Research Intern, Enclaves: Secure Hypervisor Agentic and LLM workloads

Helsinki System Security Lab (HSSL) Internship

Enclaves: Secure Hypervisor Agentic and LLM workloads

With the development of the Agentic AI, modern embedded systems are evolving to general-purpose and mixed-criticality systems, where virtualization has become one key key to guarantee the isolation between tasks with different, or in the case of AI Agents, differing criticality. Traditional server-based hypervisors (KVM and Xen) are not suitable for such workloads out-of-the box, as isolation properties, memory allotments, copy-on-write file systems or shared memory as well as MCP-interface control for LLM interaction are not part of the tools present in a classical confidential VM (CVM). Also the proper way to formulate access control for information flow in and out of a CVM with Agentic control is an open problem, as the access control decision largely must depend on the operation currently being executed (by the agent) rather than statically being fixed for a program / process / VM as is the norm.

In this work we are looking for a PhD student in Computer Science who is very familiar and has hands-on experience with confidential VMs in the spirit of Linux CCC or ARM CCA; the intention is to work together on designing and implementing a realm-based architecture that is suitable for secure, isolated workloads in the AI era - satisfying all the requirements mentioned above, but also considering AI hardware integration (NPUs) and attestation mechanisms - including attestation for true model workloads (like LLMs). The intern will be working with experienced security experts in the Helsinki System Security Laboratory, and plan, design and implement the work under their guidance and collaboration.

The internship is tailored to be a PhD internship in the field of CS.

We are looking for: Students who are close to completing their PhD studies, and experience in

promoting their work, e.g. via publication and / or standardization

Solid experience with low-level,