NVIDIA Extends AI Model Protection to Rented Dedicated Servers
A new Confidential Bare Metal option lets companies keep direct control of their models and data even on dedicated servers run by outside providers. Google Cloud is expanding support, and Cohere says it plans to adopt it.
On October 21, NVIDIA announced that it is adding a new option, Confidential Bare Metal, to its NVIDIA Confidential Computing security technology. The feature lets companies that build AI models run sensitive workloads on dedicated servers operated by an outside provider while keeping direct control over their models and data. NVIDIA described it as foundational technology that protects models and data even while AI is actively running.
What gets protected on a rented server
The heart of the announcement is a wider protection perimeter for workloads that run on someone else’s computing resources. NVIDIA built in features that protect data in transit, verify that the system has not been tampered with, and block access at the hardware level. Model developers, the company said, can configure and operate even the software stack their deployment requires on an outside server equipped with these capabilities.
Confidential Bare Metal uses a dedicated server as-is, with no sharing among multiple tenants. That brings the number of NVIDIA Confidential Computing options to three. Alongside the new approach, there is Confidential Containers for Kubernetes environments, which bundle and manage multiple programs, and Confidential Virtual Machines for environments where servers are partitioned. Enterprises can pick based on how far they are willing to trust an outside provider and how they want to run their systems.
Where it shows up first
Cohere plans to combine Confidential Bare Metal with Cohere Model Vault, its enterprise offering. The idea is to extend hardware-based security to the GPU, protecting models and data as they sit in memory and move across the interconnects between devices while the AI generates responses. The protection covers not just the data enterprise customers entrust to the service, but also the models that power it.
Image: NVIDIA Blog
Google Cloud is expanding support through its A4X Max offering, which is built on NVIDIA GB300 NVL72 systems. The company says adding cryptographic protection to an unpartitioned server environment safeguards training data and model intellectual property. NVIDIA said that as more providers come on board, model developers will have broader choices of region and operating model as they scale training and inference around the world.
How far has hardware support expanded
The list of supported hardware has grown as well. NVIDIA said it supports Grace Blackwell NVL72 along with the x86-based HGX Rubin NVL8 and DGX Rubin NVL8. Even on NVL72 systems, which tie many devices together into a single rack, models and data can be protected while in use. NVIDIA explained that it isolates the workload environment in hardware and uses cryptographic techniques to verify that a system can be trusted.
Cloud and server vendors are lining up behind it. CoreWeave, Google Cloud, and Microsoft Azure Infrastructure, among others, support NVIDIA Confidential Computing. System partners including Cisco, Dell Technologies, HPE, and Lenovo plan to support the feature on NVIDIA-Certified Systems. NVIDIA DSX OS, the company’s operations software, will support all three approaches, serving, NVIDIA says, as the software foundation cloud providers use to build and run AI facilities.
The audience for this announcement is AI services and model developers that handle sensitive enterprise data. Companies that want to use outside servers while still protecting data in use now have another option.