Side Channels Against Confidential Inference

The security model of a confidential VM says the hypervisor is the adversary, and then hands that adversary a remarkable set of powers: it schedules the guest, delivers its interrupts, manages its page tables, and can read the guest's encrypted memory as ciphertext. Memory encryption stops it reading plaintext. It does not stop it observing everything about how the guest behaves, and a long line of results has turned those observations into concrete extractions.

This matters more for inference than for a generic workload, because inference leaks structure. Token generation is a loop with one iteration per output token. Batch composition and KV cache growth are visible in memory traffic. A prompt's length, an answer's length and the time between tokens are all observable from outside the enclave without breaking a single cipher.

Ciphertext side channels

AMD SEV encrypts guest memory deterministically per physical address, without a nonce or a freshness counter. The consequence is that writing the same plaintext to the same address twice produces the same ciphertext twice, so a hypervisor that watches a page can tell when a value repeats or reverts. CipherLeaks turned this into key extraction: by monitoring ciphertext in the VM save area across context switches, it recovered register values and broke constant-time RSA and ECDSA in OpenSSL (Li et al., 2021, CIPHERLEAKS: Breaking Constant-time Cryptography on AMD SEV via the Ciphertext Side Channel, USENIX Security). Follow-up work generalised the channel beyond the save area to guest memory in general. Deterministic encryption without integrity is the root cause, and it is a design property rather than a bug, which is why mitigations have been compiler-level and partial.

Controlling execution, not just watching it

Two attack families go further and use the hypervisor's control over the guest as an input.

Single-stepping frameworks force the guest to advance one instruction at a time by manipulating the timer, turning coarse timing observations into precise instruction counts. TDXdown demonstrated single-stepping and instruction counting against Intel TDX, defeating the platform's built-in countermeasure (Wilke, Sieck & Eisenbarth, 2024, TDXdown: Single-Stepping and Instruction Counting Attacks against Intel TDX, ACM CCS).

Interrupt injection is more direct. The Ahoi family of attacks has a malicious hypervisor deliver interrupts the guest never asked for: Heckler injects interrupts whose handlers alter guest data and control flow, breaking both SEV-SNP and TDX guarantees (Schlüter et al., 2024, Heckler: Breaking Confidential VMs with Malicious Interrupts, USENIX Security, arXiv:2404.03387), and WeSee injects #VC exception 29 so that the guest's own handler copies data and registers out to the hypervisor (Schlüter et al., 2024, WeSee: Using Malicious #VC Interrupts to Break AMD SEV-SNP, IEEE S&P, arXiv:2404.03526). Note what these break: not confidentiality through a leak, but integrity, by making the enclave execute code paths the attacker chose.

The GPU half is younger and softer

CPU TEEs have had a decade of adversarial attention. Confidential GPUs have had a few years, and the attack surface is different in kind.

Physical and analogue channels do not care about memory encryption at all. Energon recovers transformer architecture details from GPU power and thermal traces, channels that are accessible without special privilege and that virtualisation cannot hide (Energon: Unveiling Transformers from GPU Power and Thermal Side-Channels, 2025, arXiv:2508.01768). The interconnect leaks too: NVBleed demonstrates covert and side channels over NVIDIA's multi-GPU interconnect (NVBleed: Covert and Side-Channel Attacks on NVIDIA Multi-GPU Interconnect, 2025, arXiv:2503.17847), and the PCIe path remains attractive enough that defensive work proposes traffic shaping and memory-layout obfuscation as a complement to confidential computing rather than a replacement for it (CloakLM, 2026, arXiv:2606.18400). Partitioning is not a clean boundary either: surveys of A100 and H100 report that MIG does not partition the last-level TLB, which is shared across instances (Confidential Computing on Heterogeneous CPU-GPU Systems: Survey and Future Directions, 2024, arXiv:2408.11601).

What to do with this

The honest reading is not that confidential computing is broken. It is that the guarantee has a shape: strong against an operator who reads memory or attaches a debugger, weak against a determined adversary who controls scheduling and interrupts and is willing to invest in an attack. That is still a large improvement over plaintext HBM, and it is not the absolute claim that vendor material implies.

Three practical consequences follow. Keep the enclave's exposed interface narrow, because every hypercall and every #VC path is attack surface that the attacker schedules. Assume timing and length are public: pad or batch where the length of a response is itself sensitive, since no memory encryption hides it. And treat the TCB version floor in your attestation policy as a live control rather than a form field, because the recurring pattern is disclosure followed by a firmware fix, and a policy that accepts old TCB versions accepts every attack already published against them. The 2026 result recovering an EPYC Milan root VCEK seed from a system reporting itself fully patched is a reminder that even that floor is a probabilistic defence (arXiv:2605.12990).