Confidential Computing makes AI commercially viable for businesses

For companies with sensitive data such as patents, internal documents or health information, Confidential Computing makes a central difference compared to classic cloud AI, where the provider of the model technically has insight into the data during processing.

Leonard Püttmann, AI Solutions Architect at accompio, In the discussion, it identifies how the technology works, what use cases it is suitable for, and where its limitations lie. This article explains how Confidential Computing and Confidential AI work, differentiates between the two terms, and outlines concrete first steps for use in enterprises.

The most important points briefly

• Confidential Computing additionally encrypts data during active processing, not just during transmission and storage.
• The technical basis is formed by a Trusted Execution Environment (TEE) directly at the processor level.
• Even the operator of the AI model does not have access to the processed data.
• According to accompio, the performance difference compared to classic AI usage is between 5 and 10 percent.
• The technology currently covers open-source AI models, sufficient for 90 to 95 percent of use cases.

What is Confidential Computing?

Confidential Computing is a security technology that keeps data encrypted at the hardware level, even during active processing. Traditional encryption protects data during transmission between systems and when stored on a server. Once a program or an AI model works with the data, in traditional systems it is usually decrypted and therefore visible to the infrastructure operator.

Confidential Computing closes exactly this gap via a Trusted Execution Environment (TEE), an isolated, encrypted environment directly on the processor. In an interview, Leonard Püttmann describes the principle as a safe, where even the infrastructure operator has no access to the content.

Core definition Confidential Computing encrypts data during active processing, in addition to encryption at rest and in transit. The technical basis is a processor-level Trusted Execution Environment.

Why does sensitive company data remain untapped for AI today?

Many AI models run in the cloud, partly on servers outside the European Union. For companies with patents, internal documents, or other sensitive information, entering this data into such a model is risky, as the data is openly available to the infrastructure operator during processing.

Without additional protection, companies often get stuck with their AI use cases because relevant data is not used in the first place due to data protection reasons. If it does happen, data breaches are a risk. Sensitive information flows into the training of further models, reaches third parties or falls prey to hacker attacks.

Confidential Computing protects data while it's being processed in memory. This is achieved using hardware-based Trusted Execution Environments (TEEs). These TEEs create an isolated area within the processor where code and data are encrypted and protected from the operating system, hypervisor, and other privileged software. Even the cloud provider or system administrator cannot access the data or code within the TEE. Technically, this involves specific processor features. For example, Intel TDX (Trustworthy Domain Extensions) and AMD SEV (Secure Encrypted Virtualization) are technologies that enable TEEs. These technologies allow for the creation of virtual machines or specific applications that run within these secure enclaves. Here's a simplified breakdown of the process: 1. **Data in Transit & At Rest:** Traditionally, data is encrypted when it's stored (at rest) and when it's being transmitted (in transit). 2. **Data in Use:** The challenge is protecting data when it's being actively processed (in use), as it needs to be decrypted in memory to be worked on. This is where Confidential Computing comes in. 3. **TEE Creation:** A TEE is created in hardware. This TEE has its own memory region that is encrypted. 4. **Loading Code and Data:** The application code and the data it needs to process are loaded into the TEE. While inside the TEE, the data is decrypted for processing, but remains encrypted from the outside. 5. **Attestation:** A crucial aspect is attestation. Before sensitive data is sent into the TEE, the TEE can "attest" to the user or application provider that it is a genuine and secure environment. This attestation is a cryptographic proof that the code running inside the TEE is what it's supposed to be, and that the TEE is running on trusted hardware. 6. **Secure Processing:** The code within the TEE performs its operations on the data, all within the encrypted memory boundary. Only the code within the TEE can decrypt and access the data. 7. **Output:** Once processing is complete, the results can be passed out of the TEE, either encrypted or in their decrypted state, depending on the application's requirements and the sensitivity of the output. Essentially, Confidential Computing uses hardware to create a "black box" for computation, ensuring that sensitive data is never exposed to the underlying infrastructure, even when it's being actively used.

Accessing a Confidential AI model begins with a remote attestation, a check to see if access is permitted at all. The system then transmits the data encrypted down to the processor level to the model. The AI model works with the data within this protected environment as usual, comparable to other AI models. The output is sent back encrypted to the user and is only decrypted there.

„It's really like a little vault. Even if I have physical access to the AI model, no one can extract any data from it.“

— Leonard Püttmann, Solution Architect at accompio AI

The encryption is at the hardware level, not in an additional software layer. According to Leonard Püttmann, this is precisely what makes the crucial difference in security.

Confidential Computing and Confidential AI: What's the difference?

Confidential Computing describes the underlying hardware technology for encryption during processing, irrespective of the specific application. Confidential AI is the application of this technology specifically to AI models and AI processes. A company uses Confidential Computing as a technical foundation to subsequently leverage Confidential AI for specific AI use cases.

Confidential AI vs. Data Masking and Anonymisation

Data masking and anonymisation attempt to remove sensitive information from documents before processing. A residual risk remains: if individual sensitive data points slip through the filter, a data protection problem still arises. Confidential AI takes a different approach and protects the data directly during processing at the hardware level, regardless of whether anonymisation has taken place beforehand.

Integration, Performance and Limitations of Technology

Confidential AI is integrated into existing systems via an external interface, similar to a conventional cloud AI model. No new hardware or major system changes are necessary for this, and existing cloud providers do not require any special prerequisites.

According to accompio, the performance difference is 5 to 10 percent compared to classic AI usage, with real-time interaction still possible. One limitation concerns model selection: Confidential AI currently works exclusively with open-source AI models; proprietary models such as ChatGPT or Claude cannot be used technically. According to accompio, this selection of open-source models covers 90 to 95 percent of companies' AI use cases.

Trust through independent audit

Contractual assurances alone are not enough for many companies when handling sensitive data. accompio therefore also relies on technical and independent evidence at the hardware level.

„For example, the entire thing was also checked by TÜV IT and verified to ensure it was indeed the case. Ernst & Young, for instance, also conducted a major audit for this technology.“

— Leonard Püttmann, Solution Architect at accompio AI

Implement confidential AI with Accompio

Are you planning specific AI use cases with sensitive company data and looking for a secure technical foundation? accompio supports you with an inventory assessment, selection of suitable open-source models, and the technical integration of Confidential AI into your existing infrastructure.

Our services

First steps: How businesses get started with Confidential AI

According to Leonard Püttmann, the maturity of Confidential Computing in Germany is currently very varied. Individual companies are already using the technology productively, but for many others, it is still new, and in some cases, they are not even aware of it as a real alternative to traditional cloud AI.

The first concrete step, regardless of your own maturity level, is always the same: an inventory of your own processes in daily operations.

This centres on two questions:

1. Where do pain points arise in day-to-day business that can be solved with AI support?
2. Are sensitive data, such as patents, internal documents, or personal information, involved in these processes?

If the answer to the second question is "yes", then according to accompio, Confidential AI is often the right next step for the technical implementation. The subsequent integration itself requires no new hardware and no fundamental system change. It runs via an external interface, comparable to a conventional cloud AI model.

Conclusion

Confidential computing closes the last remaining gap in data encryption: the moment of active processing. For companies with sensitive data, confidential AI therefore opens up AI use-cases that were previously impossible for reasons of Data protection were not feasible.

About the expert

Leonard Püttmann works as a Solutions Architect AI at accompio, dealing daily with the secure implementation of AI technology for corporate clients.

LinkedIn

Frequently Asked Questions about Confidential Computing and Confidential AI

Confidential Computing unterscheidet sich von herkömmlicher Verschlüsselung dadurch, dass Daten während der Verarbeitung in einem sicheren Bereich, der sogenannten Trusted Execution Environment (TEE), geschützt werden. Bei der herkömmlichen Verschlüsselung werden Daten nur im Ruhezustand (gespeichert) und während der Übertragung (im Netzwerk) verschlüsselt. Sobald die Daten jedoch im Speicher verarbeitet werden, werden sie entschlüsselt und sind anfällig für Angriffe, wenn das System kompromittiert ist. Confidential Computing schliesst diese Lücke, indem es sicherstellt, dass die Daten selbst innerhalb des Prozessors während der Verarbeitung verschlüsselt bleiben. Hier sind die Hauptunterschiede: * **Schutz während der Verarbeitung:** * **Her kömmliche Verschlüsselung:** Bietet Schutz für Daten im Ruhezustand und während der Übertragung. Daten werden im Arbeitsspeicher des Systems für die Verarbeitung entschlüsselt. * **Confidential Computing:** Bietet Schutz für Daten im Ruhezustand, während der Übertragung UND während der Verarbeitung, indem es eine TEE verwendet. * **Angriffs oberfläche:** * **Her kömmliche Verschlüsselung:** Lässt eine Angriffs fläche offen, wenn die Daten im Arbeitsspeicher vorliegen, insbesondere wenn der Host-Betriebssystem oder der Hypervisor kompromittiert ist. * **Confidential Computing:** Reduziert die Angriffs fläche drastisch, da selbst der Betreiber der Infrastruktur (z. B. Cloud-Anbieter) oder privilegierte Benutzer keinen Zugriff auf die Daten haben, während sie in der TEE verarbeitet werden. * **Technologie:** * **Her kömmliche Verschlüsselung:** Basiert auf kryptografischen Algorithmen wie AES, RSA usw., die auf der gesamten Festplatte oder während der Netzwerkkommunikation angewendet werden. * **Confidential Computing:** Nutzt Hardware-basierte Sicherheitsfunktionen, die in modernen Prozessoren (CPUs) integriert sind, um isolierte und verschlüsselte Rechenumgebungen zu schaffen. Beispiele hierfür sind Intels Software Guard Extensions (SGX) und AMDs Secure Encrypted Virtualization (SEV). * **Use Cases:** * **Her kömmliche Verschlüsselung:** Weit verbreitet für den Schutz von Daten in Datenbanken, bei Online-Transaktionen (HTTPS), bei der Speicherung von Dateien usw. * **Confidential Computing:** Ideal für Szenarien, in denen sensible Daten verarbeitet werden müssen, aber höchste Vertraulichkeit erforderlich ist, wie z. B. Finanzanalysen, Verarbeitung medizinischer Daten, Verwaltung von Geheimnissen und der Schutz geistigen Eigentums von KI-Modellen. Zusammenfassend lässt sich sagen, dass Confidential Computing eine zusätzliche Ebene der Sicherheit darstellt, die über die herkömmliche Verschlüsselung hinausgeht, indem es die Vertraulichkeit von Daten schützt, während sie aktiv genutzt oder verarbeitet werden.

Normal encryption protects data during transmission and storage. Confidential Computing additionally encrypts data during active processing by a program or AI model, via a processor-level Trusted Execution Environment.

Is Confidential AI usable with models such as ChatGPT or Claude?

No, ChatGPT and Claude are proprietary models and cannot be used for this purpose technically. Confidential AI currently works with open-source AI models, which, according to accompio, already cover 90 to 95 percent of enterprise use cases.

Confidential AI is particularly suitable for which industries?

In principle, every industry with sensitive data benefits from Confidential AI. According to accompio, the technology is particularly relevant for the finance and healthcare sectors, as highly sensitive personal or company-critical information is often involved, such as examination results or financial data that must not fall into the hands of third parties.

How much does performance drop due to Confidential AI?

The performance difference compared to classic AI usage is 5 to 10 percent. Interaction with the model remains possible in real-time.

How does a company start with Confidential AI?

The first step is to take stock of your own processes and pain points, along with the question of where sensitive data is involved. This forms the basis for deriving the appropriate technical implementation.