Two-Way Confidential VMs (2cVM): Collaborative Confidential Computing for Mutually Distrustful Parties

• URL: http://arxiv.org/abs/2606.10615v2
• Date: Wed, 10 Jun 2026 10:38:15 GMT
• Title: Two-Way Confidential VMs (2cVM): Collaborative Confidential Computing for Mutually Distrustful Parties
• Abstract summary: Cryptographic approaches such as fully homomorphic encryption and secure multi-party computation provide strong confidentiality.<n>We present the Two-Way Confidential Virtual Machine (2cVM), a two-layer architecture that pairs a hardware trusted execution environment with an intra-workload isolation layer.<n>Unlike regular Confidential Virtual Machines, 2cVM enforces mutual isolation between co-resident workloads, ensuring that participants retain control over their data and code.
• Score: 2.617654879276715
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Collaborative computation across organizations is often constrained by the need to process sensitive data and proprietary code without exposing them to untrusted infrastructure or participants. Cryptographic approaches such as fully homomorphic encryption and secure multi-party computation provide strong confidentiality but remain impractical for general workloads due to their extreme computational cost. We present the Two-Way Confidential Virtual Machine (2cVM), a two-layer architecture that pairs a hardware trusted execution environment with an intra-workload isolation layer. Unlike regular Confidential Virtual Machines, 2cVM enforces mutual isolation between co-resident workloads, ensuring that participants retain control over their data and code. All computation in 2cVM is governed by a Commitment Manifest that enumerates participants, component composition, permitted data channels, and authorized outputs; the manifest is locked to the VM and incorporated into attestation evidence, making the policy immutable and independently verifiable throughout the VM's lifetime. A proof-of-concept realization combines AMD SEV-SNP for hardware protection with the WebAssembly Component Model for fine-grained sandboxing of participant code. Evaluation on commodity hardware across four benchmark classes shows that the two isolation layers do not accumulate linearly: once a workload executes inside the WebAssembly sandbox, the marginal cost of enabling hardware memory protection is small. Overhead is workload-dependent, governed primarily by memory access pattern, ranging from negligible for sequential workloads to approximately 2x for irregular, pointer-chasing access patterns. These results indicate that 2cVM provides a practical and verifiable foundation for privacy-preserving collaborative computation.

Related papers

• DuMateBench: Evaluating Autonomous Agents in Complex Real-World Workflows [69.12339622053588]
  We introduce DuMateBench, a real-session benchmark reconstructed from anonymized and privacy-screened user sessions.<n>The resulting benchmark comprises 200 tasks spanning 8 broad scenarios and 17 fine-grained capability categories.<n>We execute these tasks in isolated Docker containers injected with three forms of real-world environmental complexity: Insufficient, Unstable, and Noisy.
  arXiv  Detail & Related papers  (2026-08-27T02:36:23Z)
• Secure and Parallel Determinant Computation for Large-Scale Matrices in Edge Environments [0.0]
  Matrix Determinant Computation is critical for applications in control systems, cryptography, and machine learning.<n>Traditional determinant algorithms make them unsuitable for real-time processing in constrained edge scenarios.<n>We propose a Secure Parallel Determinant Computation (SPDC) framework, which provides strong security guaranties.
  arXiv  Detail & Related papers  (2026-05-21T06:23:17Z)
• Robust Promptable Video Object Segmentation [67.1533741758339]
  This paper offers the first comprehensive study on robust PVOS (RobustPVOS)<n>We first construct a new, comprehensive benchmark with two real-world evaluation datasets of 351 video clips and more than 2,500 object masks.<n>We present a new RobustPVOS method, dubbed Memory-object-conditioned Gated-rank Adaptation (MoGA)
  arXiv  Detail & Related papers  (2026-05-12T11:55:31Z)
• Beyond Short-Horizon: VQ-Memory for Robust Long-Horizon Manipulation in Non-Markovian Simulation Benchmarks [96.60530830276281]
  RuleSafe is a new articulated manipulation benchmark built upon a scalable LLM-aided simulation framework.<n>VQ-Memory is a compact and structured temporal representation that uses vector-quantized variational autoencoders.
  arXiv  Detail & Related papers  (2026-03-10T11:13:54Z)
• Confidential, Attestable, and Efficient Inter-CVM Communication with Arm CCA [5.737719088870378]
  Confidential Virtual Machines (CVMs) are increasingly adopted to protect sensitive workloads from privileged adversaries.<n>Existing CVM architectures lack first-class mechanisms for inter-CVM data sharing.<n>We introduce CAEC, a system that enables protected memory sharing between CVMs.
  arXiv  Detail & Related papers  (2025-12-01T12:10:43Z)
• EVA-S2PMLP: Secure and Scalable Two-Party MLP via Spatial Transformation [0.0]
  This paper presents textbfEVA-S2PMLP, an Efficient, Verifiable, and Accurate Secure Two-Party Multi-Layer Perceptron framework.<n> EVA-S2PMLP achieves high inference accuracy and significantly reduced communication overhead, with up to $12.3times$ improvement over baselines.<n>It is a practical solution for privacy-preserving neural network training in finance, healthcare, and cross-organizational AI applications.
  arXiv  Detail & Related papers  (2025-06-18T03:18:35Z)
• NanoZone: Scalable, Efficient, and Secure Memory Protection for Arm CCA [4.597444093276292]
  Arm Confidential Computing Architecture (CCA) currently isolates at the granularity of an entire Confidential Virtual Machine (CVM)<n>We extend CCA with a three-tier zone model that spawns an unlimited number of lightweight isolation domains inside a single process.<n>To block domain-switch abuse, we also add a fast user-level Code-Pointer Integrity (CPI) mechanism.
  arXiv  Detail & Related papers  (2025-06-08T07:55:48Z)
• PC-MoE: Memory-Efficient and Privacy-Preserving Collaborative Training for Mixture-of-Experts LLMs [56.04036826558497]
  We introduce Privacy-preserving Collaborative Mixture-of-Experts (PC-MoE)<n>By design, PC-MoE synergistically combines the strengths of distributed computation with strong confidentiality assurances.<n>It almost matches (and sometimes exceeds) the performance and convergence rate of a fully centralized model, enjoys near 70% peak GPU RAM reduction, while being fully robust against reconstruction attacks.
  arXiv  Detail & Related papers  (2025-06-03T15:00:18Z)
• Privacy preserving layer partitioning for Deep Neural Network models [0.21470800327528838]
  Trusted Execution Environments (TEEs) can introduce significant performance overhead due to additional layers of encryption, decryption, security and integrity checks. We introduce layer partitioning technique and offloading computations to GPU. We conduct experiments to demonstrate the effectiveness of our approach in protecting against input reconstruction attacks developed using trained conditional Generative Adversarial Network(c-GAN)
  arXiv  Detail & Related papers  (2024-04-11T02:39:48Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)
• L2MAC: Large Language Model Automatic Computer for Extensive Code Generation [52.81694565226513]
  Transformer-based large language models (LLMs) are constrained by the fixed context window of the underlying transformer architecture.<n>This paper presents L2MAC, the first practical LLM-based general-purpose stored-program automatic computer (von Neumann architecture) framework, for long and consistent output generation.
  arXiv  Detail & Related papers  (2023-10-02T16:55:19Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.