As of the mid-2020s, some data-center GPUs provide features that let them be used for confidential computing together with a CPU TEE. Which correctly describes the idea of this mechanism?

Answer: B. The GPU also proves its state by attestation, and data exchanged between the CPU TEE and the GPU are encrypted and protected against tampering before being sent

AI training and inference process models and data on GPUs, so the CPU TEE alone cannot fully protect data being processed. The GPU's firmware and configuration are therefore proven by attestation, the verifier checks them before handing over keys, and the GPU is treated as part of the TEE. Data between the CPU and the GPU pass through memory managed by the hypervisor and through the PCIe path, so they are encrypted and protected against tampering with a key shared by the two before being sent. Inside the GPU the computation runs on decrypted data, and access to the GPU's internal memory from the host side is restricted.

• A. Handing data over unencrypted would let the hypervisor read them, which is not confidential computing.
• B. Correct. After proving the GPU, the path is protected and the range of trust is extended.
• C. A GPU cannot compute on ciphertext as is (this is not homomorphic encryption). Inside, it computes on decrypted data.