GPU attestation for confidential AI infrastructure
Remote attestation lets a workload owner evaluate cryptographic evidence before releasing models, data, or keys. A complete GPU design verifies the CPU TEE and every assigned accelerator.
Dataset checked 2026-09-08. Prices and availability may change.
Current public offers
Source-linked records with the published billing context preserved.
| Provider and node | Region | Term | Normalized price | Source |
|---|---|---|---|---|
| Latitude.sh1x H100 80GB (g3.h100.small) | Not published | no commitment | $1.68/GPU-hr$1.68/hr ($1,230/mo) | Provider source ↗Checked 2026-08-20 |
| Cirrascale8x RTX PRO 6000 (Server Edition) | US | 1-mo min | $1.71/GPU-hr$9,999/mo (annual commit $7,999/mo) | Provider source ↗Checked 2026-08-20 |
| Voltage Park8x HGX H100 SXM | Not published | no commitment | $1.99/GPU-hrFrom $1.99/GPU/hr (no contract) | Provider source ↗Checked 2026-08-20 |
| Leaseweb4x H100 (HP DL385 G11) | London | term not stated | $2.02/GPU-hr£4,337.86/mo | Provider source ↗Checked 2026-08-20 |
| Vultr8x H100 80GB SXM (HGX H100) | Not published | term not published | $2.30/GPU-hr$2.300/GPU/hr (pre-paid contract) | Provider source ↗Checked 2026-08-20 |
| Taiga Cloud8x H100 SXM | UK / PT / SE / NO | hourly | $2.60/GPU-hrFrom $2.60/GPU/hr (bare-metal tier) | Provider source ↗Checked 2026-09-04 |
| Leaseweb1x H100 (HP DL385 G11) | Frankfurt | term not stated | $2.61/GPU-hr€1,638.57/mo | Provider source ↗Checked 2026-08-20 |
| Gcore8x H100 SXM (bm3-ai-1xlarge-h100-80-8) | Not published | hourly | $2.64/GPU-hr18.16 | Provider source ↗Checked 2026-09-04 |
| ScalewayEM-T620E-H100: 2x H100 80GB | PAR-2 | monthly | $2.78/GPU-hr3499.99 | Provider source ↗Checked 2026-09-08 |
| Leaseweb1x H200 (HP DL385 G11) | London | term not stated | $2.80/GPU-hr£1,503.02/mo | Provider source ↗Checked 2026-08-20 |
| Taiga Cloud8x H200 SXM | Chester, UK | hourly | $3.00/GPU-hrFrom $3.00/GPU/hr (bare-metal tier) | Provider source ↗Checked 2026-09-04 |
| Latitude.sh8x RTX PRO 6000 (g4.rtx6kpro.large) | Not published | no commitment | $3.00/GPU-hr$24.00/hr ($17,520/mo) | Provider source ↗Checked 2026-08-20 |
| DataPacket8x H200 NVL | Not published | 3–6-mo prepay typ. | $3.06/GPU-hr15368 | Provider source ↗Checked 2026-09-08 |
| Gcore8x H200 | Not published | hourly | $3.17/GPU-hr21.84 | Provider source ↗Checked 2026-09-04 |
| Hostrunway1x H100 (GPU Montreal 5) | Montreal | no lock-in | $3.25/GPU-hr$2,370/mo | Provider source ↗Checked 2026-08-20 |
| Hostrunway1x H100 dedicated GPU server (dual EPYC 7543) | Montreal | no lock-in; 15% discount at 12 months | $3.42/GPU-hr2496.00 | Provider source ↗Checked 2026-08-29 |
| Vultr8x B200 192GB (HGX B200) | Not published | term not published | $3.50/GPU-hr$3.500/GPU/hr (pre-paid contract) | Provider source ↗Checked 2026-08-20 |
| Hostrunway3x H100 dedicated GPU server (dual EPYC 9334) | Montreal | no lock-in; 15% discount at 12 months | $3.75/GPU-hr8210.00 | Provider source ↗Checked 2026-08-29 |
| Cirrascale8x H100 SXM | US | 1-mo min | $4.28/GPU-hr$24,999/mo (annual commit $19,999/mo) | Provider source ↗Checked 2026-08-20 |
| Hostrunway1x H100 dedicated GPU server (dual EPYC 9224) | Montreal | no lock-in; 15% discount at 12 months | $4.36/GPU-hr3180.00 | Provider source ↗Checked 2026-08-29 |
| Hostrunway2x H200 (GPU Montreal 9) | Montreal | no lock-in | $4.45/GPU-hr$6,490/mo | Provider source ↗Checked 2026-08-20 |
| Oracle Cloud8x RTX PRO 6000 (BM.GPU.RTXPRO.8) | Select OCI regions | no commitment | $4.50/GPU-hr$4.50/GPU/hr (pay as you go) | Provider source ↗Checked 2026-08-20 |
| Cirrascale8x H200 | US | 1-mo min | $4.54/GPU-hr$26,499/mo (annual commit $21,199/mo) | Provider source ↗Checked 2026-08-20 |
| Hostrunway1x H200 dedicated GPU server (dual EPYC 9224) | Montreal | no lock-in; 15% discount at 12 months | $4.89/GPU-hr3572.00 | Provider source ↗Checked 2026-08-29 |
Showing 24 of 35 matching records. Browse all listings.
Attest the CPU and every GPU
The CPU TEE establishes the protected virtual machine and coordinates the device path. Each GPU produces evidence tied to its identity, firmware, mode, and vendor reference measurements. Composite policy evaluates both sides before admitting the workload.
Bind evidence to key release
Evidence has operational value when a verifier evaluates freshness and approved measurements, then authorizes a key broker to release secrets only to the accepted workload. The system should fail closed when evidence is stale, a device is missing, debug mode is active, or measurements drift.
Keep an audit record
Retain the evidence, verifier decision, policy version, workload image digest, device membership, key-release event, and relevant timestamps. Test upgrades, replacement devices, verifier outages, scaling, and negative-policy cases before production.
Questions buyers ask
Is GPU-only attestation sufficient?
A complete confidential GPU system also depends on the CPU TEE and protected device path. Composite CPU-and-GPU verification provides the stronger system-level decision.
What should make attestation fail?
Examples include stale evidence, unexpected firmware or image measurements, development mode, a missing device, a failed certificate or reference check, or a topology outside policy.
Does attestation prove an application is free of vulnerabilities?
No. It proves selected identity and state claims against policy. Application security, availability, network controls, and storage controls still require separate protection.