Google Cloud said on 21 October 2026 that confidential computing, designed to protect data while it is processed, is generally available on its G4 virtual machines (VMs) with NVIDIA RTX PRO 6000 Blackwell graphics processing units (GPUs). The instances are offered in 36 zones on Compute Engine and Google Kubernetes Engine (GKE), after a preview announced on 23 June 2026. Google says support for Confidential Space, its service for multi-party data sharing, will reach general availability in the coming weeks.[1, 2]
Google's documentation lists one confidential G4 machine type, g4-standard-48, with one RTX PRO 6000 GPU on the AMD EPYC Turin central processing unit (CPU) platform. Its confidential computing technologies are AMD's Secure Encrypted Virtualization (SEV) and NVIDIA Confidential Computing, and the setup guide selects SEV. SEV-SNP (SEV with Secure Nested Paging) is listed only for N2D machines.[3, 4, 5]
Google's post says customers can use "hardware-rooted remote attestation" to check code and configuration before releasing data.[1] In remote attestation, a machine produces signed evidence of the software it loaded. For SEV, Google's attestation page names one signer of CPU attestation reports, a Google-managed virtual Trusted Platform Module (vTPM) that it calls software-based. Reports signed by the AMD Secure Processor, a hardware component, are listed only for SEV-SNP. For the GPU, the page describes nvattest, a Google tool on GitHub that checks the GPU's Video BIOS (VBIOS) firmware from within the VM.[6]
Google says that in its inference tests of models including Llama 3, Llama 3.3, ResNet-50 and SDXL, throughput was less than 3.5% below that of standard G4 instances. Vertebrae, a customer, said its benchmark showed 5.2% higher end-to-end latency.[1] Among the limitations documented for G4, GPU attestation might fail with a mismatched measurement (a recorded hash) at index 9 until the VM is fully stopped and restarted, and confidential GPU VMs cannot form multi-node clusters.[3, 4, 6]
Sources
- Hardware-backed security at global scale: Confidential G4 with NVIDIA Blackwell is GA
- Verifiable, private AI: Google Cloud expands Confidential Computing frontiers
- Supported configurations (Confidential VM documentation)
- GPU machines in accelerator-optimized machine family (Compute Engine documentation)
- Create a Confidential VM instance with GPU
- Confidential VM attestation
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
84d153a701802fe831a94e92ccbfb9b005c75688ba04c9d69fc23e468d28e31b
