AI glossary · Advanced · AI security · Efficiency & infra
Confidential computing
Confidential computing is a technology that keeps data encrypted and protected inside a hardware-created isolated area (a TEE, trusted execution environment) even while it is 'in use' during computation, so that not even the cloud operator or server administrator can see its contents.
About this term
- Level
- Advanced · Specialist terms that need the inner workings
- Category
- Security & safety
- Fields
- AI security, Efficiency & infra
- Added
- 2026-10-09
How it works
Data is usually encrypted when stored and when transmitted, but it must be decrypted in memory to be computed on, and that moment is a weak point. In confidential computing, the CPU or GPU turns part of memory into an encrypted isolated area, so that even the operating system or hypervisor cannot read the data and code inside it. Before sending data, the user receives 'remote attestation': a hardware-signed report used to confirm that the isolated area is genuine and is running the promised code. Once this check is complete, the data is sent with a key that can only be decrypted inside that area.
Why it matters
In AI, sensitive data and expensive model weights often both run on someone else's cloud GPUs. With confidential computing, organizations such as hospitals and banks can hand patient or customer data to a cloud AI service without exposing it to the operator. For model companies, it is a way to prevent model theft: even when a model sits on a customer's server, the weights are hard to extract. It is also used when several organizations want to analyze data or train models together without showing each other their data.
Good to know
The protection rests on trusting the hardware manufacturer and the attestation process, so it can weaken if a hardware vulnerability is found. If the code running inside the isolated environment has bugs, it cannot stop data from leaking. Encryption and attestation reduce performance somewhat and make setup more complex. A model revealing sensitive information in its answers is a separate problem, so other safeguards such as guardrails are needed as well.
Example
Suppose a financial company wants to analyze customer transaction histories with an LLM in the cloud. If it uses a GPU instance that supports confidential computing, the company's program first uses remote attestation to check that server's isolated environment and the code running in it, and sends encrypted data only if the check passes. Even if a cloud company employee accesses the server, they cannot see the transaction data being processed or the results.