NVIDIA

NVIDIA describes itself as having "pioneered accelerated computing" S-3604. Its public material relevant to verification concerns its data-centre GPUs:

• Confidential-computing mode. NVIDIA documents a confidential-computing mode for its Hopper and Blackwell data-centre GPUs, in which the GPU is paired with a CPU trusted execution environment and attests its identity and firmware S-1200; see TEE remote attestation for AI workloads.
• H100 launch. NVIDIA engineers describe the feature's launch on the H100, with an on-die root of trust, a fused device identity key and SPDM attestation S-1201.
• Counters in confidential mode. NVIDIA disables performance counters in full confidential-computing mode, stating that they could provide an avenue for side-channel attacks S-1200; see On-chip telemetry from timing, memory and performance counters.
• Fleet telemetry. NVIDIA reports an opt-in, customer-installed fleet-management service that provides read-only GPU telemetry S-1413. Its Fleet Intelligence service uses a read-only, open-source agent that sends GPU power, performance, health and configuration data to an NVIDIA cloud service S-3180. The service supports attestation only on Blackwell and Vera Rubin GPUs S-3180. NVIDIA states that its GPUs "do not have hardware tracking technology, kill switches and backdoors" S-1413. See On-chip telemetry from timing, memory and performance counters.
• Location verification. Avellar and Grunewald report, citing Reuters, that NVIDIA has confirmed it is developing location verification that estimates a chip's location from communication delays with NVIDIA-run servers S-1402; see Chip location verification.
• Use by others. Tinfoil's documentation lists NVIDIA GPUs in confidential-computing mode as supported hardware for its enclaves S-1206; see Tinfoil model identity (Modelwrap).