One or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising: allocating device memory for one or more trust domains, TDs, in a system including one or more processors and a graphics processing unit, GPU; allocating a trusted key ID for a TD of the one or more TDs; creating Local Memory Translation Table, LMTT, mapping for address translation tables, the address translation tables being stored in a device memory of the GPU; transitioning the TD to a secure state, including generating a secure version of the address translation tables, the secure version being an encrypted version of the address translation tables, and generating one or more encryption keys to provide access to the secure version of the address translation tables; and receiving and processing a memory access request associated with the TD, wherein processing the memory access request includes: upon determining that the memory access request is associated with the one or more TDs, accessing the secure version of the address translation tables using an encryption key of the one or more encryption keys; and receiving and processing a memory access request that does not originate from the TD; and upon determining that a memory access request does not originate from the TD, accessing a non-secure version of the address translation tables for the memory access request. allocating device memory for one or more trust domains, TDs, in a system including one or more processors and a graphics processing unit, GPU; allocating a trusted key ID for a TD of the one or more TDs; creating Local Memory Translation Table, LMTT, mapping for address translation tables, the address translation tables being stored in a device memory of the GPU; transitioning the TD to a secure state, including generating a secure version of the address translation tables, the secure version being an encrypted version of the address translation tables, and generating one or more encryption keys to provide access to the secure version of the address translation tables; and receiving and processing a memory access request associated with the TD, wherein processing the memory access request includes: upon determining that the memory access request is associated with the one or more TDs, accessing the secure version of the address translation tables using an encryption key of the one or more encryption keys; and receiving and processing a memory access request that does not originate from the TD; and upon determining that a memory access request does not originate from the TD, accessing a non-secure version of the address translation tables for the memory access request. upon determining that the memory access request is associated with the one or more TDs, accessing the secure version of the address translation tables using an encryption key of the one or more encryption keys; and receiving and processing a memory access request that does not originate from the TD; and upon determining that a memory access request does not originate from the TD, accessing a non-secure version of the address translation tables for the memory access request. <EOS>