ab377e404fa1c16d176c284de5be282d9370af6544e7065ef1afe24b882731cd},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.04311. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Cloud services using private low-rank adaptation (LoRA) must protect client inputs and outputs alongside owners' proprietary parameters and execute the approved adaptation. We design and implement a system for bilateral protection of private LoRA inference using Intel Trust Domain Extensions (TDX), connecting approved application identity to actual artifact consumption and adapter activation. The client and LoRA owner independently verify remote attestation, application identity, and binding to the actual Transport Layer Security (TLS) public key before releasing inputs and the weight-decryption key. A fixed read-only image and verified-byte consumption connect approved identities to inference objects, with all inference inside a trust domain. Experiments on real TDX hardware reject controlled application and boot-parameter modifications before secret release. Across 400 fixed dialogues, protected and native CPU inference in the same trust domain produce identical token sequences for all 400 pairs. Across 12 independent trust-domain boots, the steady-state service-to-native time ratio is 1.0094, with a 95% interval of [1.0064, 1.0126]. The system connects bilateral secret release, approved model use, and task-capability preservation, providing verifiable implementation and cost evidence for confidential inference with a public base and private adapter.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2611.04311 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-04T21:38:19.525Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).