Oversubscribing One TEE: 512 Registered Tenants, a 1.22× Gain, and Isolation at 0.54 Percent

Abstract

One confidential GPU serves a limited number of concurrent tenants. This reportmeasures what happens when registration exceeds that number: idle tenants'key-separated KV state is parked to disk and revived on activation, on an AzureH100 confidential instance with SEV-SNP active and confidential compute attestedat boot. At an activation period of 400 seconds, 512 registered tenants sustaina 2.00 s p95 time-to-first-token on revived requests, bound by page-cacheresidency. The honest gain over a no-parking baseline on the same harness is1.22×, and at busy periods parking loses capacity rather than gaining it. Version 4 corrects version 3, deposited at 10.5281/zenodo.22118806. Theno-parking baseline is 420, not 360, so the gain is 1.22×, not 1.42×. Version3's ladder stepped 360 to 440 and reported its last passing rung as the ceiling;a rerun at 20-tenant granularity finds 380, 400 and 420 all passing at0.937-0.939 s, with the breach a cliff at 440 rather than a slope. Thecorrection was found by re-measuring rather than by external report, it isunfavourable, and its direction was foreseeable: a coarse ladder can onlyunderstate a baseline, so the ratio could only fall. Section 8.6 carries therung table and the same-boot reproduction. Four interventions attempted to raise the gain — five generic codecs, fp8 KVquantisation, a 4× longer activation period, and a 3.4× smaller GPU KV arena.None raised it; two lowered it. The gain is structurally bounded by the ratio ofhost RAM to GPU KV arena. What does not shrink under correction is the isolation result. A 64-blockknown-byte canary was byte-identical in every cell of every arm to 768registered tenants, rotated and unrotated; per-tenant rotation costs 0.54 percentof revival time; and a companion arc shows the same isolation surviving theengine's native preemption, recompute and eviction on the installed extensionover stock vLLM. At these workloads the product is not the tenant count, whichthe hardware largely gives away, but the demonstrated safety of selling thatcount to tenants who do not trust each other. Every measurement was preregistered (P151–P219). Six corrections that movedheadline figures are reported with their magnitudes, the largest a factor of six.