Hardened Minds

TEE Proof

TEE Proof checks the claims that AI providers make about confidential computing, and can save the evidence so that anyone with teep and the saved files can check it again.

What it is

TEE Proof is a local proxy. It sits between your OpenAI-compatible client and an AI provider, on your own machine. Before it sends requests to a provider, it checks the provider’s attestation: the evidence from the hardware. If an enforced check fails, it refuses the request. Your prompts do not go through a Hardened Minds server.

TEE Proof is free and open source under the AGPL-3.0. The command and the repository are named teep today. Source on GitHub.

How a request goes through

  1. A fresh value. TEE Proof makes a random value (a nonce) and asks the provider for attestation that includes it. A report without that value can be an old report sent again.
  2. Signed by the hardware. The attestation contains an Intel TDX quote or an AMD SEV-SNP report: measurements of the software that the machine started, signed by a key in the processor. TEE Proof checks the signature through the certificate chain to the Intel or AMD root. It also checks that the machine is not in debug mode, in which the host can read the machine’s memory.
  3. The key bound to the report. Where the provider supports it, the report contains a hash of the provider’s encryption key or TLS key (in the REPORTDATA field). TEE Proof checks that binding. Without it, an attacker can replace the key and keep the report.
  4. Encrypted to that key. Where the provider supports it, TEE Proof encrypts the request to the bound key (end-to-end encryption), or connects only to the TLS key named in the report. Where it does not, the request goes over ordinary TLS that is not bound to the report.
  5. Sent or refused. If each enforced check passes, TEE Proof sends the request. If an enforced check fails, it refuses the request and returns an error.

Later requests to the same provider can reuse a verified result.

What it protects against, and what it does not

Where the provider’s evidence covers the machine that runs the model, the request is encrypted to a key bound to that evidence, and the enforced checks pass, TEE Proof is built so that the provider’s staff, a compromised data center and a network attacker cannot read your prompt in transit or on that machine.

TEE Proof does not protect against:

  • a malicious model;
  • a backdoor in the hardware.

TEE Proof can check only the evidence that a provider gives. For some providers that evidence covers a gateway and not the machine that runs the model; the default policy for those providers says so in the source.

Which checks TEE Proof enforces is set for each provider, in internal/attestation/report.go. You can change the set in a configuration file.

Check it yourself

teep verify PROVIDER --model MODEL

Prints each check and its result: passed, failed or skipped. Exits with code 1 if an enforced check fails.

teep verify PROVIDER --model MODEL --capture DIR

Also saves the provider’s responses, in a new directory under DIR.

teep verify --reverify CAPTURE

Runs the checks again from the saved responses in CAPTURE, the directory that --capture made. The live encryption test is skipped.

Install and configuration are in the README in the repository.

Use it with your tools

Set the base URL of your OpenAI-compatible client to http://127.0.0.1:8337/v1, and use provider:model as the model name.

License

TEE Proof is open source under the AGPL-3.0. A commercial license is also available.