Key Takeaways
- Sovereign AI runs on evidence, not promises. On a single-GPU H200 Confidential VM you produce two hardware-signed proofs yourself: an Intel TDX quote and an NVIDIA GPU attestation report, each bound to a nonce you chose.
- Zero trust in the provider, literally. Intel’s root CA verifies the first proof offline. NVIDIA’s attestation service verifies the second. VoltageGPU is not in either chain.
- Measured, not marketed. Every output below was read on a live machine on 4 September 2026: CC State ON, a 4,129-byte GPU report with our nonce at offset 4, a 5,243-byte TDX quote, and NVIDIA returning
Attestation Successful. - Honest limits: the container tier, retired on 1 October 2026, gave neither proof to the tenant; the single-GPU H100 and RTX PRO 6000 Blackwell VMs give both (16 and 17 September 2026, the latter re-run on 9 October), the 8x H100 node gives both (all eight GPUs attested on 10 September 2026, NVSwitch not yet), the 8x H200 node reads the same multi-GPU mode but is not attested yet, and B200 is not offered and was never verified.
Download the evidence, verify it yourself
The raw files from the 4 September 2026 run, unchanged since capture, with SHA-256 checksums. The NVIDIA token is a JWT you can verify against NVIDIA’s public keys; the TDX quote verifies offline with Intel’s DCAP tooling. Read the README first: it says what each file proves and what it does not.
Every confidential GPU provider says a version of the same sentence: your workload runs in a trusted execution environment. The sentence is cheap. What is expensive, and rare, is letting the customer check it without going through the provider. In 2026 the buyers who matter, regulated teams moving model weights and patient data onto rented GPUs, have stopped accepting the sentence. They want the evidence, they want to generate it themselves, and they want a root of trust that is not the company sending the invoice.
This article shows what that looks like on a VoltageGPU single-GPU H200 Confidential VM: two proofs, both produced from inside the tenant’s own VM, both bound to a nonce the tenant chose, one verified by Intel and one by NVIDIA. It also says plainly where this does not apply, because a page that only lists the wins is itself a trust problem.
Proof 1: the CPU trust domain, signed by Intel
The VM is an Intel TDX trust domain. Inside it, the kernel exposes /dev/tdx_guest to you, the tenant, with full root over SSH. Through the standard configfs TSM interface you write 64 bytes of report_data that you derived from a fresh nonce, and you read back a signed TDX v4 quote. Ours came back at 5,243 bytes. You then verify it on your own machine with Intel’s open-source DCAP tooling, which walks the certificate chain up to Intel’s root CA. No VoltageGPU API is involved at any step.
# Same session, same VM. The CPU side, with 64 bytes of report_data you chose. sudo mkdir /sys/kernel/config/tsm/report/r1 printf '%s' "audit-$(date -I)-$(openssl rand -hex 16)" | sha512sum | cut -d' ' -f1 | xxd -r -p > rd.bin sudo dd if=rd.bin of=/sys/kernel/config/tsm/report/r1/inblob bs=64 count=1 sudo cat /sys/kernel/config/tsm/report/r1/outblob > quote.bin wc -c quote.bin # 5243 quote.bin <- TDX v4 quote (header 04 00 02 00 81 00), your rd.bin sits at byte 568. # Verify it off the box with Intel's DCAP tooling. File downloadable below.
The full walkthrough, including offline verification and what the quote does and does not cover, is in our tenant-side TDX attestation guide.
Proof 2: the GPU, in confidential mode, signed by NVIDIA
The TDX quote says nothing about the GPU. That is the part most pages blur. A Hopper GPU has its own confidential-computing mode, its own attestation report, and its own verification service run by NVIDIA. On the single-GPU H200 VM, the first thing you check is the mode, and you check it yourself:
$ nvidia-smi conf-compute -q
==============NVSMI CONF-COMPUTE LOG==============
CC State : ON
Multi-GPU Mode : None
CPU CC Capabilities : INTEL TDX
GPU CC Capabilities : CC Capable
CC GPUs Ready State : Ready
$ nvidia-smi conf-compute -d
DevTools Mode: OFFCC State ON is the line that matters, and DevTools Mode: OFF is the one that says the card is in production mode rather than a debug configuration. Then you pull a report bound to a nonce that did not exist a second ago:
# Inside the VM. The nonce is yours: 32 bytes, generated here, now.
python3 - <<'PY'
import os, pynvml as n
n.nvmlInit()
h = n.nvmlDeviceGetHandleByIndex(0)
nonce = os.urandom(32)
rep = n.nvmlDeviceGetConfComputeGpuAttestationReport(h, nonce)
open("gpu_report.bin", "wb").write(bytes(rep.attestationReport[:rep.attestationReportSize]))
print("report", rep.attestationReportSize, "bytes, nonce", nonce.hex())
PY
# report 4129 bytes, nonce 420662604bc726e1fc010ae10997d1ff60153bbe712d6ec0431e35f2ac404c11
# <- those 32 bytes sit at offset 4 of the report. This exact file is downloadable below.The report is 4,129 bytes and your nonce sits at offset 4, unmodified. You send the evidence to NVIDIA’s remote attestation service, and NVIDIA, not VoltageGPU, checks the signature, the certificate chain up to its own device identity root, and the driver and VBIOS measurements against its published reference values:
# NVIDIA verifies it. Not us. The token is signed by nras.attestation.nvidia.com. attest -> True x-nvidia-overall-att-result True x-nvidia-gpu-attestation-report-nonce-match True x-nvidia-gpu-attestation-report-signature-verified True x-nvidia-gpu-attestation-report-cert-chain-validated True x-nvidia-gpu-driver-rim-fetched / measurements-available True x-nvidia-gpu-vbios-rim-fetched / measurements-available True measres success hwmodel GH100 · secboot true · dbgstat disabled driver 595.71.05 · VBIOS 96.00.CF.00.02
Two claims carry the weight. nonce-match: true is what makes the report impossible to replay from an earlier session. measres: success means the runtime measurements matched NVIDIA’s golden values for that driver and VBIOS. Together with secboot true and dbgstat disabled, that is the GPU telling a third party, on your behalf, that it is what it claims to be.
nras.attestation.nvidia.com (ES384): verify its signature against NVIDIA’s public JWKS and read the claims. The TDX quote verifies offline with Intel’s DCAP tooling; the 64-byte report_data sits at byte 568 of the quote. Two rounds were run that day, so the raw GPU report and the NVIDIA token carry different nonces; the README says which file proves what.- nras_token.json, 3,055 bytes, NVIDIA-signed verdict
- gpu_report.bin, 4,129 bytes, with nonce.txt
- quote.bin, 5,243 bytes, with report_data.bin
- SHA256SUMS and README.txt
- github.com/VoltageGPU/confidential-gpu-attestation-evidence: every dated bundle from this page and the later SKUs, in one git repository you can clone and re-verify (CC BY 4.0)
pip install "voltage-verify>=0.2.1" (0.2.1 fixes a key-pinning weakness in 0.2.0; source, issues and releases on GitHub, mirrored below with SHA-256 sums) and replay it: the bundle, the manifest, the challenge (in the manifest) and the unedited run log are below.- bundle-8xh100-2026-09-12.json, 128,379 bytes, with manifest-8xh100.json and the run log
- README.md, how it works and how to use it
- WHAT_IT_PROVES.md, every check and its limit
- voltage_verify-0.2.1.tar.gz (source) and the wheel, with SHA256SUMS, the same files as the PyPI release
- github.com/VoltageGPU/voltage-verify, source, tests, issues and releases
- All of it on one page: files, SHA-256 sums, replay commands, what it proves and what it does not
Why one proof is not enough
Where you get this, and where you do not
- VoltageGPU single-GPU H200 Confidential VM. Intel TDX quote by you: yes, /dev/tdx_guest is exposed. NVIDIA GPU report by you: yes, CC State ON, NVIDIA-verified on 4 September 2026.
- VoltageGPU 8x H100 Confidential VM node. Intel TDX quote: yes. NVIDIA GPU report: yes for all eight GPUs, in multi-GPU Protected PCIe mode (the state reads CC State OFF plus Multi-GPU Mode Protected PCIe), NVIDIA-verified on 10 September 2026. NVSwitch attestation: not verified.
- VoltageGPU 8x H200 Confidential VM node. Intel TDX quote: yes. NVIDIA GPU report: same multi-GPU mode read on 4 and 9 September 2026, attestation not run yet.
- VoltageGPU container tier, any GPU (retired on 1 October 2026). Intel TDX quote: no, the device was not exposed to the container. NVIDIA GPU report: no, GPU confidential mode was off.
- VoltageGPU RTX 6000B VM. Same VM image, /dev/tdx_guest is there, and since 17 September 2026 the GPU runs with confidential mode on (it read off on 3 September 2026). NVIDIA GPU report: yes, verified, evidence at /blog/two-proofs/evidence/rtx6000b-2026-09-17/, re-run on 9 October 2026.
- VoltageGPU single-GPU H100 VM. Intel TDX quote: yes. NVIDIA GPU report: yes, CC State ON, verified on 16 September 2026 (the two H100 VMs we tried in the first round never opened their SSH port).
- VoltageGPU B200. Not offered and never verified: no B200 VM was ever available to test. We claim neither proof there.
- Typical container-based GPU rental platforms. Intel TDX quote: no, a container cannot write its own report_data. NVIDIA GPU report: usually off; ask for the output of
nvidia-smi conf-compute -q.
The hyperscalers do sell confidential GPU VMs. They sit behind quota approvals and enterprise agreements. Most specialist GPU providers hand you a container, and a container can neither write its own TDX report_data nor, in practice, run the GPU in confidential mode, which was also true of our own container tier, retired on 1 October 2026. The combination that is hard to find is the boring one: a full trust domain, the GPU in confidential mode, both proofs in your hands, self-service, billed per second. That is what the single-GPU H200 tier is for.
nvidia-smi conf-compute -q inside the machine and ask to write your own report_data into a TDX quote. If either step needs a support ticket, the proof is theirs, not yours.What the two proofs still do not prove
- They attest the hardware and firmware state at the moment of your challenge. They say nothing about what your own code does with the data afterwards.
- The GPU proof depends on NVIDIA’s reference measurements existing for the driver and VBIOS in use, and on NVIDIA’s service being reachable when you verify. Verifying the report locally against NVIDIA’s root avoids the second dependency.
- Two GPU reports are never byte-identical, even with the same nonce, because the GPU contributes 32 random bytes of its own. Pin the verified claims, not a hash of the blob. The offsets are documented in the Confidential VM guide.
- Generating several TDX quotes at once can fail with
EINVALfrom the configfs TSM interface, about one call in six at six concurrent requests. It fails closed and never corrupts report_data. Serialise quote generation and retry on EINVAL only, as documented in the concurrent-quotes section of the guide. - VoltageGPU operates the host. Attestation makes that fact verifiable and bounded; it does not make it disappear. If your threat model needs the operator cryptographically unable to open your model, that is a key-custody question layered on top of these two proofs, not a replacement for them.
Reproduce it in ten minutes
- Add an SSH key to your account and deploy a single-GPU H200 from the Confidential VM deploy page. It boots in about two and a half minutes with your key on it.
- Run
nvidia-smi conf-compute -qandnvidia-smi conf-compute -d. ExpectCC State ONandDevTools Mode: OFF. - Pull a GPU report with your own nonce and submit it to NVIDIA’s attestation service. Expect
nonce-match: trueandmeasres: success. - Generate a TDX quote with your own report_data through configfs TSM and verify it offline with Intel’s DCAP tooling.
- Press Release. Billing stops that second, and the unused part of the first hour comes back to your balance.
Measurements dated 4 and 9 September 2026 on VoltageGPU hardware. Prices and tier availability are live on the deploy page and may have changed since publication.
What does "two proofs" mean, precisely?
Why does the nonce matter so much?
On which machines does this work?
What do the two proofs not tell you?
How long does it take to reproduce this?
Generate both proofs yourself, today
A single-GPU H200 Confidential VM boots in about two and a half minutes, self-service, billed per second. The commands above are the whole test.