Where the Boundary Breaks: Platforms, Threats, and Trade-offs

This chapter compares confidential-computing platforms by the boundary they create, the deployment in which they fit, and the runtime assets they can actually cover. The goal is not to name a universal winner. It is to help readers choose a platform direction for a particular AI workload—cloud or edge, CPU or GPU, single agent or shared pipeline—and then state which adversaries and residual paths remain outside the claim.

The previous chapters established two constraints. First, a protection mechanism is meaningful only when it is connected to the model, memory, key, and code that need protection. Second, an agent or HPC workload crosses several boundaries, so the right platform may protect only a selected layer or may need to be composed with another platform. Comparing platforms therefore requires common criteria rather than a feature count.

Four boundary families, four deployment shapes

A process enclave isolates selected application components. Intel SGX represents this fine-grained approach in the surveyed platform landscape. It can be attractive when the highest-value material is a prompt handler, embedding layer, credential routine, or memory-management component rather than an entire service. A narrow trusted computing base can reduce how much code must be trusted. The cost is complexity: limited protected memory capacity, transitions between the enclave and outside code, and difficulty enclosing a large tool-using agent. SGX also does not natively extend its attested boundary into discrete GPU memory. If weights, activations, or cache state move to a GPU, the process enclave alone does not cover those values.

A confidential virtual machine moves the boundary outward. Intel TDX and AMD SEV-SNP fit cloud deployments that already package an agent service, model server, orchestration logic, and adapters as a VM or a VM-like workload. This broader boundary makes a lift-and-shift deployment more practical than splitting the service into enclave-sized pieces. It also admits more code into the trusted domain, which means less internal compartmentalization and a broader set of components whose behavior and updates matter.

The two VM-oriented platforms are not interchangeable in every design. The survey describes AMD SEV-SNP as well suited to isolated agent runtimes but less naturally suited to tightly coupled multi-agent cooperation that needs confidential shared memory across co-resident VMs, because per-VM encryption keys prevent native cross-VM sharing. SEV-SNP also does not natively extend into GPU memory, although it can act as the CPU-side attestation root for a composed deployment that uses NVIDIA H100 Confidential Compute. Intel TDX offers a similar VM-level path and is relevant to confidential GPU pipelines, but the survey treats its end-to-end behavior under sustained agentic workloads as still under-characterized.

Arm isolation covers a different deployment shape. Arm TrustZone is established in mobile and embedded settings, including devices that may host edge assistants or other on-device agents.