# GPU-less, Trust-less, Limit-less: Reimagining the Confidential AI Cloud

Mike Bursell, Super Protocol | AI Engineer World's Fair 2025 | 43:41

Source: https://www.youtube.com/watch?v=A0PxE39xaMc
Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks.
Page: https://aietalks.com/talks/gpu-less-trust-less-limit-less-reimagining-the-confidential-ai-cloud
Published: 2025-06-03
Tags: deployment, inference, privacy, security

## TL;DR
- Confidential computing protects AI data and models while they are being processed, then produces cryptographic proof that the workload ran inside verified hardware with approved code.
- Super Protocol combines trusted execution environments, distributed infrastructure, smart contracts, and a marketplace so organizations can run, share, and monetize AI without giving up control of models or data.
- Four demos show confidential model deployment, a medical workflow in n8n, distributed vLLM inference across GPU hosts, and multi-party medical-model training with on-chain execution reports.

## Summary
Mike Bursell presents confidential AI as a way to protect models and data during training, fine-tuning, and inference. Trusted execution environments isolate workloads from the host operating system, hypervisor, hardware owner, and cloud provider. Hardware attestation then provides evidence about the environment and the code that ran in it. He applies this model to healthcare data sharing, personal agents, digital marketing, and model monetization. Super Protocol adds a marketplace, decentralized storage, distributed GPU infrastructure, smart-contract orchestration, and public reports on BNB Chain and opBNB. The demos deploy a private DeepSeek model, run an n8n X-ray workflow, split vLLM inference across four GPU hosts, and train a medical model using data from two organizations without exposing either dataset or the training engine. The talk's strongest claim is that participants can replace contractual trust with checks they can independently verify, although the system still depends on approved hardware, code, certificates, and the surrounding protocol.

## Key ideas
### Trusted execution environments protect data during computation
[01:21](https://www.youtube.com/watch?v=A0PxE39xaMc&t=81s)
Bursell says AI data and models are most vulnerable while they are being processed, including during training, fine-tuning, and inference. A trusted execution environment, or TEE, is an isolated part of a processor, with examples including Intel TDX, AMD SEV-SNP, and NVIDIA GPU TEEs. Hardware instructions protect code and data from the host operating system, hypervisor, system administrators, and even the hardware owner. The TEE also creates cryptographic attestation, which can prove that a workload ran on genuine confidential-computing hardware with unmodified code.

### Confidential AI addresses barriers to shared sensitive data
[03:50](https://www.youtube.com/watch?v=A0PxE39xaMc&t=230s)
Healthcare organizations often keep clinical datasets siloed because access is regulated, expensive, and subject to security policies. Bursell says confidential AI can let a model move to protected data without exposing either side. He applies the same idea to personal agents, which need access to inboxes, calendars, and documents, and to digital marketing, where privacy laws and internal rules restrict the use of behavioral and biometric data. Model owners can also let customers use a private model without handing over its weights, while customers keep their own data inside the protected environment.

### Super Protocol treats the confidential cloud as distributed infrastructure
[08:28](https://www.youtube.com/watch?v=A0PxE39xaMc&t=508s)
Super Protocol is described as a confidential AI cloud and marketplace for collaboration and monetization of models, data, and compute. It supports Intel, NVIDIA, and AMD TEEs, with an ARM confidential-computing architecture validated through ARM 9 emulation. Its swarm-computing design distributes work across GPU nodes and can redistribute workloads when a server goes down. Smart contracts on BNB Chain orchestrate the system, and the project plans to make all parts open source. Bursell compares the protocol's role to HTTPS, but for AI processing.

### GPU-less means avoiding dependence on one GPU provider
[10:31](https://www.youtube.com/watch?v=A0PxE39xaMc&t=631s)
Bursell defines GPU-less as removing dependency rather than removing GPUs. Super Protocol can run accelerated workloads across independent GPU nodes, so users do not have to buy GPUs or rent them for longer than needed. The marketplace can deploy a model to an H100, and the model can be exposed through a link or API while remaining unavailable for download. Bursell also claims that TEEs and the open-source architecture prevent unauthorized access by the hardware provider, Super Protocol, or another party.

### Confidentiality increased usable data in the Realize case
[12:29](https://www.youtube.com/watch?v=A0PxE39xaMc&t=749s)
Bursell describes Realize, which analyzes small facial expressions to help brands assess advertisements. For a Mars project, its training ran in TEEs using NVIDIA H100 and H200 GPUs and Intel Xeon CPUs. Smart contracts automated the process, and the model and footage remained inaccessible to the cloud provider, Super Protocol, and Realize itself. The talk says providers shared four times more sensitive footage, increasing the training set by 319%. Accuracy reached 75%, and Mars saw a 3 to 5% sales increase across 30 brands in 19 markets.

### The marketplace deploys private models and verifies their runtime
[17:44](https://www.youtube.com/watch?v=A0PxE39xaMc&t=1064s)
In the marketplace demo, models are leased rather than downloaded, and users can choose hourly, fixed, or revenue-sharing pricing. Bursell logs in with Google, selects a published DeepSeek model, chooses an H100 GPU, and submits an order assembled automatically on the blockchain. After deployment, the model is available through a web interface, an API, or a custom domain. A verification tool checks that the model is inside a confidential environment, that the connection is encrypted, and that the AI engine has not been tampered with.

### An n8n workflow can keep medical processing inside a TEE
[21:39](https://www.youtube.com/watch?v=A0PxE39xaMc&t=1299s)
The second demo runs n8n inside Super Protocol for a doctor who submits an X-ray and patient details through a protected web form. The workflow extracts the image and metadata, separates personal data from diagnostic input, sends only the necessary image and symptom description to an AI model, and combines the result with patient information to create a report. The report can be text, HTML, or JSON, then goes to the doctor by email and back to the form endpoint. Credentials and API keys are stored inside the TEE, and the same pattern can be adapted to CT scans, MRIs, ECGs, and lab tests.

### Distributed vLLM inference keeps each node inside a confidential boundary
[26:26](https://www.youtube.com/watch?v=A0PxE39xaMc&t=1586s)
The vLLM demo partitions a model by layers across multiple nodes in an overlay network. Each node runs inside a confidential VM, with model weights, input data, and intermediate activations decrypted only inside that environment. Inter-node traffic is encrypted. Four host owners, Alice, Bob, Carol, and David, provide H100 or H200 hardware. Alice runs the head node, Bob and Carol run workers, and David runs a worker that also launches a 22-billion-parameter Mistral model. On-chain reports verify the image and model hashes for each participant, while parallel execution returns responses faster than the speaker's comparison with a usual setup.

### Multi-party training produces public proof without exposing inputs
[33:27](https://www.youtube.com/watch?v=A0PxE39xaMc&t=2007s)
In the final demo, Alice's lab and Bob's clinic contribute sensitive datasets, while Carol contributes a proprietary training engine for an early cancer-detection model. The datasets, engine, and configuration enter a confidential virtual machine. A certification center and trusted loader attest the environment, create keys, and compare hashes against an approved list before training starts. Data and code are decrypted only inside the TEE, and only Carol receives the encrypted trained model and artifacts. An on-chain order report records certificates, input hashes, timing, and the executable hash. After the job, raw inputs are wiped.

## Notable quotes
- "A TE lets you run sensitive computations securely and prove that they ran as intended." (02:59)
- "This isn't about removing GPUs. It's about removing dependency." (10:37)
- "Trustless doesn't mean insecure. It means verifiable by design." (31:51)
- "Security is great. Proof is better." (39:38)

## Tools & references mentioned
- Super Protocol
- Confidential AI
- trusted execution environments
- Intel TDX
- AMD SEV-SNP
- NVIDIA GPU TEEs
- ARM 9
- BNB Chain
- opBNB
- HTTPS
- Realize
- Mars
- Coca-Cola
- GDPR
- CCPA
- NVIDIA H100
- NVIDIA H200
- Intel Xeon
- BEAL
- Titonix
- FDA
- n8n
- vLLM
- SPCTL
- Mistral

## Who should watch
- You have private healthcare, behavioral, or enterprise data that cannot be sent to a conventional cloud workflow.
- You own a model and need customers to use it without downloading its weights or gaining access to your infrastructure.
- You are evaluating distributed GPU inference or multi-party training and need evidence about the code, hardware, and inputs used in a run.

## Related talks

- [The Desktop Frontier](https://aietalks.com/talks/the-desktop-frontier) (Ahmad Osman, Osmantic, 18:02)
- [Privacy-Preserving Intelligence](https://aietalks.com/talks/privacy-preserving-intelligence) (Steve Korshakov, Bee (acq. Amazon), 15:53)
- [The Unofficial Guide to Apple's Private Cloud Compute](https://aietalks.com/talks/the-unofficial-guide-to-apples-private-cloud-compute) (Jonathan Mortensen, Confident Security, 20:36)
- [Llamafile: Bringing AI to the Masses with Fast CPU Inference](https://aietalks.com/talks/llamafile-bringing-ai-to-the-masses-with-fast-cpu-inference) (Stephen Hood & Justine Tunney, Mozilla, 17:25)
- [Open Questions for AI Engineering](https://aietalks.com/talks/open-questions-for-ai-engineering) (Simon Willison, Independent open source developer, 24:33)