NVIDIA Confidential Bare Metal brings hardware-rooted security to dedicated third-party GPU infrastructure
NVIDIA announced Confidential Bare Metal at GTC Berlin on October 21, 2026, extending its Confidential Computing platform to dedicated, non-virtualized GPU infrastructure for organizations training or serving sensitive models on third-party clouds.
The new deployment option applies hardware-rooted trusted execution to bare-metal instances, so frontier model builders, sovereign AI operators, and enterprise teams can run sensitive training and inference workloads on infrastructure they do not own while retaining cryptographic control over model weights, training data, and execution state.
NVIDIA is adding platform security controls that protect data in transit, measure platform integrity, and enforce hardware-level access restrictions, letting model builders own and operate their full software stack, including host and platform infrastructure software, on third-party accelerated computing.
Confidential Computing now offers a converged architecture with three deployment options: Confidential Bare Metal for dedicated infrastructure, plus existing options for virtualized and Kubernetes environments (Confidential Containers).
The protections are expanding across NVIDIA Grace Blackwell and Rubin systems and will integrate with NVIDIA DSX OS as a reference architecture for cloud providers building AI factories.
Buyer read: for CISOs weighing neocloud or sovereign-cloud training runs, this is the piece that makes third-party bare metal a defensible option for crown-jewel weights. It is an architecture announcement, so before committing, security teams should confirm which providers actually offer Confidential Bare Metal instances, what attestation and key-custody flow their workloads get, and how platform integrity measurements are surfaced to their own monitoring.