Google Cloud has announced the general availability of Confidential Computing on G4 instances, powered by NVIDIA RTX PRO 6000 Blackwell Server edition GPUs. The release integrates NVIDIA Confidential Computing into Google Cloud’s AI Hypercomputer, targeting enterprises that process sensitive data and intellectual property in real time. The post frames the problem directly: protecting proprietary model weights, user prompts, and generated outputs requires security that safeguards data while it is being computed.

The instances were in preview earlier this year and are now GA across 36 zones, with multiple consumption models, on Compute Engine VMs and GKE nodes. Support for Confidential Space, which enables secure multi-party data sharing, is rolling out to general availability in the coming weeks.

The security model combines non-exportable hardware keys, verifiable remote attestation, and transparent memory encryption. These mechanisms create hardware-enforced execution environments, encrypting data and model parameters so they are shielded from host system administrators, hypervisors, and cloud provider access. Hardware-rooted remote attestation lets customers verify code, platform configuration, and environment integrity before releasing sensitive datasets or running workloads. NVIDIA’s Dave Salvator said NVIDIA Confidential Computing brings hardware-backed protection to GPU-accelerated workloads, and that the collaboration with Google Cloud brings Blackwell performance and these security capabilities to Confidential G4 VMs so organizations can scale production AI with high performance and verifiable protection. Taher Behbehani of Confidential Core AI added that Confidential Core AI builds on Google Cloud to turn enterprise principles, policies, and operating requirements into real-time safeguards that monitor and govern AI agents, models, data, and tools.

A central operational benefit is that no code refactoring is required. Models can be deployed out of the box with standard Ubuntu OS images, NVIDIA drivers, and NVIDIA CUDA-X libraries, with no application changes or custom builds. Polaris Cloud CEO Fred Esere described the impact on his agent workspace service: with the same G4 image, same NVIDIA driver, and same container runtime, a single flag at launch provides hardware-backed provenance from the GPU, which is bound into the receipts customers receive. He said it upgraded their customer promise overnight from ‘we run your agent’ to ‘every workload you run with us is verifiable.’

To quantify the trade-off, Google Cloud benchmarked Confidential G4 against standard, non-confidential G4 instances on the g4-standard-48 machine shape. Across Llama 3, Llama 3.3, ResNet-50, and SDXL, throughput degradation was less than 3.5% (measured in tokens or images per second). The post includes a note that performance results are based on specific testing conditions and configurations, and individual workload performance may vary. A separate result from Vertebrae CEO Andy Qin showed a 5.2% increase in end-to-end latency on their own workloads in exchange for hardware-level assurance that unauthorized users outside an attested environment cannot eavesdrop on conversations.

The release is positioned as a way to add verifiable trust and hardware isolation to model execution and agentic workloads without sacrificing performance, flexibility, or operational simplicity. Confidential G4 can be used through the documented Confidential VM with GPU workflow on Google Cloud.