Announced 21 Oct 2026 · Sources checked
What NVIDIA announced
NVIDIA has added a third way to run its Confidential Computing technology, aimed squarely at the companies that build frontier AI models. Announced on 21 October 2026 at GTC Berlin, Confidential Bare Metal is meant to let a model builder rent dedicated GPU servers from a cloud provider, run its own full software stack on them, and still keep its model weights and data protected from that provider while they are in use.
NVIDIA Confidential Computing already came in two forms: Confidential Containers for Kubernetes environments and Confidential Virtual Machines for virtualised ones. Bare metal completes what NVIDIA now calls a converged security architecture, so customers can "match the right model to their trust boundaries and operating requirements", in the company's words.
Alongside it, NVIDIA said Confidential Computing now extends to its Grace Blackwell NVL72 rack-scale systems and to x86-based HGX Rubin NVL8 and DGX Rubin NVL8 servers, and that its DSX OS software for AI factories will support all three confidential modes.
Why bare metal is the hard case
Confidential computing protects data while it is being processed, not just when it is stored or sent over a network. The usual approach puts the sensitive workload inside a trusted execution environment, an isolated area enforced by the hardware, so that even the operator of the machine cannot read what is inside. Cloud providers normally sit between the customer and the hardware through a hypervisor and host software that they control.
Bare metal removes that layer. A bare-metal customer gets the whole physical server and installs its own operating system, drivers and host software. Frontier labs like this because it gives them maximum performance and lets them use the same stack across many providers, a point Lambda makes in its own announcement. The trade-off is that the usual confidential-VM approach, which relies on the provider's virtualisation layer, does not fit.
NVIDIA's answer is a set of new platform security controls. The company says they protect data in transit, measure platform integrity and enforce hardware-level access restrictions, so that a model builder can "own and operate their bespoke software stack, including host and platform infrastructure software" on third-party cloud, neocloud and enterprise machines.
How the protection works
NVIDIA describes the core mechanism in two parts: hardware-rooted isolation and cryptographic attestation. Isolation means the GPU and the protected memory are walled off by the hardware rather than by software the provider controls. Attestation means the machine can produce a signed report of exactly what firmware and software it is running, which the customer checks before sending any model weights or data.
Google Cloud's GTC Berlin post adds the most technical detail so far. It says its version extends hardware-rooted secure boot and attestation with encrypted DDR memory and encrypted NVLink interconnects, so prompts and models stay protected during both inference and training. Cohere describes the same idea as extending "hardware-rooted security directly to the GPU, protecting customer data in memory and across interconnects during execution."
The encrypted interconnect matters at rack scale. On an NVL72 system, 72 GPUs share data constantly over NVLink, and protecting each GPU in isolation would leave that traffic exposed. NVIDIA has not yet published a detailed architecture paper or performance figures for the bare-metal mode. The same hardware-backed approach is spreading in consumer AI too, for example in Brave's encrypted Leo chat, which runs models inside trusted execution environments.
Who is signing up
Google Cloud is the most concrete early adopter. It is introducing Confidential Bare Metal on A4X Max instances built on NVIDIA GB300 NVL72 systems, describing them as "hardware-isolated, non-virtualized compute environments" for AI labs. In the same post it said confidential G4 instances on RTX PRO 6000 Blackwell GPUs are generally available, and that its A5X Vera Rubin instances reach general availability next month. Google did not give a launch date for the bare-metal option.
Cohere plans to build Confidential Bare Metal into Cohere Model Vault, its isolated inference platform for enterprises. Lambda announced support in its own GTC Berlin post. NVIDIA lists CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr as supporting NVIDIA Confidential Computing deployments, and Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull as systems partners. The NVIDIA list covers Confidential Computing in general; only Google Cloud, Cohere and Lambda have spoken specifically about the bare-metal mode.
The launch sits within a wider NVIDIA security push at GTC Berlin. The company also announced an OpenShell Reference Architecture for running AI agents safely, which partners such as Red Hat are bringing to their platforms, and its DSX POD design for quickly deployed AI factories.
Why model builders care
The target customer is clear from NVIDIA's own wording: frontier model builders that need more capacity than they own. Model weights are among the most valuable assets these companies have, and running them on someone else's hardware means trusting that provider's staff, software and security. Confidential Bare Metal is designed so that the lab does not have to extend that trust as far.
That matters more as labs spread across clouds. OpenAI, for example, has just said its models are coming to Google Cloud, and labs increasingly buy capacity from neoclouds such as CoreWeave, Nebius and Nscale as well as the big three providers. NVIDIA says the expanding ecosystem gives model builders "more geographic, sovereign and operational options" for training and inference.
For providers, it is a sales argument. NVIDIA says Confidential Bare Metal gives supported clouds a path to serve "high-value workloads that require strong model and data privacy protections", work that might otherwise stay in a lab's own data centre. For enterprises using a model, the same protection could apply to their prompts and documents, which is the angle Cohere and Google emphasise.
What is not known yet
Much of the detail is still missing. NVIDIA has not said when Confidential Bare Metal will be generally available, which providers will offer it first beyond Google Cloud and Lambda, or what it costs. There are no published figures on how much encryption of memory and NVLink traffic slows training or inference, a question that matters at the scale of a 72-GPU rack.
Confidential computing also has limits that apply here. Attestation ultimately relies on keys and firmware from the hardware maker, so customers are shifting trust to NVIDIA rather than removing it. Trusted execution environments from several chipmakers have faced side-channel and physical attacks over the years, and no independent security review of the bare-metal mode has been published.
What is clear is the direction. As AI labs rent more of the world's GPU capacity, NVIDIA wants the answer to "can we trust this provider with our model?" to depend less on the provider and more on the chip. Whether frontier labs actually move their most sensitive weights onto rented bare metal under these protections is the test to watch.
Common questions
What is NVIDIA Confidential Bare Metal?
A deployment option for NVIDIA Confidential Computing that lets a customer run its own full software stack on a dedicated, non-virtualised GPU server from a third party while hardware isolation and cryptographic attestation protect its models and data in use.
Which providers support Confidential Bare Metal?
Google Cloud is bringing it to A4X Max instances on GB300 NVL72, Lambda has announced support, and Cohere plans to use it in Cohere Model Vault. NVIDIA has not given general availability dates.
Does confidential computing remove the need to trust anyone?
No. It reduces how much a customer must trust the cloud provider, but attestation relies on the hardware maker's keys and firmware, and the approach has not yet been independently reviewed for this mode.
Sources & further reading
How this story was made
Written by Kristian Kostov with AI assistance and checked against the linked sources. Company performance claims are attributed to the company. Analysis reflects AiLookout’s interpretation; we have not independently tested the products discussed. The cover places the companies’ own logos, taken from public-domain or openly licensed files credited in the caption, on a plain background. It is not a product photograph, a screenshot, or an endorsement.
Our editorial standards
