Every existing trusted execution environment (TEE) draws its boundary at the processor. The memory bus is untrusted by design. That means PIM architectures, which move computation into the memory arrays to eliminate Von Neumann bandwidth bottlenecks, have been architecturally incompatible with secure multi-tenant workloads. YAVIN, from researchers at Pittsburgh, Drexel, and Northeastern, removes that constraint.
The architecture extends a unified trusted computing base (TCB) to encompass both processor execution and a dedicated PIM region. Data stays encrypted in transit across the memory bus. Inside the TEE-protected memory region, YAVIN decrypts, computes, and re-encrypts without the data leaving the trusted boundary. The paper reports the first PIM implementations of post-quantum cryptographic primitives, which makes the approach relevant to workloads where the data sensitivity requires forward-security guarantees, not just current-generation protection.
The constraint being removed is non-trivial. PIM has been gaining traction for LLM inference workloads precisely because memory bandwidth is the binding constraint at inference time, not compute. But deploying PIM for multi-tenant inference (cloud edge, shared inference hardware, confidential computing) has required a trust gap: the computation crossing into memory meant it also crossed out of the TEE. YAVIN closes that gap at the architecture level.
If this approach generalizes to HBM-scale PIM, which is where the inference workloads are going, the confidential computing market has a path to PIM-native deployment it did not have before. The 18-month question is whether any HBM vendor picks this up as a roadmap feature, or whether it stays a research proof-of-concept while PIM inference ships without the security guarantees.