NVIDIA Adds a Bare-Metal Option to Confidential Computing, Letting Frontier Model Builders Run Sensitive Workloads on Third-Party Infrastructure While Keeping Control of Models and Data

Frontier model builders can run sensitive workloads on dedicated bare-metal instances operated by third parties while keeping control of their models and data. Confidential Computing previously offered container and virtual-machine forms, aimed at Kubernetes and virtualized environments respectively. Confidential Bare Metal is listed alongside Confidential Containers and Confidential Virtual Machines as three options under one converged security architecture, so organizations can match a mode to their trust boundaries and operating requirements.

The capability relies on hardware-rooted isolation and cryptographic attestation to protect models and data during execution. New platform security controls cover protection of data in transit, measurement of platform integrity and enforcement of hardware-level access restrictions. These controls let model builders own and operate their bespoke software stack, including host and platform infrastructure software, on NVIDIA accelerated computing across third-party cloud, neocloud and enterprise infrastructure.

Ecosystem plans are concrete: Cohere intends to bring Confidential Bare Metal into Cohere Model Vault, and Google Cloud intends to extend support to A4X Max instances. Cohere says it will use trusted execution environments to extend hardware-rooted security directly to the GPU, protecting models and data in memory and across interconnects during execution. Google Cloud's A4X Max instances are powered by GB300 NVL72 systems and combine non-virtualized NVIDIA accelerated computing with cryptographic protection for training data and model intellectual property.

The report covers NVIDIA's announced Confidential Computing expansion: the Confidential Bare Metal deployment option, the parallel Confidential Containers and Confidential Virtual Machines options, the new platform security controls, and support extending to Grace Blackwell NVL72, HGX Rubin NVL8 and DGX Rubin NVL8 systems. It is aimed at infrastructure engineers and model-building teams that run sensitive model workloads on third-party infrastructure. The Cohere and Google Cloud integrations are announced plans, not completed deployments.

NVIDIA gives no performance-overhead figures for Confidential Bare Metal relative to non-confidential paths, and no implementation detail for the integrity measurement and access restrictions. Cohere and Google Cloud describe plans or extended support, with timing and coverage not specified. The provider and systems-partner lists are ecosystem statements, not proof that the capabilities are broadly available on every platform.