Which NVIDIA GPUs support confidential computing, and which have we verified?
NVIDIA Confidential Computing runs on Hopper GPUs (H100, H200) and Blackwell GPUs (RTX PRO 6000 Blackwell Server Edition, B200), per NVIDIA's deployment guide. VoltageGPU has verified GPU attestation from inside a tenant VM on four configurations: single-GPU H200, H100 and RTX PRO 6000 Blackwell, and an 8x H100 node in multi-GPU mode. B200 and B300 were never tested.
What NVIDIA supports
NVIDIA's product page says Confidential Computing "is supported across the NVIDIA Rubin, NVIDIA Blackwell, and NVIDIA Hopper platforms". The Deployment Guide for Confidential Computing (DU-12302-001_v7.1, April 2026) is more precise. It covers "Hopper-architecture GPUs" in a single-GPU Confidential Compute mode or in a multi-GPU mode, and "Blackwell-architecture GPUs in Confidential Compute (single or multi-GPU) mode". Its support table lists, for Blackwell, "RTX PRO 6000 Single GPU", "B200 Single GPU" and "B200 Multi GPU" on "AMD SEV or Intel TDX"; on the CPU side it names Intel processors with TDX support (Emerald Rapids, Granite Rapids) and AMD processors with SEV-SNP support (Milan 7xx3, Genoa 9xx4, Turin). The B300 does not appear in that version's table. The H200 is a Hopper GPU: in NVIDIA's tokens our H200 and H100 both report hwmodel GH100, and the RTX PRO 6000 reports GB20X.
Two modes matter to a tenant. In single-GPU mode, nvidia-smi conf-compute -q reads CC State: ON and Multi-GPU Mode: None (our RTX PRO 6000 VM, 17 September 2026). In the multi-GPU mode of the 8-GPU nodes, the same command reads CC State: OFF and names the mode on the Multi-GPU Mode line; NVIDIA's guide warns that the two modes are listed differently, and each GPU is attested on its own. A third setting, DevTools, exists for debugging and "disables security protections" (Google's documentation of the cc_mode claim); NVIDIA's token exposes it through dbgstat.
What VoltageGPU has verified, with dates
The list below is the file our deploy form and price feed read (lib/attested-skus.ts), served at /api/attestation/evidence. A SKU enters it only after NVIDIA's attestation was run from inside the VM, on a random nonce, and passed.
| GPU | GPUs in the VM | Mode | Verified on | Evidence |
|---|---|---|---|---|
| H200 | 1 | CC State ON | 4 September 2026 | /blog/two-proofs/evidence/README.txt (token 3,055 bytes, VBIOS 96.00.CF.00.02) |
| H100 | 8 | multi-GPU mode, all 8 GPUs attested; NVSwitch not verified | 10 September 2026 | /blog/two-proofs/evidence/ppcie-8x-h100/README.txt (token 17,522 bytes) |
| H100 | 1 | CC State ON, 82,542,720 KiB of GPU memory protected, 0 KiB unprotected | 16 September 2026 | no public folder |
| RTX PRO 6000 Blackwell Server Edition | 1 | CC State ON, 99,463,296 KiB protected, 0 KiB unprotected | 17 September 2026, again 9 October, then weekly | rtx6000b-2026-09-17/, rtx6000b-2026-10-09/, /proofs |
Every token says measres success, secboot true, dbgstat disabled, driver 595.71.05. The weekly run rents an RTX PRO 6000 VM through the public API, generates both proofs on a fresh challenge and verifies the bundle offline; the last run listed on /proofs is 17 October 2026, and the tutorial reads one of these quotes field by field.
Not verified, and not claimed: the 8x H200 node (never available to test); B200 and B300 (never available in our confidential inventory; on 22 October 2026 the public price feed lists them only in the standard tier, labelled "Standard GPU (no enclave, not confidential)"); the NVSwitch fabric of the 8x H100 node, where the switch evidence is collected but certificate validation fails because ocsp.ndis.nvidia.com is unreachable from the guest (retest of 19 September 2026).
What this proves, and what it does not
It proves that on those dates, those SKUs produced NVIDIA-verified GPU attestation from inside an Intel TDX guest, on a nonce chosen in the VM. It does not prove that the VM you rent today behaves the same: only the RTX PRO 6000 is re-checked weekly, so run the three commands yourself. It proves nothing about the NVSwitch fabric, the 8x H200 node, the B200 or the B300, and nothing about the software inside the VM.
Related questions
Does the H200 support NVIDIA Confidential Computing?
Yes. On 4 September 2026 our single-GPU H200 VM read CC State: ON and NVIDIA's service returned "Attestation Successful" (hwmodel GH100, measres success, VBIOS 96.00.CF.00.02). Neither Azure nor Google listed a confidential H200 when we read their documentation on 12 September 2026.
Do the B200 and B300 support it?
NVIDIA's deployment guide v7.1 lists the B200 in single-GPU and multi-GPU mode; the B300 is not in its table. We have tested neither: they were never available in our confidential inventory, and on 22 October 2026 our price feed lists them only as standard GPUs without enclave.
What does "multi-GPU mode" mean on an 8-GPU node?
Each of the eight GPUs produces its own attestation report and gets its own NVIDIA-signed token (eight in our run of 10 September 2026); nvidia-smi reads CC State: OFF and names the mode on the Multi-GPU Mode line, and the attestation SDK has to be called with get_evidence(options={"ppcie_mode": False}). The NVSwitch fabric between the GPUs is not attested.
Is the RTX PRO 6000 Blackwell checked regularly?
Yes, weekly, through the public API like any customer, with the bundle verified offline by voltage-verify before publication. The latest run and its raw bundle are on /proofs.
Where is the current list?
At /api/attestation/evidence: each attested SKU with its date and evidence URL, the not-attested list, and the three commands to reproduce the check in your own VM.