arXiv CSopen access

EnclaveScale: Hardware-Assisted Edge-DP for Secure Data Centre Power Telemetry

EnclaveScale: Hardware-Assisted Edge-DP for Secure Data Centre Power Telemetry Hung Danga,∗, Tue Nguyenb , Minh Voc

arXiv:2606.09163v1 [cs.CR] 8 Jun 2026

a

Faculty of Information Technology, Van Lang School of Technology, Van Lang University, Ho Chi Minh City, Vietnam b Appota Group, Vietnam c FPT Corporation

Abstract EnclaveScale is a distributed, hardware-assisted telemetry architecture providing post-extraction attestation, enabling operators to collaboratively model high-resolution generative AI power transients. Existing cryptographic techniques scale poorly for 10-Hz streaming or fail to authenticate origins, permitting malicious hosts to spoof sensor inputs. We implement and evaluate a post-extraction pipeline utilizing DCAP attestation, differential privacy noise injection, and Byzantine rejection across 32 GCP Confidential VMs, achieving 0% post-extraction attack success rate. This edge-DP approach distils continuous GPU transients into discrete Markov-chain transition matrices, guaranteeing event-level differential privacy. To mitigate pre-ingestion vulnerabilities, we propose an SPDM-authenticated first-mile layer. While current platforms lack attested I/O, emerging hardware architectures integrate PCIe IDE and TDISP to natively prevent host-level synthesis, securing the end-to-end provenance boundary. A Global Aggregation Enclave verifies these cryptographic proofs prior to capacity-weighted aggregation. Evaluation demonstrates a steady-state throughput of 131,406 samples/s per enclave, amortising attestation overhead to 0.23 µs/sample. On empirical NVML-sampled H100, A100, and L4 traces, EnclaveScale achieves a dynamic orchestration margin error of 1.3 MW compared to 0.1 MW for an honest-aggregator central-DP baseline. EnclaveScale establishes a secure ∗

Corresponding author Email addresses: [email protected] (Hung Dang), [email protected] (Tue Nguyen), [email protected] (Minh Vo)

Preprint submitted to Journal of Information Security and Applications

June 9, 2026

foundation for dynamic multi-tenant power orchestration, obfuscating subsecond anomalies locally and protecting macro-workload confidentiality via spatial dilution during global aggregation. Keywords: Confidential Computing, Differential Privacy, Federated Analytics, Power Profiling 1. Introduction Large-scale training and inference clusters utilizing high-density accelerators (e.g., NVIDIA H100 and A100 GPUs) generate massive, synchronized power transients at the 10-Hz scale. These transients, resulting from coordinated micro-batch executions and model-parallel communication barriers, cause instantaneous power spikes of hundreds of megawatts [1]. Grid provisioning requires aggregating raw telemetry across multiple independent infrastructure providers. However, high-resolution telemetry directly encodes proprietary workload schedules and microarchitectural efficiency optimizations, preventing centralized aggregation. Protecting this telemetry requires a dual-layer defense: securing individual execution anomalies at the edge and diluting macro-workload identities during global aggregation. Existing privacy-preserving paradigms fail to support high-frequency streaming telemetry securely. Cryptographic Multi-Party Computation (MPC) [2] over per-sample shares is WAN-infeasible at 10 Hz (O(n) bandwidth per sample). While MPC over condensed matrices is bandwidth-feasible, it sacrifices pre-sharing execution integrity against a malicious host that can fabricate the matrix before the MPC boundary, as we demonstrate in §6.5. Federated Learning Secure Aggregation (SecAgg) [3] successfully reduces transit exposure but relies on honest-but-curious assumptions, offering no cryptographic defense against a malicious host spoofing the telemetry prior to encryption. Both MPC and SecAgg blindly ingest host-provided data, suffering a fundamental “first-mile” data provenance gap. Alternatively, centralizing raw telemetry in a Trusted Execution Environment (TEE) aggregator forces single-domain trust concentration and scales poorly over cross-region interDC links. We propose EnclaveScale, a distributed, hardware-assisted framework that resolves the bandwidth bottleneck and post-extraction execution-integrity gap via attested edge sanitisation on Intel Trust Domain Extensions (TDX). In this architecture, the State-Transition Extractor (STE) computes discrete 2

Markov-chain state-transition matrices over the stream locally, isolated from the host. The enclave applies bounded differential privacy (DP) noise to the matrix to obfuscate precise AllReduce barrier timings, and binds the cryptographic output to a DCAP attestation quote before WAN transmission. EnclaveScale reduces WAN egress (§6.1), mathematically verifies local sanitisation (§6.5), and bounds utility degradation to DP noise (§6.3). Injecting noise locally incurs a 1.3 MW provisioning error (a 1.2 MW increase over the central-DP baseline, at per-batch ε = 1 (εepoch ≈ 11.3 over 10 min, δ = 10−6 ), across 32 providers) for formal execution integrity against a malicious host. Protection of the macro-workload schedule relies entirely on structural spatial dilution at the global aggregator. Contributions: • We design EnclaveScale’s post-extraction pipeline (DCAP attestation, DP noise injection, and Byzantine rejection) to preclude software spoofing, modeling standard TEE adversary capabilities to formally reduce execution integrity to the unforgeability of the TDX quoting key. • We detail an attested TEE-local differential privacy protocol, injecting Gaussian √ noise calibrated to a closed-form ℓ2 -sensitivity bound (∆2 (f ) = 6) and deriving a tight Rényi-DP composition bound for continuous streaming release. • We execute a multi-region deployment across 32 Google Cloud C3 Confidential VMs using real NVML traces (H100, A100, L4), characterising throughput, attestation overhead, scalability, and Byzantine robustness. We quantify empirical utility by reporting dynamic orchestration megawatt error against a plaintext ground truth via strict parameter sweeps, comparison with four contemporaneous baselines, and a 72hour stability run. • We explicitly scope the pre-ingestion first-mile layer as an architectural design sketch for forthcoming Granite Rapids (Xeon 6) platforms, demonstrating how PCIe TDISP theoretically enforces end-toend telemetry provenance against host-level manipulation.

3

2. Background and Problem Formulation 2.1. Background: Generative AI Power Transients Traditional 1- to 5-minute power profiling masks the profound volatility of large-scale generative AI workloads. During distributed training, clusters of high-density accelerators (e.g., NVIDIA H100) execute synchronized micro-batches, transitioning from idle (≈ 100 W) to thermal design power limits (≈ 700 W) within 50 to 100 milliseconds due to model-parallel communication barriers (e.g., AllReduce) [1, 4]. At facility scale, thousands of GPUs hitting simultaneous barriers induce massive, sub-second power transients. Standard data center undervoltage protection relays operate within 1 to 3 cycles (16–50 ms). While absolute protection against these physical trips strictly requires provisioning for the theoretical peak (Pmax ), modeling the stochastic distribution of these spikes using 10-Hz-resolution telemetry enables aggressive, dynamic power orchestration and active load shifting underneath this hard physical ceiling. 2.2. Background: Hardware Primitives (TDX and SPDM) Intel TDX provides VM-level hardware-enforced isolation (Trust Domains) with MKTME-based memory encryption and DCAP remote attestation [5]; GCP Confidential VMs expose these primitives to tenant VMs (§6.1). The Security Protocol and Data Model (SPDM), published by the DMTF, authenticates hardware component identity via X.509 certificate chains; SPDM 1.2+ additionally establishes secure session keys directly between hardware endpoints via KEY_EXCHANGE over ECDHE (or DHE/PSK). SPDM uses an AEAD-protected session (e.g., AES-GCM or ChaCha20-Poly1305) for confidentiality and integrity, rather than relying on TLS records. This enables secure telemetry transit across an untrusted host OS and establishes hardwarerooted data provenance. 2.3. Background: Event-Level DP for Transition Matrices We achieve Differential Privacy (DP) via the Gaussian Mechanism, injecting N (0, σ 2 ) noise calibrated to the global ℓ2 -sensitivity ∆2 (f ). In EnclaveScale, the query f maps a finite stream of discrete power states to a state-transition matrix M . The p √ global ℓ2 -sensitivity is strictly bounded at 2 2 2 ∆2 (f ) = (−2) + 1 + 1 = 6. Protecting a spike spanning k samples requires increasing the noise scale by a factor k (i.e., σ → kσ) to achieve

4

(ε, δ)-DP for the k-sample group, or equivalently, the same noise scale σ provides only (kε, kδ)-DP group privacy. At k = 5 and per-batch ε = 1, group privacy yields only a (5, 5 × 10−6 )-DP guarantee for 500 ms spikes, which provides negligible formal protection. Extensive formal DP definitions and degradation proofs are provided in the Supplementary Material. 2.4. Threat Model The EnclaveScale architecture comprises four entities: Data Providers (infrastructure operators), Local Sanitisation Enclaves (LSEs, TDX Confidential VMs), a Global Aggregation Enclave (GAE, neutral consortium), and Verifiers (grid operators). We adopt a strict threat model for uncooperative multi-tenant infrastructure: Malicious Host and Operator: We assume the Data Provider’s host OS, hypervisor, and operator are actively malicious, controlling the network stack and memory allocation to inject code, bypass DP noise injection, or pollute the global model. The "First-Mile" Authentication Gap: We distinguish execution integrity from semantic data integrity. Lacking hardware-rooted SPDM session capabilities, legacy accelerators cannot cryptographically attest to the LSE, allowing a malicious host to perform a Man-In-The-Middle attack by feeding semantically false power traces. We assume verified server capacity via out-of-band attestation and consider the sensor-LSE physical link out of adversarial reach. Trusted Hardware and Enclaves: We trust the Intel TDX hardware, CPU microcode, the Intel PCS root of trust, and standard cryptographic primitives. LSEs explicitly verify the GAE’s TDX attestation quote prior to session establishment (§3.4). Physical side channels and denial-of-service remain out of scope. 2.5. Security Goals Given the threat model, EnclaveScale is designed to satisfy three formal security properties: 1. Confidentiality: The raw 0.1-second power traces Si never leave the LSE in an identifiable or reconstructable form. The untrusted host OS cannot inspect Si during processing. 2. Execution Integrity: The GAE accepts a summary M̂i if and only if it is accompanied by a valid TDX attestation quote qi unequivocally binding the payload to the expected, unmodified LSE binary hash. 5

3. Output Privacy (Dual-Layered): The released summaries satisfy event-level (ε, δ)-Differential Privacy to cryptographically obfuscate individual 100-ms power samples (protecting micro-transient anomalies). Macro-workload confidentiality is not cryptographically guaranteed; rather, it is achieved structurally via capacity-weighted global aggregation at the GAE, which dilutes individual provider matrices below the threshold of classifier recoverability strictly under the assumption of heterogeneous co-tenancy. 3. System Design EnclaveScale operates via a federated architecture where edge-deployed Trusted Execution Environments distil high-frequency telemetry into privacypreserving, cryptographically attested summaries. 3.1. System Overview Our system delegates feature extraction to the provider’s edge. Provider i deploys a Local Sanitisation Enclave (LSE) on an Intel TDX Confidential VM. The LSE ingests the raw 0.1-second power trace stream Si from the host’s out-of-band management interface. The TDX Multi-Key Total Memory Encryption (MKTME) ensures the host OS cannot inspect Si (MKTME is TDX’s multi-key AES-XTS memory cipher; it is architecturally distinct from the SGX MEE). A production deployment requires bare-metal TDX hosts with SPDM-enabled PCIe/I2C passthrough. Over a temporal batching window (e.g., 10 seconds), the LSE computes a plaintext discrete Markov-chain state-transition matrix Mi . To enforce output privacy, the LSE injects Gaussian noise N (0, σ 2 I) calibrated to the tight √ ℓ2 -sensitivity bound ∆2 (f ) = 6 (§4), producing the differentially private matrix M̂i . The LSE fetches a TDX quote (DCAP token) qi , cryptographic binding it to the hash of M̂i . The provider transmits only the tuple (M̂i , qi ) to the Global Aggregation Enclave (GAE) (see Fig. 1), which verifies execution integrity via qi and computes a capacity-weighted, hardware-specific (h) global transition matrix Mglobal . 3.2. SPDM-Authenticated Telemetry Ingestion To neutralize first-mile spoofing, EnclaveScale anchors data ingestion to the Security Protocol and Data Model (SPDM). While our empirical implementation (Section 5) employs a software shim pending hardware-native 6

Provider 1

Provider 2

Untrusted Host OS

Untrusted Host OS

S1

S2

LSE1

LSE2

TDX TD

TDX TD

PCK cert

...

Provider N Untrusted Host OS SN

...

LSEN TDX TD

(M̂2 , q2 ) (M̂1 , q1 ) (M̂N , qN ) (h)

Intel PCS DCAP Root

PCK cert

GAE TDX TD

Mglobal

Verifier Grid Operator

Figure 1: The EnclaveScale architecture. Raw telemetry transients (Si ) are distilled into DP-noised matrices (M̂i ) within edge-deployed TDX enclaves (LSEs) and transmitted to the central GAE alongside an attestation quote (qi ). Untrusted host components are denoted by red dashed boundaries.

PCIe TDISP and IDE deployment, the target architecture requires hardware SPDM responders. Upon boot, the LSE generates an ephemeral Ed25519 key pair (skE , pkE ) in MKTME-protected memory and initiates an SPDM 1.2+ handshake directly with the accelerator’s Root of Trust [6]. The LSE validates the accelerator’s X.509 certificate and executes KEY_EXCHANGE to derive symmetric session keys. The host OS routes packets but cannot decrypt the stream or forge signatures without the hardware’s private key. The LSE maintains an SPDM session transcript hash (HSPDM ) capturing the authenticated history; MAC verification failures trigger immediate connection termination. 3.3. Local Extraction and Edge DP Once secured, the LSE maintains a ring buffer for the incoming 10 Hz telemetry stream. Mapping this directly to states via static thresholds risks boundary-straddling attacks, where a malicious host oscillates the clock to fabricate transitions, inflating the spectral gap γ and causing under-provisioning. To neutralize this, the State-Transition Extractor (STE) applies NonOverlapping Temporal Block Pooling. It segments the telemetry into discrete k-sample windows (e.g., k = 10 for 1 s blocks). For each window Wj , the (j) STE computes Ppool = maxt∈Wj Pt and maps this maximum to a single state Sj ∈ S (e.g., IDLE, TRAINING) using predefined hardware threshold bands. Emitting one state per block physically absorbs high-frequency oscillations. 7

The transition between Sj−1 and Sj increments the plaintext transition matrix Mi . To amortise noise, the LSE aggregates telemetry across all G local accelerators (e.g., G = 8) into a single matrix. At W = 10 s, maximum per-batch transitions expand from 9 to 72, enabling dense cells to exceed 50 counts. State count |S| trades utility against noise scale (§6.6). At the batch window’s end, the LSE injects DP noise. Because windows Wj are non-overlapping, perturbing one raw measurement Pt alters at most one pooled state Sj , changing exactly two matrix transitions (entering and leaving Sj ). The DP guarantee operates at the provider-batch level; since the window structure prevents altering more than one state across√the G-GPU pool simultaneously, the ℓ2 -sensitivity strictly remains ∆2 (f ) = 6 (§4). For privacy budget ε and δ = 10−6 , the LSE adds N (0, σ 2 I) noise calibrated via the Analytic Gaussian Mechanism [7]. It then applies thresholding (discarding cells where x + η < Φ−1 (0.95)σ) and row-stochastic normalisation. To preserve spectral properties, these steps execute in float64 inside the enclave; the final matrix is downcast to float32 for transmission. Both steps are deterministic post-processing. Degenerate-row fallback. If thresholding suppresses an entire row, the LSE substitutes a uniform distribution (1/|S| per cell), preserving DP via postprocessing theorems [8]. Empirically, this triggers in ≤ 0.3% of evaluated rows. Over the H100 trace at ε = 1, structurally empty cells survive at 5.0% (matching the 1 − Φ(1.645) rejection rate), while cells with > 50 counts survive at 99.8%. Setting |S| = 5 concentrates transition mass into this > 50 bin, preserving 98.5% of genuine transitions while correctly suppressing empty cells that erode the spectral gap. 3.4. Remote Attestation and Cryptographic Binding EnclaveScale enforces mutual hardware-rooted remote attestation. GAE pre-authentication. Before initialization, the LSE verifies the GAE’s TDX attestation quote qGAE over TLS, checking the certificate chain and validating the MRTD field against the expected GAE binary measurement. Mismatches trigger connection aborts. LSE initialization and binding. The LSE generates an ephemeral Ed25519 keypair (skE , pkE ), requests a DCAP quote qinit binding pkE , and registers with the GAE. The GAE validates the provider against a PKI registry R and adds pkE to the active-session map A. Subsequent temporal batches avoid heavy DCAP quoting; the LSE signs the payload Hpayload = SHA256(M̂i ∥ HSPDM ∥ h ∥ timestamp ∥ b) using skE to produce τ . The 8

transmitted quote qi comprises (qinit , τ, Hpayload ), amortising attestation overhead. The GAE validates pkE against A and strictly enforces counter monotonicity (b > max _b_accepted[pkE ]). To prevent rollback, the GAE persists A to a guest-managed encrypted virtual disk (sealed to the GAE’s MRTD) on every ACCEPT, adding ∼ 1.2 ms per-batch latency. 3.5. Hardware-Specific Global Aggregation Because power transient signatures depend fundamentally on microarchitecture, aggregating distinct hardware traces degrades model utility. The (h) GAE maintains hardware-specific sub-models Mglobal via capacity-weighted aggregation: X C (h) P i M̂i (1) Mglobal = C j j∈P h i∈P h

where Ci is the declared server capacity for hardware h. The PKI registry caps Ci to suppress over-reporting Sybil attacks (§6.5). 3.6. Power Orchestration Margins (h) We map the probabilistic matrix Mglobal to an active power orchestration (h)

margin. Let ⃗π be the normalized principal eigenvector of Mglobal . Given a (h) hardware-specific power profile vector P⃗h (with worst-case state Pmax ), the expected baseline power draw for cluster size Ctotal is E[P ] = Ctotal (⃗π · P⃗h ). To account for synchronized state transitions, we model physical load deviations (h) using the spectral gap γ of Mglobal . We adopt the worst-case synchrony regime, treating the Ctotal GPUs as a single synchronized Markov chain. Lemma 1 (Markov Chain Concentration). Let (Xt ) be an irreducible, reversible Markov chain with stationary distribution ⃗π and spectral gap γ = 1 − |λ2 |. For P a finite integration window of N steps, the time-averaged power draw P̄ = N1 N t=1 P (Xt ) obeys the concentration bound [9]:  
γN ϵ2 P P̄ − E[P ] ≥ ϵ ≤ exp − 2 (2) Pmax We explicitly instantiate this tight one-sided bound (parameterized via K = 1) because microgrid safety is solely concerned with under-provisioning. The exhaustive algebraic reduction from Paulin’s generalized Hoeffding-type inequality remains available in the Supplementary Material. 9

To ensure the probability of exceeding the orchestration margin remains below a critical threshold η, we invert the bound. Bundling the integration window length Np , and the failure probability η into a dimensionless safety factor c(η, N ) := log(1/η)/N , the per-cluster peak-load margin admits the closed form: r 1 (h) (h) . (3) Lpeak = E[P ] + Ctotal Pmax c(η, N ) γ Equation (3) is the rigorous closed form we use throughout this paper. This margin p is subject to a strict regime of validity (γ > γmin ≈ 0.10). As γ → 0, the 1/γ term grows unboundedly; for exceptionally slow-mixing workloads, the margin must instead be capped by the physical hardware (h) (h) ceiling Lpeak ≤ Ctotal Pmax . Aggregate facility margin bounds the linear superP (h) position of these margins: Ltotal = h∈H Lpeak . Section 6 evaluates dynamic orchestration error as the megawatt difference between the Ltotal derived from the DP-noised global model versus the plaintext ground truth. 4. Security and Privacy Analysis We formally reduce the security goals of §2 to Intel TDX hardware guarantees and differential privacy properties. 4.1. Standard TEE Attack Classes and Mitigations A TDX-resident streaming system mitigates several standard attack classes. Replay, Rollback, and TOCTOU. A malicious host may resubmit benign tuples, restore hypervisor snapshots, or attempt Time-of-Check to Timeof-Use (TOCTOU) race conditions. EnclaveScale mitigates this by requiring an attested time-sync protocol (e.g., Roughtime) to drive temporal batching. The monotonic batch counter b provides the TOCTOU guarantee directly: any hypervisor modification between noise injection and signing alters Hpayload , triggering GAE rejection regardless of clock state. The TSC provides intra-TD temporal ordering; freshness against rollback derives exclusively from the Roughtime-attested external timestamp bound into Hpayload . The DP noise seed originates from the CPU’s hardware True Random Number Generator (RDSEED) to guarantee fresh entropy upon restore. Microarchitectural Side Channels. We assume the deployed TDX module incorporates architectural mitigations for known side channels (e.g., ÆPIC Leak, Downfall, Hertzbleed) per Intel advisories [10, 11]; physical side channels are out of scope. 10

First-Mile Input Spoofing. A malicious host routing the raw stream Si can trivially synthesize fake power traces. EnclaveScale mandates SPDM 1.2+ to establish a mutually authenticated session directly between the accelerator’s hardware SPDM responder and the LSE, terminating inside the TDX Trust Domain. The host acts purely as a blind packet router. DCAP TCB-recovery handling. The GAE enforces Intel TCB recoveries (revoking PCK certificates) via CRL checks with a configurable grace period (§6.6). 4.2. Confidentiality and Integrity Bounds End-to-End Data and Execution Integrity: The raw stream Si enters the LSE’s isolated memory via an SPDM 1.2+ secure session terminating inside the Trust Domain. Lacking the accelerator’s hardware identity keys, the host OS can neither spoof Si via valid SPDM frames nor decrypt the legitimate telemetry. Once inside the enclave, Intel TDX provides cryptographic confidentiality via the Multi-Key Total Memory Encryption (MKTME) engine. Under Logical Integrity (LI) mode, integrity protection covers software-mediated tampering. Thus, data protection rigorously reduces to the unforgeability of the SPDM AEAD (AES-GCM-256) and the logical isolation guarantee of TDX MKTME. The LSE exclusively exports the transition matrix M̂i ; because M̂i is the output of an (ε, δ)-DP mechanism, residual information leakage is analytically bounded by (ε, δ). Execution Integrity: EnclaveScale prevents malicious LSE binary substitution or matrix fabrication via the DCAP verification sequence (see Supplementary Material). The hardware-generated quote qinit reflects the binary measurement. Execution integrity reduces to the unforgeability of the TDX quoting enclave’s signature (EUF-CMA) and the collision resistance of SHA-256. Lemma 2 (SPDM Transcript Binding). Assuming the unforgeability of the SPDM AEAD and the collision resistance of SHA-256, cryptographic binding of the SPDM transcript hash HSPDM into the TDX-attested payload Hpayload precludes session-splicing under the host-controlled threat model. Proof sketch. The LSE computes Hpayload = SHA256(M̂i ∥ HSPDM ∥ . . . ). The GAE verification of the TDX quote qi guarantees Hpayload was signed by the enclave-bound ephemeral key skE . Because the hardware SPDM responder mutually authenticates HSPDM across the PCIe bus, an adversary cannot 11

substitute an alternative SPDM session or inject spoofed telemetry without either invalidating the active HSPDM MAC or forging the TDX-attested signature over the resultant Hpayload . 4.3. Differential Privacy Guarantee and Composition Single-Batch DP Bound. The LSE maps a stream Si of length W to a transition-count matrix Mi . Changing a single state Si [t] alters two transitions. The maximum ℓ2 difference occurs when mutating a self-loop (e.g., A → A → A), changing exactly three +1, and +1. p cells’ counts by -2, √ 2 2 2 The ℓ2 -sensitivity is therefore ∆2 (f ) = (−2) + 1 + 1 = 6. Adding spherical Gaussian noise N (0, σ 2 I) with σ calibrated numerically via the exact Analytic Gaussian Mechanism [7] strictly satisfies (ε, δ)-DP per batch. Sequential Composition over Time. In a continuous streaming environment, the LSE releases a sequence {M̂i,1 , . . . , M̂i,T }. We bound the cumulative privacy loss using the Rényi-DP framework [12]: a single ap2 plication of the Gaussian mechanism is (α, ρ)-RDP with ρ(α) = α (∆2σ2 (f2 )) . By the linearity of RDP under sequential composition, the T -fold release is (α, T ρ(α))-RDP. Converting to (εtotal , δ)-DP and minimizing over the order p ∗ α > 1 (specifically, at the optimal order α = 1 + σ 2 ln(1/δ)/T /∆2 (f )) yields the closed-form bound [12, Proposition 3] [13]. This formula applies strictly for T > 1 as a composition bound and diverges from the analytic guarantee at T = 1; single-batch σ must be calibrated directly via the AGM condition stated above: p 2T (∆2 (f ))2 ln(1/δ) T (∆2 (f ))2 + . (4) εtotal (T, δ) = 2σ 2 σ At a batch size of W = 10 s (per-batch ε = 1, δ = 10−6 ), continuous operation without key rotation accumulates εtotal ≈ 357.7 over 24 hours. By enforcing cryptographic epoch rotation every T = 60 batches (10 minutes), EnclaveScale caps the per-epoch privacy loss at εepoch ≈ 11.3. Remark 3 (Multi-Epoch Composition and Privacy Scope). To clarify the boundaries of the system’s protections: EnclaveScale formally protects individual 100-ms power anomalies within each 10-minute epoch (bounded by the local DP guarantee εepoch ≈ 11.3); EnclaveScale empirically protects macro-workload schedules under heterogeneous co-tenancy via GAE aggregation dilution; and EnclaveScale does not protect long-term workload schedules from repeated epoch observations across infinite horizons. 12

Security against a Compromised GAE (Goal 1 vs. Goal 3). We assume the GAE host environment is operated honestly. If the GAE is compromised, the adversary’s advantage in recovering the provider’s exact workload distribution from individual submitted tuples is bounded strictly by the local DP budget (εepoch ≈ 11.3). Theorem 1 (Conditional Security of EnclaveScale.) Under Assumptions (i) EUF-CMA unforgeability of the TDX quoting key, (ii) collision resistance of SHA-256, (iii) IND-CCA security of AES-GCM-256, (iv) correctness of the SPDM session with a hardware SPDM responder, and (v) the Confidentiality bound (Goal 1) holds against software-mediated host tampering under TDX LI mode (hardware-level DMA-based memory injection against MKTME is outside the threat model), EnclaveScale satisfies: (a) Confidentiality (Goal 1) for any host-controlled adversary, (b) Post-extraction Execution Integrity (Goal 2) with 0% ASR, and (c) Event-level (per-batch ε = 1, δ = 10−6 )-DP Output Privacy (Goal 3). Assumption (iv) is not satisfied by the evaluated GCP Sapphire Rapids prototype; on that hardware, Goal 2 extends only to the post-extraction layer, and pre-ingestion integrity reverts to the honest-but-curious threat model. 5. Implementation and Baselines 5.1. Software and Hardware Stack The EnclaveScale LSE and GAE are implemented in Rust. The LSE interfaces with the TDX module for DCAP quote generation using tdx-attest-rs and integrates libspdm via FFI. Because GCP C3 instances lack Intel TDX Connect for bare-metal PCIe passthrough, we employ spdm-emu to simulate the hardware SPDM responder over a virtualized socket. The GCP TDX deployment uses Logical Integrity (LI) mode. Both components use √ ed25519-dalek for ephemeral signing. The DP module enforces ∆2 (f ) = 6 before sampling N (0, σ 2 ) (see Table 1 for deployed values). Communication utilizes asynchronous TLS. We deployed EnclaveScale on Google Cloud Platform (GCP) across four regions (us-central1, us-east5, europe-west4, asia-southeast1; 8 LSEs per region). Microbenchmarks utilized isolated GCP Confidential VMs (c3-standard-4 for LSE, c3-standard-8 for GAE) running Ubuntu 22.04 LTS on TDX-enabled Sapphire Rapids processors. Although we evaluate via spdm-emu, physical hardware Roots of Trust (e.g., GPU SPDM responders) secure the first-mile guarantee. A full SPDM 13

Table 1: Deployment parameters for the local DP mechanism. The applied noise scale σAGM = 10.35 yields εepoch ≈ 11.3 via the RDP composition formula (Eq. 4). While evaluating the exact Analytic Gaussian Mechanism (AGM) yields a tighter εAGM ≈ 10.8 at T = 60, the minimal 4% divergence confirms the RDP conversion remains a sufficiently tight and valid analytical bound.

ε

δ

1

10−6

∆2 (f ) √ 6

σAGM

σRDP_approx

εepoch (T = 60)

10.35

—

11.3

session re-establishment is triggered only upon LSE reboot, hardware reset of the accelerator, or explicit revocation of the ephemeral binding key. 5.2. GPU Power Trace Collection and Markov Chain Validation We evaluate EnclaveScale against 24-hour per-GPU power traces from three GCP accelerator families, replayed at 10 Hz into the LSE Unix-socket ingest√endpoint to preserve the live-sensor pipeline. To preserve the independent N noise-reduction assumptions for dynamic orchestration evaluation despite replaying traces from 17 physical GPUs across 32 LSEs, duplicated traces were subjected to a strict ≥ 1-hour temporal offset. Collection setup. We provisioned one a3-highgpu-8g instance (8× H100 SXM5), one a2-highgpu-8g instance (8× A100 SXM4), and one g2-standard-4 instance (1× L4) on GCP. Workloads included MLPerf Training v4.0 JAX BERT-Large (H100), PyTorch ResNet-50 (A100), and continuous Stable Diffusion v2.1 inference (L4). Power samples were recorded at 10 Hz via pynvml. The pooling parameter is fixed at k = 10 samples (1-second blocks) across all evaluations. To isolate the evaluation of the noise mechanism, the 17 multi-GPU traces were decoupled such that each of the 32 simulated LSEs ingests exactly one single-GPU trace (i.e., G = 1). Specifically, the 32 LSEs are distributed as 11 H100 traces, 11 A100 traces, and 10 L4 traces. Because G = 1, the theoretical maximum number of transitions per 10-second batch remains strictly bounded at 9. This operational choice formally ensures the mathematical ℓ2 -sensitivity of the local DP mechanism identically matches √ the single-device analytical bound of ∆2 (f ) = 6 derived in §4, precluding the need for aggregate-state re-derivation. The |S| = 5 threshold bands are derived from each GPU’s rated TDP and empirically observed idle power floor (details in Supplementary Material), mapping to Idle, Low, Med, High, and Peak. 14

Markov chain validation. We fitted 5-state discrete-time Markov chains to each trace, extracting the stationary distribution πreal and spectral gap γreal = 1 − |λ2 |. Table 2 compares these empirical properties against a baseline Gaussian-mixture synthetic model. Table 2: Gaussian-mixture synthetic model vs. real NVML-sampled Markov chains (|S| = 5). γ denotes the spectral gap (1 − |λ2 |). ∥Msynth − Mreal ∥1 is the average per-row ℓ1 distance between row-normalised matrices. Note: The empirical variance in γreal across H100 (JAX) and A100 (PyTorch) traces inherently conflates microarchitectural hardware differences with framework-specific scheduling behaviors (e.g., memory barriers). Identifying the isolated hardware effect remains an area for future work. Workload

Trace

γsynth

γreal

πreal (Idle, Low, Med, High, Peak)

∥Msynth − Mreal ∥1

Synthetic BERT ResNet Stable Diff.

– H100 (SXM5) A100 (SXM4) L4 (PCIe)

0.18 0.18 0.18 0.18

– 0.13 0.11 0.12

[0.20, 0.20, 0.20, 0.20, 0.20] [0.11, 0.04, 0.08, 0.36, 0.41] [0.08, 0.02, 0.05, 0.32, 0.53] [0.14, 0.10, 0.09, 0.41, 0.26]

– 0.84 1.02 0.67

Training workloads (H100, A100) exhibit smaller real spectral gaps than the synthetic model due to sustained high-power compute phases separated by synchronisation barriers. For the L4 inference trace, hardware polling aliasing at 5–10 Hz artificially inflates self-loop counts, depressing its empirical spectral gap to γreal = 0.12. This aliasing acts as a structural fail-safe: lowering γ strictly increases the peak-margin heuristic, yielding a more conservative bound. Stationarity check. A formal likelihood-ratio test (LRT) over nonoverlapping sub-windows strictly rejects time-homogeneity (p < 10−5 ), which is statistically expected for dynamic training workloads. However, slidingwindow analysis confirms structural stability: worst-case variance (δγ = −0.009) shifts the predicted capacity requirement by a negligible +5.9 W per GPU. Thus, the macro-stationarity violation is physically immaterial and safely absorbed within the 4.8% conservative over-estimation buffer (§6.4). 5.3. Comparative Baselines We benchmark EnclaveScale against four baselines: • Baseline A (Cryptographic MPC): MP-SPDZ [2] aggregation. Vulnerable to first-mile attacks (the OS can spoof telemetry before the MPC boundary). 15

• Baseline B (Centralized TEE): A single GAE ingests raw 0.1second streams. Represents the theoretical utility ceiling but demands massive WAN egress bandwidth. • Baseline C (SecAgg): Federated Learning Secure Aggregation [3]. Offers zero execution integrity against malicious data fabrication. • Baseline D (Software LDP, No TEE): Local DP without TDX protection. Acts as a structural control, confirming that executing the DP mechanism inside a TD does not perturb mathematical utility. 6. Evaluation We evaluate EnclaveScale across 32 Google Cloud Confidential VMs (8 LSEs/region across us-central1, us-east5, europe-west4, asia-southeast1) during a 72-hour continuous deployment. Throughput and latency metrics include 95% confidence intervals over 30 runs. 6.1. System and Cryptographic Microbenchmarks Per-LSE single-session throughput sustains 131,406 samples/s. Multi-Session Multiplexing Scaling. We evaluate LSE throughput degradation during concurrent SPDM session multiplexing via asynchronous I/O. As shown in Table 3, aggregate throughput remains flat through K ≤ 64 but degrades super-linearly as the aggregate working set exceeds the 2 MB percore L2 cache boundary. At K = 1024, the throughput of 82,467 samples/s retains an 8.1× processing headroom above the required 10,240 samples/s ingestion rate for a 1,024-GPU pod. Table 3: Multi-Session Multiplexing Throughput Scaling. Values report the median ± 95% CI.

K (Concurrent) 1 8 64 256 1024

Total Throughput

L1d Miss

L2 Miss

Instr/Cycle

131,406 ± 410 130,890 ± 520 128,100 ± 840 104,500 ± 1,100 82,467 ± 1,450

4.2% 4.5% 8.1% 14.3% 22.1%

1.1% 1.1% 1.8% 6.2% 15.4%

2.14 2.11 1.95 1.62 1.10

16

Attestation Overhead Amortisation. The heavy DCAP qinit generation incurs a median cold-start latency of 81.2 ms. Because this periodic quote generation executes asynchronously, it overlaps with continuous ingestion. The steady-state ingestion throughput is dictated solely by the per-batch attestation and I/O path. Per-submission GAE verification latency decomposes as shown in Table 4. The total per-batch compute time of 4.90 ms is dominated by the cryptographic signature verification and the synchronous TDX disk seal for counter persistence. Table 4: Decomposition of GAE per-batch compute latency (32 nodes).

Component

Latency (ms)

% Total

TLS Payload Deserialization PKI & MRTD Eval Ed25519 Quote Verification (O(n)) Capacity-Weighted Aggregation Sealed Disk Persist (Counter Sync)

0.12 0.05 2.84 0.27 1.62

2.4% 1.0% 58.0% 5.5% 33.1%

Total Per-Batch Compute

4.90

100.0%

TDX and SPDM Overhead Decomposition. Steady-state per-sample overhead comprises: (i) native baseline (3.1 µs/sample), (ii) TDX virtio-vsock I/O and MKTME overhead (4.1 µs), (iii) amortised per-batch Ed25519 attestation binding (0.23 µs/sample), and (iv) SPDM AEAD MAC verification (0.18 µs/sample, measured via spdm-emu over vsock). We explicitly caution that this 0.18 µs figure is an artifact of the software emulator; a production deployment terminating SPDM over physical PCIe IDE/TDISP will encounter orders-of-magnitude higher latency (typically 100–500 µs per roundtrip). These sum to 7.61 µs/sample, validating the 131,406 samples/s throughput. 6.2. Cross-Platform GAE Scalability We evaluated GAE aggregation latency as participating LSEs scale from 1 to 32 nodes across four GCP regions. Aggregation scales linearly (0.15 ms/LSE, Fig. 2), dominated by O(n) perquote signature verification. At the full 32-node deployment, the GAE completes per-batch aggregation in 4.9 ms (median), well within the 10-second batch window. 17

Latency (ms)

End-to-end batch-completion latency. The 4.9 ms figure measures GAE compute time from receipt of the final submission in the batch window to publication of the global matrix; it excludes WAN transit. We instrumented submission timestamps at each LSE and recorded the one-way transit latency from each region to the GAE (co-located in us-central1) over the 72-hour stability run. The 95th-percentile one-way transit latency from the farthest region (europe-west4) was 109 ms. The end-to-end batch-completion latency (from the start of the 10-second window to publication of the global matrix) is therefore 4.9 + 109 = 113.9 ms at the 95th percentile, comfortably within the 10-second batch window and well below the 20-second freshness threshold enforced by the monotonic-counter replay check. Empirical Results 6 4 2 0

1

5

Local OLS Fit (n ∈ [1, 32])

10 15 20 25 Number of LSEs (n)

32

Figure 2: GAE per-batch aggregation latency vs. participating LSEs (median ± 95% CI over 30 runs). The decomposed scaling law yields 1.62 + 0.101n ms, comfortably bounded within the 10s batch window.

To simulate realistic multi-operator WAN conditions across the GCP backbone, we injected artificial network jitter (150 ms RTT, 1% packet loss) via tc qdisc. Despite this interference, the GAE successfully maintained hardware-specific sub-models for H100, A100, and L4 traces without triggering queuing delays that would violate the 10-second temporal-batch boundary. Following the simulated TCB revocation event, the GAE completed its state-machine recovery relying on pre-fetched cached collateral (invalidated via a strict 24-hour TTL to prevent stale-PCK authorization) within 12.4 ms. 6.3. Privacy–Utility Pareto Against Baselines We evaluate noised matrix fidelity for grid provisioning against a plaintext ground-truth model derived from centralised NVML trace replay. We compute the EnclaveScale global model at varying ε (with δ = 10−6 ) and evaluate both via a standard dynamic orchestration calculator (cf. §3.6) assuming a total facility load Ctotal = 200 MW. 18

Orchestration Error (MW)

EnclaveScale Software LDP (No TEE)

Central-DP-after-SecAgg Centralized TEE / MPC (Baselines B & A)

10 8 6 4 2 0 1 10

10−1

100

10−2

Per-Batch Privacy Budget (ε) Figure 3: Privacy-Utility Pareto Front: Dynamic Orchestration Error vs. Per-Batch ε. EnclaveScale (blue) perfectly overlaps Software LDP (orange), confirming the TDX wrapper preserves statistical utility. The 1.2 MW gap to Central-DP (red) is the cost of decentralised trust. Baselines A & B lack DP (0 MW error).

To position EnclaveScale within the privacy-utility design space, we evaluate five contemporaneous schemes on the same axis: • EnclaveScale: attested edge-DP via the LSE. • Centralised-TEE (Baseline B): no DP; the ground-truth utility ceiling. • Cryptographic MPC (Baseline A): secure multi-party computation over plaintext matrices. Offers no DP privacy loss (utility matches Baseline B) but scales poorly and lacks pre-ingestion execution integrity. • Central-DP-after-SecAgg: matrices aggregated under SecAgg, then central Gaussian noise applied at the aggregator (the standard FL-DP recipe [14]). • Local-DP-only (no TEE): each provider applies the same Gaussian noise locally without TDX protection (this is the lower-trust point of comparison). We performed a 50-point sweep across per-batch ε ∈ [0.01, 10], √ executing 1,000 Monte Carlo replicates of the DP noise injection (∆2 (f ) = 6) to map the privacy-utility Pareto frontier (see Figure 3). While per-batch ε is the operative configuration knob, the resultant privacy guarantee over a complete 10-minute epoch (T = 60 batches) is (εepoch ≈ 19

11.3, δ = 10−6 )-DP, as derived in §4. Infrastructure operators should treat εepoch as the primary deployment metric. Interpreting this in a deployment context: an εepoch ≈ 11.3 budget bounds the exposure of individual 100ms anomalies within a 10-minute window, but it does not formally protect macro-workload identity (see empirical bounds below). Operators requiring tighter formal guarantees can leverage the system’s Pareto flexibility by reducing epoch duration (e.g., yielding εepoch ≈ 3.2 at T = 6) or lowering the per-batch ε, explicitly trading utility for stricter budgets. At a per-batch ε = 1 (epoch-level εepoch ≈ 11.3), EnclaveScale achieves a dynamic orchestration margin error of 1.3 MW (CI: 1.1–1.5 MW) on the real NVML traces, while the Central-DP-after-SecAgg variant achieves 0.1 MW (CI: 0.0–0.2 MW). Cryptographic MPC (Baseline A), lacking DP noise, perfectly matches the Centralised-TEE baseline (0.0 MW error relative to ground truth). Central-DP-after-SecAgg limits noise scale by adding it centrally over an aggregate matrix, yielding a lower error at the fatal cost of assuming an honest aggregator. Baseline D (Software LDP, No TEE) perfectly matches EnclaveScale’s 1.3 MW utility by design (1.3 MW ≡ 1.3 MW), confirming that the enclave wrapper does not perturb the mathematical utility; however, Baseline D offers zero defence against malicious host spoofing. EnclaveScale accepts a 1.2 MW error penalty relative to central DP and a 1.3 MW penalty relative to MPC; in exchange, its DCAP pipeline mathematically precludes host-level alteration (0.0% ASR, §6.5) and its SPDM architecture guarantees pre-ingestion provenance. Neither SecAgg, MPC, nor √ LDP offers both protections. Ultimately, the ∆2 (f ) = 6 sensitivity and cross-provider noise averaging ensure the 1.3 MW error remains well within the tolerance of a 200 MW facility. Variance reconciliation against theoretical noise multipliers. The total 1.3 MW facility figure aggregates across all three hardware sub-models (H100: 11 LSEs, A100: 11 LSEs, L4: 10 LSEs) at a capacity-weighted Ctotal√ = 200 MW. For the per-hardware aggregate, local-DP error scales as σ/ N where N is the number of LSEs. For the H100 hardware sub-model specifically (N = 11 √ same-hardware LSEs), the theoretical input-noise multiplier is bounded by 11 ≈ 3.32; the remaining gap is explained by the inverse Mills ratio bias detailed below. The empirical output error ratio (1.3 MW vs. 0.1 MW) diverges due to pre-aggregation statistical thresholding. Discarding cells where the noisy count v = c + Z < 1.645σ systematically removes samples with large negative noise Z. For surviving genuine transitions (c > 0), 20

the conditional expectation is biased positively: E[c + Z | c + Z ≥ 1.645σ] = c + σ

ϕ(1.645 − c/σ) 1 − Φ(1.645 − c/σ)

where the positive bias is governed by the inverse Mills ratio. Weighting this closed-form bias term by the empirical cell frequencies yields an analytical mass-inflation estimate of ≈ 0.48 MW, perfectly matching the 0.5 MW systematic gap (0.8 MW → 1.3 MW) observed during ablation. This positive bias inflates total transition mass prior to row-normalisation, narrowing the apparent spectral gap and compounding the final orchestration error. We explicitly accept the compounded 1.3 MW error √ as the mathematically unavoidable cost of preserving the tight ∆2 (f ) = 6 DP bound required for continuous streaming release at the evaluated G = 1 scale. Under the designed G = 8 deployment architecture (§3.3), the per-batch transition count expands from a maximum of 9 to 72. This increased transition density shifts a substantially larger fraction of genuine cells into the > 50 count regime, mitigating the severe pre-aggregation truncation bias governed by the inverse Mills ratio. Our inverse-Mills bias model projects that this improved signalto-noise ratio would reduce the total orchestration error from 1.3 MW down to approximately 0.4 MW. Exhaustive empirical validation of this projection against live multi-GPU traces is deferred to future work. The T = 60 configuration prioritises microgrid utility. To satisfy stricter privacy mandates, operators can navigate the Pareto frontier: at T = 6 (60second epochs) with fixed per-batch ε = 1, Equation (4) tightens the cumulative bound to εepoch ≈ 3.2. Aggregating fewer matrices smoothly increases orchestration error to 2.1 MW (CI: 1.8–2.4 MW). EnclaveScale’s tunable epoch length provides a formal switch between a high-utility regime (εepoch ≈ 11.3, 1.3 MW error) and a strong-privacy regime (εepoch ≈ 3.2, 2.1 MW error) without algorithmic modification. Operators targeting εepoch ≤ 3.2 may further reduce T ≤ 5 or lower the per-batch ε, accepting proportional utility degradation. Empirical privacy auditing. We instantiate a worst-case canary auditor following Steinke et al. [15]: the canary is the boundary-transition sequence A → B → A that maximises the per-sample ℓ2 perturbation under our extraction map. We executed 100,000 paired runs over a single 10-minute epoch (T = 60 batches), computing for each pair the membership-inference classifier’s true-positive and false-positive rate as in [15, Algorithm 1]. The empirical lower bound on the achieved epoch-level privacy loss is ε̂epoch ≥ 8.2 21

at 95% confidence (one-sided Clopper–Pearson). The 27% gap between the empirical bound and the analytical upper bound εepoch ≈ 11.3 is attributable to the conservatism of the Clopper–Pearson interval at finite sample sizes (N = 100,000) rather than looseness in the RDP analytical bound, which is known to be tight for the Gaussian mechanism at the worst-case input pair [12]. We cannot rule out a contribution from the gap between the Mironov RDP upper bound and the exact worst-case ε; however, since the RDP bound is known to be tight at the optimal order α∗ for the Gaussian mechanism, Clopper–Pearson conservatism is the dominant explanation at N = 100,000. The audit therefore confirms that the noise calibration is mathematically sound. We acknowledge that an εepoch ≈ 11.3 represents a weak formal privacy guarantee (with e11.3 ≈ 8 × 104 ), functioning primarily to obfuscate isolated sub-second anomalies rather than providing rigorous cryptographic indistinguishability. Empirical Workload Confidentiality (GAE Resilience). While event-level DP obscures isolated anomalies, it does not unilaterally hide macro-workload identity prior to aggregation. To quantify pre-aggregation leakage, we trained a Random Forest classifier on individual DP-noised LSE matrices (ε = 1). Focusing on the most rigorous control group (a same-hardware, 2-class discrimination task of SD versus BERT on H100 instances), the classifier achieved a 71.8% cross-validation accuracy. This result is meaningfully above the 50% random baseline, confirming that individual LSE matrices inherently leak structural workload signatures.1 The EnclaveScale privacy model relies on the GAE to protect workload schedules via capacity-weighted aggregation. We simulated an adversary attempting to recover the workload of (h) target provider i from the globally released matrix Mglobal , aggregated across |Ph | = 11 same-hardware providers. Because the target’s signal constitutes a minor fraction of the aggregate, its signature is massively diluted. Under heterogeneous co-tenancy, the post-aggregation 2-class accuracy collapsed to 52.3%, rendering it statistically indistinguishable from a random guess. At 1

A 3-class classifier separating BERT (H100), ResNet (A100), and SD (L4) achieved 94.1%. This metric trivially conflates workload identity with hardware power regimes (700 W, 400 W, and 72 W TDPs). When applied to TDP-normalised features (P/TDP), this 3-class accuracy drops to 61.4%. A binomial test confirms this residual 28-point margin above the 33.3% random baseline is structurally significant (n = 25,920, p ≪ 10−5 ), confirming the 94.1% figure is overwhelmingly TDP-driven, although genuine crossarchitecture structural leakage persists.

22

production scale with |Ph | ≫ 11, spatial dilution is strictly stronger and classifier accuracy is expected to rapidly approach the 50% baseline. Conversely, under a worst-case homogeneous scenario where all co-tenants execute an identical workload, the aggregated signal mutually reinforces the signature, elevating classifier accuracy above 98%. These results establish that the post-aggregation matrix effectively obscures workload schedules under heterogeneous co-tenancy. Classifier Methodology. The classifiers were trained on the exact 10second DP-noised transition matrices used for orchestration, yielding 8,640 matrix observations per 24-hour hardware trace (n = 25,920 total). To strictly preclude temporal leakage, we employed a 5-fold blocked time-series cross-validation scheme, inserting a 1-hour purge gap between training and testing blocks to ensure structural independence. The Random Forest utilized 100 estimators, a maximum depth of 10, and Gini impurity over the flattened 25-feature matrix. 6.4. Empirical Validation of the Peak-Margin Heuristic p (h) The peak-margin formula Lpeak = E[P ] + Ctotal Pmax c 1/γ (cf. p Eq. (3)) maps the DP-sanitised matrix to a provisioning margin. Because 1/γ theoretically grows unbounded as γ → 0, we validate the formula against empirical 99th-percentile hardware physical draws and evaluate its statistical stability near the γmin ≈ 0.10 validity boundary. We fix the dimensionless safety factor to its deployment value c ≈ 0.083 (K = 1, η = 10−3 , N = 1000), held identical across all hardware (see Table 5 for an ablation of grid-provisioning error against c). (Tightening the reliability threshold to a mission-critical η = 10−6 increases c to ≈ 0.117, scaling the orchestration margin proportionally but preserving the structural bound). Evaluating the per-GPU margin (Ctotal = 1), the H100 trace (γreal = 0.13, (H100) Pmax = 700 W, E[P ] = 486.8 W) predicts a peak margin of 648.1 W. The true empirical 99th-percentile draw is 618.4 W, yielding a safe over-estimation error of 4.80% (95% CI: 2.1%–8.5%). Similarly, the A100 trace (γreal = 0.11, (A100) Pmax = 400 W, E[P ] = 281.3 W) predicts 381.5 W against a true 99thpercentile draw of 363.5 W, a 4.95% over-estimation error (95% CI: 2.2%– (L4) 8.8%); the L4 trace (γreal = 0.12, Pmax = 72 W, E[P ] = 52.4 W) predicts 69.7 W against a true draw of 66.3 W, a 5.12% error (95% CI: 2.4%–8.8%). (h) (h) Each prediction respects the physical ceiling Lpeak ≤ Pmax . To confirm statistical stability near the boundary, we bootstrapped the spectral gap estimator 23

γ̂ over 1,000 independentpDP-noised A100 matrix realisationsp(γreal = 0.11, so the point estimate is 1/γreal = 3.02). The scaling term 1/γ̂ remains robust with a 95% confidence interval of 2.71–3.44 bracketing this point estimate, yielding a stable predicted Lpeak of 381.5 W (CI: 371.4–395.6 W). These results confirm that for modern generative AI workloads, the formula serves as a robust, conservative upper bound, over-estimating required capacity by an empirically bounded 4.8–5.1% without catastrophic divergence at the spectral boundary. Table 5: Sensitivity of grid-provisioning error to the safety factor c. Errors are evaluated over 1,000 DP-noised replicates. The deployed c ≈ 0.083 yields 1.3 MW error. Rows at (h) (h) γ < γmin = 0.10 demonstrate the hard ceiling Lpeak ≤ Pmax preventing divergence.

c (at γ = 0.12)

√ c/ γ

MW error (mean ± 95% CI)

∆ from c = 0.083

0.055 0.069 0.083 0.097 0.111

0.158 0.199 0.239 0.280 0.320

0.9 MW (0.8–1.0 MW) 1.1 MW (1.0–1.3 MW) 1.3 MW (1.1–1.5 MW) 1.5 MW (1.3–1.7 MW) 1.7 MW (1.5–1.9 MW)

−0.4 MW −0.2 MW reference +0.2 MW +0.4 MW

Boundary limits at fixed c = 0.083 (ceiling cap activated) 0.083 (at γ = 0.10) 0.083 (at γ = 0.09)

0.262 0.276

1.6 MW (1.6–1.6 MW) 1.7 MW (1.7–1.7 MW)

+0.3 MW +0.4 MW

Remark 2 (Orchestration Error Uniformity). The striking uniformity in over-estimation errors (≈ 5%) across disparate GPU architectures stems mathematically from their shared utilization characteristics rather than parameter tuning. Let load factor u = E[P ]/Pmax . For saturated generative AI workloads, u ≈ 0.70 consistently across the H100 (0.695), A100 (0.703), and L4 (0.728) traces. Substituting E[P ] = uPmax into the marp (h) (h) gin formula yields Lpeak = Pmax (u + c 1/γ). Because the empirical 99thpercentile draw Ptrue also scales proportionally to Pmax for equivalent workloads (let Ptrue = αPmax , where α p≈ 0.9), the relative over-estimation error ϵ = (Lpeak − Ptrue )/Ptrue = (u + c 1/γ − α)/α becomes structurally independent of the hardware’s absolute TDP Pmax . Thus, the formula intrinsically produces uniform relative margins for workload classes exhibiting consistent load factors and spectral gaps. Experimental Limitation (Hardware vs. Framework Conflation). We ex24

plicitly note a limitation regarding the empirical traces: because the collected H100 trace executes JAX (BERT) while the A100 trace executes PyTorch (ResNet), the observed variance in empirical spectral gaps (γreal = 0.13 vs. 0.11) conflates underlying microarchitectural differences with frameworkspecific memory-access and communication scheduling differences. Consequently, the γreal differences cannot be attributed solely to hardware. Isolating the pure microarchitectural effect requires an identical-framework ablation (e.g., PyTorch BERT on H100 versus PyTorch BERT on A100), which we leave to future dedicated profiling. 6.5. Byzantine Robustness Under Active Poisoning We evaluate EnclaveScale against Baseline A (MPC) and Baseline C (SecAgg without TEE) under an active-poisoning adversary. Setup. We evaluate two structurally distinct attack classes. (i) Input Spoofing (First-Mile Poisoning): a Byzantine host OS generates synthetically flattened power traces and feeds them into the extraction pipeline to bias the aggregate grid model downward. (ii) Capacity-inflation Sybil attacks: a Byzantine provider inflates its declared capacity Ci to skew the capacityweighted aggregation. For both, a fraction f ∈ {0.1, 0.2, 0.3, 0.4, 0.5} of the 32 providers is Byzantine. Each Byzantine host targets Lpeak downward bias (under-provisioning the microgrid). We define the attack success rate (ASR) as the fraction of 1,000 trials in which under-provisioning exceeds a critical threshold of τ = 50 MW relative to the plaintext ground truth. Input Spoofing (First-Mile Poisoning). This attack targets the fundamental vulnerability of software-only aggregation schemes: the lack of data provenance. Because MPC (Baseline A) and SecAgg (Baseline C) blindly ingest data from the untrusted host OS, the host can trivially pipe a synthetically generated trace (e.g., all IDLE transitions) into the local extraction pipeline. Once ingested, the cryptographic protocols faithfully protect this poisoned data, leading to “Attested Garbage Out.” Both Baseline A and Baseline C suffer a 100.0% ASR under input spoofing at f = 0.3; this is an expected consequence of the software-only threat model, in which SecAgg is a cryptographic transit protocol, not a hardware-isolation primitive. MP-SPDZ (Baseline A) Direct Measurement. To benchmark Baseline A under realistic constraints, we measured the semi-honest SPDZ-2k protocol (128-bit computational, 40-bit statistical security) directly on the same 32-node GCP multi-region deployment under 150 ms injected RTT, executing 30 independent trials (Table 6). The direct measurement reveals that 25

per-batch latency is dominated by WAN transit (measured 183 ms/batch under a 75 ms one-way WAN delay, reflecting one full round trip plus offline preprocessing and reconstruction compute), and is consequently nearly independent of party count for n ≤ 32 at fixed RTT. Bandwidth scales linearly as (n − 1) share distributions of 25 field elements per batch. The communication figure reported below is the per-node one-way egress (i.e., bytes sent, excluding bytes received), measured via tc byte counters on each node’s outbound interface; the analytical equivalent for 128-bit computational security is (n − 1) × 25 × 8 bytes per batch per node, where the online Open sends only the 8-byte masked ring value per element (the remaining 8 bytes of the 16-byte SPDZ-2k element being the statistical/MAC share settled in offline preprocessing). This equals (n−1)×25×16/2 and gives 363 KB per node per epoch at n = 32, T = 60 batches, in agreement with the measurement. Because our threat model explicitly assumes malicious hosts (§2.4), evaluating a semi-honest baseline alone is insufficient. We therefore include an analytical lower bound for MASCOT, a maliciously secure MPC protocol (Table 6). Upgrading to MASCOT demands heavy oblivious transfer extensions and MAC generation for triple production, typically imposing a 30–100× bandwidth penalty depending on the specific OT-extension implementation [16], and requiring multiple sequential WAN round trips. We conservatively estimate a > 1500 ms per-batch latency and > 18 MB per-epoch egress under our 32-node topology. EnclaveScale provides malicious security via hardware attestation, avoiding this cryptographic circuit complexity entirely while achieving 4.9 ms latency and minimal per-epoch egress (12.5 KB per node, derived as 213 bytes per batch × T =60; where the 213 byte payload comprises a 5 × 5 float32 matrix (100 bytes), Ed25519 signature (64 bytes), SHA-256 hash (32 bytes), batch counter (8 bytes), timestamp (4 bytes), and provider ID (4 bytes) plus 1 byte of framing). More critically, MPC provides no DP privacy guarantees without incurring prohibitive additional overhead, and remains fundamentally vulnerable to pre-ingestion host spoofing. EnclaveScale’s defences against input spoofing operate at two distinct layers with different evaluation footings; we report each separately. (a) Post-extraction attestation layer (experimentally validated on GCP TDX hardware). A malicious host may attempt to bypass the DP noise injection after LSE computation: either by altering the extracted transition matrix in transit or by substituting the LSE binary with a variant that omits noise injection or exports the raw matrix. Both attacks are fully testable on the GCP prototype without requiring bare-metal SPDM 26

Table 6: Performance and security of MPC variants vs. EnclaveScale (32 nodes, 150 ms RTT). Baseline A was benchmarked directly, whereas MASCOT is analytically estimated [16]. Bandwidth is reported as per-node one-way egress per T = 60 epoch. Metric Per-Batch Latency One-way Egress / Node Post-Extract ASR First-Mile ASR (eval.) First-Mile ASR (arch.) †

MP-SPDZ (Semi-Honest)

MASCOT (Malicious)

EnclaveScale

183 ± 24 ms 364 ± 11 KB 0.0% 100.0% 100.0%

> 1500 ms (est.) > 10.9 MB to > 36 MB (est.) 0.0% 100.0% 100.0%

4.9 ± 0.19 ms 12.5 KB 0.0% 100.0%† Prevented

Same as baselines; SPDM responder is spdm-emu (see §6.5).

connectivity. Rather than treating this as a probabilistic security evaluation, we utilize 5,000 fault-injection trials (sweeping Byzantine fraction f ∈ {0.1, 0.2, 0.3, 0.4, 0.5} with 1,000 trials each) to sweep the space of malformed quotes, mismatched MRTDs, fabricated signatures, and tampered matrices; all 5,000 trials were correctly rejected, validating the implementation against the deterministic security argument of §2.4 (the security property itself reduces to EUF-CMA of TDX quoting and SHA-256 collision resistance and is not in question). Byzantine hosts attempted: (i) submitting a matrix bearing a fabricated Ed25519 signature, and (ii) loading a modified LSE binary that transmits the plaintext transition matrix without noise. In case (i), the GAE’s VerifySignature check rejected the submission because the signature is computed inside the TD with the hardware-bound ephemeral key skE . In case (ii), the hardware-generated DCAP quote for the modified binary reflected a mismatched MRTD field, which the GAE rejected at the VerifyChain step. Providing operational evidence that this rejection path fires under realistic conditions, the 72-hour stability run (§6.6) recorded 24 MRTD-mismatch rejections and 67 signature-failure rejections among 2,273 total rejected submissions on live GCP Confidential VMs. (b) Pre-ingestion first-mile layer (architectural sketch, conditional on hardware SPDM responders). The deeper attack class, where a Byzantine host OS intercepts and fabricates telemetry before the SPDM session ingests it, is theoretically prevented by the SPDM protocol and hardware identity binding. Under SPDM 1.2+ coupled with hardware-attested I/O (such as the PCIe IDE and TDISP standards targeted for emerging architectures like Intel Xeon 6), the accelerator’s Root of Trust is designed to present a hardware-burned X.509 identity certificate. In this intended architectural model, the host OS acts only as a blind ciphertext router for the encrypted SPDM session and 27

cannot forge AEAD session MACs without the hardware’s private key. Any spoofing attempt theoretically causes AEAD MAC verification to fail inside the LSE memory region, triggering immediate batch invalidation. However, current-generation GCP C3 instances expose TDX but explicitly lack TDX Connect. Because the evaluation prototype replaces the hardware SPDM responder with the DMTF reference spdm-emu responder [6] running over a vsock transport on the same host, an attacker controlling the host OS can trivially extract the emulator’s keys and spoof the telemetry. Therefore, on the evaluated hardware, EnclaveScale suffers the exact same 100.0% first-mile ASR as the software baselines. The first-mile defense is strictly an architectural design sketch; its real-world efficacy remains contingent upon the unforgeability of hardware-backed responder keys and the flawless implementation of these emerging I/O standards, which we identify as necessary follow-on experimental work. Capacity Inflation Sybil Attacks. Separately, if declared server capacities Ci remain unverified, Byzantine providers can artificially inflate their capacity claims to dominate the capacity-weighted aggregation. Table 7 demonstrates the catastrophic impact of unverified capacity claims on federated baselines. The Table sweeps the per-Sybil capacity multiplier while holding the Byzantine fraction at f = 0.1 to isolate the effect of multiplier magnitude; at the higher f = 0.3 setting referenced previously in the input spoofing evaluation, the naive (uncapped) SecAgg baseline at the 1,000× multiplier yields an ASR of > 99.9%. Under PKI-registry capacity caps (an assumption we acknowledge as weaker than full attestation against a malicious operator), EnclaveScale caps the capacity multiplier at the hardcoded registry limit, suppressing the Sybil ASR to 0.0% at both f = 0.1 and f = 0.3. We emphasise that this result is a conditional PKI enforcement property, achievable by any architecture enforcing registry limits. A malicious provider might also attempt hardware-type spoofing (e.g., claiming A100 capacity while operating lower-power L4s to reduce noise contribution). Because the SPDM hardware identity explicitly binds to the physical Root of Trust certificate, cross-architecture spoofing is cryptographically prevented at the ingestion layer, rendering this attack computationally infeasible. EnclaveScale’s ultimate mitigation against unbounded Sybil attacks lies in hardware-rooted capacity attestation (§8).

28

Table 7: Baseline Sybil Amplification vs. Attack Success Rate (f = 0.1)

Sybil Capacity Multiplier

SecAgg / MPC ASR 11.1% 52.6% 91.7% 99.1%

1× 10× 100× 1000×

6.6. Sensitivity and Operational Robustness Discretisation granularity (|S|). Sweeping |S| ∈ {3, 4, 5, 7, 10} at fixed (ε, δ) = (1, 10−6 ) and W = 10 s, orchestration error is minimised at |S| = 5 (1.3 MW), with both finer and coarser granularities degrading utility (1.4 MW at |S| = 3; 1.33 MW at |S| = 4; 1.7 MW at |S| = 7; 2.2 MW at |S| = 10). The non-monotonicity reflects the trade-off between abstraction fidelity and noise-floor scaling: at |S| = 10, 100 cells are independently noised, raising the aggregate noise norm despite finer state resolution. The sparse transition structure of H100 and A100 training workloads (concentrated in the top two states) confirms |S| = 5 as the production default. This across-the-board reduction in absolute MW error, despite the higher baseline power E[P ], is primarily driven by the retention of high-frequency self-loops, which restores the physically accurate, highly concentrated stationary distribution and dramatically increases the signal-to-noise ratio against the Analytic Gaussian noise floor. Temporal block size (k). The pooling window k governs the temporal resolution and neutralizes boundary-straddling attacks (§3.3). Sweeping k ∈ {5, 10, 20} at fixed W = 10 s reveals a stark trade-off. At k = 5 (0.5 s blocks), the higher temporal resolution artificially inflates the boundarystraddling attack surface; a simulated malicious host oscillating the clock at 2 Hz successfully inflates the apparent spectral gap γ, increasing dynamic orchestration error to 1.9 MW due to induced under-provisioning. Conversely, at k = 20 (2.0 s blocks), over-pooling severely degrades temporal resolution, destroying genuine micro-transients and artificially depressing γ, which drives the over-provisioning error to 2.4 MW. The k = 10 (1.0 s) configuration physically absorbs high-frequency clock oscillations while preserving sufficient macroscopic state transitions, isolating the 1.3 MW optimal error. Noise-suppression threshold (p). The statistical threshold p = 0.95 (where τnoise = Φ−1 (p)σ) is chosen to aggressively suppress spurious transitions. 29

Sweeping p ∈ {0.90, 0.95, 0.99} at ε = 1, the orchestration error is 1.6 MW at p = 0.90, 1.3 MW at p = 0.95, and 1.5 MW at p = 0.99. We select p = 0.95 as the empirical optimum, balancing the retention of genuine lowfrequency transitions against the structural distortion caused by surviving noise artifacts. Batch window (W ). Sweeping W ∈ {1, 5, 10, 30, 60} s at (ε, δ) = (1, 10−6 ), the joint-optimal point is W = 10 s: 1.3 MW utility error at 0.23 µs/sample amortised attestation cost. Without epoch rotation, the 24-hour cumulative budget grows to εtotal ≈ 357.7, so EnclaveScale rotates cryptographic epochs every 10 minutes (T = 60 batches), bounding the per-epoch privacy loss to εepoch ≈ 11.3. Stability and TCB-Recovery Handling. The W = 10 s optimum was validated via 1,000 Monte Carlo replicates (§6.3); the 72-hour stability run uses W = 30 s to reduce cloud egress costs, providing a conservative upper bound on the W = 10 s result. Across the 72-hour stability run, we recorded uninterrupted sustained ingestion at the target rate. The deployment processed 276,480 attested submissions (≈ 120 /LSE/hour across 32 LSEs). Because (h) the DP margin Lpeak depends strictly on the 10-minute epoch boundary and the total privacy budget, increasing the batch window to 30 s at a fixed epoch budget mathematically decreases the required per-batch noise, ensuring the 1.3 MW orchestration error validated at the joint-optimal W = 10 s remains a strictly preserved, conservative upper bound for this run. Of the 276,480 submissions, 2,273 were rejected by the GAE: 24 for MRTD mismatch, 67 for signature failure, 2,048 for replay-window violation (2,036 of these were concentrated in the 8-hour artificial-jitter injection phase of the scalability experiment, §6.2; only 12 violations occurred during the remaining 64 hours of native-latency operation. This confirms the exact 20 s freshness window, which is strictly enforced via hardware monotonic counters rather than hostclock TTLs to prevent hypervisor snapshot rollback (§8), is well-calibrated. These 12 violations over ≈ 245,760 native-latency submissions establish a rigorous 0.0048% upper bound on replay-window false positives over GCP’s multi-region network), and 134 for stale-TCB membership outside the configured grace period. These 134 stale-TCB rejections were not artificially injected; rather, they resulted from an organic, unannounced GCP host-level microcode patch rolled out sequentially across our us-central1 cluster between hours 42 and 46 of the run. Because the GAE enforces a strict 1-hour grace period for TCB updates (to balance availability against zero-day expo30

sure), the unpatched instances were correctly rejected once the grace period expired. Despite these rejections, zero providers experienced service interruption. Automated Failover Mechanism. The failover executes autonomously without operator intervention. The GAE rejection is returned as a synchronous TLS STALE_TCB error code during the batch submission. Because the ephemeral keypair and SPDM session map are mathematically bound to the enclave measurement, they cannot be exported or migrated. Instead, upon receiving the rejection, the primary LSE signals the local facility router to redirect the raw telemetry stream to a pre-provisioned secondary LSE held in warm standby (OS booted, enclave initialized) in a fully patched region. The secondary LSE immediately establishes a fresh SPDM session with the accelerator and generates a new DCAP Quote. Because the cold-start DCAP quote generation requires 81.2 ms and the SPDM handshake requires < 20 ms, the entire recovery sequence completes in ≈ 100 ms, easily finishing within the current 10-second batch window to prevent structural data loss. This successfully demonstrates EnclaveScale’s cross-region resilience to uncoordinated cloud infrastructure events. 7. Related Work Confidential Federated Analytics on TEEs. Prior work isolates federated computation inside hardware enclaves ([17], [18]). EnclaveScale diverges in three respects: it targets streaming telemetry via temporal-batch attestation rather than periodic-round ML; it operates at TDX VM granularity, sidestepping SGX EPC paging limits; and it guarantees the integrity of a counting query rather than an iterative training loop. Streaming and Continual Differential Privacy. Streaming frameworks provide theoretical utility bounds for continuous data release [19, 20, 21]. EnclaveScale adopts the Rényi-DP accountant [12] for sequential √ composition, utilizing a strict closed-form ℓ2 -sensitivity bound (∆2 (f ) = 6) over transition matrices to retain practical utility at ε = 1 over multi-hour deployments. Local DP and the Shuffle Model. The shuffle model [22, 23] amplifies local guarantees via a trusted shuffler. EnclaveScale operates as a hybrid: the LSE applies local DP inside a hardware-attested boundary, explicitly positioning the GAE as an attested replacement for a mixnet shuffler, and replacing trust amplification with cryptographic attestation. 31

MPC and Secure Aggregation. MPC frameworks [2, 24] provide hardware-independent cryptographic data protection. However, applying MPC to raw streams incurs prohibitive circuit complexity to verify SPDM AES-GCM MACs. Applying MPC or SecAgg [3] to condensed matrices sacrifices pre-sharing execution integrity against fabricated inputs (§6.5). EnclaveScale relies on hardware enclaves to terminate the SPDM session securely and amortises the bandwidth cost via temporal-batch attestation. Data-Centre Power Telemetry. Generative AI has catalyzed research into grid-level impacts [25], gross carbon footprint [26, 4], and active power stabilization [27]. While frameworks like PowerAPI [28] expose sub-second telemetry, they operate as plaintext tools for single-operator profiling. Concurrent work by Vercellino et al. [1] establishes the 0.1-second-resolution requirement driving EnclaveScale’s design, but relies on a trusted, singleoperator environment. EnclaveScale provides the cryptographic execution integrity and DP mechanisms required to aggregate 10-Hz transients across untrusted, multi-tenant boundaries. 8. Discussion and Limitations Legacy Hardware Compatibility (SPDM Adoption): Legacy infrastructure lacking SPDM 1.2+ hardware responders cannot participate securely; EnclaveScale degrades to an honest-but-curious threat model equivalent to software LDP on these devices. Counter Rollback and State Persistence: While the GAE persists its session counter map to a sealed virtual disk to prevent offline tampering, this software-only mechanism on an isolated disk theoretically remains vulnerable to hypervisor snapshot-rollback attacks. However, EnclaveScale mitigates this threat entirely by integrating the attested time-sync protocol (Roughtime) described in Section 4.1. This integration neutralizes the snapshotrollback vulnerability: any restored snapshot will inevitably present an expired Roughtime token to the GAE, causing the batch to be unconditionally rejected. Production deployments can thus achieve absolute cryptographic freshness without requiring hardware vTPM non-volatile counters. DP Composition Exhaustion and Pan-Privacy: Under Rényi-DP, cumulative privacy loss increases monotonically. Infinite-horizon telemetry theoretically requires Pan-Privacy [19]; however, true Pan-Privacy demands atomic, DP-noised state checkpoints at the hardware instruction level, which current

32

TDX architectures lack, leaving LSE memory vulnerable to side-channel extraction prior to noise injection. Hardware-Rooted Inventory Attestation (NVIDIA RIM): The current implementation mitigates Sybil capacity-inflation via a trusted PKI registry capping Ci . Defending against unbounded Sybil behavior requires integrating hardware-rooted inventory attestation (e.g., NVIDIA RIM [29]). Future iterations could bind Ci to SPDM GET_MEASUREMENTS requests issued directly to PCIe-attached GPUs, injecting this verified capacity into the TDX REPORTDATA field. 9. Conclusion EnclaveScale provides a hardware-assisted framework for aggregating highly sensitive generative AI power telemetry. By migrating feature extraction and differential privacy noise injection to the provider’s edge via Intel TDX Confidential VMs, EnclaveScale resolves the dichotomy between cryptographic communication bottlenecks and centralized trust, and characterises a hardware-dependent resolution for the first-mile data provenance gap. Our 32-node multi-region implementation, validated against real H100, A100, and L4 power traces, sustains 10-Hz telemetry streams, amortises DCAP attestation overheads through temporal batching, and bounds the WAN footprint strictly below traditional MPC thresholds. The empirically validated 1.3 MW dynamic orchestration error (at εepoch ≈ 11.3 across a 200 MW facility) confirms that data center operators can securely model high-frequency power transients and dynamically orchestrate facility microgrids while empirically obscuring proprietary workload schedules under heterogeneous co-tenancy. Future work will benchmark the end-to-end attestation pipeline natively on emerging hardware bridging PCIe TDISP and IDE with accelerator Root of Trusts. Declaration of generative AI and AI-assisted technologies in the manuscript preparation process During the preparation of this work the authors used Google Gemini in order to assist with copy-editing, proofreading, and verifying the technical accuracy of hardware specifications. After using this tool/service, the authors reviewed and edited the content as needed and take full responsibility for the content of the published article. 33

Data and Code Availability Empirical data supporting the findings of this study are presented within the manuscript’s tables, figures, and text. The EnclaveScale post-extraction pipeline, including the Rust enclave implementation, differential privacy mechanisms, and GCP deployment orchestration scripts, is available at https: //github.com/dkhme/ENCLAVE_SCALE. The repository serves as a minimal reproducible artifact for empirical evaluation. References [1] R. Vercellino, J. Willard, G. Campos, W. d. S. Pereira, O. Hull, M. Selensky, J. Mueller, Measurement of generative ai workload power profiles for whole-facility data center infrastructure planning (2026). doi:10.48550/ARXIV.2604.07345. URL https://arxiv.org/abs/2604.07345 [2] M. Keller, MP-SPDZ: A versatile framework for multi-party computation, in: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, pp. 1575–1590. [3] K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, K. Seth, Practical secure aggregation for privacy-preserving machine learning, in: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1175–1191. [4] D. A. P. 0001, J. G. 0001, Q. V. Le, C. Liang, L.-M. Munguia, D. Rothchild, D. R. So, M. Texier, J. Dean, Carbon emissions and large neural network training., CoRR (2021). [5] Intel, Intel trust domain extensions (TDX), Tech. rep., Intel Corporation (2023). URL https://www.intel.com/content/www/us/en/developer/ articles/technical/intel-trust-domain-extensions.html [6] Distributed Management Task Force (DMTF), Security protocol and data model (spdm) specification, version 1.2.1 (dsp0274), Tech. rep. (2023). URL https://www.dmtf.org/dsp/DSP0274 34

[7] B. Balle, Y.-X. W. 0003, Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising., ICML (2018). [8] C. Dwork, Differential privacy: A survey of results, Theory and Applications of Models of Computation (2008) 1–19. [9] D. Paulin, Concentration inequalities for markov chains by martingale methods, Electronic Journal of Probability 20 (2015) 1–32. [10] Intel Corporation, Intel trust domain extensions (Intel TDX) module advisory, Tech. Rep. INTEL-SA-00837, Intel Security Center (2024). URL https://www.intel.com/content/www/us/en/ security-center/advisory/intel-sa-00837.html [11] Intel Corporation, Frequency throttling side channel guidance, Intel Security Advisory INTEL-SA-00698; software guidance for mitigating frequency-based timing side channels on Sapphire Rapids and later. (2022). URL https://www.intel.com/content/ www/us/en/developer/articles/technical/ frequency-throttling-side-channel-guidance.html [12] I. Mironov, Rényi differential privacy, in: IEEE 30th Computer Security Foundations Symposium (CSF), 2017, pp. 263–275. [13] Y.-X. Wang, B. Balle, S. P. Kasiviswanathan, Subsampled rényi differential privacy and analytical moments accountant, in: The 22nd International Conference on Artificial Intelligence and Statistics, 2019. [14] P. Kairouz, H. B. McMahan, et al., Advances and open problems in federated learning, Foundations and Trends in Machine Learning 14 (1– 2) (2021) 1–210. [15] T. Steinke, M. Nasr, M. Jagielski, Privacy auditing with one (1) training run, in: Advances in Neural Information Processing Systems 36, NeurIPS 2023, Neural Information Processing Systems Foundation, Inc. (NeurIPS), 2023, p. 49268–49280. doi:10.52202/075280-2143. URL http://dx.doi.org/10.52202/075280-2143

35

[16] M. Keller, E. Orsini, P. Scholl, Mascot: bounding vulnerabilities and errors in secure computation, in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 830– 841. [17] F. Mo, H. Haddadi, K. Katevas, E. Marin, D. Perino, N. Kourtellis, PPFL: Privacy-preserving federated learning with trusted execution environments, in: Proceedings of the 19th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys), 2021. [18] C. Zhang, J. Xia, B. Yang, H. Puyang, W. Wang, R. Chen, I. E. Akkus, P. Aditya, F. Yan, Citadel: Protecting data privacy and model confidentiality for collaborative learning, in: Proceedings of the ACM Symposium on Cloud Computing, SoCC ’21, ACM, 2021, p. 546–561. doi:10.1145/3472883.3486998. URL http://dx.doi.org/10.1145/3472883.3486998 [19] C. Dwork, M. Naor, T. Pitassi, G. N. Rothblum, Differential privacy under continual observation, in: Proceedings of the 42nd ACM Symposium on Theory of Computing (STOC), 2010, pp. 715–724. [20] T.-H. H. Chan, E. Shi, D. Song, Private and continual release of statistics, in: Proceedings of the 37th International Colloquium on Automata, Languages, and Programming (ICALP), 2010, pp. 405–417. [21] R. Cummings, V. Feldman, A. McMillan, K. Talwar, Mean estimation with user-level privacy under data heterogeneity, in: Advances in Neural Information Processing Systems (NeurIPS), 2022. [22] A. Cheu, A. Smith, J. Ullman, D. Zeber, M. Zhilyaev, Distributed differential privacy via shuffling, in: Annual International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT), 2019, pp. 375–403. [23] Ú. Erlingsson, V. Feldman, I. Mironov, A. Raghunathan, K. Talwar, A. Thakurta, Amplification by shuffling: From local to central differential privacy via anonymity, in: Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), 2019, pp. 2468–2479.

36

[24] I. Damgård, V. Pastro, N. Smart, S. Zakarias, Multiparty computation from somewhat homomorphic encryption, in: Annual Cryptology Conference (CRYPTO), 2012, pp. 643–662. [25] Y. Sheng, C. Zhang, Z. Zhu, H. Xu, J. Wen, R. Wang, J. Yang, Q. Wang, S. Bu, Power for ai data centers: Energy demand, grid impacts, challenges and perspectives, Energies 19 (3) (2026) 722. doi: 10.3390/en19030722. URL http://dx.doi.org/10.3390/en19030722 [26] J. Dodge, T. Prewitt, R. Tachet des Combes, E. Odmark, R. Schwartz, E. Strubell, A. S. Luccioni, N. A. Smith, N. DeCario, W. Buchanan, Measuring the carbon intensity of AI in cloud instances, Proceedings of the ACM Conference on Fairness, Accountability, and Transparency (FAccT) (2022). [27] E. Choukse, B. Warrier, S. Heath, L. Belmont, A. Zhao, H. A. Khan, B. Harry, M. Kappel, R. J. Hewett, K. Datta, Y. Pei, C. Lichtenberger, J. Siegler, D. Lukofsky, Z. Kahn, G. Sahota, A. Sullivan, C. Frederick, H. Thai, R. Naughton, D. Jurnove, J. Harp, R. Carper, N. Mahalingam, S. Varkala, A. G. Kumbhare, S. Desai, V. Ramamurthy, P. Gottumukkala, G. Bhatia, K. Wildstone, L. Olariu, I. Incorvaia, A. Wetmore, P. Ram, M. Raghuraman, M. Ayna, M. Kendrick, R. Bianchini, A. Hurst, R. Zamani, X. Li, M. Petrov, G. Oden, R. Carmichael, T. Li, A. Gupta, P. Patel, N. Dattani, L. Marwong, R. Nertney, H. Kobayashi, J. Liott, M. Enev, D. Ramakrishnan, I. Buck, J. Alben, Power stabilization for ai training datacenters (2025). doi:10.48550/ ARXIV.2508.14318. URL https://arxiv.org/abs/2508.14318 [28] A. Bourdon, A. Noureddine, R. Rouvoy, L. Seinturier, A preliminary study of the impact of software engineering on GreenIT, in: First International Workshop on Green and Sustainable Software (GREENS), 2012. [29] NVIDIA, NVIDIA GPU remote attestation and Reference Integrity Manifest (RIM) architecture, Tech. rep., NVIDIA Corporation (2024). URL https://docs.nvidia.com/nvtrust/ reference-integrity-manifest/ 37