# trusted execution environment (TEE) *Entry of the [Dictionary of Applied Machine Learning](https://dictionaryofml.org) (course edition), by Alexander Jung, Aalto University. CC BY 4.0. Updated 2026-11-08. [HTML](https://dictionaryofml.org/terms/tee.html) · [typeset PDF](https://dictionaryofml.org/terms/tee.pdf) · [LaTeX](https://dictionaryofml.org/terms/tee.tex) · [Python demo](https://dictionaryofml.org/terms/tee.py) · [notebook](https://dictionaryofml.org/terms/tee.ipynb)* Math is LaTeX with the book's macros expanded, so no notation package is needed to read it. ## Abstract A trusted execution environment (TEE) is a part of a computing system that isolates code and data from other software. Even the operating system cannot directly read or alter its protected memory. Remote attestation can prove to another party which code it runs. Processor features such as Arm TrustZone and Intel SGX provide TEEs on ordinary chips. In machine learning, a TEE protects input feature vectors, learned model parameters and the integrity of the computed prediction. It does not limit what the prediction reveals; differential privacy addresses that problem. Physical and software side channels require additional countermeasures. Compared with fully homomorphic encryption, a TEE runs at near-native speed but replaces a mathematical guarantee with trust in the chip vendor and its hardware. ## Definition Consider an embedded controller in a refrigerated medicine cabinet. Each minute, it reads a temperature sensor and forms a feature vector ${\mathbf x}$ from the current temperature and its recent changes. A learned hypothesis computes the prediction $\widehat{h}({\mathbf x})$ of whether the cooling system is failing. The controller sits in a sealed metal box with no network cable and no radio. Its only inputs are the sensor cable and the power cable, and its only output is an alarm display. The model parameters $\widehat{{\mathbf w}}$ of $\widehat{h}$ and the recorded temperature readings never leave the box. A TEE is the part of the processor that provides the logical isolation. Software outside it cannot directly read or alter its protected code and memory, even if that software is a privileged operating system (Sabt et al., 2015). The metal enclosure is not the TEE; it is a separate layer that protects the processor against physical probing and fault injection. Most TEEs are a mode of an ordinary processor. Arm TrustZone splits the processor of the controller into two parts. The normal world runs the display software. The secure world runs the prediction code and holds $\widehat{{\mathbf w}}$ and the temperature readings. The normal world cannot read the memory of the secure world even with root privileges (Pinto and Santos, 2019). Intel SGX provides similar isolation for an enclave inside a process on a server (Costan and Devadas, 2016). Remote attestation lets a client verify a signed digest of the enclave's code before it sends any data. The isolation guarantee concerns direct access through software and memory interfaces; information revealed by outputs, side channels and physical attacks requires additional protection. Fig. 1 shows the embedded controller and what each part can see. ![Figure 1 of the entry tee](https://dictionaryofml.org/terms/fig/tee-fig1.svg) *Figure 1: A TEE in an embedded temperature-monitoring controller. The secure world (the TEE) holds the prediction code, the model parameters and the recorded temperature readings; the normal world receives only the prediction for the alarm display. Separately, the sealed enclosure reduces the physical side channels available to a probe outside the processor* A TEE protects three assets of a machine learning system. The first is the data: the temperature history is an operational record that the cabinet operator must not disclose or allow an attacker to alter. The second is the learned hypothesis. Its model parameters $\widehat{{\mathbf w}}$ are the outcome of training on a costly dataset. An attack that reads them out obtains the hypothesis without the dataset. The third is the integrity of the prediction: nobody can alter the code so that it suppresses an alarm when the cooling system is failing. A TEE does not protect what the prediction reveals. A membership inference attack that only observes predictions is unaffected by it, and differential privacy addresses that part. A TEE also does not, by itself, protect against physical side channels. The processor's current and electromagnetic field depend on the data it processes. A probe held near the chip can recover secret keys from these traces (Kocher et al., 1999). The same probe recovers the model parameters and the layer structure of an artificial neural network running on an embedded processor, one multiplication at a time (Batina et al., 2019). A short electromagnetic pulse or a glitch on the supply voltage can also skip an instruction, e.g., the check that rejects unsigned code (Bar-El et al., 2006). The metal enclosure attenuates the emitted field and blocks the pulse. Tamper sensors erase $\widehat{{\mathbf w}}$ when the box is opened. Constant-time code makes the power trace independent of the data. However, server TEEs are also exposed to software and processor-level side channels. The operating system can see the memory access pattern of an enclave. Therefore, machine learning code inside an enclave must be data-oblivious. Its access patterns must not depend on the data (Ohrimenko et al., 2016). Speculative execution has also leaked enclave memory outright (Van Bulck et al., 2018). Two uses of TEEs beyond the sealed box are prediction in the cloud and federated learning. A hospital that rents a server can require an SGX enclave. It first uses attestation to verify the agreed prediction code. It then encrypts its feature vectors for the enclave, so the cloud provider never sees them (Ohrimenko et al., 2016). In federated learning, a server enclave can provide a hardware-based implementation of secure aggregation. Clients encrypt their model parameters updates for the enclave. It decrypts and sums the updates, while the server operator sees only the sum. Separately, the TrustZone secure world of each phone can protect its local update before transmission; a system can use either protection or combine both (Mo et al., 2021). A TEE, fully homomorphic encryption and differential privacy provide different guarantees by different means. Fully homomorphic encryption hides the data during computation without trusting the processor, at a cost of orders of magnitude in time and memory. A TEE obtains near-native speed by trusting the chip vendor, the hardware implementation and the countermeasures against side channels. Differential privacy bounds what the released prediction reveals about any single data point (Dwork and Roth, 2014, Def. 2.4) and can be combined with either. **Synonyms:** secure enclave. **See also:** fully homomorphic encryption, secure aggregation, differential privacy, privacy protection, privacy attack, [membership inference attack](https://dictionaryofml.org/terms/membershipinferenceattack.html), attack, federated learning, edge device, cloud computing, machine learning system, [trustworthy artificial intelligence](https://dictionaryofml.org/terms/trustAI.html). ## References - Sabt et al. (2015). Trusted Execution Environment: What It is, and What It is Not. *Proc. IEEE Trustcom/BigDataSE/ISPA*. - Pinto and Santos (2019). Demystifying Arm TrustZone: A Comprehensive Survey. *ACM Computing Surveys*. - Costan and Devadas (2016). Intel SGX Explained. - Kocher et al. (1999). Differential Power Analysis. *Advances in Cryptology -- CRYPTO '99*. - Batina et al. (2019). CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel. *Proc. 28th USENIX Security Symposium*. - Bar-El et al. (2006). The Sorcerer's Apprentice Guide to Fault Attacks. *Proceedings of the IEEE*. - Ohrimenko et al. (2016). Oblivious Multi-Party Machine Learning on Trusted Processors. *Proc. 25th USENIX Security Symposium*. - Van Bulck et al. (2018). Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution. *Proc. 27th USENIX Security Symposium*. - Mo et al. (2021). PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments. *Proc. 19th Annual Int. Conf. Mobile Systems, Applications, and Services (MobiSys)*. - Dwork and Roth (2014). The Algorithmic Foundations of Differential Privacy. *Foundations and Trends\textregistered in Theoretical Computer Science*. ## Cite this entry ```bibtex @misc{dictml_tee, author = {Jung, Alexander}, editor = {Olioumtsevits, Konstantina and Schnoor, Ekkehard}, title = {trusted execution environment (TEE)}, howpublished = {Dictionary of Applied Machine Learning (course edition)}, year = {2026}, doi = {10.5281/zenodo.21569296}, note = {ISBN 978-952-64-3013-3, CC BY 4.0, retrieved 2026-11-11}, url = {https://dictionaryofml.org/terms/tee.html} } ```