Security pattern
Confidential computing for AI: protecting data, prompts and models while they are in use
By Richard White ·
Free, no form.
Abstract
Data is encrypted on disk and on the network, but AI does its work in memory, in plain text. Confidential computing runs the workload in a hardware-protected environment and proves what is running through attestation.
The paper explains what the technology protects and what it doesn’t, why confidential GPUs change the picture for AI, and how Microsoft Azure, Google Cloud and AWS differ. Azure and Google Cloud offer confidential GPUs; AWS relies on Nitro operator isolation, Nitro Enclaves and instance attestation.
It covers private AI services, the physical attacks published in 2025, the attestation-gated key release pattern, and how labels and classification decide which workloads need it, with Purview, Cyera, Confidential Space and AWS KMS as examples. A healthcare section sets out what HIPAA does and doesn’t require and five clinical and research uses.
In the paper
Three passages, as published
The recommendation
Make attestation gate the release of keys and data, or the technology becomes a label instead of a control.
Where it doesn’t help
Confidential computing protects the workload from its host. Designing what the workload may see, and say, is still your job.
The test
Ask the team to make the environment fail attestation on purpose and show that nothing sensitive was released.
Next step
Discuss this paper against your own program.
A free sixty-minute working session with Richard on your top gaps. You leave with a one-page summary within three business days, and three next questions.