The city evaluates confidential-computing options for GenAI processing of sealed juvenile records. What capability is being considered?
Select an answer to reveal the explanation.
Short Explanation
Sealed juvenile records need a vault, not a shared hallway — confidential computing is that kind of hardware-backed isolation for GenAI. Turning off enclave memory protection, showing sealed text on dashboards, or FTP staging miss the point.
Full Explanation
Evaluating confidential computing for GenAI over sealed juvenile records is about hardware-backed isolation for highly sensitive municipal GenAI workloads: memory encryption, attested execution environments, and reduced host-operator visibility into plaintext sealed content during inference. That capability targets threats where ordinary VM or container isolation is insufficient for the sensitivity class of juvenile sealed records processed by city systems.
Disabling memory encryption inside the enclave for faster training undermines the isolation property being purchased and re-exposes sealed content to host-level observation. Public attestation dashboards that display sealed record contents confuse attestation evidence with content disclosure and violate sealing requirements. Moving sealed records to anonymous FTP before inference introduces an insecure staging channel that contradicts confidential processing goals.
Exam caveat: confidential computing helps with host and infrastructure insider or co-tenant threats; it does not by itself fix application-level authorization bugs inside the enclave workload or misuse by an authorized application role. Operational check: verify attested launch of the GenAI workload, confirm sealed datasets are mounted only into the trusted execution context, ensure operators cannot dump plaintext juvenile content from host memory interfaces, and retain attestation logs for audit.