NVIDIA GPU Confidential Computing¶

This guide covers scanning a GPU running in Confidential Computing mode next to a confidential VM. The checks read evidence you capture on the confidential VM:

the GPU attestation report;
the verifier policy;
the key-release policy;
the launch configuration.

They do not call a cloud API, apart from one optional active probe.

What gets checked: attestation, measurements and the certificate chain, CC mode, the order of attestation and readiness, model inputs, and the binding between the GPU and its confidential VM. See the GPU CC check list.

Before you begin¶

Install the CLI: Install.
On the confidential VM, collect the files the checks read. Each check's page names the option it reads, and Scan inputs lists them all.

1. Try the demo¶

untrust scan --platform gpu-cc --demo

[FAIL] GPUCC-ATT-01       GPU attestation report does not assert a trusted state: cc_mode is 'devtools' (expected on).  [report-derived]
[FAIL] GPUCC-MODE-01      GPU is not in production Confidential Computing mode: CC mode is DevTools — a debug/perf mode that weakens the isolation.  [operator-declared]
...
25 of 25 checks failed.
Recorded results: 0 PASS, 25 FAIL, 0 SKIP, 0 ERROR. Skipped checks and errors remain unassessed.

The label at the end of a line is the result's assurance. report-derived means it was read from a report whose signature that check does not verify. operator-declared means it rests on a value you told the scanner. See Concepts.

2. Run a scan¶

untrust scan --platform gpu-cc \
  --gpu-attestation-report report.json \
  --gpu-verifier-policy verifier-policy.json \
  --gpu-cc-mode on \
  --gpu-kbs-policy kbs-policy.json \
  --gpu-launch-config launch.json \
  --output gpu-report.json

Option	What it is	Checks that read it
`--gpu-weight-file`	a model weight file, whose leading bytes show its real format	GPUCC-INPUT-01
`--gpu-reset-evidence`	captures from before and after a GPU reset	GPUCC-PERSIST-01
`--gpu-model-bucket`	the object store holding model weights, for the injection probe	GPUCC-MODEL-01

3. The model-store probe¶

GPUCC-MODEL-01 is an active check. It writes probe objects to the model bucket and then removes them, using Google Cloud Storage and your Application Default Credentials. It needs storage.objects.create and storage.objects.delete on that bucket. --read-only skips it.

4. Read the results¶

FAIL: open the check's page for what a failure enables and how to fix it.
SKIP: the evidence file for that check was not given.
ERROR: a file could not be read or parsed.

See Output and exit codes.

5. Keep it running¶

untrust detect --platform gpu-cc compares successive GPU attestation captures and reports changes. See Runtime detections.