The board costs less than $200. It slides in between a server's processor and its memory, and while the machine hums along, it quietly throws away some of the writes headed to RAM. The encrypted data sitting in memory stays encrypted. It also stays old. And because the processor never checks whether the ciphertext it reads back is the latest version, the stale data decrypts perfectly and the workload carries on computing with values an attacker chose to freeze in place.
That attack, disclosed in September 2026 and named DDRop by a team drawn from KU Leuven, ETH Zurich, Durham University and Google, is the sharpest recent reminder of an awkward truth in cloud security. The industry has spent five years building enclaves that even a cloud provider cannot peek into, and wrapping them in a new language of proof. The cryptography mostly works. The leaks have moved to the seams — the cache, the memory bus, the gap between what encryption promises and what it never claimed to promise.
Proof without the secret
Start with the idea in this article's name. A zero-knowledge proof lets one party prove a statement is true without revealing the information behind it. Prove you are over 18 without showing a birth date. Prove a credential is genuine without handing over the credential.
This is no longer a whiteboard concept. Google has built zero-knowledge proof technology into Google Wallet, so a phone can confirm its owner's age for an app or website with, as the company puts it, no way to link the age back to the person's identity. The dating app Bumble is among the partners using it, and Google has open-sourced its ZKP library — the Longfellow implementation — for other wallets and services. The European Union's Digital Identity Wallet programme has written zero-knowledge presentations into its technical specification, with wallet implementations already integrating the scheme, because European regulators want citizens to prove attributes without broadcasting their documents to every verifier.
The same instinct is spreading to computation itself. Work catalogued in current AI-verification standards describes cryptographic inference proofs — ZKML — that can establish a specific model processed specific data, without exposing either. Small teams such as Modulus Labs, Ritual and Giza have built businesses on that question: did you get the model you paid for? For a bank running fraud models on rented infrastructure, or a ministry running analytics it cannot show the operator, that is not an academic question.
Proof, in other words, is becoming the product. Which is exactly why the hardware underneath it matters so much.
The sovereign tenant problem
Cloud computing has always had a trust hole in the middle. Encryption protects data on disk and data on the wire. But data being processed sits exposed in memory, readable in principle by the platform's own software and the people who run it. For a retailer, that risk is a line in a contract. For a government — a tax authority, a health service, a central bank — it can be a legal barrier to using the cloud at all.
Confidential computing, the term the Confidential Computing Consortium settled on, attacks that hole with hardware. A Trusted Execution Environment, or TEE, is an isolated region enforced by the processor itself — Intel's TDX and SGX, AMD's SEV-SNP. Data is decrypted only inside the enclave. The host operating system, the hypervisor, the BIOS and the cloud provider's own administrators sit outside the trusted computing base and get no visibility into the workload. Microsoft's training material for its sovereignty cloud puts it bluntly: even the platform provider cannot access the enclave, because it does not hold the keys. Its listed use cases are a regulator's shopping list — anti-money-laundering, fraud prevention, adverse drug event detection.
It also unlocks a use case no legal department would previously sign off. Rival banks can pool transaction data inside a shared enclave to hunt money-laundering patterns that none of them could spot alone — the data stays encrypted in use, each contributor's records stay sealed from the others, and only the agreed analysis runs. Microsoft lists collaborative computing of exactly this kind among the framework's core scenarios, alongside regulatory compliance and cloud migration for organisations that had been too nervous to move sensitive workloads at all. The enclave becomes a neutral room: nobody owns the walls, everybody can audit the locks.
The multi-tenant part is where it gets delicate. A sovereign enclave does not get a building to itself. It shares silicon with strangers — other tenants on the same host, separated by encryption and access control rather than by walls. Before any secret is released into an enclave, an attestation step asks the hardware to produce a cryptographic report that the environment is genuine, unmodified and running the expected code. Only then do the keys move. It is the zero-knowledge instinct again, applied to machines: don't trust the operator's assurance, verify the platform's proof. The same attestation thinking shows up across the industry, from the hardening of critical infrastructure that state-sponsored attackers keep probing to the defence in depth of enterprise ransomware defence, where immutable and air-gapped copies carry the day.
The leak was never through the door
Side channels are the weak point. A side-channel attack does not read memory. It infers secrets from the side effects of computation — which cache lines got touched, how long an operation took, how the memory bus behaved. On shared hardware, a hostile tenant does not need to break the enclave's encryption if it can watch the enclave work and reconstruct what it is doing.
The research record is humbling. ÆPIC Leak (CVE-2022-21233) could read enclave memory on unpatched Intel systems and is fixed by microcode updates — which means tenants are safe exactly as long as their provider patches promptly. Cache attacks of the Prime+Probe family let one workload spy on another through shared cache sets. And then there is the physical end of the spectrum. TEE.fail, an earlier interposer attack, listened passively to DDR5 memory traffic. DDRop went further: it is, its authors say, the first active interposer attack on DDR5 and the first to break the integrity of a fully updated Intel TDX system rather than merely read from it. By dropping page-table writes, the researchers took full control of protected virtual machines and even forged attestation — the very proof the whole model leans on. AMD's SEV-SNP was affected too, though the impact there was more limited.
The researchers, for their part, published the attack's design and code. Nothing about DDRop requires exotic equipment or a nation-state's budget — an interposer built for under $200, a few minutes of access, and a target running some of the most widely deployed confidential computing silicon on the market.
Intel and AMD both responded that the attack sits outside their threat models, because it needs an adversary who already controls the server's software and can get brief physical access to it. That is a fair point and an incomplete comfort. Sovereign cloud, almost by definition, is sold to customers who worry about insiders and compelled access — the people with the keys to the cage. A threat model that waves away physical access is a weaker sell in that market, and the researchers' parting observation stings: there is no simple software patch, because the gap is in the hardware design. Memory encryption, as shipped today, guarantees confidentiality of content. It does not guarantee freshness.
What survives the $200 board
None of this kills the enclave model. It disciplines it. The defensive playbook that has emerged from a decade of leaks is unglamorous and specific: apply microcode and TEE security patches the day they land; partition the last-level cache between tenants — Intel's Cache Allocation Technology and AMD's equivalent quality-of-service controls directly blunt Prime+Probe by keeping one tenant's cache sets away from another's; write secret-handling code in constant time so its behaviour does not vary with the data; and for the most sensitive workloads, skip the shared host entirely and run on physically dedicated machines, where co-tenant channels simply do not exist.
Architecture choices help too. VM-level environments such as TDX and SEV-SNP present a smaller, sturdier target than the older application-level enclave designs, which is one reason providers have been steering customers that way. And the monitoring side of the shared-host problem keeps improving: visibility that reaches into the kernel itself, through lightweight eBPF probes that watch every system call, gives defenders a view of what co-tenants are doing without breaking the isolation the enclave promises.
The honest summary for any government or bank signing a sovereign cloud contract in 2026 goes like this. Enclaves genuinely remove the operator from the trust equation, and attestation genuinely proves what is running. Zero-knowledge techniques genuinely let people and systems prove facts without surrendering the underlying data. But "genuinely" has footnotes: a freshness gap in memory encryption, a cache shared with strangers, a patch cycle measured in someone else's sprint. The vendors know it. The researchers with the $200 board have made sure everyone else knows it too.
Zero-knowledge techniques are escaping the blockchain niche they grew up in. The same proof machinery is being aimed at machine learning itself, where the tenant's data and the provider's model both stay hidden. Both fields share a deadline set by hardware progress — and by the patience of adversaries who treat today's stored data as tomorrow's prize, the subject of state-level espionage campaigns built on harvest-now, decrypt-later collection. Proof is becoming the product. The hardware underneath it is, at last, getting the same scrutiny as the mathematics on top.
Sources
- Microsoft Learn — confidential computing and sovereignty cloud training material
- SC Media — confidential computing and enclave security coverage
- EU Digital Identity Wallet technical specification — zero-knowledge presentations (GitHub)
- CX Today — zero-knowledge proof and digital identity coverage
