On October 21, 2026, NVIDIA announced Confidential Bare Metal. It is a new way to deploy NVIDIA Confidential Computing that lets frontier model builders rent dedicated, non-virtualized GPU servers from a cloud, neocloud or enterprise operator. They can run their own host and platform software on those servers and keep their model weights and data protected from the operator. NVIDIA has not given an availability date or pricing.
What NVIDIA announced on October 21, 2026
The announcement is an NVIDIA Blog post by John Fanelli, published October 21, 2026 alongside NVIDIA's GTC Berlin news. Its main points:
- A new deployment option. Confidential Bare Metal is for dedicated third-party infrastructure, and the builder keeps control of its models and data.
- New platform security controls. NVIDIA says these protect data in transit, measure platform integrity and enforce hardware-level access restrictions.
- Builder-owned software stack. The controls let builders use bare-metal instances to own and operate their own software stack, including host and platform infrastructure software, on third-party cloud, neocloud and enterprise infrastructure.
- Wider hardware support. Support now covers Grace Blackwell NVL72 rack-scale systems and the x86-based HGX Rubin NVL8 and DGX Rubin NVL8 systems.
- DSX OS. NVIDIA says DSX OS, its reference architecture for cloud providers building AI factories, will support all Confidential Computing modes.
Why bare metal matters for confidential AI
Confidential computing protects data while it is being processed, not only when it is stored or moving over a network. NVIDIA's product page says its implementation runs AI workloads inside a hardware-enforced trusted execution environment (TEE) on Rubin, Blackwell and Hopper GPUs. It covers training data, fine-tuning datasets, inference prompts and model weights. Hardware-rooted attestation lets a customer check that the environment can be trusted before sending it sensitive code or data.
Before this announcement, a model builder renting GPUs usually had two choices:
- Run inside the provider's virtual machines or Kubernetes, where the provider controls the host software.
- Take bare-metal servers for full control of the stack, without confidential-computing guarantees against the infrastructure owner.
Confidential Bare Metal is meant to remove that trade-off. The builder controls the whole server image, and hardware isolation plus attestation are meant to stop the operator from reading the workload. This matters most to labs whose model weights are their most valuable asset and who rent capacity from many providers.
Three NVIDIA options by environment
Which option matches the environment where a sensitive model workload runs?
| Option | Environment NVIDIA names | What NVIDIA says it is for | Source |
|---|---|---|---|
| Confidential Bare Metal | Bare-metal infrastructure | Dedicated third-party infrastructure, with the builder keeping control of models and data | Source: NVIDIA, accessed Oct 21, 2026 |
| Confidential Containers | Kubernetes environments | Not stated in the announcement | Source: NVIDIA, accessed Oct 21, 2026 |
| Confidential Virtual Machines | Virtualized environments | Not stated in the announcement | Source: NVIDIA, accessed Oct 21, 2026 |
These are NVIDIA's own descriptions, and the announcement does not say which providers offer each option.
The three deployment options compared
NVIDIA now groups three options under what it calls a converged security architecture:
| Option | Environment |
|---|---|
| Confidential Bare Metal | Dedicated, non-virtualized servers; the model builder owns and operates the host software |
| Confidential Containers | Kubernetes |
| Confidential Virtual Machines | Virtualized environments |
NVIDIA does not rank the three by strength of protection, and it does not say that the container and VM options lack the new platform controls. Its framing is that organizations match the option to their trust boundaries and operating requirements. Teams already on Kubernetes or VMs would look at the matching option first. Teams that build their own host images would look at bare metal.
Performance and code changes
NVIDIA's Confidential Computing page says supported configurations run "at up to 98% of the performance of unsecured deployments," and that results "depend on the workload, platform, and configuration." This is a vendor figure, not an independent benchmark, and it is not specific to the bare-metal mode. The page also says many workloads need no changes to application code, but infrastructure must follow a supported configuration. It adds that the technology "does not certify a workload by itself," so compliance still needs a separate review.
Who is supporting it
Cloud and infrastructure providers that NVIDIA lists as supporting its Confidential Computing deployments: CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr. The list applies to the platform in general. NVIDIA does not say which of them offer the bare-metal mode today.
Systems makers: NVIDIA says Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull will support these capabilities through NVIDIA-Certified Systems.
Google Cloud: A4X Max
According to NVIDIA, Google Cloud is extending Confidential Bare Metal to A4X Max instances powered by GB300 NVL72 systems. The post quotes Andrés Lagar-Cavilla, a distinguished engineer and AI infrastructure security lead at Google Cloud, who describes the offering as hardware-isolated, non-virtualized compute for AI labs. Google's documentation lists an A4X Max bare-metal machine type, a4x-maxgpu-4g-metal, with four NVIDIA B300 GPUs, Grace CPUs, 144 vCPUs and 960 GB of memory.
Cohere: Model Vault
NVIDIA says Cohere plans to integrate Confidential Bare Metal into Cohere Model Vault. The plan uses trusted execution environments to extend hardware-rooted security to the GPU and to protect models and data in memory and across interconnects during execution. NVIDIA quotes Cohere CTO Phil Blunsom: "Enterprises trust Cohere to provide a secure and confidential platform for inference." No timeline was given.
GMI Cloud
On October 21, 2026, GMI Cloud published its own post saying it supports the new Confidential Bare Metal option and that its GB200 NVL72 and GB300 NVL72 clusters can run confidential workloads. That post also lists Vera Rubin NVL72 among supported systems, which NVIDIA's announcement does not mention. GMI Cloud gave no availability date or pricing.
What is still unknown
- Availability: neither NVIDIA nor its partners have given general-availability dates for Confidential Bare Metal, the Google Cloud A4X Max extension or the Cohere integration.
- Pricing: none disclosed.
- Provider coverage: it is not stated which listed providers offer the bare-metal mode now rather than other modes.
- Independent validation: no third-party security review or benchmark of the new platform controls has been published.
The next signals to look for are provider documentation listing a confidential bare-metal machine type and attestation documentation for Rubin-based systems.
