Confidential Computing for AI Training: How to Protect Models and Data on Bare Metal

Training AI models often involves sensitive data and valuable intellectual property. Whether you’re building proprietary machine learning models or analyzing confidential datasets, keeping that information secure throughout the training process is essential. Confidential computing protects data at every stage—when stored, in transit, and during processing.

This post explores how you can use confidential computing—specifically Intel TDX and bare metal infrastructure—to secure AI training workloads. If you already know the basics, check out OpenMetal’s blog on practical deployments or on balancing security and speed.

Why AI Models and Training Data Need Protection

AI models are incredibly valuable—often reflecting years of development and unique intellectual property. When businesses train these models, they often rely on proprietary data that might include sensitive personal information, competitive insights, or financial details. This type of data attracts attackers, which is why teams must protect it throughout the entire AI lifecycle.

Even if encryption is used during storage or transmission, a major gap remains: what happens when the data is being processed? In traditional virtualized environments, it’s possible for insiders or misconfigured systems to expose active memory. That’s where confidential computing plays a key role—protecting the training process itself.

How Confidential Computing Helps

Confidential computing creates a trusted execution environment (TEE) around the workload. This isolates it from the rest of the system—even the hypervisor and root users. With Intel TDX, which is supported by OpenMetal’s infrastructure, you can run secure virtual machines that shield your AI models and data while in use.

This is especially important for training large language models, recommendation systems, or predictive algorithms that rely on confidential or high-value data. By using TEEs, organizations gain confidence that the data will remain protected throughout the process—even if they’re deploying in a shared or multi-tenant environment.

What You Need for Confidential Computing in AI Training

To successfully run confidential computing workloads for AI training, your infrastructure must meet several key requirements—starting with the right hardware. At the foundation are Intel 5th Gen Xeon CPUs with Intel Trust Domain Extensions (TDX). These processors enable hardware-based memory encryption and ensure that sensitive data used in training models stays protected, even while in use.

At OpenMetal, both our XL V4 and XXL V4 bare metal servers are equipped with TDX-capable CPUs. This gives you the ability to isolate memory and workloads at the hardware level, which is essential for truly confidential computing environments.

Once you have the hardware in place, you’ll need a way to create secure virtual machines. Using hypervisors like KVM or QEMU, which are compatible with Intel TDX, you can launch TDX-enabled VMs that keep data fully isolated from the host system and other tenants.

AI workloads also generate and process huge volumes of data, so fast, secure storage is a must. With encrypted NVMe storage, OpenMetal ensures your training data stays protected while delivering high-speed performance—even in cases of drive loss or unauthorized access.

For those who require GPU acceleration during training, OpenMetal offers H100 GPUs that can be attached to TDX-enabled virtual machines using PCIe passthrough—but this configuration is available only on the XXL V4 bare metal server. This server provides the right balance of compute power, memory capacity, and hardware support to run both Intel TDX and GPU passthrough simultaneously.

This setup handles demanding AI workloads like deep learning exceptionally well, delivering both security and performance at scale.

Lastly, network isolation is critical—especially for customers dealing with compliance or privacy regulations. OpenMetal provides dedicated VLANs to separate your traffic from other workloads, helping to reduce risk and maintain a clean, segmented network environment.

Example Use Case

An OpenMetal customer in the blockchain space provides a helpful comparison. Their platform manages validator workloads and real-time transaction indexing. While they’re not training AI models, their infrastructure has similar security and performance needs: consistent compute, strict data separation, and hardware-level trust.

They use OpenMetal’s XL V4 servers with Intel TDX to launch secure VMs, isolate data with VLAN segmentation, and use encrypted volumes for sensitive blockchain metadata. The same environment is ideal for AI teams training proprietary models, especially if those models support financial, medical, or compliance-focused products.

Final Thoughts

Confidential computing is no longer experimental—it’s ready for production. If you’re training AI models with proprietary data, using Intel TDX on OpenMetal’s bare metal servers gives you the security and performance you need. If you’re ready to adopt confidential computing for AI training, OpenMetal’s Intel TDX-enabled infrastructure gives you a secure foundation to begin.

Contact us to learn how to start building your confidential AI training environment today.

Read More on the OpenMetal Blog

Architecting Your Predictive Analytics Pipeline on OpenMetal for Speed and Accuracy

Learn how to architect a complete predictive analytics pipeline using OpenMetal’s dedicated infrastructure. This technical guide covers Ceph storage, GPU training clusters, and OpenStack serving – delivering superior performance and cost predictability compared to public cloud alternatives.

How Hidden Cloud Costs Quietly Erode Portfolio EBITDA

Hidden cloud costs are silently destroying SaaS profit margins. PE firms lose billions in portfolio value due to unpredictable usage fees, resource waste, and egress charges. Learn how private cloud infrastructure delivers 30-50% cost savings and predictable EBITDA improvement.

How PE Firms Can Reduce Cloud Costs Across Their SaaS Portfolio with OpenMetal

PE firms face mounting cloud costs across SaaS portfolios. Learn how OpenMetal’s private cloud delivers 30-60% cost savings, predictable pricing, and improved margins that directly boost portfolio valuations and exit multiples.

20 Gbps NICs and Free Internal Traffic Matter: The Hidden Power of OpenMetal’s Private Networking

Learn how OpenMetal’s private networking architecture delivers 20 Gbps per server, free internal traffic, customer-specific VLANs with VXLAN support, and predictable egress billing. Perfect for AI training clusters, database replication, and high-throughput workloads requiring performance without bandwidth constraints.

Private Cloud vs. Public Cloud for Confidential Workloads: A Risk and Control Comparison

Public cloud confidential computing promises security but retains provider control over critical trust components. Private cloud infrastructure eliminates third-party trust dependencies, providing genuine confidentiality for sensitive workloads through dedicated hardware and transparent attestation.

Powering Your Data Warehouse with PostgreSQL and Citus on OpenMetal for Distributed SQL at Scale

Learn how PostgreSQL and Citus on OpenMetal deliver enterprise-scale data warehousing with distributed SQL performance, eliminating vendor lock-in while providing predictable costs and unlimited scalability for modern analytical workloads.

Secure Oracles and Smart Contracts: The Role of Confidential Computing in Decentralized Trust

Explore how confidential computing transforms blockchain security by protecting oracle data feeds and smart contract execution. This guide covers implementation strategies, performance optimization, and deployment best practices for building secure decentralized applications on OpenMetal’s bare metal infrastructure.

5 Blockchain Workloads That Absolutely Should Not Be on Shared Public Cloud

Discover five blockchain workloads that demand dedicated infrastructure over shared public cloud. From validator nodes to MEV systems, learn why bare metal servers and private cloud provide the performance, security, and control these critical operations require.