NVIDIA Confidential Computing

Establishes a cryptographically verifiable chain of trust from the GPU firmware to the application. NVIDIA GPUs with confidential computing capabilities integrate a hardware root of trust that validates firmware signatures before execution, ensuring the GPU boots into a known-good state. This immutable foundation underpins all subsequent attestation and encryption operations, preventing firmware tampering and supply chain attacks.

Enables a remote relying party to cryptographically verify the identity and integrity of the GPU before provisioning sensitive data or model weights. The GPU generates a signed attestation report containing firmware measurements, security configuration, and device identity. This report proves the GPU is genuine, running authorized firmware, and configured with the correct security properties—establishing trust before any confidential workload begins.

Protects data in transit between the CPU and GPU over the PCI Express bus. All data transfers—including model weights, training data, and inference inputs—are transparently encrypted using hardware-accelerated cryptography. This prevents physical bus sniffing attacks and protects against malicious devices on the PCIe fabric, ensuring end-to-end confidentiality from the CPU's Trusted Execution Environment to the GPU.

Extends GPU protection to virtualized environments through NVIDIA's Multi-Instance GPU (MIG) technology combined with confidential computing. Each GPU partition operates as an isolated compute enclave with dedicated memory, cache, and compute resources. This enables cloud providers to offer GPU-accelerated confidential VMs where the hypervisor cannot access guest GPU memory or computation.

Implements hardware-enforced memory isolation through encrypted page tables that map GPU virtual addresses to physical memory. The GPU's memory management unit validates all access requests against these protected page tables, preventing unauthorized memory access from the host, other VMs, or compromised drivers. This ensures that confidential data remains encrypted in GPU memory and is only decrypted inside the secure compute engine.

Enables end-to-end protection for the full AI lifecycle:

• Confidential Training: Model weights and training data remain encrypted throughout the training process
• Confidential Inference: User prompts and model responses are protected from the infrastructure provider
• Federated Learning: GPU attestation ensures aggregator nodes are genuine before accepting model updates
• Multi-Party AI: Multiple organizations can collaborate on shared models without exposing proprietary data to each other or the cloud operator

The overarching hardware-based security paradigm that protects data in use by performing computation within a hardware-enforced Trusted Execution Environment. While traditional Confidential Computing focused on CPUs, NVIDIA Confidential Computing extends these protections to GPU-accelerated workloads, shielding sensitive AI training and inference from the cloud provider, hypervisor, and other tenants. This closes the final gap in the encryption lifecycle, complementing protection for data at rest and in transit.

The application of Confidential Computing hardware to protect the confidentiality and integrity of machine learning assets during active computation. Key use cases include:

• Private Inference: A client's input data and the server's proprietary model weights remain mutually confidential during inference, enforced by GPU-backed TEEs.
• Federated Learning: Model updates from distributed parties are securely aggregated inside GPU enclaves without exposing individual contributions.
• Multi-Party Training: Competing organizations can jointly train models on combined sensitive datasets without revealing raw data to each other.

Techniques that safeguard the intellectual property of a trained machine learning model by encrypting its weights and architecture. With NVIDIA Confidential Computing, the model is only decrypted within a secure, attested GPU enclave during inference or training. This prevents even the infrastructure operator from extracting the model, addressing a critical concern for ISVs deploying proprietary models to untrusted cloud environments or edge locations.

The set of all hardware, firmware, and software components critical to a system's security. A vulnerability in any TCB component can compromise the entire system. NVIDIA Confidential Computing aims to minimize the GPU TCB by:

• Keeping the GPU driver and host OS outside the trust boundary.
• Attesting only the GPU firmware and hardware.
• Encrypting all communication over the PCIe bus to prevent physical snooping. This reduced TCB limits the attack surface compared to software-only isolation.

A non-invasive attack that exploits physical information leakage—such as timing, power consumption, or electromagnetic emissions—from a computing device to extract secrets from a theoretically secure enclave. GPU Confidential Computing architectures incorporate defenses against side-channel threats, including memory encryption to prevent cold-boot attacks, integrity-protected firmware, and hardware-level isolation that prevents a compromised host from probing GPU memory contents during active computation.