Composite attestation for AI workloads

Two pieces of evidence, one decision

For confidential AI, a key service should release model or data keys only when both the confidential VM and every attached GPU pass attestation. NVIDIA provides the NVIDIA Remote Attestation Service (NRAS) as the primary way to validate GPU attestation reports, and publishes open-source tooling for local verification in its nvtrust repository.

1. Attest the CVM: chain, TCB, debug off, measurements of firmware, kernel and image.
2. Attest each GPU: report signed via NVIDIA's certificate chain, CC mode on, approved driver and VBIOS versions.
3. Bind: the CVM evidence commits to the GPU evidence and the session key.
4. Release: the key service releases the model key wrapped to the session key.

release_model_key IF
    cvm.signature_chain_valid            AND cvm.debug == false
    AND cvm.tcb >= MIN_TCB               AND cvm.measurements IN approved_images
    AND cvm.report_data == H(gpu_evidence_hashes || session_pubkey || nonce)
    AND FOR EACH gpu: gpu.verified_by(NRAS or local verifier)
                     AND gpu.cc_mode == "on"
                     AND gpu.driver_and_vbios IN approved_versions

AI-specific operational controls

• Encrypt model weights at rest and decrypt only inside the attested CVM.
• Keep prompt and completion logging inside the boundary, or redact before it leaves.
• Pin inference server and driver versions; GPU driver and firmware updates change what you must approve.
• Track NVIDIA security bulletins alongside CPU vendor advisories (Module 9).

Reference: NVIDIA nvtrust (GitHub), NVIDIA confidential computing.