Confidential Computing for Double-Blind AI Model Evaluation
This article explores a novel system architecture for double-blind AI model evaluation, utilizing confidential computing to ensure neither the model provider nor the evaluator gains unauthorized access to the other's proprietary data (model weights vs. test questions). It details how Google DeepMind leverages Google Cloud Confidential Space, NVIDIA Confidential GPUs, and Intel TDX for secure execution in a trusted execution environment (TEE). The system highlights an architectural pattern for maintaining data privacy and integrity in sensitive AI contexts, addressing challenges like benchmark leakage and establishing trust in AI performance claims.
Read original on The New StackThe Challenge of Trust in AI Model Evaluation
Evaluating advanced AI models, especially proprietary frontier-class models, presents a significant challenge: preventing "benchmark leakage." This occurs when models are inadvertently, or intentionally, exposed to test data during training or fine-tuning, leading to inflated performance scores. Traditional evaluation methods often require model providers to expose their model weights to evaluators or evaluators to run tests through a provider's API, giving the provider access to private benchmarks. This dilemma creates a trust gap and compromises the integrity of evaluations.
Confidential Computing: A Double-Blind Architecture
Google DeepMind's approach addresses this by employing confidential computing to create a double-blind evaluation environment. This architectural pattern ensures that both the model weights and the test questions remain private during the evaluation process. The core idea is to execute the evaluation within a Trusted Execution Environment (TEE), where neither party can access the other's confidential assets.
- Model Provider (Google DeepMind): Provides Gemini model weights and inference code.
- Evaluator (MLCommons, Singapore AI Safety Institute): Provides benchmark prompts and evaluation code.
- Confidential Enclave (Google Cloud Confidential Space): A TEE where the evaluation runs securely.
Enclave Architecture and Data Flow
The pilot system uses Google Cloud Confidential Space, NVIDIA H100 Confidential GPU, and Intel TDX host memory encryption. Both the model weights and evaluation prompts are transmitted over encrypted connections into this enclave. Inside the enclave, model weights are stored in hardware-encrypted GPU memory, and prompts are kept in encrypted host memory. The evaluation executes, and only permitted results are returned to the evaluator, after which the temporary environment is destroyed.
Remote Attestation for Trust
Before any private data is sent, remote attestation verifies that the confidential enclave is running the software agreed upon by both parties. This cryptographic verification step is crucial for establishing initial trust in the TEE's integrity.
Code Controls Beyond Encryption
While memory encryption protects data at rest and in use, the code running inside the enclave also requires control. OpenMined's PySyft is used to allow both Google and the evaluator to approve the evaluation code in advance and to block sensitive parts from making external network connections. This prevents potential data exfiltration even within the trusted environment.
Scalability and Future Considerations
The current pilot runs on a single H100 GPU, but researchers are exploring scaling to clusters of H100 and B200 GPUs connected via encrypted links to handle larger models. The article emphasizes that while this system significantly reduces the need for direct trust between parties, it doesn't eliminate it entirely, as trust is shifted to the underlying hardware and cloud provider. Legal agreements and rigorous code reviews also remain significant hurdles in practical adoption, highlighting that system design for trust extends beyond purely technical solutions.