answrsnow
AI Infrastructure · Explainer

What Is Confidential Computing and Why Does It Matter for AI in 2027?

By Kory White · Updated Oct 2026 · 10 min read
The open top of a multi-GPU server, with a row of GPU cards mounted above the PCIe slots
Direct answer

Confidential computing is the protection of data while it is being processed, not just while it is stored or sent. The Confidential Computing Consortium, an open community under the Linux Foundation, defines it as "the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment." In practice a processor (and now a GPU) creates an isolated space whose memory the host operating system, the hypervisor, the cloud operator and administrators are not supposed to read or change, and the workload proves what it is running through attestation before any secret is released to it.

For AI this matters because a model's weights, a customer's prompt and a training dataset are all plain text to the machine while the model runs. Hardware TEEs from Intel, AMD and Arm, NVIDIA's confidential computing mode for Hopper and Blackwell GPUs, and cloud products from Azure, Google Cloud and AWS are the official routes to closing that gap. Apple's Private Cloud Compute is a public example of the same idea applied to a consumer AI service.

Every fact below comes from an official standards-body, vendor or cloud documentation page read on October 31, 2026, and vendor claims are labelled as such. This page does not predict what will be standard in 2027, and it gives no overhead figure beyond the one NVIDIA states itself.

What confidential computing is

Data has three states, as the Consortium's technical paper puts it: in transit across a network, at rest in storage, and in use while a program processes it. Encryption for the first two is routine. The paper calls protecting data in use "the new frontier," because the processor has to see the data in the clear to compute on it, and so does anything that can read the machine's memory.

The Consortium's answer is the Trusted Execution Environment, or TEE. It defines a TEE as an environment that gives a level of assurance of three properties: data confidentiality, data integrity and code integrity. The unauthorized parties it names include other applications on the host, the host operating system and hypervisor, system administrators, service providers, the infrastructure owner, and anyone with physical access to the hardware. The paper adds that the definition is not tied to the cloud or to one kind of chip, and that trusted processing can also sit in a GPU or a network card.

Honest limit from the Consortium itself: its goal is to make reading data inside a TEE not an economically or logically viable attack, and it says there is no absolute security. It also says confidential computing does not attempt to address every threat vector.

The hardware behind it: Intel, AMD and Arm

Each major CPU family has its own TEE design. They share the goal of keeping a workload's memory opaque to the platform that hosts it, but they differ in what they isolate: whole virtual machines, or smaller pieces of an application.

Two details are worth knowing. Intel and AMD describe TDX and SEV-SNP as virtual-machine based, while SGX works at the level of enclaves that developers carve out of an application. And AMD notes that its SEV-TIO extension is designed to carry the TEE out to PCIe devices such as accelerators, which is the CPU-side step toward the GPU story below.

Attestation: how a TEE proves what it is running

Isolation alone is not enough, because you still need to know that the isolated environment is real and running the code you expect. That is the job of attestation. The Consortium describes it as a process in which a Verifier assesses the trustworthiness of an Attester. In its hardware example the Verifier sends a challenge, the trusted hardware gathers evidence about the software and data state and signs it together with the challenge, and the Verifier checks the signature and compares the evidence with reference values it considers trustworthy. Including the challenge is what shows the evidence is fresh.

The cloud products build their key handling on this. Microsoft says Azure confidential VMs boot only after successful attestation of the platform's critical components and security settings, and that key release is cryptographically bound to successful attestation. AWS says Nitro Enclaves can tie AWS Key Management Service operations to attestation, so a key policy can require that the enclave's measurements match. Google's Confidential Space lets data owners set conditions on attestation tokens so that only a workload that passes can decrypt the data.

Practical meaning: the secret, whether a model key or a dataset key, is released to the environment only after it proves its identity. Without that step a TEE is a sealed box you have to take on trust.

GPUs: NVIDIA confidential computing mode

AI work runs on accelerators, so a CPU-only TEE would leave the most valuable computation outside the boundary. NVIDIA's confidential computing page says the feature preserves the confidentiality and integrity of AI models deployed on Rubin, Blackwell and Hopper GPUs, and describes hardware-rooted attestation to verify compute assets. Its FAQ says attestation checks the environment's integrity before any sensitive code or data is released to it, and points to a Supported Platforms page for the exact GPU, CPU and deployment combinations.

Treat the 98% figure as a vendor ceiling, not a promise. NVIDIA's own FAQ says supported configurations are designed to run at near-native performance but that results vary, so a team should measure its own model, batch size and platform before relying on any overhead number.

What the big clouds offer

All three large clouds sell confidential computing, but the products are shaped differently.

A narrow aisle between two rows of black server cabinets in a data center
Photo: Robert.Harker / CC BY-SA 3.0 via Wikimedia Commons

Why it matters for AI

Four AI problems line up with what the official pages describe. None of these is a guarantee on its own; each depends on the platform, the configuration and the attestation policy you actually set.

Confidential computing also changes who has to be trusted. The Consortium's paper says that by anchoring security in hardware it is possible to remove operating system and driver vendors, platform vendors and service providers and their administrators from the list of parties you must trust.

A real example: Apple Private Cloud Compute

Apple's Security Research blog, in a post dated June 10, 2024, describes Private Cloud Compute for running AI requests in the cloud. It lists five design goals: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability and verifiable transparency.

The post is an initial overview, and Apple says a deeper technical follow-up would come after the service reached beta. Read it as a statement of Apple's design intent. It is useful here because it shows the same three ideas as the rest of this page, isolated execution, attestation before data is sent, and no administrator back door, assembled into one AI service.

Limits and what to ask before you adopt it

Confidential computing narrows who can see your AI workload; it does not make the workload safe by default. The official pages themselves list conditions.

If you are deploying AI agents, confidential computing is one layer among several, alongside identity, network isolation and logging. See the infrastructure needed to run AI agents in production for the wider picture, and the best confidential computing platforms for AI for a ranked list of products.

Questions people ask

What is confidential computing in one sentence?

The Confidential Computing Consortium defines it as the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment, so the host, hypervisor and operator are not supposed to read or alter what runs inside.

Is a TEE the same as encryption?

No. Encryption protects data at rest and in transit. A TEE protects data while it is processed, and the Consortium notes that its definition is not limited to solutions that use encryption, though encryption is the most common technique.

Does confidential computing work on GPUs?

Yes on supported systems. NVIDIA says its confidential computing preserves the confidentiality and integrity of AI models on Rubin, Blackwell and Hopper GPUs, and Azure sells an H100-based confidential GPU VM. Check the vendor's supported-platforms list for your exact hardware.

How much slower is it?

NVIDIA claims up to 98% of the performance of unsecured deployments and says results depend on workload, platform and configuration. No other overhead number is given here because none of the other official pages read states one.

What is attestation and why does it matter?

Attestation is how a TEE proves its identity and state to a verifier using hardware-signed evidence. It matters because keys and data should be released only to an environment that has proven it is the one you expect.

Is Apple Private Cloud Compute confidential computing?

Apple's own post describes attestation of nodes, a Secure Enclave, published software images and no privileged runtime access. It is presented as Apple's design, and this page treats it as a real-world example rather than a product you can buy.

Sources

Figures and statements were read from the linked pages on October 31, 2026. Several pages were read through a fetch tool that returns summaries, so confirm each detail on the vendor's own page before you build or buy. Vendor claims are the vendors' own. This page is not security or legal advice.

Top photo: Lawrence Systems / CC BY 3.0 via Wikimedia Commons

Share this page
LinkedIn: share linkLinkedIn: share post