As of May 22, 2026
This document is subject to periodic updates as new hardware, drivers, and validation data become available – or as such information is confirmed by or reported to Super Protocol.
For the most accurate and up-to-date guidance, always consult your provider directly when making a decision.
The system's CPU and GPU must both support TEE mode and be fully compatible with each other to operate in confidential mode.
Blackwell Architecture:
Rubin Architecture:
More information will be provided at a later time.
Unlike Hopper-based DGX/HGX systems (H100/H200), Blackwell-based platforms (such as B200, B300, and RTX PRO 6000) introduce significantly greater flexibility for confidential GPU allocation and multi-GPU deployment in TEE mode.
Blackwell-based HGX/DGX systems with NVLink support secure multi-GPU configurations in TEE mode with 1, 2, 4, or 8 GPU deployments, providing significantly more deployment options than previous-generation systems.
By contrast, Hopper multi-GPU passthrough (PPCIe) does not encrypt GPU-to-GPU NVLink communication, preventing the creation of a secure shared multi-GPU memory domain for confidential workloads. As a result, Hopper-based confidential deployments are constrained to either Single GPU Passthrough (SPT CC) or full-platform passthrough configurations (e.g., entire 8-GPU systems).
Blackwell systems may also support mixed TEE and non-TEE virtual machines (VMs) on the same physical server, subject to configuration. However, for bare metal servers, where the entire machine is dedicated to a single user, this distinction may be operationally less relevant.
The boundary of the Trusted Execution Environment – and therefore the boundary of accessible confidential memory – depends on two factors: the GPU architecture and the CC mode in use.
Why this matters for workloads: Large Language Model (LLM) inference relies on tensor parallelism (TP) to distribute model weights across multiple GPUs, requiring constant, massive data transfers. Because PPCIe does not encrypt inter-GPU NVLink traffic, Hopper architectures cannot establish a hardware-encrypted shared Peer-to-Peer (P2P) memory domain for multi-GPU confidential workloads. As a result, when operating multi-GPU Hopper platforms (such as 4-GPU or 8-GPU HGX H100) under strict zero-trust security, the GPUs cannot be treated as a hardware-encrypted aggregated confidential memory pool. While multiple GPUs can reside inside a single CVM, they can be utilized for independent task parallelization. This means each GPU operates as an isolated compute entity inside the CVM, processing separate workloads or independent model instances concurrently to prevent plaintext data exposure on the physical interconnect.
Blackwell MPT CC addresses this limitation by extending hardware-level encryption directly across the NVLink fabric. This architectural upgrade allows up to 8 GPUs to securely combine their VRAM into a single, aggregated memory pool inside one CVM.
Blackwell also enables a second path for confidential large-model inference through native NVFP4 (NVIDIA's hardware 4-bit floating-point format, E2M1 with per-block scales, executed on dedicated Blackwell Tensor Cores). According to NVIDIA's NVFP4 materials, NVFP4 cuts the model memory footprint by roughly 4× versus bf16 with near-lossless accuracy on standard benchmarks. This allows workloads that would otherwise require multi-GPU TP to fit inside a single GPU operating in SPT CC mode. For example, certain 122B-parameter MoE models can fit on a single RTX PRO 6000 Blackwell SE (96 GB), avoiding the need for multi-GPU TP or NVLink-based scaling This is particularly relevant for SKUs without NVLink (such as RTX PRO 6000 SE), as well as for deployments that prefer the simplicity and broader hardware availability of single-GPU SPT CC over MPT CC.
For a practical example of how this unlocks workloads, see our High-Performance Inference with vLLM on Super Protocol article.
Hopper GPUs support two TEE configurations:
As a result, Hopper architectures do not support secure shared confidential multi-GPU memory or partial GPU allocation within a larger multi-GPU platform.
Blackwell GPUs support two TEE modes:
Blackwell systems may also support mixed TEE and non-TEE virtual machines on the same physical server, subject to configuration. However, for bare metal servers, where the entire machine is dedicated to a single user, this distinction may be operationally less relevant.
Refer to official NVIDIA Confidential Computing driver documentation for SKU-level compatibility and supported modes.
TEE functionality is currently available only for the Server Edition, while the Workstation and Max-Q Editions are expected to add support in future releases. Super plans to validate this release in upcoming tests.
The release of RTX PRO 6000 Blackwell Server Edition (SE) makes TEE support much more flexible in various topologies.
The driver version primarily determines which TEE modes and GPU SKUs are available on a specific platform. The overview below details the features introduced by each release.
Hopper TEE capabilities were first introduced in earlier driver releases (R550-R575) and have since been stabilized and expanded across subsequent updates. R595 TRD1 is the current General Availability (GA) release.
Blackwell TEE capabilities represent a major architectural shift in the driver, moving from unencrypted NVLink (Hopper PPCIe) to hardware-encrypted NVLink (Blackwell MPT CC).
RTX PRO 6000 TEE capabilities were introduced in recent driver releases and are gradually expanding to new hardware variants.
For current firmware and OS requirements per SKU, refer to the NVIDIA Secure AI Compatibility Matrix.
⚠️ 4th Gen Intel Xeon (Sapphire Rapids)
Intel supplied 4th Gen Xeon CPUs with TDX support exclusively to Google Cloud Platform, Microsoft Azure, IBM, and Alibaba. Only these cloud providers can offer instances with TEE-enabled 4th Gen Intel Xeon CPUs. All 4th Gen Intel Xeon CPUs from any other sources (cloud providers, OEMs, etc.) do not support Intel TDX.
✅ For all other cases, TDX support begins with the 5th Gen Xeon (Emerald Rapids) and newer — including Sierra Forest, Granite Rapids, and beyond.
However, Intel TDX support alone may not be sufficient for NVIDIA GPU TEE workloads. NVIDIA certifies platforms based on CPU generation (among other factors), and in some cases, OEMs support only specific CPU models (SKUs) to ensure proper functionality in GPU TEE mode.
Note: These compatibility requirements apply to both Intel TDX and AMD SEV-SNP based systems.
✅ NVIDIA Secure AI Compatibility Matrix
NVIDIA publishes the Secure AI Compatibility Matrix – the official reference for supported combinations of NVIDIA GPUs, VBIOS versions, CUDA driver versions, and Confidential Computing modes (SPT CC, PPCIe, MPT CC). This matrix is the primary reference for GPU-level TEE support validation.
For a comprehensive list of GPU-accelerated systems available from the NVIDIA partner network, refer to NVIDIA's official qualification and certification catalog.
⚠️ GPU-Level vs System-Level Functioning
The Compatibility Matrix confirms whether a specific GPU SKU and software stack are TEE-capable. However, it does not guarantee that the entire physical server will function reliably in TEE mode.
The Matrix covers GPU-level compatibility; it does not replace OEM system-level validation, which accounts for the full system integration: CPU generation, memory (DIMM) configuration, BIOS/Firmware settings, and the component interaction within a specific server chassis.
⚠️ Cooling Variants: Air Cooled (AC), Partner Cooled (PC), and Liquid Cooled (LC) versions of the same GPU platform are treated as distinct SKUs by NVIDIA and often do not share the same TEE support status or driver availability. Always verify the exact cooling variant in the Compatibility Matrix before making a decision.
OEMs are not required to conduct separate testing for TEE mode. While OEMs may not officially validate systems for TEE configurations, they often limit available configurations to those more likely to function reliably, especially in scenarios involving TEE workloads.
Additionally, many OEMs confirm that if TEE is part of the GPU feature set and all components meet the necessary requirements, TEE functionality is expected to work as intended.
Note: However, caution is advised with brand-new server models that have not yet been widely tested in the field. We’ve encountered cases where a newly launched system did not meet the OEM’s own standards for TEE readiness and required additional adjustments or testing. Actual outcomes may vary depending on the OEM and their internal validation processes.
Even when a GPU SKU appears in the Secure AI Compatibility Matrix, testing the full configuration in a staging or pilot environment remains the most reliable way to confirm compatibility.
⚠️ Always consult directly with your OEM or hardware reseller to verify that your specific system configuration (including BIOS/Firmware versions, memory (DIMMs) and OS validation) fully meets the requirements for Intel TDX, AMD SEV-SNP, NVIDIA GPU TEE, and your intended confidential computing workloads.
In some cases, ODMs had TEE-related BIOS settings hidden by default, making it impossible to enable TEE on otherwise compatible CPUs (AMD SEV-SNP in our case) — simply because TEE was not part of their expected use case. It can be solved but requires extra effort and time.
⚠️ Some cloud providers claimed to offer Intel TDX-enabled instances, but the required DIMM configuration (i.e., main memory setup) was not met, preventing TEE mode from being properly enabled.
The configurations below are not compatible for use in TEE mode in their current form.
