Comment by amluto

1. I don’t believe that these secure enclaves are very secure. Intel has had plenty of SGX breaks. AMD has had plenty of SEV breaks. Everyone is outrageously vulnerable to side channels.

2. The models are writing the inference stacks, which are what’s inside the supposedly secure environments.