NVIDIA announced Confidential Bare Metal for sensitive workloads on dedicated third-party infrastructure, while saying model builders retain control of their models and data.
Teams handling sensitive workloads may gain a choice of deployment boundary rather than relying only on containers or virtual machines. Google Cloud says it is extending support to A4X Max instances with GB300 NVL72; Cohere plans to integrate Bare Metal into Model Vault. These details indicate partner direction, not proof that every deployment is available now.
Thesis
Confidential computing is becoming a deployment choice across infrastructure types, not only a feature of virtualized environments.
Observed facts
NVIDIA announced Confidential Bare Metal for dedicated third-party infrastructure and described controls for data in transit, platform integrity measurement, and hardware-level access restrictions.
1NVIDIA lists Confidential Bare Metal, Confidential Containers for Kubernetes, and Confidential Virtual Machines as three deployment options.
1NVIDIA says support is expanding to Grace Blackwell NVL72 and Rubin systems, while Google Cloud plans support on A4X Max instances with GB300 NVL72 and Cohere plans Model Vault integration.
1
Mechanism
NVIDIA describes hardware-rooted isolation and cryptographic attestation, with platform controls intended to protect data and model assets during execution across bare-metal, container, and virtual-machine deployments.
Why now
NVIDIA presents the expansion as enabling model builders to scale training and inference across more geographic, sovereign, and operational options.
Implications
Teams handling sensitive workloads may gain a choice of deployment boundary rather than relying only on containers or virtual machines.
Provider availability and independent security evidence will determine whether this flexibility translates into deployable trust.
Evidence boundary
The supplied public source is NVIDIA's announcement and its account of partner plans; it does not independently establish security guarantees, availability, implementation quality, or performance.
Watch conditions
Whether named providers make deployments broadly available and publish verifiable attestation, threat-model, and performance details.