CCSI

Lesson 10.1 · 10 min read

The scenario

Two organisations want to pool data for fraud detection without revealing raw records to each other or to the operator.

Brief

Two banks, Northbank and Lakeshore (fictional), want to train and run a fraud model on their combined transaction data. Neither may see the other's raw records. A third company, the operator, runs the infrastructure. The proposed design:

Proposed design (as submitted)OPERATOR CLOUD PROJECTkeysNorthbankencrypted datasetLakeshoreencrypted datasetConfidential VM + GPUtraining + inferenceSecrets managerdataset keysFraud scoresreturned to each bank
Each bank uploads its encrypted dataset; the workload fetches dataset keys from a secrets manager in the operator's project.

Facts from the design document

  • The confidential VM is AMD SEV-SNP with an H100 attached. The image is built by the operator's CI.
  • Dataset keys are in the operator's secrets manager. Access is granted to the VM's service account.
  • SSH is enabled on the VM "for troubleshooting".
  • The GPU mode is set by an operator runbook; nobody checks it at runtime.
  • Training logs, including sample rows for debugging, are shipped to the operator's logging service.
  • The banks receive a PDF listing the image hash at launch. There is no process for updates.