TodayToday's edition
NVIDIA says model builders can keep control of models and data on rented bare-metal GPU servers. Google's A4X Max is named and Cohere only plans to adopt it; pricing and dates are not given.
2 min readAI-assisted
NVIDIA's own illustration for the announcement, not a photo of a specific installation.
Image: NVIDIA
Source · Press image from the NVIDIA blog, used for news reporting.
NVIDIA said on Oct. 21 it is adding Confidential Bare Metal, a third deployment option for NVIDIA Confidential Computing, so frontier model builders can run on dedicated third-party GPU servers while keeping control of their models and data.
The company said the option lets customers operate their own host and platform software on bare-metal instances at cloud, neocloud and enterprise operators. NVIDIA is also adding platform controls that protect data in transit, measure platform integrity and enforce hardware-level access limits. Confidential Computing now spans Confidential Bare Metal, Confidential Containers for Kubernetes and Confidential Virtual Machines, according to NVIDIA's blog post.
NVIDIA says Confidential Bare Metal joins Containers and Virtual Machines as the third deployment option, according to its blog post.
Illustration (AI-generated)
Support now covers Grace Blackwell NVL72 rack-scale systems and x86-based HGX Rubin NVL8 and DGX Rubin NVL8 systems, NVIDIA said. Google Cloud is extending Confidential Bare Metal to its A4X Max instances, which run on GB300 NVL72. Google says the instances add hardware-rooted secure boot and attestation, with encrypted memory and NVLink interconnects, to protect prompts and models during training and inference.
Cohere is the one named model builder, and it is a plan rather than a launch: the company intends to build the option into Cohere Model Vault. NVIDIA listed CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr as providers that support Confidential Computing deployments. Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull are to support it through NVIDIA-Certified Systems.
The practical change is who can rent which racks. Labs that would not put model weights on shared virtualized infrastructure now have a vendor-backed path to rack-scale systems that third parties own and power. That widens the pool of sites a model builder can use, including sovereign and regional ones, which is the framing NVIDIA itself uses. For neocloud operators filling Vera Rubin and GB300 capacity, as Voltgrid has covered, it removes one objection from high-value tenants. NVIDIA also says DSX OS, its software base for AI factories, will support all the confidential modes.
Google Cloud's own post adds that confidential computing on its G4 instances, backed by RTX PRO 6000 Blackwell Server Edition GPUs, is now generally available. That is a separate, smaller product from A4X Max.
NVIDIA's post gives no pricing, regional availability or start date for Confidential Bare Metal, and no figure for the performance cost of the added protections. Google gives no availability date for A4X Max with the feature. Cohere's integration is still a plan. All performance and security statements are vendor claims, and none comes from an independent test. The security work follows NVIDIA's separate OpenShell agent-security architecture, announced the same day.
