TEE coprocessors for decentralized AI
Joined March 2018
- Tweets2.1K
- Following346
- Followers51.7K
- Likes2.2K
Pinned Tweet
Wondering how to secure your AI agent within a TEE? We’ve got you covered!
Check out our latest post by @roshanrags @0xkrane @PrateekReddyy @0xlinguine:
Securing TEE Apps: A Developer's Guide
Securing TEE Apps: A Developer's Guide
In this post, @roshanrags, @PrateekReddyy, @0xlinguine and @0xkrane explore the features that have made TEEs popular for crypto x AI, discuss security concerns and lay out some practical solutions to build TEE applications
The security rules come built in. Operators list who’s allowed into the control panel, and everyone else is kept out. A long checklist is now a single command.
See how it works: github.com/marlinprotocol/ma…
Marlin retweeted
v0.3.0 is live on Solana devnet.
A bank statement goes into a hardware enclave on @MarlinProtocol Oyster. A signed income tier comes out, lands on Solana as an attestation, and a lending pool reads it to decide how much you can borrow.
The bank statement never leaves the enclave. On-chain: tier, policy hash, statement date range.
What shipped:
• Oracle program: checks the enclave's secp256k1 signature via Solana's precompile, writes a Solana Attestation Service record
• Enclave registry: on-chain list of approved enclave builds; restart = new key, old one revoked
• Demo lending pool: borrow limit set by tier (tier A can borrow more than B; REJECT gets nothing)
• Reproducible enclave image: rebuild it, compare the image id with the one registered on-chain
Data comes from a sandbox bank + aggregator, built to India's Account Aggregator spec.
Real attestation tx:
explorer.solana.com/tx/45yYt…
Release + verify steps:
github.com/pandaa880/tee-inc…
Update: v0.2.0: the enclave can now score.
Same pipeline, 4 simulated borrowers, 4 different answers:
• Steady salary → A
• Trader with lumpy income → B
• Income dropped in the last 3 months → C
• Bounced EMIs + 178 days in overdraft → REJECT
The bank statement never leaves the enclave. On-chain: just the tier, the policy hash and the statement's date range.
How it decides (inside the enclave, in Rust):
→ parses the ReBIT bank statement
→ classifies transactions: income, loan EMIs, bounces, overdraft
→ measures FOIR (share of income going to EMIs), income stability, and the last 3 months against the full history
→ applies the lender's policy. Its hash goes into the signed result, so anyone can see which rules produced the tier
→ a REJECT produces nothing to sign
The default policy is a transparent heuristic, not a trained model. Lenders can bring their own.
github.com/pandaa880/tee-inc…
That timing is the point. By the time two enclaves are exchanging anything real, the question of what each one is has already been asked and answered.
A channel exists because the evidence held, not because anyone extended benefit of the doubt.
The rules for all of this are not tucked away in a service somewhere. They are written into the Marlin SDK, in the open, where anyone can read how a proof is made and how it is judged.
github.com/marlinprotocol/ma…
Genuine TEE or not? The Marlin Hub UI tells you in seconds.
Paste a hex-encoded Oyster attestation, click Verify, and it checks the document structure and traces the certificate chain back to a trusted hardware root.
Don't trust, verify: hub.marlin.org/oyster/attest…
No TPM or certificate expertise required, just declared expectations and a single call. The whole check is open to inspect.
Here's the implementation:
github.com/marlinprotocol/ma…
Scallop is what sits underneath this. Open-source, part of the Oyster SDK.
github.com/marlinprotocol/ma…