↓ Skip to main content
Le Site de François
  1. Index/

Confidential GPU

Security Confidential-Computing Gpu Ai Attestation Nvidia
Table of Contents

A Confidential GPU is a GPU whose memory, computation state, and data transfers are hardware-encrypted and isolated from the host system — extending the Trusted Execution Environment (TEE) boundary that technologies like TDX and SEV-SNP provide at the CPU level to encompass the GPU accelerator as well. The primary implementation today is NVIDIA Confidential Computing on the Hopper architecture (H100 and later), which encrypts all data resident in GPU High Bandwidth Memory (HBM) using per-context keys managed by the GPU’s on-die security processor. This means that model weights, training data, activations, and intermediate computations are cryptographically protected throughout GPU processing — a host administrator, hypervisor, or co-tenant with DMA access to the PCIe bus sees only ciphertext. The GPU also participates in a dedicated attestation flow: the NVIDIA Remote Attestation Service (NRAS) produces signed evidence that a specific GPU is genuine NVIDIA hardware running in Confidential Computing mode with unmodified firmware, analogous to how Intel DCAP or AMD KDS attest CPU TEEs. This GPU attestation is verified alongside CPU attestation before secrets (model decryption keys, dataset credentials) are released to the combined CPU+GPU TEE. The technology requires no application code changes — existing TensorFlow, PyTorch, and CUDA workloads run unmodified inside the confidential boundary. The primary threat model is the same as CPU-level confidential computing (protecting data-in-use from the infrastructure operator) but applied to the specific risk of AI workloads: model intellectual property theft, training data exfiltration, and inference input/output interception during GPU computation.

Red Hat integrated Confidential GPU support in OpenShift sandboxed containers 1.12 (April 2026) as a Technology Preview, in collaboration with NVIDIA. The implementation extends the existing CoCo (Confidential Containers) architecture: a confidential container running inside a CPU TEE (TDX or SEV-SNP) is connected to an NVIDIA H100 GPU operating in Confidential Computing mode, creating a unified TEE spanning both CPU memory and GPU memory. Red Hat build of Trustee 1.1 adds NRAS integration, enabling the attestation service to verify GPU hardware integrity as part of the same attestation flow that validates the CPU TEE — secrets are released only when both CPU and GPU attestation pass. The OpenShift sandboxed containers operator provides automated hardware node discovery for confidential GPU-capable nodes and dynamically provisions dedicated RuntimeClasses (kata-qemu-nvidia-gpu-tdx, kata-qemu-nvidia-gpu-snp), integrating with the standard NVIDIA GPU Operator for resource management. The key use case demonstrated by Red Hat is model IP protection for distributed inference: a proprietary model vendor encrypts model weights and stores them in a standard registry; the weights are pulled by an untrusted third-party infrastructure operator running OpenShift; Trustee releases the decryption key only after verifying both the CPU TEE and the GPU TEE via NRAS — guaranteeing that the model is never exposed in plaintext outside verified hardware, even though the infrastructure is operated by someone else. This enables AI model distribution without trust assumptions about the hosting environment, addressing a critical blocker for regulated industries (healthcare AI, financial modeling) and model vendors who need to protect years of R&D investment.

Additional Information
#

Related

CUDA (Compute Unified Device Architecture)

Ai Cuda Nvidia Gpu Programming Parallel-Computing
CUDA (Compute Unified Device Architecture) is NVIDIA’s software platform for general-purpose computing on GPUs. Its objective is to give developers a familiar C/C++ (and Fortran, Python bindings) programming model with explicit control over kernels (functions that run on the device), streams (ordered queues of work), and memory spaces (host, device, unified). CUDA sits above the GPU driver and below frameworks such as cuDNN, NCCL, and higher-level ML stacks; it is the layer that makes it practical to implement custom operators, HPC solvers, and inference engines that are not covered by a closed library. For AI, virtually every major training and inference stack ultimately depends on CUDA (or a CUDA-compatible runtime) on NVIDIA hardware.

Confidential Cluster

Security Confidential-Computing Kubernetes Attestation Tee
A Confidential Cluster is a Kubernetes cluster designed so that the cloud or infrastructure operator — including hypervisor administrators, datacenter staff, and anyone who can access the underlying hardware — is entirely outside the trusted computing base. It achieves this by running every Kubernetes node, including control plane nodes, as a Confidential VM, and by extending the confidential boundary to cover not just individual workloads but the cluster’s network traffic, persistent storage, and control plane state. The goal is that a workload owner can cryptographically verify the entire cluster before trusting it, and that no privileged party outside the cluster’s own CVMs can read or tamper with workload data, cluster secrets, or etcd contents.

Confidential Containers (CoCo)

Security Confidential-Computing Kubernetes Attestation Containers Cncf
Confidential Containers (CoCo) is a CNCF sandbox project that lifts hardware confidential computing — TDX, SEV-SNP, Intel SGX, IBM Secure Execution — up to the Kubernetes pod level, providing a unified software layer that abstracts away the underlying TEE technology. Its defining trust model is unusually strict: the Kubernetes control plane, the kubelet, the container runtime, and the cloud operator are all treated as explicitly untrusted. Only the hardware itself and the workload owner’s own supply chain are in scope for trust.