PAL*M: Property Attestation for Large Generative Models

TL;DR

PAL*M advances ML property attestations to large generative models by integrating CVM-based CPU–GPU execution with GPU attestation and progressive dataset integrity via incremental multiset hashing. It defines a comprehensive measurement framework for dataset preprocessing, training, fine-tuning/quantization, evaluation, and inference-time properties, and converts measurements into authenticated QUOTE attestations. The approach is demonstrated on Intel TDX and NVIDIA H100, showing efficient overheads, scalability across CVM/GPU configurations, and robust security against a malicious host. This work enables regulators and practitioners to verify properties of confidential data and models without exposing sensitive assets, establishing a practical foundation for trustworthy AI governance.

Abstract

Machine learning property attestations allow provers (e.g., model providers or owners) to attest properties of their models/datasets to verifiers (e.g., regulators, customers), enabling accountability towards regulations and policies. But, current approaches do not support generative models or large datasets. We present PAL*M, a property attestation framework for large generative models, illustrated using large language models. PAL*M defines properties across training and inference, leverages confidential virtual machines with security-aware GPUs for coverage of CPU-GPU operations, and proposes using incremental multiset hashing over memory-mapped datasets to efficiently track their integrity. We implement PAL*M on Intel TDX and NVIDIA H100, showing it is efficient, scalable, versatile, and secure.

Figures (6)

• Figure 1: Traditional remote attestation protocol: a prover ($\sf{Prv}$) demonstrates its software integrity to a verifier ($\sf{Vrf}$).
• Figure 2: Desired property attestation for ML, in which $\sf{Prv}$ interacts with an Initiator ($\sf{\mathsf{Inr}}$). $\sf{Vrf}$ requests evidence from $\sf{\mathsf{Inr}}$, and may consult a Trusted Authority ($\sf{Tru}$) to obtain reference values of a desired property.
• Figure 2: Performance for proofs of dataset attribute distribution, preprocessing, and binding using (Full) and (1/100).
• Figure 3: High-level overview of PAL$^*$M-enabled property attestation. $\sf{\mathsf{Inr}}$ interacts with untrusted components of $\sf{Prv}$, which saves inputs to disk. PAL$^*$M reads and measures inputs, runs the operations (including GPU), and measures all CPU and GPU outputs. All measurements are extended to REPORTDATA, which is used to as input to obtain TDREPORT from TDX Module. Finally, a QUOTE is generated by invoking the Quoting Enclave (QE) and returned to $\sf{\mathsf{Inr}}$.
• Figure 4: Depiction of PAL$^*$M’s handling of in-memory (left) and memory-mapped (right) dataset. In the in-memory approach, the entire dataset is loaded and measured once at load time. In the memory-mapped approach, individual records are measured when accessed using a multiset hash to ensure consistent measurements regardless of sampling order.