NVIDIA adds Confidential Bare Metal for frontier model builders

What Confidential Bare Metal does

According to NVIDIA, Confidential Bare Metal is a new deployment option for NVIDIA Confidential Computing. It targets frontier model builders who want to use dedicated infrastructure run by someone else without giving up control of their models and data.

NVIDIA is introducing new platform security controls alongside it. They protect data in transit, measure platform integrity and enforce hardware-level access restrictions. With these controls, model builders can use bare-metal instances to own and operate their bespoke software stack, including host and platform infrastructure software. This applies on NVIDIA accelerated computing infrastructure across third-party cloud, neocloud and enterprise environments.

NVIDIA Confidential Computing now offers a converged security architecture with three deployment options:

• Confidential Bare Metal for bare-metal infrastructure
• Confidential Containers for Kubernetes environments
• Confidential Virtual Machines for virtualized environments

NVIDIA says organizations can match the right model to their trust boundaries and operating requirements.

Cohere and Google Cloud sign on

Cohere plans to integrate Confidential Bare Metal into Cohere Model Vault. It will use NVIDIA Confidential Computing trusted execution environments to extend hardware-rooted security to the GPU, protecting models and data in memory and across interconnects during execution. "Enterprises trust Cohere to provide a secure and confidential platform for inference," said Phil Blunsom, chief technology officer at Cohere.

Google Cloud is extending support for Confidential Bare Metal to A4X Max instances powered by NVIDIA GB300 NVL72 systems. NVIDIA says these will combine non-virtualized accelerated computing with cryptographic protection for training data and model intellectual property. Andrés Lagar-Cavilla, distinguished engineer and AI infrastructure security lead at Google Cloud, said the offering aims "to provide AI labs with hardware-isolated, non-virtualized compute environments and end-to-end cryptographic protection."

Wider hardware and partner support

NVIDIA Confidential Computing uses hardware-rooted isolation and cryptographic attestation to help protect models and data during execution. Support now extends to NVIDIA Grace Blackwell NVL72, which brings Confidential Computing to NVL72 rack-scale systems. It also covers x86-based NVIDIA HGX Rubin NVL8 and NVIDIA DGX Rubin NVL8 systems.

NVIDIA lists CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr as supporting NVIDIA Confidential Computing deployments. Systems partners Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull will support the capabilities with NVIDIA-Certified Systems.

The technology will also integrate with NVIDIA DSX OS, a reference architecture for cloud providers building AI factories. NVIDIA says DSX OS will support all Confidential Computing modes, giving providers a software base for confidential workloads.

What it means for model builders

NVIDIA frames the release as a way for providers to serve high-value workloads that require strong model and data privacy protections. For model builders, it says the growing ecosystem offers more geographic, sovereign and operational options for scaling training and inference worldwide.

The announcement sits within NVIDIA's wider push to help organizations deploy agents safely. The company describes Confidential Computing as the infrastructure layer that protects the models and data those agents rely on while running. The source gives no pricing or availability dates for Confidential Bare Metal.