Google Cloud has moved Confidential G4 instances, which embed NVIDIA RTX PRO 6000 Blackwell Server GPUs, from preview to general availability. The change means you can now provision these GPUs on Compute Engine VMs or GKE nodes in 36 zones, using the same consumption models that power existing workloads, while the platform enforces hardware‑based confidentiality for data in use.
Availability and Deployment Options
Confidential G4 is exposed as a machine type that can be selected in the same way as any other GPU‑accelerated instance. It is supported in 36 geographic zones and can be launched on both Compute Engine and Google Kubernetes Engine. The service respects the existing consumption models (on‑demand, committed use, etc.), so budgeting and scaling practices remain unchanged.
Because the offering uses standard Ubuntu images, NVIDIA drivers, and CUDA‑X libraries, you do not need to rebuild containers or modify your CI pipelines. The only addition is a launch flag that enables the confidential mode.
Security Guarantees and Attestation
Confidential G4 relies on three hardware‑rooted mechanisms: non‑exportable keys stored in the GPU, verifiable remote attestation, and transparent memory encryption. Together they ensure that model weights, prompts, and generated outputs remain encrypted while being processed, shielding them from host administrators, hypervisors, and even the cloud provider.
- End‑to‑end confidentiality and isolation: Data and model parameters are encrypted inside the GPU’s execution environment.
- Verifiable cryptographic trust: Remote attestation lets a client confirm the exact software stack and configuration before releasing sensitive inputs.
- No code refactoring required: Existing Ubuntu‑based images and CUDA‑X stacks run unchanged; the confidential flag is the only operational difference.
“Google Cloud Confidential G4 VMs powered by NVIDIA RTX PRO 6000 Blackwell GPUs provide a powerful foundation for privacy‑preserving AI and AI operations,” notes Taher Behbehani, Founder and CEO of Confidential Core AI.
Operational Impact for CI/CD and Workloads
From a DevOps perspective, the shift to Confidential G4 does not alter the build artefacts you produce. However, you should incorporate attestation verification into your deployment pipeline if you need to enforce that only trusted instances run sensitive workloads. Monitoring should include the new GPU‑specific metrics (e.g., memory encryption status) that are exposed by the underlying NVIDIA stack.
Security engineers can treat the GPU as a hardware security module: the non‑exportable keys never leave the device, and any attempt to extract them would be detected by the attestation process. This reduces the attack surface for data‑in‑use threats without adding a separate HSM layer.
Related CloudNinjas coverage: Google Cloud.
What This Means For Practitioners
Practitioners should start by mapping any workloads that handle proprietary model weights or user‑generated prompts to Confidential G4 instances. Verify zone availability for your region, update your infrastructure‑as‑code templates to include the confidential launch flag, and add a step that validates the remote attestation report before data is sent to the GPU. Keep an eye on the upcoming GA of Confidential Space, which will extend secure multi‑party data sharing capabilities. Finally, incorporate the new hardware‑rooted trust signals into your compliance reporting to demonstrate that data‑in‑use is protected by design.