GPU trusted execution environment. The H100 is the first GPU to offer confidential computing: it boots in "CC-On" mode behind an on-die hardware ROOT OF TRUST, runs only NVIDIA-signed firmware (secure + measured boot), and pairs with a CPU confidential VM (AMD SEV-SNP or Intel TDX) over an encrypted, authenticated SPDM channel. Data moves CPU<->GPU through an encrypted "bounce buffer"; the GPU decrypts inside its package, computes, and re-encrypts on the way out.

The hardware everyone in this section actually runs on -- filed as its own PRIMARY entry because the corpus previously had only third-party views of it: a benchmark paper (TEE confidential LLM inference) and a rollup design (Optimistic TEE-Rollups (OTR)) that uses H100 CC as a component. This is the vendor's own spec of the mechanism. The load-bearing point for this SoK is threat-model point 4 on the TEEs page: attestation proves the binary's hash, not that the weights inside are the ones advertised -- the model-substitution question verifiable inference exists to answer -- and whether the attestation even covers the weights is a deployment choice. It is, by a wide margin, the most deployed answer to "verifiable/confidential inference" today; its assumption (trust NVIDIA, for now, against your adversary) is the thing the ZK case must be argued against, not around.

What is new

This is the vendor's own spec for the hardware every other paper in this section runs on. The corpus already had two third-party views of H100 confidential computing, a benchmark study (TEE confidential LLM inference) and a rollup design that uses it as a component (Optimistic TEE-Rollups (OTR)), but not the primary source describing the mechanism. This entry is that source.

The H100 is the first GPU with a trusted execution environment. The whitepaper's claim is narrow and mechanical: the GPU boots in a "CC-On" mode behind an on-die hardware root of trust, runs only NVIDIA-signed firmware (secure + measured boot), and pairs with a CPU confidential VM (AMD SEV-SNP or Intel TDX) over an encrypted, authenticated SPDM channel. Application data crosses the PCIe boundary through an encrypted bounce buffer, the CPU VM encrypts it, the GPU copies it inside its package, decrypts, computes, and re-encrypts on the way out. The output of the boot is an attestation report: a cryptographically signed set of measurements of the GPU's identity and firmware, checked against NVIDIA's Remote Attestation Service and a Reference Integrity Manifest.

What it actually proves

An attestation proves what ran, on genuine NVIDIA silicon, a specific measured firmware/GPU identity, signed by a key rooted in NVIDIA. That is all it proves. It says nothing about whether the computation was correct, whether the operator was honest, or whether the weights inside the attested binary are the ones advertised. This is the distinction that matters for this SoK, and it is threat-model point 4 on the TEEs page: a TEE will faithfully attest to a backdoored model. Whether the attestation even covers the weights, rather than stopping at the container that loads them, is a deployment choice, and it is exactly the model-substitution question verifiable inference exists to answer.

So it belongs in Alternatives to ZK: it delivers confidentiality plus hardware-attested integrity, at a throughput cost ZK cannot approach, in exchange for a trust assumption ZK does not make.

What to distrust

Two gaps, both load-bearing, and one of them the whitepaper concedes itself.

Side channels are explicitly out of scope, a documented exclusion in the whitepaper's own threat model, not an oversight. That is precisely the attack class the academic TEE-breaking literature has spent a decade demonstrating against CPU enclaves, and the honest reading is the one on the TEEs page: the assumption is not "this hardware is secure" but "secure enough, for now, against the adversary I have, and I will get told when it isn't."

The sharpest structural caveat has nothing to do with side channels. An attestation is perishable. It is worth what NVIDIA's signing key is worth on the day you check it; if the key later leaks or the part is later broken, past attestations are retroactively worthless. A ZK proof verified today is still verified in ten years. For an on-chain settlement or a compliance artifact that must survive a dispute years later, that difference is the whole argument, and it is independent of the throughput numbers that dominate the discussion. See TEEs, the assumption that is actually deployed for where this lands.