Procedure, with the real outputs published
How to verify a confidential GPU yourself: Intel TDX + NVIDIA attestation
A confidential cloud that asks you to trust its word is not confidential. This page is the procedure a tenant runs from inside their own VM to obtain two hardware-signed proofs on values they chose, verify them without the cloud, and bind them to the workload they meant to run. Every command below was run on a VoltageGPU Confidential VM and the outputs are public.
Two proofs, two roots: Intel and NVIDIAAbout twenty minutesOpen-source verifier
On which machines this works, exactly
Both proofs verified by us as a tenant: the single-GPU H200 Confidential VM(NVIDIA CC State ON, attestation successful at NVIDIA on 4 September 2026) and the 8x H100 node in NVIDIA Protected PCIe mode (all eight GPUs attested on 10 September 2026, one token per GPU, NVSwitch not attested), the single-GPU H100 VM (16 September 2026) and the single-GPU RTX PRO 6000 Blackwell VM (17 September 2026, CC State ON, evidence at /blog/two-proofs/evidence/rtx6000b-2026-09-17/). The 8x H200 node reads the same mode but we have not run its attestation yet. Containers expose no /dev/tdx_guest to the tenant. B200 VMs are not verified and we claim nothing for them.
The five steps
- 1. Confirm the environment from inside the VM. Check that /dev/tdx_guest and /sys/kernel/config/tsm/report exist, and read nvidia-smi conf-compute -q. On a single-GPU H200 VM you expect CC State: ON; on an 8-GPU node you expect CC State: OFF next to Multi-GPU Mode: Protected PCIe, which is the normal reading for that mode.
- 2. Generate the Intel TDX quote on your own report_data. Write 64 bytes you chose (for example the SHA-512 of a string that includes the date and a random value) into a new configfs TSM report entry, read the quote from outblob. Your bytes sit at offset 568 of the TDX v4 quote. Retry only on EINVAL, which signals a concurrent request.
- 3. Verify the quote offline against Intel. Check the attestation key signature, the Quoting Enclave binding and signature, the PCK certificate chain up to the pinned Intel SGX Root CA, the platform TCB level and the TDX module identity against Intel's signed TCB info, the Quoting Enclave identity, and the revocation lists. None of this needs the cloud provider.
- 4. Generate the NVIDIA GPU attestation on your own nonce. Ask the driver for the GPU attestation report with 32 random bytes you generated, and submit it to NVIDIA's Remote Attestation Service (or a local verifier). The signed result must carry your nonce, measurements success, secure boot on and debugging off. On 8-GPU Protected PCIe nodes, expect one token per GPU and no NVSwitch attestation.
- 5. Bind both proofs to your workload with voltage-verify. Write a manifest (image digest, artifact digests, statement, fresh challenge); its SHA-512 becomes the TDX report_data and its SHA-256 the NVIDIA nonce; verify the resulting bundle on your machine, online or offline, then run the six negative tests. What this proves: the hardware signed your description of the workload, after your challenge. What it does not prove: that the GPU executed that exact image, which needs a measured launcher.
Step 2, the TDX quote
# Inside your Confidential VM. Your 64 bytes, your quote.
sudo mkdir /sys/kernel/config/tsm/report/r1
printf '%s' "audit-$(date -I)-$(openssl rand -hex 16)" | sha512sum | cut -d' ' -f1 | xxd -r -p > rd.bin
sudo dd if=rd.bin of=/sys/kernel/config/tsm/report/r1/inblob bs=64 count=1
sudo cat /sys/kernel/config/tsm/report/r1/outblob > quote.bin
# TDX v4 quote, your rd.bin sits at byte 568. Verify it off the box against Intel DCAP.Step 4, the GPU report
# Same VM. Your 32-byte nonce, NVIDIA's signature.
python3 - <<'PY'
import os, pynvml as n
n.nvmlInit()
h = n.nvmlDeviceGetHandleByIndex(0)
nonce = os.urandom(32)
rep = n.nvmlDeviceGetConfComputeGpuAttestationReport(h, nonce)
open("gpu_report.bin", "wb").write(bytes(rep.attestationReport[:rep.attestationReportSize]))
print("report", rep.attestationReportSize, "bytes, nonce", nonce.hex())
PY
# Submit to NVIDIA's Remote Attestation Service: overall result, nonce match, signature, chain.Step 5, bind both to your workload
# Your machine: describe the workload, get a fresh challenge
pip install "voltage-verify>=0.2.1"
voltage-verify manifest --image ghcr.io/you/app:1.4.2 --artifact model.safetensors -o manifest.json
# Inside the VM, as root: TDX quote on SHA-512(manifest), NVIDIA report on SHA-256(manifest)
sudo -E python -m voltage_verify attest --manifest manifest.json -o bundle.json
# Your machine again: verify online, then offline, then six negative tests
voltage-verify verify bundle.json --challenge <printed by manifest>
voltage-verify verify bundle.json --challenge <same> --offline
voltage-verify selftest bundle.jsonReference bundle from an 8x H100 Confidential VM (12 September 2026), replayable offline, at /blog/two-proofs/voltage-verify. Source and issues on GitHub.
What the two proofs do and do not tell you
- They prove that a genuine Intel TDX trust domain, at a TCB level Intel accepts, answered your challenge, and that NVIDIA’s service accepted the GPU’s measurements, secure boot and debug state on your nonce, both after you issued the values, so nothing can be replayed from an earlier session or another tenant.
- They do not prove what your own code does with the data afterwards, that the GPU executed the image named in a manifest (that needs a measured launcher), or anything about SKUs you did not attest yourself. Two GPU reports are never byte-identical (the SPDM responder adds its own randomness), so pin the verified claims, not a hash of the blob.
- Known pitfall. Six concurrent TDX quote requests through configfs TSM can fail with EINVAL as one request tears down the object the next was creating; retry on EINVAL only and fail closed on anything else. Found by a tenant, documented with credit.
Go deeper
- Two proofs, yours, not ours: the article with the raw outputs and an outside reproduction.
- Tenant TDX attestation guide: the five commands, one by one, with what each output means.
- Confidential VM documentation: environment checks, DCAP verification, GPU attestation, report stability, concurrent quotes.
- Evidence folder: the files with SHA-256 sums.
- Four clouds compared on the same criteria, with sources.
- What is confidential computing: the plain-language guide, from the three states of data to attestation.
Run it on your own Confidential VM
Self-service, about two and a half minutes to SSH, one hour prepaid then per second.