Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Hardware Security
Use a trusted execution environment
Verify that execution within a trusted execution environment (TEE) provides hardware-enforced isolation, memory encryption, and integrity protection.
OWASP AISVS v1.01, requirement 4.2.2
In plain English
A trusted execution environment (TEE) is a hardware feature that isolates a workload from everything else on the machine, encrypts its memory and detects tampering. This requirement asks that when you rely on a TEE, it really provides all three. It is a Level 3 control.
What good looks like
- Sensitive AI workloads run in a hardware-backed TEE, such as a confidential VM.
- Memory encryption and integrity protection are switched on and confirmed in the attestation report.
- Data and keys are released to the environment only after attestation.
- The whole sensitive path is inside the boundary, including any GPU processing.
How teams usually do it
- Confidential computing instances from your cloud provider, built on AMD SEV-SNP, Intel TDX or Arm CCA.
- GPU variants of those instances where inference needs an accelerator.
- A written note of what the TEE protects against and what it does not, such as side channels and bugs in your own code.
Suggested evidence
- Instance configuration showing the TEE type.
- Attestation records confirming the security features are active.
- The threat model note.
Common mistakes
- Running only the CPU part of the workload in the protected environment.
- Using an older TEE mode that encrypts memory without integrity protection, and assuming you have both.
- Treating a TEE as protection against attacks that come through the application's own interface.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.