NVIDIA’s Vera Rubin NVL72 announcement at GTC on March 16, 2026 confirmed seven new chips in full production. GPU-layer confidentiality is now baseline for AI factory deployments, attested memory enclaves and encrypted NVLink ship today on Hopper (H100, H200) and Blackwell (B200, GB200).
The compute side is solved. The storage layer isn’t. The same dataset an attested GPU enclave processes confidentially has to be loaded into that enclave from somewhere, and that somewhere is where most AI architectures hand the audit a problem.
The audit surface moves to the data layer
GPU confidential computing proves the right code ran on the right hardware on the right input. It opens the next question: how do you know the input the enclave attested to was the input you intended? Where did the training data come from? Can you prove the data the model trained on in March is the same data your storage layer has in November?
Those are storage questions. Most architectures answer them by trust assertion, SOC 2 reports, vendor-documented encryption at rest. For regulated financial services, healthcare PHI, federal research CUI, and EU personal data, those answers don’t pass audit anymore. console.akave.com is where teams test this against their own pipelines.
Five properties the storage layer has to have
Verifiable data lineage, every training input has a cryptographic proof at ingestion, verifiable externally without trusting the storage provider.
Integrity proofs anchored independently, anchored on a dedicated immutable storage ledger structurally separate from the object store.
Geofenced placement guarantees, enforced at the protocol layer with placement records auditors can verify independently, not metadata claims in a dashboard.
Immutable audit trail with detection guarantees, any modification is independently detectable through hash mismatch against the ledger. Not “no administrator can modify the data,” but a property an external auditor can verify on their own.
Verifiable retrieval, the bytes the GPU enclave attested to are the bytes the auditor can show came out of storage. The retrieval verification closes the loop between compute attestation and data lineage.
AI factory needs a substrate, not a product
NVIDIA’s AI factory framing describes a vertically integrated stack, GPU silicon, NVL fabric, CUDA, networking. Storage gets treated as a commodity input. That works when storage is inside the trust perimeter. It breaks when the audit requirement is verifiability across the boundary. The GPU layer can attest the model ran on the right inputs. It cannot attest where those inputs came from before they entered the enclave.
How Akave is built for this?
Akave Cloud is S3-compatible, boto3, dataset loaders, and existing CUDA-side ingestion code stay the same. Underneath the S3 API: data is sharded across independent storage operators so no single operator reconstructs the object. Cryptographic proof is generated at ingestion and anchored on a dedicated immutable storage ledger separate from the object store. Geofenced placement is enforced at the protocol layer. Any modification is independently detectable through hash mismatch. Retrieval can be verified externally without trusting Akave.
Connect to the console.akave.com and test Akave for free with a 30-day free trial, no payment details asked.
Production reference architecture
Compute: Blackwell B200/GB200 with attestation and NVLink encryption, or H100/H200 CC instances; Vera Rubin rolls out through H2 2026. Orchestration: Slurm, Kubernetes with a GPU operator, or managed. The pipeline reads from Akave’s S3 endpoint. The enclave’s attestation document and the storage layer’s retrieval record together form the evidence package. No custom drivers, no kernel modules.
Why this can’t be retrofitted
Provenance can’t be retrofitted. Proof at ingestion has to be generated when the data lands; there is no way to produce one for an object uploaded six months ago without it. Deferred long enough, datasets accumulate without proofs, and the team reconstructs provenance from indirect evidence, pipeline logs, git commits, producing assertions where the audit asks for evidence.
Looking ahead
2026: GPU-layer confidential computing becomes baseline for regulated AI. 2027: confidential computing extends down the stack, networking, storage, orchestration. Teams that put the storage substrate in place first will be deploying additional confidential layers on top of verifiable evidence. The architecture decision is the audit decision.
FAQ
What does NVIDIA confidential computing actually cover?
It covers the GPU enclave, model weights, activations, and computation are protected from the host system or hypervisor, with attestation proving a specific computation ran on a specific input. H100/H200 use PCIe encryption; Blackwell adds NVLink encryption. Rubin-specific CC details aren’t yet confirmed in primary NVIDIA documentation. What it doesn’t cover: where the input came from before the enclave.
Why do AI factories need a verifiable storage layer?
GPU-layer confidentiality proves the right computation ran on the right input. Audit frameworks also require evidence of where the input came from before the enclave, and that lives in storage. Verifiable storage produces ingestion-time proofs an external auditor can verify without trusting the storage provider.
Can I add verifiable storage to an existing AI factory after the fact?
Not for the data already stored. Proof at ingestion has to be generated when the data lands. Objects uploaded before the verifiable layer was deployed don’t have ingestion proofs and can’t get them retroactively. The architectural decision has to happen before training datasets accumulate.
How is Akave different from AWS GovCloud or Azure confidential compute storage?
GovCloud-tier offerings satisfy regulated workloads through trust assertion, audit reports, vendor-documented provenance. Akave provides independently verifiable properties: sharded data across independent operators, ingestion proofs on a separate immutable storage ledger, and retrieval verifiable without trusting the provider.
Further Reading
- Akave product overview
- AI/ML storage use cases
- For an architecture walkthrough specific to your AI factory stack, talk to Stefaan Vervaet, Founder & CEO at Akave: stefaan@akave.com
Sources
- NVIDIA H100 confidential computing, first NVIDIA GPU with TEE on the CPU anchored in an on-die hardware root of trust, with PCIe encryption. NVIDIA Developer documentation.
- NVIDIA H200 confidential computing, Hopper-generation CC carried forward to H200. NVIDIA Developer documentation.
- NVIDIA Blackwell (B200, GB200), adds NVLink encryption on top of PCIe encryption for multi-GPU communication. NVIDIA product pages.
- NVIDIA Vera Rubin platform, initial announcement CES January 6, 2026; detailed platform announcement GTC March 16, 2026, seven new chips in full production. nvidianews.nvidia.com/news/nvidia-vera-rubin-platform.
- Rubin-specific confidential computing capabilities, not yet confirmed in primary NVIDIA documentation; expected on the architectural trajectory from Hopper to Blackwell.