On 21 October 2026 NVIDIA introduced Confidential Bare Metal (CBM), a deployment mode for NVIDIA Confidential Computing. The company says CBM lets model builders run their own software, host included, on dedicated NVIDIA systems that third-party clouds and enterprises operate, and keep control of their models and data.[1]
The documentation says this release covers Grace Blackwell rack-scale and Vera Rubin platforms. The builder controls the host operating system and drivers, the workload, its keys and its remote attestation policy. Before releasing model weights or other secrets, it appraises fresh platform evidence and the measurements (hashes) of the loaded software that a dynamic root of trust for measurement (DRTM) records at launch. No confidential virtual machine (CVM) is required, and NVIDIA tells builders to plan for substantial engineering.[2]
After handoff and that appraisal, NVIDIA says, the operator stays outside the builder's runtime trust boundary and has no authority to read the workload's unencrypted data. It still runs power, the baseboard management controller (BMC), fabric and storage, and can remove power or block traffic. Because the builder's administrators and software stay trusted, CBM does not protect end users' data from the builder. NVIDIA describes adding a CVM for that case.[2, 3]
The documentation also lists limits. On the Grace Blackwell baseline, CPU-to-GPU and CPU-to-CPU links are unencrypted, hardware encryption of PCI Express traffic is unavailable, and NVLink encryption for GPU-to-GPU traffic does not cover those links or network traffic. CPU memory encryption alone does not protect against alteration or replay, and CBM offers no general protection against invasive hardware attacks or timing, cache and power side channels.[3]
NVIDIA says Cohere plans to integrate CBM into Model Vault.[1] Google Cloud says it is introducing CBM on A4X Max instances with GB300 NVL72 systems.[4]
Sources
- NVIDIA Confidential Computing Expands, Enabling Frontier Model Builders to Securely Scale Across Global Infrastructure
- Confidential Bare Metal (documentation, version Dev)
- Trust and Threat Model (Confidential Bare Metal documentation, version Dev)
- Google Cloud and NVIDIA expand co-engineering collaboration to scale infrastructure for the agentic era
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
9e0cd5bf629bf6500a8e8fe5a4e10f354c1c475103255dbf67eef30b266de324
_22.png){kind=link}