Research Intern, Enclaves: Secure Hypervisor Agentic and LLM workloads
At a glance
Junior AI Engineering role at Huawei Finland R&D. Helsinki.
Pay not stated AI Engineering salary
aimlroles summary, based on the employer's posting.
What you'll do
- Plan, design and build a realm-based architecture for isolated AI workloads, working with security experts
- Address workload isolation, memory allocation, shared-memory and file-system needs in confidential VMs
- Develop access controls that respond to an AI agent’s current operation and govern information entering or leaving a VM
- Account for NPU integration and attestation, including checks for LLM workloads
What you bring
- You are nearing completion of a computer science PhD and have shared research through publication or standardization
- You have hands-on experience with confidential VMs and strong low-level software skills in C, C++ or Rust
- You understand virtualization technology and hardware architecture, and can work and communicate in English
Who this fits
This PhD-focused research internship suits someone interested in exploring new security challenges and collaborating with a research team. It runs for six months and is based at the Helsinki, Ruoholahti office. Familiarity with ARM architecture and ARM CCA is an advantage.
From the employer
Helsinki System Security Lab (HSSL) Internship
Enclaves: Secure Hypervisor Agentic and LLM workloads
With the development of the Agentic AI, modern embedded systems are evolving to general-purpose and mixed-criticality systems, where virtualization has become one key key to guarantee the isolation between tasks with different, or in the case of AI Agents, differing criticality. Traditional server-based hypervisors (KVM and Xen) are not suitable for such workloads out-of-the box, as isolation properties, memory allotments, copy-on-write file systems or shared memory as well as MCP-interface control for LLM interaction are not part of the tools present in a classical confidential VM (CVM). Also the proper way to formulate access control for information flow in and out of a CVM with Agentic control is an open problem, as the access control decision largely must depend on the operation currently being executed (by the agent) rather than statically being fixed for a program / process / VM as is the norm.
In this work we are looking for a PhD student in Computer Science who is very familiar and has hands-on experience with confidential VMs in the spirit of Linux CCC or ARM CCA; the intention is to work together on designing and implementing a realm-based architecture that is suitable for secure, isolated workloads in the AI era – satisfying all the requirements mentioned above, but also considering AI hardware integration (NPUs) and attestation mechanisms – including attestation for true model workloads (like LLMs). The intern will be working with experienced security experts in the Helsinki System Security Laboratory, and plan, design and implement the work under their guidance and collaboration.
The internship is tailored to be a PhD internship in the field of CS.
We are looking for:
Students who are close to completing their PhD studies, and experience in
promoting their work, e.g. via publication and / or standardizationSolid experience with low-level, OS-like software (hypervisors), hardware architecture
using programming languages such as C, C++ or Rust.Familiarity with virtualization technologies and confidential compute.
Sufficient skills to work and interact in English
Good team-working skills
Students with interest to do research and explore new challenges
The following we count as advantage:
Knowledge of the ARM architecture and of ARM CCA technology.
Location and internship period: This is a 6-month internship based at our Helsinki, Ruoholahti office.
The Helsinki Systems Security Laboratory in Huawei Finland (HSSL) drives renewal and mastery in the field of platform / device related security technologies for consumer devices such as mobile phones and PCs. Our topical expertise lies in hardware-assisted memory protection, trustworthy execution (processor isolation primitives, hypervisor, TEE, kernel hardening), as well as functionality like device key management, attestation and integrity. We are also making inroads in the areas of security testing and AI protection on terminal devices.