Robots Atlas>ROBOTS ATLAS
Security & Privacy

Confidential Computing

2019ActivePublished: 22 October 2026Updated: 22 October 2026Published
Key innovation
Protects data and code while in use (during computation) inside a hardware-based trusted execution environment (TEE), with the environment's authenticity verified through remote attestation — complementing encryption of data at rest and in transit.
Category
Security & Privacy
Abstraction level
Pattern
Operation level
InferenceServingDeployment
Use cases
Confidential AI model inference in the public cloudConfidential training of models on sensitive dataProtecting proprietary model weights from the infrastructure providerMulti-party machine learning and data clean roomsProcessing of regulated data (healthcare, finance)Privacy-preserving analytics

How it works

Confidential computations run inside a hardware TEE instantiated on a CPU or GPU. TEE memory is hardware-encrypted, and the hardware enforces a trust boundary that defines the trusted computing base (TCB) — the set of elements able to access the data. A key element is remote cryptographic attestation: the environment presents a signed, verifiable attestation report proving it is genuine and running with an acceptable security posture; only after the relying party verifies it are data or keys released. Implementations differ in isolation level: virtual machine (e.g. Intel TDX, AMD SEV-SNP), application/process (e.g. Intel SGX), or function/library. The NVIDIA H100 was the first GPU to add hardware confidential computing for AI, establishing a chain of trust via secure boot, an SPDM session with the CPU TEE, and a signed attestation report; in CC-On mode GPU compute and HBM bandwidth are unchanged, while the encrypted CPU–GPU interconnect becomes the bottleneck.

Problem solved

Data being processed in a CPU/GPU and memory typically exists in a decrypted state and is exposed to inspection or tampering by privileged software (hypervisor, operating system) and by infrastructure administrators or the cloud provider. Encryption at rest and in transit does not protect data at this critical moment. Confidential computing closes this gap by protecting data and code during computation.

Components

Trusted Execution Environment (TEE)Executes computation on confidential data in isolation.

A hardware-isolated environment on a CPU or GPU where code and data are protected from the rest of the system, including the operating system and hypervisor.

Remote attestationEstablishes trust in the environment before data is released.

A cryptographic process in which the TEE presents signed, verifiable evidence of its authenticity and security state before it is given data or keys.

Memory encryptionProtects data in memory during processing.

A hardware mechanism that encrypts the contents of memory assigned to the TEE, preventing plaintext reads from outside the enclave/VM.

Trusted computing base and trust boundaryDefines the threat model and scope of trust.

The set of hardware, firmware and software elements able to access confidential data; the trust boundary defines what sits inside the TCB.

Implementation

Reference implementations
Open Enclave SDK
C/C++ · Confidential Computing Consortium
Enarx
Rust · Confidential Computing Consortium
Implementation pitfalls
Side-channel attacksHigh

Researchers have demonstrated architectural and side-channel attacks effective against TEEs, e.g. against Intel SGX and CIPHERLEAKS against AMD SEV-SNP.

Fix:Hardware/firmware updates and TCB recovery mechanisms mitigate vulnerabilities as they are discovered.
CPU–GPU interconnect overheadMedium

In confidential mode on the H100, GPU compute and HBM bandwidth are unchanged, but the encrypted CPU–GPU interconnect limits bandwidth to about 4 GB/s.

Fix:Minimize CPU–GPU transfers and keep data/compute GPU-side.
Attestation trust and TCB sizeMedium

Without correct attestation a compromised system can impersonate a trusted one; a large trusted computing base increases the attack surface.

Fix:Rigorously verify attestation reports and minimize the TCB.

Evolution

2015
Intel SGX in 6th-generation Intel Core (Skylake) CPUs
Inflection point

One of the first mainstream hardware TEEs, with application-level (enclave) isolation.

2019
Formation of the Confidential Computing Consortium
Inflection point

CCC formed under the Linux Foundation; founding premiere members: Alibaba, Arm, Google Cloud, Huawei, Intel, Microsoft, Red Hat. Standardized the term and definition.

2021
Intel TDX — VM-level TEE

Intel proposed Trust Domain Extensions (May 2021), isolating entire virtual machines from the hypervisor and host.

2023
NVIDIA H100 — confidential computing on the GPU
Inflection point

First GPU support for confidential computing, protecting data and code during AI training and inference.

Hyperparameters (configurable axes)

Isolation levelHigh

Granularity of isolation enforced by the TEE: virtual machine, application/process, or function/library. Determines the size of the trusted computing base.

VM isolationVirtual machine isolation (e.g. Intel TDX, AMD SEV-SNP).
Application/process isolationApplication/process isolation (e.g. Intel SGX).
Function/library isolationSingle function or library isolation.

Hardware requirements

Primary

CPU-based hardware TEEs (Intel SGX/TDX, AMD SEV-SNP, Arm CCA) are the foundation of confidential computing.

Good fit

The NVIDIA H100 was the first GPU to add confidential computing for AI training and inference.