Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing#

Zhongshu Gu, Enriquillo Valdez, Salman Ahmed, Julian James stephen, Michael Le, Hani Jamjoom, Shixuan Zhao, Zhiqiang Lin (affiliations not listed in the program)

• Why: GPU confidential computing is on the path to becoming table stakes for regulated AI workloads, and it is a proprietary, hard-to-inspect black box. A reverse-engineered architecture view plus disclosed vulnerabilities is exactly what a security PM needs to reason about the CPU–GPU trust boundary and what attestation actually covers.
• What: A security analysis of NVIDIA GPU-CC that reconstructs the system: its specialized architectural engines, the bootstrap process that coordinates hardware and software protections, and targeted experiments testing whether data transfers along different paths stay protected across the CPU–GPU bridge under GPU-CC's own threat model. All findings were responsibly disclosed to NVIDIA PSIRT (from abstract only).
• How: System reconstruction from the outside in, then directed experiments against specific transfer paths at the trust-domain boundary.
• Where applicable: NVIDIA-specific by definition (GPU-CC on current NVIDIA silicon), and the concrete findings apply to that stack's current generation. The methodology — treating a vendor's confidential-computing claims as something to be independently verified rather than trusted — generalizes to any TEE/hardware-root-of-trust evaluation.