Every conversation about AI security today centers on the same three words: data, models, and trust. We encrypt data on disk. We encrypt data in transit over networks. But the moment that data is actually used — the split second it’s decrypted inside a server to be processed — it has historically been exposed to whoever controls that server: the cloud provider, a systems administrator, or an attacker who’s compromised the host.
Confidential computing closes that gap. And as AI infrastructure scales to a point where enterprises are running proprietary models and sensitive data on hardware they don’t own, it’s quietly becoming one of the most important technologies in the security stack.
What Confidential Computing Actually Is
Confidential computing protects data while it’s being processed, not just when it’s stored or moving across a network. It does this using a Trusted Execution Environment (TEE) — an isolated, encrypted region inside a processor that even the operating system, the hypervisor, the cloud service provider’s own engineers, and a compromised administrator account cannot see into.
Think of it as a locked room inside a building you don’t own. You can walk in, do your work, and leave — and even the landlord who controls every other room in the building has no key to that one.
Three ingredients make this possible:
- A hardware root of trust — a cryptographic key burned into the chip at manufacture time, which the CPU or GPU uses to prove it’s genuine, unmodified hardware.
- Memory encryption — data in RAM is encrypted with keys that never leave the processor. Not even the infrastructure owner holds them.
- Remote attestation — before sending sensitive data anywhere, the receiving enclave must cryptographically prove: “I am running exactly the code you approved, on genuine, untampered hardware.” This is what lets two organizations that don’t trust each other’s infrastructure still trust a specific, verified enclave.
This isn’t new cryptography — it’s a new place to run computation. The major silicon vendors have all built this capability into their hardware over the last several years:
| Vendor | Technology | Where It Runs |
|---|---|---|
| Intel | SGX, TDX | CPU |
| AMD | SEV-SNP | CPU |
| ARM | TrustZone, CCA | CPU |
| AWS | Nitro Enclaves | Cloud / CPU |
| NVIDIA | Confidential Computing | GPU (Hopper, Blackwell) |
Why This Matters So Much for AI Infrastructure
For a long time, confidential computing was a CPU-only story — useful for databases and general workloads, but useless for AI, because AI runs on GPUs. That changed with NVIDIA’s Hopper architecture, and it’s a bigger deal than it sounds.
Here’s the specific problem it solves in AI:
- Protecting model weights during training and inference. A trained model represents millions of dollars of compute and IP. When that model runs on rented cloud infrastructure, confidential computing keeps the weights encrypted in GPU memory — invisible even to the cloud provider hosting them.
- Protecting user prompts and data during inference. When you send a prompt to an AI system, confidential computing can guarantee that neither the infrastructure operator nor anyone else can read that prompt or the response — only the encrypted enclave processing it can.
- Protecting training data itself. Multiple organizations can now contribute sensitive datasets to train or fine-tune a shared model without any party — including the entity running the training job — ever seeing another party’s raw data.
- Enabling regulated industries to actually use cloud AI. Healthcare, finance, and government have sensitive-data obligations that made “just use the cloud” a non-starter for years. Confidential computing, backed by attestation, gives compliance teams a cryptographic guarantee — not just a policy promise — that data stays confidential.
This is the difference between a cloud provider promising not to look at your data, and a cloud provider being mathematically incapable of looking at it.
Four Real Examples Worth Knowing
1. Apple’s Private Cloud Compute — Now Running on Someone Else’s Hardware
Apple built Private Cloud Compute (PCC) to handle the Apple Intelligence requests too large for an iPhone to process locally, while guaranteeing that not even Apple’s own staff can access user data sent to the cloud. What makes this genuinely remarkable: in mid-2026, Apple extended PCC to run on Google Cloud infrastructure — on NVIDIA Blackwell GPUs and Intel CPUs Apple doesn’t own — under the exact same privacy guarantees, stacking NVIDIA’s confidential computing, Intel TDX, and Google’s own hardware root of trust so that compromising any single vendor still isn’t enough to break the verification chain. That’s confidential computing proving it can extend trust across company boundaries, not just within one company’s data centers.
2. Signal’s Private Contact Discovery — And an Honest Lesson in Its Limits
Signal has used Intel SGX enclaves for years so its servers can determine which of your contacts also use Signal, without ever seeing your address book. It’s one of the most cited real-world TEE deployments in consumer software. It’s also a useful reality check: in August 2026, security researchers disclosed two vulnerabilities in Signal’s contact discovery enclave — a race condition allowing enclave memory to be read, and a separate flaw that could allow code execution — either of which would have required a malicious party to already control the server host. Signal patched both quickly, and no exploitation in the wild was found. It’s a reminder that confidential computing hardens a system dramatically; it doesn’t make it invulnerable.
3. Confidential AI on Azure with NVIDIA H100/H200 — Protecting Healthcare and Enterprise Workloads
Microsoft and NVIDIA’s confidential GPU VMs are now used for real workloads: hospitals running Whisper-based speech-to-text transcription on patient audio without exposing that data to the cloud provider, and enterprises fine-tuning proprietary models while keeping both the model weights and the training data confidential from each other. This is confidential computing solving the exact regulated-industry problem described above.
4. Fortanix Confidential AI — Protecting Model IP in Enterprise Deployments
Model vendors want to license their models without them being copied or reverse-engineered. Enterprises want to run those models on their own sensitive data without sending that data back to the model vendor. Fortanix’s confidential AI offering, built on NVIDIA’s confidential computing, lets both happen at once — the model stays encrypted and unreadable even to the infrastructure running it, while the enterprise’s data never leaves its control. It’s a clean example of confidential computing resolving a trust deadlock that neither policy nor contracts could solve on their own.
The Honest Caveats
Confidential computing is powerful, not magic:
- Performance overhead is real, though shrinking. Modern implementations report single-digit-percent overhead on inference workloads, down from far higher a few years ago.
- Side-channel attacks remain an active research area. Hardware isolation is strong, but as the Signal SGX disclosure shows, it isn’t theoretically unbreakable.
- Verification is only as good as what’s open. Attestation proves which code is running — but if that code isn’t open-source and independently auditable, you’re trusting the vendor’s word about what the code actually does. Apple’s approach of publishing every production PCC software image, plus a cryptographically tamper-proof transparency log, for public inspection is the industry’s strongest answer to this so far.
Where This Is Heading
As AI moves from “trained once, deployed everywhere” to systems that are continuously fine-tuned on proprietary, often regulated data, the question of who can see the data while it’s being computed on stops being a theoretical compliance checkbox and becomes the central infrastructure decision. Confidential computing is how the industry is answering it — not by asking cloud providers, AI vendors, and enterprises to trust each other, but by removing the need for that trust altogether. It’s the same underlying shift this site covered in the context of post-quantum cryptography: replacing a policy promise with a mathematical guarantee.
If you’re building, buying, or securing AI infrastructure in the next few years, this is a technology worth understanding at more than a buzzword level.