Trusted Execution Environment (TEE)

A Trusted Execution Environment is a walled-off region inside a chip, its own protected memory, its own isolated execution path, built so that nothing outside it can read what's happening inside, not even the computer's own operating system, hypervisor, or the person with root access to the machine. It's the hardware primitive underneath the broader practice called Confidential Computing: Confidential Computing is the strategy of running sensitive computation inside a TEE; a TEE is the physical thing that makes the strategy possible at all.

A TEE alone isn't enough to trust remotely, though, you also need a way to prove, from outside the chip, that a genuine, unmodified TEE actually ran the code it claims to have run. That's what remote attestation does: the hardware itself signs a report, "I am a genuine [chip model], running [exact firmware/code hash], right now". That a stranger can verify against the manufacturer's public key before trusting the enclave with anything secret.

Where it comes from

TEEs predate the "Confidential Computing" industry branding by well over a decade. ARM's TrustZone, built into its processor architecture since 2004, was an early mainstream example, mostly used for mobile device security (protecting fingerprint data, DRM keys). Intel's SGX ("Software Guard Extensions"), launched in 2015, brought fine-grained enclaves to server CPUs. AMD's SEV ("Secure Encrypted Virtualization"), from 2016, took a whole-VM-encryption approach instead of Intel's smaller-enclave model. NVIDIA extended the same idea to GPUs, the piece most relevant to AI inference, with an on-die Confidential Computing Engine starting on its Hopper generation (H100/H200), which encrypts every write to GPU memory (VRAM/HBM) and produces its own attestation reports via NVIDIA's Remote Attestation Service. None of this hardware, or the cryptographic attestation protocols that prove it's genuine, is Solidus's design.

Solidus status

No TEE is running anywhere in Solidus's stack today. It's worth being precise about what actually exists instead, because it's easy to mistake for one: Solidus's shipped GPU inference build (onnx-cuda, part of its compute-node software) is trustworthy today through a signed-supply-chain guarantee: the binary is Ed25519-signed and its SHA-256 hash is checked against a manifest Solidus publishes, so an operator (or a stranger) can confirm they're running exactly the code Solidus released. That's a real integrity property, but it is not a TEE: nothing about it encrypts GPU memory against the machine's own operator, and no hardware attestation report accompanies it.

The genuine TEE upgrade is designed, not built: Solidus's own documentation specifies an "attested tier" that requires NVIDIA H100/H200 hardware and an attestation-gated key-release flow. A decryption key for a job is only handed to a node after it proves, via a signed NVIDIA attestation report, that it's running inside genuine Confidential Computing mode with the correct model loaded. That plan is explicitly gated on acquiring H100/H200 hardware Solidus does not currently have, and none of the attestation-verification code exists yet.

Proof: none Solidus-specific. Nothing is built. The honest, checkable adjacent fact: download the signed onnx-cuda build from releases.solidus.network/gpu-node and verify its SHA-256 against the published manifest yourself. That proves supply-chain integrity, not TEE hardware isolation: the two should never be described as equivalent.