A frontier model company may need a cloud provider’s GPUs while wanting to keep model weights, training data and decryption keys under its own control. NVIDIA’s Confidential Bare Metal introduces a way to verify dedicated machines before those secrets are released. Here is the trust boundary it creates, the protections it promises and the operational work that remains.
Quick Take
- The announcement: On 21 October 2026, NVIDIA introduced Confidential Bare Metal as a deployment mode for a model owner using dedicated third-party infrastructure.
- The key mechanism: The model owner checks fresh hardware and software evidence; its policy allows model-decryption keys to be released only to an approved environment.
- The trust boundary: The infrastructure provider supplies and manages physical capacity, while the model owner operates the host software, workload and key policy.
- The limit: The approved model owner’s administrators and software remain trusted. Availability, data rights, vulnerable code and every network or storage path need separate controls.
Why Would a Frontier Model Builder Rent Someone Else’s GPUs?
Training and serving frontier models require expensive accelerators, fast links and space to expand. Building every rack yourself can limit where and when you can run a workload. A cloud or neocloud supplies capacity, but outsourcing the hardware raises a distinct question: who can inspect the model while it is being processed?
Encrypting files on disk and securing a network connection are necessary steps. They do not, by themselves, establish what a provider’s administrator or management system could see once model weights are loaded into memory. For a model developer, an unauthorized copy of weights could mean loss of valuable intellectual property. Sensitive training data and inference traffic may raise separate contractual and privacy concerns.
In its 21 October announcement, NVIDIA says Confidential Bare Metal is intended to let the model builder use a dedicated third-party machine while owning and operating its host and workload software. Hardware-rooted protections and verification are meant to keep the infrastructure owner outside the runtime boundary that can see model plaintext. The design addresses a specific class of provider-access risk; it cannot make every party or workflow trustworthy.
What Does “Confidential Bare Metal” Actually Mean?
Bare metal means the tenant receives a dedicated server rather than running its workload as an ordinary guest virtual machine on a provider-managed hypervisor. In NVIDIA’s technical description, the infrastructure owner prepares the hardware, firmware, power, physical fabric and baseboard management controller. The model owner builds and maintains the host operating system, drivers and AI workload, and defines what machine state it will trust.
Confidential refers to the supported protections for assets in use. A measured launch records relevant software state. Attestation lets the model owner verify the reported hardware, firmware and launch measurements against its approved policy. Memory controls, GPU access restrictions and protection of supported communication paths help keep plaintext from a party outside the trusted boundary.
This division of responsibilities changes who must do the security engineering. The model owner gains more control over the software stack, but also takes on patching, configuration, monitoring, approved component lists and key-management decisions. NVIDIA’s documentation says the infrastructure owner remains responsible for availability and physical safeguards. A dedicated host can reduce one source of shared-host complexity; it does not eliminate dependence on the provider’s facility and operations.
How Does a Protected Model Reach the GPU?
Imagine an AI lab that has encrypted its model weights before transferring them to rented capacity. The cloud provider can provision the server, but possession of encrypted files does not give it the decryption key. The lab prepares a trusted host image and an attestation policy describing acceptable components and settings.
- Prepare the platform: The provider supplies a qualified dedicated system; the lab approves the software it intends to run and the measurements it expects to see.
- Launch and measure: The platform reports fresh evidence about relevant CPU and device state and the launched software. The lab’s verifier checks it against trusted reference values and security requirements.
- Apply key policy: A successful hardware signature alone is insufficient. The lab’s key service releases a model-decryption key only when the complete policy for the intended workload passes.
- Operate and recheck: The model runs on the approved system. After relevant resets or changes, the lab re-attests before releasing protected secrets again.
That sequence is based on NVIDIA’s Confidential Bare Metal trust model. Verification attests to measured state and policy, not to the absence of bugs in approved code. If the model owner approves a vulnerable driver or makes its key policy too broad, the hardware cannot correct that decision.
Bare Metal vs Confidential Containers vs Confidential VMs
NVIDIA presents three confidential-computing deployment modes. The right choice depends on whose administrators must be outside the boundary and how much platform software the customer is prepared to operate.
| Mode | Typical arrangement | Security question to ask |
|---|---|---|
| Confidential Bare Metal | One model owner controls a dedicated host, including its OS, drivers and workload. | Can its verifier check the full approved host state before keys are released? |
| Confidential Containers | A workload uses a container-oriented deployment with an isolation boundary suited to its platform. | Which guest, container and orchestrator components are measured and trusted? |
| Confidential Virtual Machines | A workload runs within a protected virtual machine on supported hardware. | Who operates the host, who operates the guest and who can access workload plaintext? |
| Ordinary dedicated server | A single customer receives hardware without an established confidential-computing workflow. | What can the provider access through firmware, management systems or running memory? |
The names alone do not prove a particular privacy property. Read the provider’s exact configuration and threat model. NVIDIA also notes that Confidential Bare Metal does not isolate an end customer’s prompts from the model owner; achieving that different separation can require another confidential boundary and appropriate application policies.
Which Data Paths Are Protected, and Which Still Need Work?
“Encrypted GPU” is too vague for an infrastructure purchase. NVIDIA’s published threat model explains that protections depend on hardware generation, enabled settings and the path taken by sensitive information. For its described Grace Blackwell baseline, NVLink encryption can protect GPU-to-GPU traffic through NVLink switches when enabled. That does not automatically encrypt PCIe, storage, ordinary networking or remote direct memory access traffic.
The same documentation says baseline CPU-to-GPU chip-to-chip links do not provide the stated encryption protection, and that a network interface should not be assumed trusted simply because another part of the platform was attested. Data travelling through an untrusted interface may need its own encryption, authentication and restricted memory access. Rubin systems can have different properties; teams should check the documentation for the exact system they intend to rent.
Other exclusions matter as well: approved but compromised software may disclose secrets; the provider can still disrupt power or connectivity; and the architecture is not a general defence against every invasive physical or side-channel attack. These are explicit limits in NVIDIA’s security documentation. A buyer’s security review should map the model weights, training data, prompts, logs and checkpoints across their real paths before accepting a claim about protection “in use.”
Who Is Supporting It, and What Is Available Today?
NVIDIA says its confidential-computing coverage is expanding across Grace Blackwell and Rubin platforms and will extend into its DSX OS reference architecture. Its announcement names Confidential Bare Metal, confidential containers and confidential VMs as the three deployment options. These statements describe NVIDIA’s product direction; they do not confirm that every configuration is ready to order in every region.
Google Cloud says it is extending Confidential Bare Metal support to A4X Max instances based on GB300 NVL72 systems. Google’s Compute Engine documentation confirms A4X Max is a bare-metal instance type. That fact alone should not be taken as proof that a particular reservation has Confidential Bare Metal enabled. Ask Google Cloud for the feature’s status, supported configuration, capacity and region.
Cohere plans to integrate the option with Cohere Model Vault, according to NVIDIA. NVIDIA also lists infrastructure companies supporting confidential-computing deployments more broadly. A partner list is evidence of ecosystem interest, not a tested service-level or feature commitment from every listed provider. Seek a documented configuration, proof of the attestation flow and commercial terms before relying on it.
Four Teams That Need to Work Together
Defines which weights and datasets are sensitive, builds approved software, controls keys and decides what an attested machine is allowed to run.
Supplies compatible dedicated hardware, firmware, capacity and physical protection. Publishes exactly which configurations and regions support the required controls.
Tests fresh attestation, rejected configurations, patch changes, key rotation, incident logs and whether any sensitive data takes an unprotected route.
Checks separately whether the model provider can see prompts and outputs, where data travels, how long it is retained and who may use it.
The enterprise customer’s concern is easy to miss. A model owner may successfully prevent its cloud host from reading model weights while still legitimately reading the customer’s queries through its own inference software. Those are two different trust relationships.
What Should a Pilot Measure Before Production?
- Verification quality: Show a successful launch and deliberately rejected evidence for altered firmware, disabled settings or an unapproved workload. Confirm secrets remain withheld after failure.
- Complete data flows: Document which memory regions, GPU links, NICs, checkpoints, storage volumes and logs carry plaintext or keys. Protect each unsupported path explicitly.
- Change management: Test a driver or firmware update, the resulting measurement change, approval of new reference values and a safe rollback.
- Workload economics: Benchmark the real training or inference job, including GPU utilization, throughput, latency, capacity reservation and engineering time. NVIDIA’s other confidential-computing benchmarks should not be reused as a measured result for this bare-metal configuration.
- Provider obligations: Record the supported service and region, hardware replacement process, physical safeguards, incident handling, outage terms and how an offboarded server is prepared for its next tenant.
These questions turn a hardware security announcement into a testable deployment decision. A protected system is useful only when its policy and operating procedures keep working after routine changes.
What Does This Mean for EU Data Protection and the AI Act?
Confidential computing can support technical safeguards, but it does not settle legal obligations. For EU personal data, the European Commission’s GDPR guidance highlights lawful purpose, data minimization, security, retention and accountability. Organizations must also assess provider relationships and transfers when their workflows require them. A GPU attestation report does not answer who is permitted to process customer records or how long inference logs are retained.
The Commission’s AI Act guidance ties risk classification to an AI system’s actual intended purpose and the roles of its provider and deployer. Confidential Bare Metal is an infrastructure option; it does not automatically classify every hosted AI application as compliant or high-risk. A lab serving a clinical decision tool and one hosting a general writing assistant may face different application-level obligations.
For proprietary model weights, assess contracts, data licensing and access to third-party code as well as technical controls. The article’s analysis is original; readers can inspect the linked NVIDIA, Google Cloud and European Commission materials for the underlying product and regulatory descriptions.
MaGeN-AI View
Trust moves from the provider’s promise to a verifiable policy
Confidential Bare Metal matters because a model builder may be able to rent global GPU capacity while retaining control over its software and the release of its model keys. Its practical value will depend on supported hardware, strict attestation policy and an honest map of what remains visible to the model owner, provider and end customer. The question for a buyer is concrete: can this exact machine prove it is in an approved state, and will the keys stay unavailable when it is not?
Frequently Asked Questions
What is NVIDIA Confidential Bare Metal?
It is NVIDIA’s confidential-computing deployment option for dedicated servers operated by a model owner on a third-party infrastructure provider’s hardware. It uses a measured launch, attestation and policy-controlled secret release within a supported platform configuration.
Can a cloud provider read a model running on Confidential Bare Metal?
NVIDIA’s design aims to keep the infrastructure owner outside the verified runtime trust boundary, including for access through its management controller. Protection depends on compatible hardware, correct settings, trusted software and successful verification; it is not a guarantee against every attack.
Who controls the operating system and model-decryption keys?
The model owner is responsible for the host operating system, drivers, workload, approved measurements and key-release policy. A verifier checks the platform and software state before the model owner’s key service releases protected secrets.
Does Confidential Bare Metal hide customer prompts from the model provider?
No. NVIDIA’s bare-metal threat model trusts the model owner’s administrators and software. Protecting an end user’s data from that model owner requires a separate trust boundary and data-handling controls.
Is Confidential Bare Metal generally available on every NVIDIA GPU and cloud?
No blanket availability is established. NVIDIA describes support for qualified Grace Blackwell and Vera Rubin configurations, while individual providers must confirm their supported hardware, firmware, software, region and service status.
