---
title: What is confidential AI?
description: Confidential AI explained: confidential computing on NVIDIA GPUs, Azure and Apple Private Cloud Compute, what it protects, what it misses, how to check it.
canonical: https://privatesuperintelligence.si/blog/confidential-ai/
last-updated: 2026-10-15
---

# What is confidential AI?

Confidential AI is AI that runs inside a hardware-protected enclave, called a trusted execution environment, so that your prompts, data and the model stay encrypted even while the processor is working on them. The cloud operator, the hypervisor and other tenants on the same server cannot read what is inside, and attestation lets you check what software is running before you send anything. It protects data in use, the stage that standard encryption at rest and in transit leaves open.

The term also gets used loosely, for any AI a vendor calls private. That makes it worth asking which of the two a vendor means.

## How confidential computing works for AI

Standard cloud encryption protects data on disk and on the wire. The moment a GPU processes a prompt, the data has to be decrypted in memory, and anyone with enough control of the machine (a cloud administrator, a compromised hypervisor) could in principle read it. Confidential computing closes that gap with three pieces:

- **A CPU enclave.** Intel TDX or AMD SEV-SNP isolates a confidential virtual machine from the host. NVIDIA's whitepaper lists one of these as a requirement for confidential computing on its GPUs.
- **A GPU inside the enclave.** NVIDIA Hopper (H100) and Blackwell GPUs extend the protected boundary to GPU memory. Data crossing between CPU and GPU travels encrypted, either through encrypted "bounce buffers" or, on newer systems, through the GPU's TEE-IO capability.
- **Attestation.** The hardware signs a report of what firmware and software are loaded, so you or your vendor can verify the environment before it receives keys or data.

## What the main platforms offer

**NVIDIA.** NVIDIA says its confidential computing protects GPU execution, memory and register states, keeping models, training data and prompts isolated, on Hopper, Blackwell and Rubin GPUs. It says Blackwell runs at up to 98% of the performance of unsecured systems, and that a model can move into a protected enclave without code changes. In confidential mode, NVIDIA locks out the server's management controller from paths that reach tenant data, disables JTAG debugging, and turns off the performance counters that could leak information through side channels.

**Microsoft Azure.** Azure's confidential GPU virtual machines, the NCCadsH100v5 series, pair AMD 4th Gen EPYC processors running SEV-SNP with NVIDIA H100 GPUs, so the trusted environment spans the confidential VM and the attached GPU. Microsoft's documentation notes practical limits: Ubuntu 22.04 LTS as the qualified image, no resizing, and high availability and disaster recovery left to you.

**Apple Private Cloud Compute.** Apple built Private Cloud Compute (described June 10, 2024) for Apple Intelligence requests that need larger models than a device can run. It runs on Apple silicon servers with the Secure Enclave and Secure Boot. Apple set five requirements: stateless computation on personal data, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency. Your device encrypts each request to the public keys of specific, certified nodes, and load balancers outside the trust boundary can't decrypt it. Apple says it publishes every production build for researchers to inspect, with an append-only transparency log. Apple's post also names the problem it set out to fix: with typical cloud AI, researchers have no way to verify a provider's privacy promise.

## Where confidential computing helps

- **Against the cloud operator.** If your worry is a cloud administrator or a compromised host reading prompts in memory, this is the control built for it.
- **Against other tenants.** Shared GPU servers stop being a route to your data.
- **For proof.** Attestation turns "trust us" into a report you can check. For a general counsel or a family office CIO, that's the difference between a policy and evidence.
- **For model owners.** It protects model weights as well as data, which matters if you fine-tune a model on your own documents.

## Where it doesn't help

NVIDIA's whitepaper is direct about the limits. Sophisticated physical attacks and denial-of-service attacks are out of scope. A malicious host can still cut network access or power to your machine; it just can't read the keys.

The bigger gap sits above the hardware. Confidential computing protects data while the processor handles it. It says nothing about what the application does next: whether the service logs your prompts to a database, keeps outputs for 30 days of abuse monitoring, sends a web query to a search engine, or lets an agent email someone. An enclave that runs software which stores every conversation still stores every conversation. That is why confidential computing sits alongside [zero data retention](/blog/zero-data-retention-ai/), access controls and deployment choices, and does not replace them. Our guide to [private AI versus public AI](/blog/private-ai-vs-public-ai/) covers the deployment side, including air gaps.

## How to check a vendor's "confidential AI" claim

| Ask | A good answer names |
|---|---|
| Is inference running in a trusted execution environment? | The CPU technology (TDX or SEV-SNP) and the GPU (H100, Blackwell) |
| Can we see an attestation report? | Who verifies it, and what happens if verification fails |
| Which parts of the service run outside the enclave? | Load balancers, logging, search, file storage, connectors |
| What is stored after a response, and for how long? | A retention period in the contract, ideally none |
| Can your staff reach our data at runtime? | No shells or debug access in production, as Apple describes for PCC |
| Where does it run? | The region, the cloud, or your own hardware |

If a vendor answers the first question and goes quiet on the rest, you have learned what you need to know.

## Private SuperIntelligence

Private SuperIntelligence from Mitosis Labs is the most capable AI, trusted with everything. It treats privacy as six layers: retention and deletion, communication, access and actions, model inference, data storage, and deployment. Each deployment is built for one client, from the hardware to the choice of model provider to where the data is stored, and the provider keeps no copy of the work, trains nothing on it and cannot see the outputs. Read the full definition of [private superintelligence](/blog/what-is-private-superintelligence/), or [register interest](/#waitlist).

## Frequently asked questions

### What is the difference between confidential AI and private AI?

Confidential AI usually refers to confidential computing: hardware that keeps data encrypted while a model processes it. Private AI is broader, covering retention, who can access data, what the system can do on your behalf, and where it runs.

### Does confidential computing slow AI down?

Some overhead exists. NVIDIA says Blackwell confidential computing runs at up to 98% of the performance of unsecured systems.

### Which GPUs support confidential computing?

NVIDIA lists Hopper (H100), Blackwell and Rubin. On Azure, the NCCadsH100v5 series offers confidential VMs with H100 GPUs.

### Is Apple Private Cloud Compute confidential AI?

It is Apple's version, built on Apple silicon servers instead of NVIDIA GPUs, and it applies to Apple Intelligence requests. Apple adds a public transparency log of production software so researchers can check its claims.

### Is confidential AI enough for privileged legal work?

It protects one stage: data in use. A law firm still needs to know retention, access, and where outputs go, and should check its professional rules. This is general information, not legal advice.


## Related reading

- [Is ChatGPT safe for confidential information?](/blog/is-chatgpt-safe-for-confidential-information/)
- [What is zero data retention AI?](/blog/zero-data-retention-ai/)
- [How to keep company data private when using AI](/blog/keep-company-data-private-with-ai/)
- [Private AI vs public AI](/blog/private-ai-vs-public-ai/)
- [Is Claude, Copilot or Gemini safe for confidential information?](/blog/is-claude-copilot-gemini-safe-for-confidential-information/)
- [Private ChatGPT for business: the options](/blog/private-chatgpt-for-business/)
- [What is private superintelligence?](/blog/what-is-private-superintelligence/)

## Sources

- [NVIDIA Confidential Computing (NVIDIA)](https://www.nvidia.com/en-us/data-center/solutions/confidential-computing/), accessed 2026-10-15
- [NVIDIA Secure AI with Blackwell and Hopper GPUs, white paper WP-12554-001 v1.3 (NVIDIA, August 2025)](https://docs.nvidia.com/nvidia-secure-ai-with-blackwell-and-hopper-gpus-whitepaper.pdf), accessed 2026-10-15
- [Azure Confidential GPU options (Microsoft Learn)](https://learn.microsoft.com/en-us/azure/confidential-computing/gpu-options), accessed 2026-10-15
- [Private Cloud Compute: A new frontier for AI privacy in the cloud (Apple Security Research, June 10, 2024)](https://security.apple.com/blog/private-cloud-compute/), accessed 2026-10-15