A Survey of Published Attacks on Intel SGX
Not on the map. Why?
Abstract (arXiv)
Intel Software Guard Extensions (SGX) provides a trusted execution environment (TEE) to run code and operate sensitive data. SGX provides runtime hardware protection where both code and data are protected even if other code components are malicious. However, recently many attacks targeting SGX have been identified and introduced that can thwart the hardware defence provided by SGX. In this paper we present a survey of all attacks specifically targeting Intel SGX that are known to the authors, to date. We categorized the attacks based on their implementation details into 7 different categories. We also look into the available defence mechanisms against identified attacks and categorize the available types of mitigations for each presented attack.
Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). First posted on arXiv 24 Jun 2020.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2022: 2; 2023: 2; 2024: 2; 2025: 3; 2026: 1.
10 papers.
- 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
- 2024Optimistic Verifiable Training by Controlling Hardware Nondeterminismcited by 7
- 2022Network Shuffling: Privacy Amplification via Random Walkscited by 6
- 2022OLIVE: Oblivious Federated Learning on Trusted Execution Environment against the risk of sparsificationcited by 4
- 2024TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Modelscited by 3
- 2025Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channelscited by 2
- 2025On Model Protection in Federated Learning against Eavesdropping Attackscited by 2
- 2023Scalable and Privacy-Preserving Synthetic Data Generation on Decentralised Webcited by 0
- 2025Provably Secure Retrieval-Augmented Generationcited by 0
- 2026Privacy-Preserving Iris Recognition: Performance Challenges and Outlookcited by 0
- 2026Privacy-Preserving Iris Recognition: Performance Challenges and Outlook27 Mar 2026
- 2025Provably Secure Retrieval-Augmented Generation1 Aug 2025
- 2025On Model Protection in Federated Learning against Eavesdropping Attacks2 Apr 2025
- 2025Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channels24 Mar 2025
- 2024TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Models15 Nov 2024
- 2024Optimistic Verifiable Training by Controlling Hardware Nondeterminism14 Mar 2024
- 2023Scalable and Privacy-Preserving Synthetic Data Generation on Decentralised Web30 Oct 2023
- 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML11 Oct 2023
- 2022Network Shuffling: Privacy Amplification via Random Walks8 Apr 2022
- 2022OLIVE: Oblivious Federated Learning on Trusted Execution Environment against the risk of sparsification15 Feb 2022