Intel TDX protects a confidential VM’s private memory and CPU state from the host, but that protection alone does not secure data as it travels to and from a GPU. Intel TDX Connect is designed to extend the trust boundary to supported PCIe device interfaces and protect their communication with a Trust Domain (TD). It is an architecture, not a guarantee that a particular GPU, cloud instance, or software stack supports the complete design.
Why does GPU use create a security gap?
Intel Trust Domain Extensions (TDX) isolate a TD—roughly, a confidential virtual machine—from the host virtual-machine monitor (VMM). The baseline protection covers the TD’s private memory and CPU state, except for data the TD explicitly shares. That describes the CPU-and-memory boundary, not every component a workload may use.
A GPU needs data from the VM and returns results to it. In a conventional device-I/O path, data may pass through shared memory buffers, often called bounce buffers. The TD can be responsible for copying data between private and shared memory and encrypting or decrypting it as needed. Intel’s architecture specification identifies extra complexity and overhead in this model, particularly for accelerators that need unencrypted data to operate.
So the practical question is not only whether the VM’s memory is protected, but also how the device is assigned, what can observe the data while it is in transit, and whether the device’s identity and relationship to the VM are verified.
#1 Best Overall
What is Intel TDX Connect?
TDX Connect is an architecture intended to let a TD use a trusted PCIe device interface directly. Intel calls these interfaces TEE Device Interfaces (TDIs). Rather than relying on the conventional shared-buffer path as the design’s central mechanism, TDX Connect aims to extend the trust relationship to the device interface and protect PCIe traffic.
That does not mean every PCIe device becomes trusted automatically, or that assigning a GPU to a VM is sufficient. The architecture depends on device, platform, firmware, and software support, as well as protocols that establish and protect the device relationship.
Rank #2
Which protocols extend protection to the device?
Intel’s TDX Connect architecture describes several complementary protocols. They address different parts of the device trust and communication process:
| Protocol | Role in the architecture |
|---|---|
| TDISP | Defines secure lifecycle management, attestation, and binding of PCIe device interfaces to trusted execution environments. |
| IDE | Provides confidentiality, integrity, and replay protection for PCIe transactions. |
| SPDM | Supports authenticated sessions, device certificates and measurements, and provisioning of IDE keys. |
Together, these mechanisms can extend the trust story from the TD to its device interface and traffic. They do not eliminate risks in all software, firmware, workloads, or parts of the supply chain.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How does TDX Connect compare with bounce buffering?
The distinction is about the data path and trust boundary, not a published performance result. Intel describes bounce buffering as an interim way to use accelerators securely, while presenting hardware-based TDX Connect as the intended later capability.
| Question | Conventional bounce-buffer path | TDX Connect design |
|---|---|---|
| Data path | Data may be copied through shared memory buffers, with the TD managing copies and any needed encryption or decryption. | Designed for direct assignment of a trusted PCIe device interface to a TD. |
| Trust boundary | Baseline TDX protects TD private memory and CPU state; the shared-buffer I/O path is an additional boundary to manage. | Intended to extend trust to the device interface and protect PCIe traffic using the relevant protocols. |
| Enablement | Intel’s Confidential AI white paper describes this as an interim software-based approach for secure use of NVIDIA accelerators. | Requires the relevant TDX Connect-capable platform, device, firmware, VMM, guest software, and configuration; availability must be confirmed for the deployment. |
| Performance evidence | Intel describes some performance overhead for bounce buffering; no numerical result is established here. | No verified TDX Connect performance figure is established here. |
A bounce-buffer measurement should not be treated as a TDX Connect benchmark. Intel’s documentation index lists an April 2026 paper analyzing TDX and NVIDIA H100 confidential-AI performance under a bounce-buffer architecture, but the index entry alone does not provide a figure that can be applied to TDX Connect.
Rank #4
Does an NVIDIA H100 work with TDX Connect?
Intel Trust Authority documentation describes composite attestation for an Intel TDX confidential VM and an NVIDIA H100 GPU. That is evidence of a documented attestation combination. It does not establish that H100 universally supports the full TDX Connect direct-device architecture, or that any H100-based cloud instance offers that configuration.
Attestation helps verify claims about a TD and, where configured, a device and their relationship. The exact evidence available depends on the deployment. Do not infer complete device-I/O protection from an attestation example alone.
What is documented, and what should a deployment team verify?
Intel’s documentation index lists the TDX Connect Architecture Specification as updated in June 2025 and the TEE-IO Device Guide as updated in May 2025. The index also lists a TDX Connect ABI specification dated September 2026 and GHCI v2.0 dated April 2026. These entries show continuing specification and enablement work; they are not a complete matrix of shipping products or supported cloud configurations.
Intel Trust Authority documentation describes TDX confidential VMs on-premises and on Azure and Google Cloud. A cloud service’s support for TDX VMs, however, does not by itself confirm support for TDX Connect with a particular accelerator. Before relying on a deployment, confirm the complete configuration with the platform or cloud provider:
- Exact CPU and platform, including whether its firmware supports the required TDX Connect capabilities.
- Accelerator model and device firmware, and whether its PCIe interface supports the required TEE-IO mechanisms.
- Host firmware, VMM, guest software, and any device-assignment configuration required.
- Whether TDISP, IDE, and SPDM are implemented and enabled across the relevant components.
- What the attestation report covers: the TD alone, the assigned device, or the binding between them.
- Whether the named cloud offering or on-premises configuration explicitly supports this combination in production.
What should readers take away?
TDX Connect addresses a real architectural boundary: a confidential VM’s CPU and memory protections do not, by themselves, settle how accelerator data is handled. Its intended answer is trusted device-interface assignment with protocols for device binding, authentication, and protected PCIe traffic. Whether that answer applies to a particular GPU deployment depends on the full platform and software stack, not the GPU model alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
