NVIDIA Introduces Confidential Bare Metal for AI Training and Inference

NVIDIA added a third confidential deployment mode

NVIDIA announced Confidential Bare Metal on October 21, 2026 for model builders running sensitive training or inference on dedicated third-party infrastructure. It joins two existing patterns: Confidential Containers for Kubernetes workloads and Confidential Virtual Machines for virtualized environments. The new path is aimed at organizations that want to own the complete software stack without placing the infrastructure provider inside the runtime trust boundary.

This is an infrastructure release, not a model or hosted inference API. The buyer supplies or chooses the model, serving or training stack, trust policy and key service. NVIDIA names Grace Blackwell rack-scale and Vera Rubin as the initial platform scope in the Dev Beta documentation, while its announcement also discusses Grace Blackwell NVL72, HGX Rubin NVL8, DGX Rubin NVL8 and future DSX OS integration.

Measured handoff gates model and data release

The provider prepares dedicated hardware and handles data-center operations. The tenant then appraises measured-launch and platform-attestation evidence against its own policy before releasing model weights, data or runtime secrets. NVIDIA’s documentation says the tenant controls the host OS, kernel, drivers, optional hypervisor or Kubernetes layer, workload, verifier policy and remote keys.

That control is also an obligation. The tenant must harden and patch the stack, protect storage, networking and RDMA paths, operate monitoring and key services, and re-attest after resets or relevant changes. A successful hardware attestation is therefore one gate in a larger deployment system; it is not proof that the model server, container image, access policy or application is safe.

The threat boundary has explicit exclusions

Confidential Bare Metal is designed to prevent the infrastructure owner from reading runtime plaintext through ordinary management access, including the baseboard management controller without tenant host credentials. Its claim depends on qualified hardware and firmware, enabled protection settings, accepted measurements, a trusted verifier and key service, and hardened tenant software.

The documentation is equally important about what remains trusted or out of scope. The tenant’s own privileged administrators and software can still access plaintext. Downstream prompts and outputs are not protected from the tenant or its serving application. NVIDIA also excludes infrastructure-owner denial of service, all physical attacks and all side-channel attacks. Procurement language should preserve those limits rather than reducing them to “the cloud cannot see the model.”

Partner support is planned, not a complete availability matrix

NVIDIA says Cohere plans to integrate Confidential Bare Metal with Cohere Model Vault and Google Cloud is extending support to A4X Max instances powered by GB300 NVL72. The announcement also lists cloud, neocloud and systems partners supporting broader NVIDIA Confidential Computing deployments. These statements establish ecosystem intent, not identical bare-metal availability across every named provider.

The reviewed pages do not provide a Confidential Bare Metal general-availability date, provider SKU, region list, capacity commitment, support tier, service-level agreement or price. The documentation itself is marked Dev Beta. Teams that need capacity now should request a provider-specific written matrix covering exact hardware, firmware, attestation evidence, key-service integration, tenancy, storage and network protection, regions, support and exit procedures.

Existing performance evidence does not benchmark bare metal

NVIDIA’s July technical post reports tests of Qwen3.5-397B-A17B-FP8 on HGX B300 using an Intel TDX confidential virtual machine, SGLang and a pinned software stack. Across two input-length settings and concurrency from 4 to 256, the displayed throughput and median time-per-output-token changes were roughly 1% to 8% versus confidential mode off. Those are NVIDIA-run results for one model, system and virtual-machine configuration.

They should not be presented as a measured overhead for Confidential Bare Metal. Secure work submission, encrypted transfer bandwidth, model shape, batch pattern, interconnect, framework and software version can all change the result. Benchmark the exact provider configuration with attestation and key release enabled, then include startup, model-load, first-token, steady-state throughput, failure recovery and re-attestation costs.

What AI infrastructure buyers should do next

Start with a written adversary and trust map. Name the infrastructure operator, tenant administrators, model-serving code, verifier, key service, control plane, storage, network, observability stack and downstream application. For each, record whether it can access plaintext or release keys. Reject any design whose marketing diagram and actual administrator privileges describe different boundaries.

Trial Confidential Bare Metal only on a named provider and qualified platform with reproducible evidence appraisal and a fail-closed key policy. Constrain access until reset, rollback, stale-evidence, firmware-change, network and denial-of-service drills pass. Wait when a purchasable SKU, region, capacity, price or support contract is mandatory. Reject the approach when the organization cannot own the host stack and key lifecycle or when the real threat is a trusted tenant administrator or application.

Disclosures

AccessAllGPT received no NVIDIA or provider account, hardware, software access, credits, model weights, security evidence, benchmark logs, private briefing, review, payment or compensation for this article. NVIDIA, Cohere, Google Cloud and other named partners did not sponsor, review or endorse it. AccessAllGPT did not test, certify or rank any deployment. AccessAllGPT Research is operated by NeuralArc, is independent, and is not affiliated with NVIDIA or any named partner. Publication-wide relationships are listed on the disclosures page.