Confidential Computing

Most of computer security protects data in two states: at rest (encrypted on disk) and in transit (encrypted over the network, via TLS). There's a third state neither of those covers, data in use, while a program is actually computing on it in memory, and historically that gap has meant trusting whoever operates the machine: a cloud provider, a GPU host, an outsourced processor could, in principle, inspect the RAM of a running program and see everything it's working on, no matter how well the data was encrypted before it arrived. Confidential Computing is the name for closing that gap: running the computation inside a hardware-isolated region, a Trusted Execution Environment (see that entry), where the memory itself is encrypted and fenced off, so that even someone with full administrative access to the machine's operating system cannot read the data or the code running inside it.

The practical proof that this happened, rather than just being promised, is attestation: the hardware produces a signed report, cryptographically tied to the actual chip, proving a genuine, unmodified confidential-compute environment ran a specific, verifiable piece of code. A relying party can check that report before releasing any secret to the machine, rather than taking the operator's word for it.

Where it comes from

The term and its formal, vendor-neutral definition belong to the Confidential Computing Consortium, a Linux Foundation project founded in 2019 by Google, Intel, Microsoft, Red Hat, and other hardware and cloud companies, created specifically because several vendors were building similar hardware protections (Intel's SGX and TDX, AMD's SEV, ARM's Confidential Compute Architecture) under different names, and the industry needed a shared definition of what qualifies. NVIDIA extended the same idea to GPUs starting with its Hopper generation (H100/H200), the piece most relevant to AI inference. Solidus built none of this hardware and did not contribute to the Consortium's definition.

Solidus status

Nothing here is running. Solidus's compute network, the system that dispatches AI inference jobs (face embeddings, liveness checks) to third-party GPU operators, ships a trusted-optimistic model today: operators are vetted (KYB), contractually bound (a signed data-processing agreement), staked, and statistically spot-checked, but nothing cryptographically prevents a dishonest operator's own machine from reading the data it's processing during the brief window it's decrypted in RAM. That's a real, named gap Solidus's own design documents state plainly: the software promise reduces a dishonest operator to "the risk class of a contracted cloud KYC sub-processor", bounded and contractual, not eliminated.

The fix, a confidential-computing "attested tier," using NVIDIA H100/H200 hardware, is fully designed: an attestation-gated key-release flow where the operator's node must first prove, via a signed hardware report, that it is running inside genuine confidential-compute mode with the exact expected model loaded, before it ever receives the key needed to decrypt a job. That design exists in Solidus's own documentation. It is explicitly gated on Solidus acquiring H100/H200 hardware it does not currently have, and the plumbing has deliberately not been wired into any running code, a cargo feature slot exists for it, unimplemented. No throughput or cost number exists for this tier from Solidus in either direction.

Proof: none Solidus-specific. Nothing is built. The design document itself is real and checkable: gpu-node/docs/attested-tier.md in the private monorepo lays out the exact attestation-gated flow described above, stated there as hardware-gated and not yet wired into code, the honest status, not a claim of readiness.