Phd Position F - M Trusted Virtualization Architectures For Confidential ai H/F - INRIA

A propos d'Inria Inria est l'institut national de recherche dédié aux sciences et technologies du numérique. Il emploie 2600 personnes. Ses 215 équipes-projets agiles, en général communes avec des partenaires académiques, impliquent plus de 3900 scientifiques pour relever les défis du numérique, souvent à l'interface d'autres disciplines. L'institut fait appel à de nombreux talents dans plus d'une quarantaine de métiers différents. 900 personnels d'appui à la recherche et à l'innovation contribuent à faire émerger et grandir des projets scientifiques ou entrepreneuriaux qui impactent le monde. Inria travaille avec de nombreuses entreprises et a accompagné la création de plus de 200 start-up. L'institut s'eorce ainsi de répondre aux enjeux de la transformation numérique de la science, de la société et de l'économie.
PhD Position F/M Trusted Virtualization Architectures for Confidential AI
Le descriptif de l'offre ci-dessous est en Anglais
Type de contrat : CDD

Niveau de diplôme exigé : Bac +5 ou équivalent

Fonction : Doctorant

A propos du centre ou de la direction fonctionnelle

The Inria Rennes - Bretagne Atlantique Centre is one of Inria's eight centres and has more than thirty research teams. The Inria Center is a major and recognized player in the field of digital sciences. It is at the heart of a rich R&D and innovation ecosystem: highly innovative PMEs, large industrial groups, competitiveness clusters, research and higher education players, laboratories of excellence, technological research institute, etc.

Contexte et atouts du poste

Research Environment

This PhD thesis will be funded by the CUPSELI Inria Challenge (Défi Inria).

The CUPSELI Challenge brings together 11 Inria project teams across six Inria research centres, together with Hivenet, a startup company based in Cannes.

Hivenet develops an original storage architecture in which data is stored securely and in a distributed manner using participants' spare storage capacity within a peer-to-peer infrastructure. This architecture is designed to provide scalability, resilience, and controlled data sharing among users. It also aims to reduce the environmental footprint of cloud infrastructure by making use of existing computing and storage resources rather than relying exclusively on the construction of new data centres.

The collaboration between Hivenet and Inria will investigate how to support large-scale computation on top of the Hivenet infrastructure. This objective is particularly relevant for applications that can be distributed across interconnected computing resources despite network performance being significantly lower than in conventional high-performance computing environments. While tightly coupled numerical simulations may not be suitable for this infrastructure, workloads such as model fine-tuning and, potentially, the distributed training of large machine-learning models fall within the scope of the challenge.

The PhD student will be hosted by the WIDE team in Rennes and jointly supervised by researchers from WIDE and members of Hivenet in Cannes.

About WIDE

The WIDE team at the Inria Centre at Rennes University investigates fundamental and practical questions raised by modern distributed computer systems. Its research explores the tension between scalability and coordination guarantees and develops new techniques and abstractions adapted to the rapid evolution of distributed systems, both in terms of their application domains and the operational constraints under which they must function.

About Hivenet

Hivenet is developing a decentralized and environmentally conscious alternative to conventional cloud computing by making use of otherwise idle computing and storage capacity. Its platform relies on distributed peer-to-peer networks, end-to-end encryption, and blockchain-based mechanisms, with the objective of building a more sovereign, efficient, and user-controlled cloud ecosystem.

Meetings and Travel

The project will involve regular meetings with researchers from the participating Inria teams and with colleagues at Hivenet. Most meetings will be held online, although occasional travel to Paris and Cannes is expected.

The PhD student will also have opportunities to attend international conferences and workshops to present and discuss the results of their research.

Mission confiée

This PhD thesis will investigate how server-side confidential-computing technologies can be used to secure training and inference in decentralized machine-learning systems.

Processing distributed data, whether for inference or for training a shared model, offers the prospect of more privacy-preserving forms of machine learning. Rather than relying on a small number of service providers that collect and centralize user data, decentralized approaches can allow data to remain on user devices or distributed storage nodes. However, decentralization does not in itself guarantee privacy or security: in a distributed environment, any participating node may be compromised or behave maliciously.

Against this background, the integration of confidential computing into artificial-intelligence systems is becoming increasingly important, particularly as AI is increasingly used to process sensitive data in domains such as healthcare, finance, and defence. Retrieval-Augmented Generation (RAG) systems, which combine information retrieval with generative models such as large language models (LLMs), are now widely used for applications including document analysis, conversational assistants, and recommendation systems. These systems are commonly deployed in cloud environments, where they may be exposed to risks such as data leakage, intellectual-property theft, malicious infrastructure operators, and model tampering.

Recent hardware technologies such as Intel Trust Domain Extensions (TDX) and AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) provide promising foundations for securing such workloads. They make it possible to isolate virtual machines, models, and data within trusted execution environments (TEEs), even when the underlying cloud infrastructure is not fully trusted. These mechanisms protect data while it is being processed and provide cryptographic attestation mechanisms that can be used to verify the identity and integrity of the execution environment [2,3].

The PhD student will build on the WIDE team's expertise in operating systems, hypervisors, trusted execution environments [4], and decentralized machine learning [5,6]. The central objective will be to design new virtualization mechanisms and a trusted Virtual Machine Monitor (VMM) for confidential AI workloads, with RAG systems serving as a principal use case.

The thesis will primarily make systems contributions at the intersection of operating systems, virtualization, distributed systems, and hardware-assisted security. It will involve the design, implementation, and experimental evaluation of low-level mechanisms. The implementation work will require strong low-level programming skills, particularly in C or C++, and may also involve Rust depending on the selected system components and research directions. Although the work targets AI workloads, its main scientific and technical focus is not the design of machine-learning models, but the construction of secure and efficient systems infrastructure for their execution.

A first challenge is to provide strong security guarantees while preserving compatibility with existing guest operating systems and application stacks. The VMM should offer services such as isolation, attestation, secure resource management, and controlled communication without requiring invasive changes to the guest operating system or forcing applications to be aware of the underlying confidential-computing mechanisms. Achieving such transparency is essential for practical deployment, but raises significant questions regarding the trusted computing base, the placement of security mechanisms, and the trade-offs between transparency, performance, and assurance.

A second challenge arises from the heterogeneity of the available infrastructure. Not all participating servers will support confidential-computing technologies, and some may be untrusted or incompatible with technologies such as TDX or SEV-SNP. The thesis will therefore investigate hybrid architectures that combine trusted and untrusted computing resources.

A naive distribution of an AI workload across heterogeneous nodes could expose sensitive data, intermediate representations, model parameters, or computation results to malicious participants. The thesis will explore mechanisms for partitioning data and computation between protected and unprotected environments. This may involve splitting models, data, or execution stages so that sensitive components remain confined to trusted nodes, while less sensitive computation is delegated to untrusted resources.

The resulting system will need to determine which components must execute within trusted environments, how protected and unprotected nodes can cooperate securely, and which security guarantees can be maintained under different threat models. Particular attention will be paid to low-level VMM and systems-software design, secure communication between execution domains, attestation, memory and resource management, and the performance and scalability of the resulting architecture. The work will therefore require substantial implementation effort, including low-level programming, debugging, performance analysis, and experimentation on modern virtualization and confidential-computing platforms.

Principales activités

The PhD student will work on the design and implementation of a trusted Virtual Machine Monitor (VMM) for confidential AI workloads.

The following high-level work plan is envisioned. It may be adjusted as the research progresses and new results emerge.

Months 0-3: The PhD student will conduct a thorough review of the state of the art in confidential computing, virtualization, trusted execution environments, and machine-learning workloads. This phase will also include familiarization with the relevant hardware platforms, software stacks, and experimental infrastructure.

Months 4-12: The student will investigate new mechanisms to address the first research challenge identified above: enabling the VMM to provide security services transparently to the guest operating system. This work will focus in particular on isolation, attestation, communication, and resource-management mechanisms that exploit confidential-computing hardware while minimizing changes to existing guest systems.

Months 13-24: The student will explore hybrid architectures that combine confidential-computing-enabled devices with untrusted or incompatible resources. This phase will involve defining suitable threat models and designing mechanisms for partitioning data and computation across trusted and untrusted execution environments.

Months 25-30: The student will integrate the results of the previous phases into a scalable and reusable VMM architecture. The resulting prototype will be evaluated on representative machine-learning workloads, including Retrieval-Augmented Generation (RAG) systems, with particular attention to security, performance, and scalability.

Months 31-36: The final phase will focus on consolidating the research results, completing the remaining experiments, finalizing publications, and writing and defending the PhD dissertation.

Compétences

Excellent programming skills are essential, including solid experience with low-level systems programming, preferably in C or C++. Experience with Rust would also be valuable. The candidate should be willing to learn and work with new technologies and techniques in areas such as confidential computing, virtualization, trusted execution environments, and machine learning. Strong written and oral communication skills are also required, together with the ability to formulate, present, and discuss new ideas and to work effectively in a collaborative research environment.

Avantages

- Subsidized meals
- Partial reimbursement of public transport costs
- Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.)
- Possibility of teleworking (after 6 months of employment)
- Social, cultural and sports events and activities
- Access to vocational training

Rémunération

2 300€ per month