Ubuntu for confidential AI
Protect the confidentiality and integrity of your AI workloads at run-time across public and private clouds.
Contact us
Why you need Ubuntu for confidential AI
- Harness AI's power with hardware-backed protection
- Protect your security-sensitive AI data at run-time
- Fine-tune your model securely with your enterprise data
- Safeguard your intellectual property and protect your model
- Deploy your AI workload securely even in untrusted environments
- Strengthen your compliance posture
How confidential AI works
Confidential AI is made possible thanks to confidential computing. Confidential VMs aim to protect private guest memory from the host operating system and hypervisor, reducing the software your workload must trust. The guest software and the platform’s trusted hardware and firmware remain part of that trust boundary.
Confidential AI applies this protection to AI workloads. By running the model and its supporting software inside the protected environment, it shields sensitive inputs, model weights, and outputs from the host operating system and hypervisor while they are being processed. For GPU-accelerated workloads, that protection must extend to the GPU and the data exchanged with it.
Learn more about confidential computing ›
-
CPU-based confidential computing
Ubuntu confidential VMs use Intel TDX or AMD SEV-SNP to protect your workload’s private memory through hardware-backed encryption and isolation.
-
GPU-based confidential computing
On Ubuntu, supported NVIDIA GPUs, including the H200, extend protection to GPU computation and memory when configured in confidential computing mode.
-
Securely integrated CPU-GPU solution
In supported configurations, CPU-GPU transfers are encrypted and integrity-protected. On Ubuntu, remote attestation lets you verify CPU and GPU security evidence before releasing sensitive data or keys.
Confidential AI with Ubuntu and NVIDIA GPUs
-
Confidential AI on your own infrastructure
Run confidential AI with Ubuntu, Intel TDX or AMD SEV-SNP, and supported NVIDIA GPUs. GPU passthrough assigns the GPU to the confidential VM, while encrypted bounce buffers protect CPU–GPU transfers. NVIDIA’s deployment guides specify compatible Ubuntu host and guest versions, GPUs, drivers, and firmware.
-
Confidential AI in the public cloud
Get the same protection without owning the hardware. On Google Cloud, G4 instances run Ubuntu 24.04 LTS with NVIDIA RTX PRO 6000 Blackwell GPUs and AMD SEV, and are generally available across all G4 regions. A3 High instances run Ubuntu 22.04 LTS with NVIDIA H100 GPUs and Intel TDX. On Azure, NCCads H100 v5 instances run Ubuntu 22.04 LTS or 24.04 LTS with NVIDIA H100 GPUs and AMD SEV-SNP.
Enterprise-ready confidential computing in Ubuntu 26.04 LTS
Ubuntu 26.04 LTS is the first enterprise Linux distribution to support both Intel TDX and AMD SEV-SNP across host and guest. Deploy confidential VMs on your own infrastructure with an integrated virtualization stack, protecting sensitive data during processing with hardware-backed isolation.
New confidential computing features without leaving LTS
Ubuntu 26.04 LTS’s optional virtualization Hardware Enablement (HWE) stack updates QEMU, libvirt and VM firmware every six months during the LTS’s first two years. It complements kernel HWE, bringing newer capabilities as they mature without requiring an upgrade to a new Ubuntu release.
Use Ubuntu Pro to further harden your confidential VMs
While confidential VMs can protect your workload from external threats, vulnerabilities from within their boundaries remain a concern. This is where Ubuntu Pro becomes essential, in order to keep your guest CVM software stack patched and up to date.
Ubuntu Pro is Canonical’s comprehensive subscription for open source security, support, and compliance. It gives you access to a trusted open source repository, compliance profiles for the most stringent security standards, and up to 15 years of vulnerability fixes for your OS, infrastructure, and applications – and the AI and open source components you build with.