Ładowanie Technology Radar
Confidential computing protects data in use by running workloads inside hardware-based, attested Trusted Execution Environments, according to the Confidential Computing Consortium (Confidential Computing Consortium). For AI systems, this extends the security boundary from stored data and network traffic into the active processing path where prompts, retrieval context, training records, model weights, embeddings, and intermediate outputs are otherwise exposed to privileged infrastructure layers.
The technique is especially relevant for regulated inference, RAG over sensitive documents, fine-tuning on proprietary data, multi-party analytics, and partner data clean rooms. Google Cloud positions confidential computing for analytics, AI, and federated learning as a way to reduce the trust boundary so fewer cloud and infrastructure components have access to confidential data (Google Cloud Architecture Center). Microsoft and NVIDIA have also moved the pattern into GPU-backed AI workloads, making confidential VMs with NVIDIA H100 GPUs available for inference, fine-tuning, and small-to-medium model training scenarios (Microsoft Azure Confidential Computing Blog, NVIDIA Technical Blog).
Keep this in the Trial ring because the value is real, but the implementation burden is still high. Teams must validate the hardware trust chain, attestation evidence, key-release policy, accelerator support, performance profile, observability model, incident response, and application-layer controls before using confidential computing as a default requirement.
Confidential computing narrows infrastructure trust, but it does not eliminate the need to secure the full AI data path. Sensitive content can still leak through application logs, retrieval pipelines, prompt templates, agent tools, model outputs, telemetry, debugging artifacts, misconfigured storage, or over-broad access policies outside the TEE boundary.
Attestation and key release are the critical control plane. If teams cannot verify what code, firmware, drivers, model artifacts, and runtime configuration are measured before secrets are released, they may only be adding hardware complexity without gaining a meaningful security guarantee. NVIDIA’s H100 flow illustrates this dependency: the confidential VM must authenticate the GPU, validate device identity and attestation reports, and extend trust from CPU TEEs into the GPU before using it for confidential workloads (NVIDIA Technical Blog).
Performance and portability need workload-specific testing. NVIDIA notes that GPU confidential computing performs close to non-confidential mode when compute is large relative to input data, but workloads with low compute per input byte can be limited by encrypted transfer overhead across non-secure interconnects (NVIDIA Technical Blog). Microsoft similarly reports negligible overhead for most models while noting that smaller models can see higher overhead from encrypted PCIe traffic and kernel invocations (Microsoft Azure Confidential Computing Blog).
Cloud and hardware capabilities are uneven. CPU TEE, GPU TEE, enclave, Kubernetes, data-processing, and clean-room offerings differ by provider, region, instance family, accelerator, operating model, and attestation tooling, so platform teams should not assume that one provider’s confidential AI architecture is directly portable to another.
Trial confidential computing for high-value AI workloads where data-in-use protection materially changes the risk model: regulated inference, confidential RAG, fine-tuning on proprietary or customer data, model-weight protection, and multi-party analytics. Start with one narrow workload, define the threat model, document the trust boundary, require remote attestation before secret release, benchmark performance against a non-confidential baseline, and verify that logs, retrieval stores, outputs, and downstream agent tools do not bypass the protection boundary.
Do not adopt it as a blanket AI platform default yet. Use it when it is more practical than alternatives such as on-prem deployment, data minimization, redaction, synthetic data, privacy-preserving transformations, contractual controls, or stricter tenant isolation. Promote from Trial only after the team has repeatable attestation automation, key-management integration, provider-region availability, operational runbooks, monitoring coverage, and evidence that the residual risk reduction justifies the added platform complexity.