Cove - Compositional and Verifiable Confidential Workflows

The talk starts from a multi-party computation problem: several parties hold secrets, such as a private prompt, a proprietary model, or an auditor's benchmark data, and want a joint result without revealing them. Trusted execution environments can stand in for a neutral third party, but remote attestation only proves which code is running, not what that code does. Private code therefore leaves a trust gap, and the speakers argue that it can be closed by attesting a separate audit of that code inside its own enclave.

The speakers then introduce Cove, which describes a workflow as a graph of enclave nodes with declared artifacts, owners, and dependencies. Owners release their secrets only after reviewing and approving that exact workflow. Downstream nodes can require upstream certificates as preconditions before they run, and the chain can be checked by anyone holding the workflow and the vendor's attestation roots. Examples include confidential inference, bilateral benchmarks of AI models, and auditing the auditor, with a public or open-weight model as the stopping point.

To measure cost, the team ran the framework on Intel TDX through Phala Cloud's dstack. Reported overhead was about 1.1 times for CPU-bound compilation, about 2.1 times for attested GPU inference during a benchmark, and about 1.16 to 1.33 times for a 120-billion-parameter model under load. The main takeaway is that a small set of reusable primitives can replace bespoke enclave protocols.