Confidential Computing on NVIDIA HGX™ B300 & HGX™ B200

Sensitive data used in AI workloads needs to be protected the entire time, from the moment it's stored to the moment it's computed on. That's where the AI infrastructure you use can fall short.

Right now, your data is already encrypted in storage and over the network. But the moment an NVIDIA GPU actually runs inference or training, that data has to be decrypted to sit in memory and get computed on. From that point until the computation finishes, it's readable by anyone with access to the host, including engineers or a compromised hypervisor.

Protecting that data has traditionally come down to policy, access controls, audit logs, and contract language. Verda offers confidential computing on NVIDIA GPUs, which replaces that with proof. The hardware protects the workload while it's running, not just before or after, and attestation provides signed proof that its components, like the GPU firmware, match an approved state. This encrypted workload runs on GDPR-compliant infrastructure, which matters when your requirements are tied to where data is processed, not just how it's protected.

With confidential computing, sensitive data that used to have to stay on-prem to meet compliance requirements can now be used for inference and fine tuning on infrastructure the company doesn't own. The same holds for organizations licensing a model or serving it to customers on infrastructure they don't control: the weights stay as protected as they would on hardware the company owns outright. And for anyone building a product where privacy is the pitch, it is the difference between a claim in a privacy policy and a claim backed by cryptographic proof.

Confidential computing on Verda runs on three NVIDIA GPUs, each with different configuration support:

Verda’s approach to confidential computing

Confidential computing on Verda relies on an extended root of trust from CPU to NVIDIA GPU with encrypted memory channel between.

Each instance gets a unique encryption key held by AMD's Secure Processor, a dedicated security processor inside the AMD CPU that the hypervisor cannot access. That same hardware also prevents the hypervisor from replaying or remapping memory pages, so it's not just encryption, it's tamper detection. The NVIDIA GPU checks its own firmware integrity at boot, isolates its memory from the host, and encrypts everything moving in or out, including traffic between GPUs. Together, they form a Trusted Execution Environment, or TEE: a boundary enforced by hardware, not software, where your instance and its GPU sit inside, and everything else, the hypervisor, host OS, Verda's own management software, other VMs, sits outside and cannot read what's inside.

The proof goes deeper than confirming the hardware is genuine. By default, this kind of check only confirms the firmware. Verda's setup extends it further: every boot produces a signed measurement of the exact software that started it, so you're verifying nothing was swapped in before your workload started running.

That covers your workload while it's running. For data at rest inside the same instance, you can encrypt your home directory, or encrypt the entire disk, which only unlocks after the instance proves it's running exactly what it was built with.

Attestation is how you check this yourself. You generate composite attestation signed reports from inside your own instance and each is verified remotely. For maximum security, Verda’s encrypted custom OS boot flow ensures secrets and decryption keys are released only after the remote verification succeeds. NVIDIA GPU blocks all workloads until it enters a ready state. You can trigger that manually, but a successful attestation sets it automatically, unlocking the GPU to run your code.

Confidential computing that doesn’t slow you down

You shouldn't have to give up performance to protect your workload. So we measured it, on NVIDIA HGX™ B300, replicating NVIDIA's benchmark, "Hardware-Rooted AI Security That Won't Slow You Down,", on the same model and the same GPU generation, changing only the confidential computing technology underneath: AMD SEV-SNP instead of Intel TDX.

We ran the same workload twice on the same physical host, everything else held constant: same volume, same images. Confidential computing was switched on for one run and off for the other. We measured how many tokens the system could generate per second, and how long each individual token took to generate, across the same 15 test points NVIDIA published.

Confidential computing on Verda ran at up to 99% of full speed on some configurations, with a cost to throughput and latency minimal enough that most workloads won’t notice the difference.

Confidential computing vs. non-confidential computing

Setup stack

Getting started

Confidential computing on Verda is available today, for regulated inference, fine tuning on sensitive data, and privacy-first AI products. Sign up to deploy and read the docs for setup and verification steps. Get in touch with us for custom configurations.