Confidential computing and AI trust boundaries

Technical note · 26 October 2026. Confidential computing is a technology option under evaluation; this page does not announce an AGIACC deployment.

Name the infrastructure threat

#

An AI workload may need to protect model weights, inputs, or credentials from infrastructure outside its trust boundary. A Trusted Execution Environment can provide isolation and protect data in use under a platform-specific threat model. The supported hardware, firmware, guest software, and operational controls all matter. NVIDIA’s documentation distinguishes deployment boundaries and supported configurations.

Attestation informs a decision

#

Remote attestation provides evidence about an execution environment. A verifier still needs a policy: which measurements, versions, configurations, and freshness requirements are acceptable before releasing a secret? Deployment and update procedures must also address revoked evidence and failed verification.

A measured environment may still contain application vulnerabilities or an unsafe policy. Protection from a host administrator does not automatically isolate every plugin inside a guest or make model-generated actions safe.

Evaluate the composed system

#

For a future reference platform, useful measurements include startup and attestation time, inference latency, throughput, memory use, and failure behavior. The comparison needs a stated baseline and configuration. We will choose mechanisms around the workload and threat model; security, safety, and operational cost must be evaluated together.

The next research question is how confidential execution composes with runtime boundaries, memory protection, and application-level authorization.