EnclaveScale: Hardware-Assisted Edge-DP for Secure Data Centre Power Telemetry
2026-06-08 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors developed EnclaveScale, a system that securely monitors and models power usage patterns in GPUs used for generative AI. It uses hardware-based security features to ensure that power data is authentic and private, preventing tampering or spying by malicious hosts. Their approach processes data in a way that hides individual events to protect privacy while allowing accurate overall analysis. They tested EnclaveScale on real hardware and showed it can handle large data streams efficiently with very low error. This work lays groundwork for safely managing power across multiple users sharing GPUs in data centers.
EnclaveScalepost-extraction attestationdifferential privacyByzantine rejectionDCAP attestationMarkov-chainSPDM authenticationGPU power telemetryconfidential computingpower orchestration
Authors
Hung Dang, Tue Nguyen, Minh Vo
Abstract
EnclaveScale is a distributed, hardware-assisted telemetry architecture providing post-extraction attestation, enabling operators to collaboratively model high-resolution generative AI power transients. Existing cryptographic techniques scale poorly for 10-Hz streaming or fail to authenticate origins, permitting malicious hosts to spoof sensor inputs. We implement and evaluate a post-extraction pipeline utilizing DCAP attestation, differential privacy noise injection, and Byzantine rejection across 32 GCP Confidential VMs, achieving 0\% post-extraction attack success rate. This edge-DP approach distils continuous GPU transients into discrete Markov-chain transition matrices, guaranteeing event-level differential privacy. To mitigate pre-ingestion vulnerabilities, we propose an SPDM-authenticated first-mile layer. While current platforms lack attested I/O, emerging hardware architectures integrate PCIe IDE and TDISP to natively prevent host-level synthesis, securing the end-to-end provenance boundary. A Global Aggregation Enclave verifies these cryptographic proofs prior to capacity-weighted aggregation. Evaluation demonstrates a steady-state throughput of $131{,}406$ samples/s per enclave, amortising attestation overhead to $0.23\,μ$s/sample. On empirical NVML-sampled H100, A100, and L4 traces, EnclaveScale achieves a dynamic orchestration margin error of $1.3$\,MW compared to $0.1$\,MW for an honest-aggregator central-DP baseline. EnclaveScale establishes a secure foundation for dynamic multi-tenant power orchestration, obfuscating sub-second anomalies locally and protecting macro-workload confidentiality via spatial dilution during global aggregation.