Luis Carranza

Oversubscribing One TEE: 512 Registered Tenants, a 1.22× Gain, and Isolation at 0.54 Percent

One confidential GPU serves a limited number of concurrent tenants. This reportmeasures what happens when registration exceeds that number: idle tenants'key-separated KV state is parked to disk and revived on activation, on an AzureH100 confidential instance with SEV-SNP active a...

Oversubscribing One TEE: 512 Registered Tenants, a 1.22× Gain, and Isolation at 0.54 Percent

One confidential GPU serves a limited number of concurrent tenants. This reportmeasures what happens when registration exceeds that number: idle tenants'key-separated KV state is parked to disk and revived on activation, on an AzureH100 confidential instance with SEV-SNP active a...

The Isometry Tax: At-Rest Leakage in Rotation-Isolated Multi-Tenant Vector Search as an Instance of Property-Preserving-Encryption Leakage, with Bounds on Its Mitigations

Multi-tenant vector indexes promise large cost savings by sharing one approximate-nearestneighbour structure across many tenants. Per-tenant orthonormal rotation is an appealing way to isolate those tenants: each tenant's vectors are rotated under a per-tenant key, within-tenant...

Isolation Through Orthonormal Rotation Holds

Per-tenant orthonormal rotation applied to attention K-vectors provides cryptographic isolation between tenants sharing a single language model instance. Within a tenant, rotation is an isometry — retrieval quality is preserved exactly. Across tenants, a wrong-key query returns c...

Isolation Through Orthonormal Rotation Holds

Per-tenant orthonormal rotation applied to attention K-vectors provides cryptographic isolation between tenants sharing a single language model instance. Within a tenant, rotation is an isometry — retrieval quality is preserved exactly. Across tenants, a wrong-key query returns c...