CCSI Officer course · Module 07 of 10
Confidential AI and GPU TEEs
Protecting model weights, prompts and training data with confidential VMs and NVIDIA H100 confidential computing: CC modes, encrypted bounce buffers, GPU attestation, and composite attestation of CPU plus GPU.
Learning objectives
- Identify the assets in an AI pipeline and who they must be protected from
- Explain how NVIDIA H100 confidential computing extends a CPU TEE to the GPU
- Design composite attestation that covers both the confidential VM and the GPU
- List the AI-specific leakage paths a TEE does not close
Lessons
Lesson 7.1 · 12 min
AI assets and threat model
Model weights, prompts, outputs, training data and fine-tuning sets, and who wants them.
Lesson 7.2 · 15 min
NVIDIA H100 confidential computing
On-die root of trust, CC modes, encrypted transfers over PCIe, and GPU attestation.
Lesson 7.3 · 13 min
Composite attestation for AI workloads
Verifying the CPU TEE and the GPU together before releasing model keys.
Check your understanding
Module 7 quiz
6 questions · pass mark 80%
1.Which of these is OUT of scope for GPU and CPU hardware isolation in an AI system?
2.Where is the H100's confidential computing TEE anchored?
3.How does data move between a confidential VM and an H100 in CC-On mode?
4.What is CC-DevTools mode?
5.What does NVIDIA provide as the primary method of validating GPU attestation reports?
6.Why bind a hash of the GPU evidence into the confidential VM's evidence?
Glossary
- Confidential AI
- Use of TEEs to protect AI assets such as model weights, prompts and training data while in use.
- Bounce buffer
- A staging area in shared memory through which encrypted data passes between a CVM and a GPU.
- NRAS
- NVIDIA Remote Attestation Service, which validates GPU attestation reports.
- Composite attestation
- Appraising evidence from several components (CPU TEE, GPUs) as one decision.