Confidential mode
What changes when a node runs with measured boot and GPU confidential computing.
Confidential mode is an option on supported plans. It turns on measured boot for the host and, on accelerators that support it, the GPU’s confidential-computing mode.
Supported accelerators
| Accelerator | GPU confidential computing |
|---|---|
| B300, B200 | Supported |
| H200, H100 | Supported |
| RTX PRO 6000 | Not yet confirmed |
| MI300X, L40S | Not available |
On accelerators without support, confidential mode still provides measured boot and attestation of the host, but data on the GPU is not protected by the hardware.
What changes
- Transfers between CPU and GPU are encrypted. The GPU driver and the GPU establish a session key; data crossing PCIe travels encrypted.
- GPU state is attested. Each GPU produces a signed report of its firmware and mode, included in the node’s attestation evidence.
- Debug interfaces are locked. Performance counters and debug features that could read GPU memory are disabled while the mode is on.
Performance
Encrypting CPU–GPU transfers adds overhead to workloads that move a lot of data across PCIe. Workloads that keep data resident on the GPU — most training and batched inference — are affected least. Measure your own workload before committing to a term.
Enabling it
cloister nodes create --plan cl.b200.x8 --region us-e --confidential
The mode is fixed for the life of the node. To turn it off, delete the node and create a new one.
Pricing
Confidential mode is billed as a percentage of compute. See Pricing.