PhD Position F/M Trusted Virtualization Architectures for Confidential AI

PhD Position F/M Trusted Virtualization Architectures for Confidential AI Download job offer in PDF format Contract type : Fixed-term contract Level of qualifications required : Graduate degree or equivalent Fonction : PhD Position About the research centre or Inria department The Inria Rennes - Bretagne Atlantique Centre is one of Inria's eight centres and has more than thirty research teams. The Inria Center is a major and recognized player in the field of digital sciences. It is at the heart of a rich R&D and innovation ecosystem: highly innovative PMEs, large industrial groups, competitiveness clusters, research and higher education players, laboratories of excellence, technological research institute, etc. Context Research Environment This PhD thesis will be funded by the CUPSELI Inria Challenge (Défi Inria). The CUPSELI Challenge brings together 11 Inria project teams across six Inria research centres, together with Hivenet, a startup company based in Cannes. Hivenet develops an original storage architecture in which data is stored securely and in a distributed manner using participants’ spare storage capacity within a peer-to-peer infrastructure. This architecture is designed to provide scalability, resilience, and controlled data sharing among users. It also aims to reduce the environmental footprint of cloud infrastructure by making use of existing computing and storage resources rather than relying exclusively on the construction of new data centres. The collaboration between Hivenet and Inria will investigate how to support large-scale computation on top of the Hivenet infrastructure. This objective is particularly relevant for applications that can be distributed across interconnected computing resources despite network performance being significantly lower than in conventional high-performance computing environments. While tightly coupled numerical simulations may not be suitable for this infrastructure, workloads such as model fine-tuning and, potentially, the distributed training of large machine-learning models fall within the scope of the challenge. The PhD student will be hosted by the WIDE team in Rennes and jointly supervised by researchers from WIDE and members of Hivenet in Cannes. About WIDE The WIDE team at the Inria Centre at Rennes University investigates fundamental and practical questions raised by modern distributed computer systems. Its research explores the tension between scalability and coordination guarantees and develops new techniques and abstractions adapted to the rapid evolution of distributed systems, both in terms of their application domains and the operational constraints under which they must function. About Hivenet Hivenet is developing a decentralized and environmentally conscious alternative to conventional cloud computing by making use of otherwise idle computing and storage capacity. Its platform relies on distributed peer-to-peer networks, end-to-end encryption, and blockchain-based mechanisms, with the objective of building a more sovereign, efficient, and user-controlled cloud ecosystem. Meetings and Travel The project will involve regular meetings with researchers from the participating Inria teams and with colleagues at Hivenet. Most meetings will be held online, although occasional travel to Paris and Cannes is expected. The PhD student will also have opportunities to attend international conferences and workshops to present and discuss the results of their research. Assignment This PhD thesis will investigate how server-side confidential-computing technologies can be used to secure training and inference in decentralized machine-learning systems. Processing distributed data, whether for inference or for training a shared model, offers the prospect of more privacy-preserving forms of machine learning. Rather than relying on a small number of service providers that collect and centralize user data, decentralized approaches can allow data to remain on user devices or distributed storage nodes. However, decentralization does not in itself guarantee privacy or security: in a distributed environment, any participating node may be compromised or behave maliciously. Against this background, the integration of confidential computing into artificial-intelligence systems is becoming increasingly important, particularly as AI is increasingly used to process sensitive data in domains such as healthcare, finance, and defence. Retrieval-Augmented Generation (RAG) systems, which combine information retrieval with generative models such as large language models (LLMs), are now widely used for applications including document analysis, conversational assistants, and recommendation systems. These systems are commonly deployed in cloud environments, where they may be exposed to risks such as data leakage, intellectual-property theft, malicious infrastructure operators, and model tampering. Recent hardware technologies such as Intel Trust Domain Extensions (TDX) and AMD Secure Encrypted Virtualization–Secure Nested Paging (SEV-SNP) provide promising foundations for securing such workloads. They make it possible to isolate virtual machines, models, and data within trusted execution environments (TEEs), even when the underlying cloud infrastructure is not fully trusted. These mechanisms protect data while it is being processed and provide cryptographic attestation mechanisms that can be used to verify the identity and integrity of the execution environment [2,3]. The PhD student will build on the WIDE team’s expertise in operating systems, hypervisors, trusted execution environments [4], and decentralized machine learning [5,6]. The central objective will be to design new virtualization mechanisms and a trusted Virtual Machine Monitor (VMM) for confidential AI workloads, with RAG systems serving as a principal use case. The thesis will primarily make systems contributions at the intersection of operating systems, virtualization, distributed systems, and hardware-assisted security. It will involve the design, implementation, and experimental evaluation of low-level mechanisms. The implementation work will require strong low-level programming skills, particularly in C or C++, and may also involve Rust depending on the selected system components and research directions. Although the work targets AI workloads, its main scientific and technical focus is not the design of machine-learning models, but the construction of secure and efficient systems infrastructure for their execution. A first challenge is to provide strong security guarantees while preserving compatibility with existing guest operating systems and application stacks. The VMM should offer services such as isolation, attestation, secure resource management, and controlled communication without requiring invasive changes to the guest operating system or forcing applications to be aware of the underlying confidential-computing mechanisms. Achieving such transparency is essential for practical deployment, but raises significant questions regarding the trusted computing base, the placement of security mechanisms, and the trade-offs between transparency, performance, and assurance. A second challenge arises from the heterogeneity of the available infrastructure. Not all participating servers will support confidential-computing technologies, and some may be untrusted or incompatible with technologies such as TDX or SEV-SNP. The thesis will therefore investigate hybrid architectures that combine trusted and untrusted computing resources. A naive distribution of an AI workload across heterogeneous nodes could expose sensitive data, intermediate representations, model parameters, or computation results to malicious participants. The thesis will explore mechanisms for partitioning data and computation between protected and unprotected environments. This may involve splitting models, data, or execution stages so that sensitive components remain confined to trusted nodes, while less sensitive computation is delegated to untrusted resources. The resulting system will need to determine which components must execute within trusted environments, how protected and unprotected nodes can cooperate securely, and which security guarantees can be maintained under different threat models. Particular attention will be paid to low-level VMM and systems-software design, secure communication between execution domains, attestation, memory and resource management, and the performance and scalability of the resulting architecture. The work will therefore require substantial implementation effort, including low-level programming, debugging, performance analysis, and experimentation on modern virtualization and confidential-computing platforms. Main activities The PhD student will work on the design and implementation of a trusted Virtual Machine Monitor (VMM) for confidential AI workloads. The following high-level work plan is envisioned. It may be adjusted as the research progresses and new results emerge. Months 0–3: The PhD student will conduct a thorough review of the state of the art in confidential computing, virtualization, trusted execution environments, and machine-learning workloads. This phase will also include familiarization with the relevant hardware platforms, software stacks, and experimental infrastructure. Months 4–12: The student will investigate new mechanisms to address the first research challenge identified above: enabling the VMM to provide security services transparently to the guest operating system. This work will focus in particular on isolation, attestation, communication, and resource-management mechanisms that exploit confidential-computing hardware while minimizing changes to existing guest systems. Months 13–24: The student will explore hybrid architectures that combine confidential-computing-enabled devices with untrusted or incompatible resources. This phase will involve defining suitable threat models and designing mechanisms for partitioning data and computation across trusted and untrusted execution environments. Months 25–30: The student will integrate the results of the previous phases into a scalable and reusable VMM architecture. The resulting prototype will be evaluated on representative machine-learning workloads, including Retrieval-Augmented Generation (RAG) systems, with particular attention to security, performance, and scalability. Months 31–36: The final phase will focus on consolidating the research results, completing the remaining experiments, finalizing publications, and writing and defending the PhD dissertation. Skills Excellent programming skills are essential, including solid experience with low-level systems programming, preferably in C or C++. Experience with Rust would also be valuable. The candidate should be willing to learn and work with new technologies and techniques in areas such as confidential computing, virtualization, trusted execution environments, and machine learning. Strong written and oral communication skills are also required, together with the ability to formulate, present, and discuss new ideas and to work effectively in a collaborative research environment. Benefits package • Subsidized meals • Partial reimbursement of public transport costs • Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.) • Possibility of teleworking (after 6 months of employment) • Social, cultural and sports events and activities • Access to vocational training Remuneration 2 300€ per month Apply for this position Share • Facebook • Linkedin • Twitter • Email General Information • Theme/Domain : Distributed Systems and middleware • Town/city : Rennes • Inria Center : Centre Inria de l'Université de Rennes • Starting date : 2026-10-01 • Duration of contract : 3 years • Deadline to apply : 2026-09-30 Warning : you must enter your e-mail address in order to save your application to Inria. Applications must be submitted online on the Inria website. Processing of applications sent from other channels is not guaranteed. Instruction to apply Please submit your CV, cover letter, and any recommandations online Defence Security : This position is likely to be situated in a restricted area (ZRR), as defined in Decree No. 2011-1425 relating to the protection of national scientific and technical potential (PPST).Authorisation to enter an area is granted by the director of the unit, following a favourable Ministerial decision, as defined in the decree of 3 July 2012 relating to the PPST. An unfavourable Ministerial decision in respect of a position situated in a ZRR would result in the cancellation of the appointment. Recruitment Policy : As part of its diversity policy, all Inria positions are accessible to people with disabilities. Contacts • Inria Team : WIDE • PhD Supervisor : Frey Davide / davide.frey@inria.fr The keys to success The successful candidate should hold a Master’s degree in Computer Science or a closely related field and have a strong background in operating systems, virtualization, and distributed systems. Solid low-level programming skills are expected, particularly in C or C++; experience with Rust is also welcome. Familiarity with systems programming, hypervisors, Linux internals, memory management, networking, or performance analysis would be highly relevant. Knowledge of confidential-computing hardware, trusted execution environments, and/or machine learning would be an advantage. About Inria Inria, the French national institute for research in digital science and technology, supports the French government in national research and innovation strategies in the digital field, acting as Digital Programs Agency. Inria leads over 300 research and innovation projects with its 3,500 scientists, engineers, and support staff, in partnership with universities and the digital ecosystem (businesses, entrepreneurs, and public stakeholders). Together, we explore strategic fields such as artificial intelligence, cybersecurity, quantum computing, cloud technologies, digital transformation in healthcare, digital twins, and digital technologies for defence. We develop practical solutions such as software, tech startups, partnerships with national companies, and cutting-edge training programmes. Our goal is to drive scientific, technological, and industrial excellence to ensure France’s digital sovereignty.