# Attestation Mechanisms for Trusted Execution Environments Demystified

arXiv: https://arxiv.org/abs/2206.03780 · HTML: https://mlsanity.com/paper/2206.03780/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Jun 2022.

## Built on by (most cited first, 8 of 8)

- [Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents](https://mlsanity.com/paper/2509.13597/) (2025)
- [Atlas: A Framework for ML Lifecycle Provenance & Transparency](https://mlsanity.com/paper/2502.19567/) (2025)
- [AEX: Non-Intrusive Multi-Hop Attestation and Provenance for LLM APIs](https://mlsanity.com/paper/2603.14283/) (2026)
- [Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms](https://mlsanity.com/paper/2605.20704/) (2026)
- [VEDLIoT -- Next generation accelerated AIoT systems and applications](https://mlsanity.com/paper/2305.05388/) (2023)
- [When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling](https://mlsanity.com/paper/2608.17275/) (2026)
- [SpliTEE: Fast and Private LLM Inference by Coupling GPU-Assisted Trusted Execution Environments with Differential Privacy](https://mlsanity.com/paper/2609.15039/) (2026)
- [HXAI: Hierarchical Privacy-Preserving Explainable AI in Distributed Energy Systems](https://mlsanity.com/paper/2610.02504/) (2026)

## Abstract (arXiv)

Attestation is a fundamental building block to establish trust over software systems. When used in conjunction with trusted execution environments, it guarantees the genuineness of the code executed against powerful attackers and threats, paving the way for adoption in several sensitive application domains. This paper reviews remote attestation principles and explains how the modern and industrially well-established trusted execution environments Intel SGX, Arm TrustZone and AMD SEV, as well as emerging RISC-V solutions, leverage these mechanisms.