What problem does confidential AI solve?
The last gap in encryption. Data is routinely encrypted on disk and on the network, but to be processed it is decrypted in memory, where whoever controls the host (a cloud administrator, a compromised hypervisor, a malicious insider) can in principle read it. The Confidential Computing Consortium sums up the fix: “Confidential Computing protects data while it’s in use” (Confidential Computing Consortium, read 5 November 2026). For AI that matters because prompts carry contracts and patient records, and the model weights themselves are valuable. It lets a company use shared cloud GPUs without having to trust the people who run them.
How does confidential AI work?
Two mechanisms. A trusted execution environment (TEE) is a hardware-isolated region whose memory is encrypted and closed to the host, on CPUs and now on GPUs: NVIDIA states that its confidential computing is supported on its Hopper, Blackwell and Rubin platforms at “up to 98% of the performance of unsecured deployments”, depending on workload (NVIDIA, read 5 November 2026). Attestation is the hardware’s signed proof of what is running inside, checked before keys or data are released. Microsoft describes confidential AI as “cryptographically verifiable protection for data and model assets across the AI lifecycle”, offered on Azure through confidential VMs and confidential containers (Microsoft Learn, updated 30 June 2026, read 5 November 2026). Without attestation, confidential AI is just a promise.
What does confidential AI protect, and what does it not?
Its reach is specific:
| Risk | Protected? |
|---|---|
| Cloud staff or a compromised host reading prompts in memory | Yes |
| The infrastructure operator copying model weights | Yes |
| Different code running than the one agreed | Detected through attestation |
| The application itself leaking data through outputs or logs | No |
| Prompt injection, wrong answers, misuse by authorized users | No |
NVIDIA’s own page says confidential computing “does not certify a workload by itself”. It protects data from the infrastructure, not from the application, so it sits inside an AI security program, not in place of one.
When does a mid-sized company need confidential AI?
Less often than vendors suggest. If the goal is keeping data out of a vendor’s hands, private AI in your own cloud tenancy under a no-training contract usually suffices. Confidential AI earns its cost in narrower cases: a client or regulator demands that the provider be technically unable to see the data, as in some health workloads where HIPAA-compliant AI is the starting point; several companies pool data to train a shared model, such as banks combining anti-money-laundering records, a scenario Microsoft describes; or a model must run on infrastructure its owner does not control. It turns a contractual promise about access into a technical one, which strengthens a data sovereignty position but does not replace choosing where the data is processed.