Phala Cloud Documentation — Private AI on TEE

Confidential responses carry typed claims about the upstream that served the request, including TCB (Trusted Computing Base) freshness. Claims appear in the attested session referenced by the receipt’s upstream.verified.session_id; the canonical receipt event does not embed the full claim set. A claim is not just a boolean. It has a status, a source, and often a reason.

{
  "tee_attested": {
    "status": "asserted",
    "source": "hardware_proven",
    "reason": "verified TEE quote and bound request channel"
  }
}

Claim Status

Status	Meaning
`asserted`	Evidence backs this claim.
`refuted`	Evidence contradicts this claim, such as a stale TCB.
`unknown`	The verifier did not establish this claim. Treat it as not proven.

Claim Source

Source	Assurance
`hardware_proven`	Comes from verified TEE quote or collateral.
`verifier_derived`	Computed by the verifier from checked evidence.
`provider_asserted`	Published by the provider, not independently proven.
`operator_asserted`	Declared by the gateway operator.

Common Claims

Claim	Meaning
`tee_attested`	An attested TEE identity is bound to the channel, directly or through the measured proxy; inspect `source`.
`tcb_up_to_date`	The platform Trusted Computing Base is current.
`os_known_good`	The OS or platform image maps to reviewed source or known measurements.
`serving_software_known_good`	Serving software maps to reviewed source or build provenance.
`gpu_attested`	NVIDIA confidential-computing GPU evidence was verified and nonce-bound.
`model_weights_provenance`	Model weights and quantization match a reviewed provenance chain.

Privatemode reports tee_attested: asserted with source: verifier_derived under verifier privatemode-proxy/co-deployed-contrast/v1. It relies on the measured co-deployed proxy and its Contrast-attested secret path, rather than a provider quote verified directly by the gateway. Its other common claims are unknown.

TCB Freshness

tcb_up_to_date is intentionally tri-state:

Up-to-date evidence asserts the claim.
Stale evidence refutes the claim and records the stale status.
Missing evidence leaves the claim unknown.

Your verifier policy decides whether a refuted TCB is acceptable. The receipt’s job is to expose the fact.

GPU Attestation

gpu_attested proves a confidential-computing GPU attestation was verified for the provider’s evidence. It does not by itself prove model weights, serving software, or CPU-to-GPU binding for every provider. Read it as supplemental evidence unless your policy says otherwise.

Suggested Policy

For direct hardware proof, require tee_attested: asserted from hardware_proven. This policy excludes Privatemode’s verifier_derived sessions.
Require upstream.verified.result = verified and required = true for sensitive prompts.
Treat unknown as not proven.
Decide whether to reject tcb_up_to_date: refuted.
Use serving_software_known_good and gpu_attested to increase assurance when available.

Private AI

TCB and Claims

Claim Status

Claim Source

Common Claims

TCB Freshness

GPU Attestation

Suggested Policy

Providers

Get Session

​Claim Status

​Claim Source

​Common Claims

​TCB Freshness

​GPU Attestation

​Suggested Policy

​Related

Providers

Get Session

Claim Status

Claim Source

Common Claims

TCB Freshness

GPU Attestation

Suggested Policy

Related