cavendish
QueueExperimentsScorecard
Type 4Question

Confidential inference on a TEE for banking PII

TEE and Secure Inference
  1. proposed
  2. voting
  3. running · 59d
  4. measuring
  5. concluded

Preregistration · v1 · 22 Jun 2026 · immutable after start

An extension creates a new version rather than editing the old.

Hypothesis

A mid-size open-weight model served inside a GPU TEE in an AU region delivers under 1.4× the latency and under 1.6× the cost of the same model outside the enclave, with attestation a bank's security team accepts as evidence that plaintext PII never left the enclave.

Kill condition

Kill if latency exceeds 2× outside-enclave by day 20, if attestation cannot be verified end-to-end from the client side, or if the bank's security team declines the attestation model in the design review.

MethodSame model, same eval traffic, inside and outside an AU-region GPU TEE. Client-like data: a bank-provided synthetic-but-realistic PII set under a data-handling agreement, which is what makes this Type 4. Measure latency, cost, and walk the bank's security team through the attestation chain. Governance sign-off obtained 2026-06-30.
Expected cost$6,000 in enclave GPU hours, two people part-time for four months
Expected duration4 months

Running notes · fed from harness sessions and by the pair

AW
manual · Adam Witanowski · 3 Sep 2026· ⌘↩ to post
  1. manual20 Aug 2026LF Lena Fischer

    Walked the bank's security team through attestation. Accepted in principle; they want the verifier to be independent of the cloud provider. That is a tooling gap, not a kill.

  2. harness24 Jul 2026PR Priya Raman

    enclave serving; attestation chain verified client-side; latency 1.28x; cost 1.7x on current pricing

  3. manual22 Jun 2026PR Priya Raman

    Type 4: client-like data under agreement; governance signed 30 June. Commercial rationale: two banking RFPs name confidential inference. Predicted 1.3× latency, 1.5× cost, attestation accepted with conditions, confidence 0.45.

Harness notes are auto-captured from Claude Code sessions: model, date, commit, session reference. Never the transcript, code or paths.

Artifacts

repotee-serve (enclave deployment + client verifier)repo
measLatency and cost inside vs outside the enclavemeasurement