AI Labs Get a Bare-Metal Option for Keeping Models Private on Rented NVIDIA GPUs

Frontier model builders that rent GPUs from clouds and neoclouds have to run their model weights on hardware they don’t control. NVIDIA is pitching a fix for that with Confidential Bare Metal, a deployment option it says lets model builders run sensitive workloads on third-party infrastructure “while retaining control of their models and data.”

NVIDIA announced the option in a blog post Wednesday during GTC Berlin. It is the third piece of what the company now calls a converged security architecture for NVIDIA Confidential Computing, alongside Confidential Containers for Kubernetes and Confidential Virtual Machines for virtualized environments.

Owning the whole stack on someone else’s racks

The bare-metal mode is aimed at labs that want to run their own host and platform software rather than accept a provider’s hypervisor. To make that workable, NVIDIA said it is adding platform security controls that protect data in transit, measure platform integrity and enforce hardware-level access restrictions. Confidential Computing relies on hardware-rooted isolation and cryptographic attestation to protect models and data while they are running, according to NVIDIA.

Hardware coverage is widening at the same time. Support now reaches Grace Blackwell NVL72 rack-scale systems, along with x86-based HGX Rubin NVL8 and DGX Rubin NVL8 systems, and the company said it is expanding across Grace Blackwell and Rubin platforms more broadly. NVIDIA DSX OS, the company’s software foundation for cloud providers building AI factories, will support all three confidential modes.

Ten infrastructure providers support NVIDIA Confidential Computing deployments: CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr. Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull will support the capabilities through NVIDIA-Certified Systems.

Cohere and Google Cloud sign on

Cohere plans to build Confidential Bare Metal into Cohere Model Vault, using NVIDIA’s trusted execution environments to carry protection down to the GPU.

“With NVIDIA Confidential Computing in Cohere Model Vault, we’re extending hardware-rooted security directly to the GPU, protecting customer data in memory and across interconnects during execution,” said Phil Blunsom, Cohere’s chief technology officer.

Google Cloud is extending Confidential Bare Metal support to its A4X Max instances, which run on NVIDIA GB300 NVL72 systems. NVIDIA said the combination pairs non-virtualized accelerated computing with cryptographic protection for training data and model intellectual property.

NVIDIA did not say which of those providers will offer the bare-metal mode or what it will cost.

NVIDIA framed Confidential Computing as the infrastructure layer under its OpenShell reference architecture for safe AI agents, also announced Wednesday, and Google Cloud used the same show to set general availability timing for its Vera Rubin-based A5X instances.

Google Cloud’s Andrés Lagar-Cavilla, distinguished engineer and AI infrastructure security lead, said: “Google Cloud introduces Confidential Bare Metal to provide AI labs with hardware-isolated, non-virtualized compute environments and end-to-end cryptographic protection.”

Source: NVIDIA Blog