NVIDIA Expands Confidential Computing with Bare Metal Deployment Option

NVIDIA has announced an expansion of its Confidential Computing infrastructure, introducing a new deployment option called Confidential Bare Metal. This update allows frontier model builders to execute sensitive workloads on dedicated third-party infrastructure while maintaining control over their models and data, according to the company’s blog post.

Root cause

NVIDIA states that Confidential Computing serves as the infrastructure layer protecting models and data during execution. The company is expanding this layer with Confidential Bare Metal to enable frontier model builders to run sensitive workloads on dedicated third-party infrastructure while retaining control of their models and data.

Attack path

This release does not describe a vulnerability or attack vector. Instead, it details new security controls designed to prevent unauthorized access. These controls protect data in transit, measure platform integrity, and enforce hardware-level access restrictions. The goal is to safeguard bespoke software stacks, including host infrastructure, when operating across third-party cloud, neocloud, and enterprise systems.

Affected versions

NVIDIA Confidential Computing now offers three distinct deployment options for organizations to match their operational requirements. These include Confidential Bare Metal for bare-metal infrastructure, Confidential Containers for Kubernetes environments, and Confidential Virtual Machines for virtualized environments. Support extends to NVIDIA Grace Blackwell NVL72, HGX Rubin NVL8, and DGX Rubin NVL8 systems.

Mitigation

No fix is required as this is a feature announcement rather than a security flaw. Organizations can adopt the new architecture by selecting the appropriate deployment model based on their trust boundaries. The expanding ecosystem includes support from providers such as CoreWeave, Google Cloud, Microsoft Azure, and Vultr, enabling geographic and sovereign scaling options for training and inference workloads.

Why it matters

Security teams should understand that confidential computing uses hardware isolation to protect data while it is being processed, not just when stored or transferred. This matters because traditional encryption leaves data exposed during computation. By verifying platform integrity and restricting hardware access, organizations can run sensitive AI models on external infrastructure without trusting the host provider. Teams usually evaluate trust boundaries to decide between containers, virtual machines, or bare metal.

What to do and how to stay safe: NVIDIA

• Review current AI workload deployment strategies to determine if third-party infrastructure usage requires enhanced data privacy controls.
• Evaluate whether hardware-rooted isolation and cryptographic attestation are necessary for your specific model and data sensitivity levels.
• Check compatibility of existing software stacks with new confidential computing deployment options such as bare metal or containers.
• Monitor vendor announcements for integration updates with platforms like Kubernetes or specific GPU architectures to ensure continued support.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Confidential Bare Metal?

It is a new deployment option in NVIDIA Confidential Computing that allows sensitive workloads to run on dedicated third-party infrastructure while retaining control of models and data.

Which systems support the expanded Confidential Computing features?

Support extends to NVIDIA Grace Blackwell NVL72, x86-based HGX Rubin NVL8, and DGX Rubin NVL8 systems, integrating with NVIDIA DSX OS.

Are there any known vulnerabilities associated with this announcement?

No, this announcement details new security features and deployment options, not a security flaw or vulnerability.