LGT4CG: Lightweight GPU-TEE for cloud GPUs

GPU Trusted Execution Environments (GPU-TEEs) protect GPU-accelerated AI applications from untrusted system software. Existing GPU-TEEs can be categorized into Type-I and Type-II designs. Type-I GPU-TEEs execute AI applications and the full-featured AI runtime inside the TEE, enlarging the trusted computing base (TCB). Type-II GPU-TEEs reduce the TCB by moving applications and complex runtimes outside the TEE and verifying execution via pre-recorded metadata. Existing lightweight Type-II designs target integrated GPUs, leaving cloud discrete GPUs (dGPUs) unprotected. We propose LGT4CG, a lightweight GPU-TEE for dGPUs. It includes GPU Shield, which secures CPU–GPU interactions, and Task Monitor, which verifies execution against metadata. We implement a prototype on ARM with NVIDIA RTX 3090. The runtime TCB consists of only about 6K lines of C code. On DNNs, LGT4CG adds an average overhead of 4.16% for inference and 0.34% for training. On LLMs, the average overhead is 7.10% for TTFT and 6.05% for output throughput.