What does NVIDIA's Confidential Bare Metal mean for model builders scaling across clouds?

How Confidential Bare Metal differs from the existing options

NVIDIA Confidential Computing now offers three deployment models. Confidential Virtual Machines handle virtualized environments. Confidential Containers serve Kubernetes workloads. The new Confidential Bare Metal targets non-virtualized infrastructure directly.

This matters because model builders can now own and operate their bespoke software stack — host and platform infrastructure software included — on dedicated third-party hardware. The announcement frames this as a way to match the right model to specific trust boundaries and operating requirements. Hardware-rooted isolation and cryptographic attestation protect models and data during execution. The bare-metal path adds platform security controls that protect data in transit, measure platform integrity, and enforce hardware-level access restrictions.

Where the new deployment runs and who supports it

Support extends to Grace Blackwell NVL72 rack-scale systems. It also reaches x86-based HGX Rubin NVL8 and DGX Rubin NVL8 systems.

Nine cloud and neocloud providers have signed on: CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale, and Vultr. Six global systems partners will deliver these capabilities through NVIDIA-Certified Systems: Cisco, Dell Technologies, HPE, Lenovo, Supermicro, and Bull. DSX OS will support all Confidential Computing modes, giving cloud providers a software foundation for AI factories that handle confidential workloads. The announcement does not say how many of these systems are already deployed or when each provider will reach general availability.

What Cohere and Google Cloud are doing with it

Cohere plans to integrate Confidential Bare Metal into Cohere Model Vault. The integration uses trusted execution environments to extend hardware-rooted security directly to the GPU. This protects models and data in memory and across interconnects during execution. Phil Blunsom, chief technology officer at Cohere, said enterprises trust Cohere to provide a secure and confidential platform for inference.

Google Cloud is extending support to A4X Max instances powered by GB300 NVL72 systems. These combine non-virtualized accelerated computing with cryptographic protection for training data and model intellectual property. Andrés Lagar-Cavilla is a distinguished engineer at Google Cloud. He also serves as AI infrastructure security lead. He said the A4X instances preserve user data privacy, protect model IP, and provide top-line serving performance.

The limits of what the announcement covers

No performance benchmarks appear in the release. No pricing details for any deployment model. No timeline for when Rubin systems will ship with Confidential Computing enabled. The document does not disclose how many bare-metal instances exist today across the provider ecosystem. It also does not describe the attestation flow for multi-GPU NVL72 configurations in detail. The GTC Berlin keynote on October 21 at 11 a.m. CEST may add context, but the blog post itself stops at architecture and partner commitments.