NVIDIA Confidential Computing

Creates a hardware-enforced secure enclave on the NVIDIA GPU, physically isolating sensitive computation from the rest of the system. This confidential virtual machine (CVM) model extends protection to the entire guest OS and AI workload, not just a single application. The GPU's memory is encrypted with a key managed by the hardware root of trust, making it inaccessible to the host OS, hypervisor, or any privileged user with physical access.

• Hardware Root of Trust: Cryptographic keys are generated and managed within the GPU silicon, never exposed to firmware or software.
• Full VM Encryption: Protects the entire virtual machine's memory, including the OS kernel, drivers, and AI frameworks.
• Physical Isolation: The GPU enforces memory access controls at the hardware level, preventing DMA attacks from other PCIe devices.

Provides a cryptographic mechanism to verify that the GPU is genuine, its firmware is untampered, and the secure enclave is correctly configured before any sensitive data is loaded. This GPU attestation process generates a signed measurement of the entire Trusted Computing Base (TCB), including GPU firmware, driver versions, and enclave configuration. A remote party can validate this attestation report against NVIDIA's endorsement certificates to establish trust.

• Measured Boot: Every firmware component loaded onto the GPU is cryptographically hashed and recorded.
• Signed Attestation Reports: The GPU signs a verifiable report containing the TCB measurements using a key derived from its hardware root of trust.
• Policy Enforcement: Attestation results can be integrated with key management services to ensure decryption keys are only released to verified GPU enclaves.

Extends hardware isolation to individual GPU instances, allowing a single physical NVIDIA H100 or B200 GPU to be securely partitioned into multiple, fully isolated Confidential MIG instances. Each instance gets its own dedicated memory, cache, and compute resources, all encrypted with unique keys. This enables multi-tenant environments where different users or departments can run sensitive workloads on the same physical GPU without any risk of cross-instance data leakage.

• Hardware-Enforced Isolation: MIG partitions are enforced by the GPU's memory management unit, not software.
• Dedicated Encryption Keys: Each MIG instance has its own encryption key, derived from the hardware root of trust.
• Independent Attestation: Each partition can be independently attested, allowing per-tenant trust verification.

Secures data in transit between the CPU and GPU, and between multiple GPUs in a cluster, using inline hardware encryption. All data moving over PCIe buses and NVLink interconnects is transparently encrypted and integrity-protected, preventing physical bus sniffing or man-in-the-middle attacks on the interconnects. This is critical for multi-GPU training jobs where model gradients and parameters are exchanged over NVSwitch fabrics.

• Inline Encryption Engines: Dedicated hardware on the GPU encrypts data as it enters the PCIe/NVLink controller, with no performance penalty.
• Integrity Protection: Message Authentication Codes (MACs) prevent tampering with data in flight.
• Secure GPU-to-GPU Communication: NVLink encryption ensures that distributed training across nodes remains confidential even if the physical network is compromised.

Provides a seamless developer experience by integrating confidential computing capabilities into the standard NVIDIA AI software stack. The NVIDIA Confidential Computing SDK and drivers expose attestation APIs, encrypted memory management, and secure key handling to frameworks like CUDA, TensorRT, and Triton Inference Server. This allows existing AI applications to be deployed into a TEE with minimal code changes, accelerating adoption.

• CUDA Enclave Support: Standard CUDA kernels run unmodified within the confidential GPU environment.
• Triton Inference Server Integration: Model serving endpoints can be configured to require successful GPU attestation before loading models.
• Key Management Interoperability: Integrates with external KMS solutions via standard protocols to automate key release based on attestation results.

Enables end-to-end confidential AI pipelines where both the retrieval of proprietary documents and the LLM inference occur entirely within a GPU-accelerated TEE. In a Confidential RAG architecture, the user's query, the retrieved context from an encrypted vector database, and the generated response are all processed inside the GPU enclave. This ensures that sensitive enterprise knowledge bases and user prompts are never exposed in plaintext to the infrastructure provider.

• End-to-End Encryption: Query, context, and response remain encrypted from client to GPU and back.
• Protected Knowledge Base: Vector embeddings and source documents are decrypted only inside the attested GPU enclave.
• Verifiable Pipeline: Attestation covers the entire RAG stack, from the retrieval engine to the LLM inference runtime.

A secure area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside. In the NVIDIA context, the GPU itself becomes the TEE, creating an isolated enclave that protects AI workloads from the host operating system, hypervisor, and cloud provider. Unlike CPU-based TEEs, GPU TEEs must handle massive parallel computation while maintaining encryption boundaries.

• Isolates sensitive model weights during inference
• Prevents memory snooping by privileged system software
• Forms the foundational hardware primitive for confidential AI

The cryptographic process of verifying the identity and integrity of a GPU's trusted execution environment before sensitive computation begins. NVIDIA GPUs generate a signed attestation report containing firmware measurements, hardware identity, and security configuration. A remote party validates this report against known-good values to ensure the GPU is genuine, untampered, and running in confidential mode.

• Verifies GPU firmware has not been modified
• Confirms confidential computing mode is active
• Establishes trust before releasing decryption keys or data

A specialized attestation protocol that cryptographically verifies the authenticity and security posture of an NVIDIA GPU before offloading sensitive computation. This process validates the GPU's unique identity, firmware integrity, and active security features. Secure GPU attestation ensures that AI workloads are dispatched only to verified hardware, preventing data exposure to compromised or counterfeit accelerators.

• Validates GPU silicon identity via factory-provisioned keys
• Confirms confidential computing firmware is loaded and active
• Integrates with enterprise key management services for conditional key release

The protection of data while it is actively being processed in GPU memory, as opposed to data-at-rest on storage or data-in-transit across a network. NVIDIA confidential computing extends encryption to the compute phase, ensuring that model parameters, input data, and intermediate activations remain encrypted within the GPU's memory. This closes the final gap in the data lifecycle protection triad.

• Protects model weights during inference from memory inspection
• Encrypts training data gradients during distributed training
• Prevents cloud provider access to active computation state

A software development kit providing APIs and tools for building AI applications that run within an NVIDIA GPU's trusted execution environment. The SDK abstracts the complexity of enclave management, enabling developers to deploy unmodified PyTorch or TensorFlow workloads with confidentiality guarantees. It handles attestation, secure key delivery, and encrypted data transfer between the CPU and GPU.

• Supports standard ML frameworks without code changes
• Manages secure channel establishment between host and GPU
• Provides runtime verification of enclave integrity

A model serving endpoint that runs entirely within an NVIDIA GPU's trusted execution environment, ensuring that both client input data and proprietary model parameters are invisible to the cloud provider. This architecture enables organizations to deploy sensitive models—such as those trained on medical records or financial data—on shared infrastructure without exposing intellectual property or violating data privacy regulations.

• Protects model weights from infrastructure administrators
• Encrypts user queries end-to-end during inference
• Enables multi-tenant GPU sharing with hardware-enforced isolation