Key Notes
- Google Cloud is extending Confidential Bare Metal support to GB300-based A4X Max instances, giving model builders more control over dedicated infrastructure.
- The announcement also expands Nvidia confidential computing across Blackwell and Rubin systems but does not confirm general availability of Google Cloud’s A5X Rubin offering.
- Hardware-backed isolation protects models and data during execution, while workload performance and the exact deployment boundary still require evaluation.
Google Cloud is extending support for Nvidia’s Confidential Bare Metal technology to A4X Max instances, giving AI developers a way to use dedicated cloud infrastructure while adding hardware-backed protections for their models and data. The update is part of a wider Nvidia confidential-computing expansion announced on October 21.
Nvidia’s announcement describes protections for sensitive workloads running on third-party cloud, specialist AI cloud and enterprise infrastructure. The Google Cloud deployment uses GB300 NVL72 systems from Nvidia’s Blackwell Ultra generation. Rubin support is also expanding, but the post does not announce general availability of Google Cloud’s Vera Rubin infrastructure.
What Changes for Google Cloud Customers
Confidential Bare Metal is intended for model builders that want dedicated machines and control over their software stack, rather than relying on a provider-managed virtualized environment. Nvidia says the approach adds platform-integrity checks, protection for data in transit and hardware-level access restrictions while allowing customers to operate their own infrastructure software.
Google’s machine documentation identifies A4X Max as a GB300-based bare-metal offering. Bare metal gives customers direct access to the server’s CPU and memory without the Compute Engine hypervisor layer. The documentation also says customers must reserve capacity to provision A4X Max instances and clusters.
That distinction matters for availability. An existing machine family, a newly announced security capability and a new generation of chips are separate milestones. Nvidia’s October 21 post does not provide pricing, a regional rollout list or a specific general-availability date for the Google Cloud Confidential Bare Metal capability.
Protecting Models While They Are Running
Confidential computing addresses a different problem from encrypting a stored file or a network connection. AI workloads also need to use model weights and process customer information during execution. Nvidia’s technology overview describes hardware-based isolation and attestation, which lets a workload verify the state of its computing environment before trusting it with sensitive material.
The commercial question is who must be trusted with an AI model. A developer may want access to another company’s computing capacity without giving that infrastructure operator unrestricted visibility into proprietary weights or customer inputs. Hardware-backed protections are designed to reduce that exposure within the supported deployment’s security assumptions.
This complements the OpenShell architecture announced the same day. OpenShell governs what an agent can access and do; confidential computing protects the models and information being processed underneath it. Neither purpose substitutes for the other: protecting model memory does not decide whether an agent should be allowed to send a message or change a business record.
Where Vera Rubin Fits
The Rubin connection is real, but broader than the Google Cloud A4X Max update. Nvidia says confidential-computing support now extends to HGX Rubin NVL8 and DGX Rubin NVL8 systems, alongside Grace Blackwell NVL72. It is also bringing the technology into its DSX OS infrastructure framework.
Google’s Rubin offering uses a different name: A5X. The companies’ April announcement described A5X bare-metal instances powered by Vera Rubin NVL72, while Google’s earlier roadmap targeted Rubin systems for the second half of 2026. Those plans should not be read as a newly confirmed general-availability date in the October confidential-computing post.
We previously reported on the companies’ wider infrastructure partnership. The latest update adds another security deployment option to that relationship, rather than establishing that all of its hardware and cloud offerings have reached the same release stage.
Security Still Has a Performance Cost to Measure
Protecting a workload can change how data moves between processors and how software schedules computation. Nvidia’s September testing found that confidential inference retained 96.1% to 98.2% of baseline output-token throughput in a controlled DeepSeek-R1 comparison on eight B200 GPUs. Per-token latency overhead ranged from 1.2% to 4.3% across the tested concurrency levels.
Those are Nvidia’s results for a specified Blackwell configuration, not a performance guarantee for A4X Max, Rubin or every customer model. The practical task for buyers is to assess the security boundary, confirm the supported hardware and software, and measure their own workload. The announcement broadens the infrastructure choices for private AI; deployment details still determine what customers can use and what protection they receive.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
