Confidential Computing

For most workloads, “decentralized inference” just means your request runs on a GPU you don’t own. But when the prompt itself is sensitive — medical records, legal documents, proprietary code, embedded API keys — that’s not enough. The node operator can in principle read everything passing through their GPU.

The proposed confidential tier would close that gap by encrypting prompts and outputs through a hardware-isolated Trusted Execution Environment (TEE) and returning evidence that the client can verify against an approved workload and hardware trust chain.

What Changes for Users

In a future confidential tier, a request would need this lifecycle:

1. Your prompt is encrypted end-to-end to the GPU’s TEE
2. The node operator’s host OS cannot see plaintext — not in RAM, not in GPU memory, not on the bus
3. The GPU returns an attestation — a signed report from NVIDIA hardware proving the workload ran inside a genuine TEE
4. Your client verifies the attestation before trusting the response

One possible interface is shown below as nonfunctional pseudoprotocol. The header and response field are not accepted by the current API:

POST /v1/chat/completions
X-AIPG-Confidential: required
Content-Type: application/json
 
{"model": "...", "messages": [...]}

A production design must fail closed when no certified worker is available; it must never silently fall back to ordinary inference.

How the TEE Works (NVIDIA Confidential Computing)

NVIDIA Confidential Computing (NVCC) is supported starting with the Hopper generation (H100 / H200) and matures with Blackwell (B200 / B300). The guarantees:

• Memory encryption — GPU memory is encrypted with a per-instance key. The host OS, hypervisor, and other VMs on the same machine cannot read it.
• TDX / SEV-SNP integration — the CPU side runs in a confidential VM (Intel TDX or AMD SEV-SNP), so the entire data path is protected, not just the GPU.
• Hardware attestation — NVIDIA hardware signs a quote describing the GPU model, firmware version, driver, and workload measurement. The signature chains back to NVIDIA’s root of trust.
• Measured boot — the workload binary is hashed before launch, and that hash is included in the attestation. Tampered code is detectable.

Hardware capabilities and supported driver/firmware combinations must be verified against NVIDIA’s current attestation documentation before a worker is certified. The Grid has not defined that certification policy yet.

What Operators Need

The eventual operator profile is expected to require:

• NVIDIA Blackwell or Hopper GPU with Confidential Computing enabled in firmware (B200 / B300 recommended; H100 / H200 also supported)
• Confidential VM on the host — Intel TDX (Xeon 6) or AMD SEV-SNP (EPYC 4+)
• A currently supported NVIDIA driver/firmware stack with confidential-computing support
• A reproducibly built AIPG worker image measured by the attestation
• A future worker bond and confidential policy — amount and fee schedule are not defined

Whether one node may safely serve confidential and ordinary workloads, and how any premium is priced, remain design decisions.

Proposed Attestation Verification

A future client would verify the quote, certificate chain, freshness, workload measurement, policy, and response binding. The following is illustrative only; these imports and response fields do not exist in the released Grid SDKs:

from aipg import Client
from aipg.attestation import verify_nvidia_attestation
 
client = Client(api_key="...")
 
response = client.chat.completions.create(
    model="gpt-oss-120b",
    messages=[...],
    extra_headers={"X-AIPG-Confidential": "required"},
)
 
# Verify before trusting the response
report = response.attestation  # base64-encoded NVIDIA attestation
verify_nvidia_attestation(
    report,
    expected_workload_hash=KNOWN_GOOD_WORKER_HASH,
)

No released Grid SDK currently provides verify_attestation=True.

Use Cases

• Health-tech — clinical notes, scan analysis, anything subject to HIPAA
• Legal & financial — document review, contract analysis, due diligence
• Enterprise code analysis — proprietary codebases, internal tooling
• Personal AI — journaling, therapy, anything you wouldn’t want a stranger to read
• Agent workloads handling credentials — agents that touch real secrets shouldn’t run on commodity nodes

Status & Roadmap

The fastest way to follow progress is the AIPG Discord. Operators with Blackwell hardware who want to be early test nodes are welcome — ping the team in #node-operators.