Confidential computing protects data while it is being processed. Encryption already covers data at rest on a disk and in transit over a network, but to compute on data a system normally has to decrypt it in memory, where an administrator, a compromised operating system or another tenant could in principle read it. Confidential computing closes that gap by running the workload inside a hardware-protected area called a trusted execution environment (TEE), with memory encrypted and isolated even from the host. For AI, this now extends to the GPU, so prompts, model weights and results can stay protected during inference and training.
It matters most when you run sensitive AI workloads on infrastructure you don't fully control, such as a public cloud, a colocation provider or a shared internal cluster.
The three states of data
| State | Example | Usual protection |
|---|---|---|
| At rest | Files on an SSD or NAS | Disk and volume encryption |
| In transit | Data sent between systems | TLS, VPN |
| In use | Data in memory while a model runs | Confidential computing |
How does confidential computing work?
- CPU trusted execution environments. Intel TDX and AMD SEV-SNP run an entire virtual machine with encrypted memory that the hypervisor and host administrators can't read. This is called a confidential VM.
- GPU confidential computing. NVIDIA's documentation describes passing Hopper and Blackwell GPUs through to a confidential VM, extending protection to GPU memory and to data moving between the CPU and GPU. It requires a host with AMD SEV-SNP or Intel TDX.
- Attestation. Before any secret is released, the hardware produces a signed report of its identity, firmware and configuration. A verification service checks it against known-good values, and only then are keys, such as the key that decrypts model weights, delivered into the environment.
Attestation is the part that turns a claim into evidence. Without it, you are trusting that the mode was switched on. With it, you can verify that it was.
What does it protect against, and what doesn't it?
| Protects against | Does not protect against |
|---|---|
| Cloud or data-centre administrators reading memory | Vulnerabilities inside your own application |
| A compromised hypervisor or host operating system | Prompt injection and misuse by authorised users |
| Other tenants on shared hardware | Data you choose to send out of the environment |
| Theft of model weights from the infrastructure owner's side | Data-residency requirements |
The last row is often misunderstood. Confidential computing controls who can access data during processing. It says nothing about which country the data is in. See data residency vs data sovereignty.
Confidential computing changes the question from 'do we trust the operator?' to 'can we verify the hardware?' It reduces how many people and systems you have to trust. It doesn't reduce that number to zero.
Does it slow AI down?
Much less than it used to. In a 2026 engineering post, NVIDIA reported that confidential computing on Blackwell delivered about 98 percent of the performance of the same setup without it, with single-digit percentage overheads in its inference tests on a 397-billion-parameter model on HGX B300 under Intel TDX. Attestation happens once at start-up and adds no delay to individual requests. Results depend on the workload, so test your own.
Source: NVIDIA developer blog and confidential computing documentation (2026). Compiled 11 Nov 2026.
Do you need it if the AI runs on your own premises?
Often not. If the hardware sits in your own locked room, is managed by your own staff and holds only your own data, the operator you would be protecting against is yourself. Physical security, access control, disk encryption, patching and network isolation do most of the work; our DGX Station security hardening checklist and air-gapping guide cover them. Confidential computing becomes valuable when:
- the AI runs in a public cloud or a third party's data centre;
- several departments or customers share one cluster and must be isolated from each other;
- a vendor deploys its proprietary model on your hardware and wants its weights protected, or the reverse;
- several organisations want to compute on combined data without revealing it to each other;
- a regulator or client asks for verifiable, hardware-level evidence of isolation, common in finance and healthcare. See sending financial data to public AI models.
What hardware does it need?
- A CPU with a TEE. Server processors with Intel TDX or AMD SEV-SNP, enabled in the BIOS.
- A supported GPU. NVIDIA lists Hopper and Blackwell data-centre GPUs. Support varies by model, driver and mode, so confirm the exact GPU against NVIDIA's current documentation before buying.
- Current firmware and drivers. BIOS, BMC, GPU firmware and a driver release that supports confidential mode.
- A virtualisation stack that supports confidential VMs and an attestation service.
This is server and data-centre territory. Desktop AI systems are normally protected by the on-premises measures above rather than by GPU confidential computing. When specifying a GPU server for regulated work, ask for TDX or SEV-SNP support and GPU attestation in writing.
Buying in Singapore
For on-premises private AI, the NVIDIA DGX Spark 4TB (S$9,450) keeps data inside your office. For server builds, the NVIDIA RTX PRO 6000 Blackwell Server Edition (S$32,999), and to segment the AI network, the Fortinet FortiGate 90G (S$3,796.80) (listed 11 Nov 2026; prices change; ask for a current quotation). GPU servers such as the Lenovo ThinkSystem SR675 V3 and DGX Station GB300 systems such as the ASUS ExpertCenter Pro ET900N G3 are price on request; tell us if confidential computing support is a requirement so we can confirm it with the vendor. To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
What is confidential computing? Confidential computing protects data while it is being processed by running workloads in a hardware-based trusted execution environment whose memory is encrypted and isolated from the host, hypervisor and administrators.
Can GPUs do confidential computing? Yes. NVIDIA supports confidential computing on Hopper and Blackwell GPUs passed through to a confidential virtual machine on hosts with Intel TDX or AMD SEV-SNP, protecting GPU memory and CPU-GPU data transfers.
What is attestation? Attestation is a hardware-signed report of a system's identity, firmware and configuration that is verified against known-good values before secrets such as model decryption keys are released to it.
Does confidential computing satisfy data-residency rules? No. It controls who can access data during processing, not where the data is located. Residency and confidentiality are separate requirements.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
