Glossary
SGX
Intel's earliest mainstream trusted execution environment, the predecessor to TDX, with smaller enclave sizes and a history of side-channel vulnerabilities that limited its deployment for AI.
Intel’s first-generation TEEidentity-trustA hardware-isolated CPU region where code and data are protected from inspection by the host OS, used to run inference in a way the operator cannot read or modify. Open full entry , introduced in 2015. SGX enclaves are isolated regions of memory the host OS cannot read, with hardware-rooted attestationidentity-trustA cryptographic protocol that lets a remote party verify which code is running inside a TEE, including which model is loaded and which build of the inference engine. Open full entry that a known measurement of code is running inside. SGX served as the practical reference TEEidentity-trustA hardware-isolated CPU region where code and data are protected from inspection by the host OS, used to run inference in a way the operator cannot read or modify. Open full entry for over a decade.
Its limitations are why it has been largely superseded for AI workloads. Enclave size is capped at modest gigabytes, which fits embeddings or small classifiers but not large-language-model weights. The threat model assumes the host is hostile but trusts the CPU; a parade of side-channel attacks (Foreshadow, Plundervolt, SGAxe) has required microcode updates and complicates the trust story.
For AI confidential-computing work in 2026, Intel TDX (per-VM isolation, much larger memory, similar attestationidentity-trustA cryptographic protocol that lets a remote party verify which code is running inside a TEE, including which model is loaded and which build of the inference engine. Open full entry primitives) is the spiritual successor and the more common deployment target. SGX still appears in legacy workloads and in specialized scenarios where small isolated enclaves suffice.