Verify a Confidential GPU Attestation Offline in Five Minutes, No Account Needed

Every confidential computing vendor says your workload runs in a sealed enclave. The useful question is whether you can check that claim without trusting the vendor.

This tutorial does exactly that with a real bundle captured on 9 October 2026 inside an Intel TDX virtual machine with one NVIDIA RTX PRO 6000 Blackwell GPU, rented through a public API like any customer would. You verify it with an MIT-licensed tool, on your laptop, offline if you like. No account, no GPU rental, about five minutes.

What is in a bundle

Two proofs, both tied to the same manifest. The manifest holds a random challenge.

• The Intel TDX quote carries the SHA-512 of the manifest in its report_data, signed by the platform's quoting enclave with a key that chains to Intel.
• The NVIDIA tokens carry the SHA-256 of the same manifest as their nonce, signed by NVIDIA's attestation service after it checked the GPU's own report.

The bundle also embeds the Intel collateral captured at attest time (TCB info, QE identity, revocation lists), which is what makes an offline check possible.

Step 1: download it and check the checksums

mkdir bundle && cd bundle
curl -sO https://voltagegpu.com/blog/two-proofs/evidence/rtx6000b-2026-10-09/bundle.json
curl -sO https://voltagegpu.com/blog/two-proofs/evidence/rtx6000b-2026-10-09/manifest.json
curl -sO https://voltagegpu.com/blog/two-proofs/evidence/rtx6000b-2026-10-09/SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing
# manifest.json: OK
# bundle.json: OK

The checksums were computed inside the VM before download. The same folder has what the script printed inside the VM, nvidia-smi output and kernel details (README.txt).

Step 2: install the verifier

python3 -m venv .venv && . .venv/bin/activate
pip install "voltage-verify>=0.2.1"

Python 3.10 or later. Use 0.2.1 or later: 0.2.0 and earlier trusted the NVIDIA signing keys a bundle carried, 0.2.1 chains them to a pinned NVIDIA attestation service intermediate. Source: github.com/Jabsama/voltage-verify.

Step 3: verify, offline

voltage-verify verify bundle.json --offline \
  --challenge 627ba9c51d4719038e917c7431675b183ac576c819d712178dc8a100f4409a45 \
  --hwmodel GB20X --gpus 1

What it printed on my machine on 19 October 2026:

[PASS] manifest.format       manifest is well formed
[PASS] manifest.commitments  bundle commitments match the manifest
[PASS] manifest.challenge    challenge is the one this verifier issued
[PASS] tdx.structure         TDX quote v4, TEE 0x81, 4940 bytes
[PASS] tdx.report_data       quote report_data equals SHA-512 of the manifest
[PASS] tdx.signatures        attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA
[PASS] tdx.collateral        TCB info and QE identity signed by Intel (bundle (fetched 2026-10-09T21:54:01+00:00))
[PASS] tdx.tcb               platform TCB UpToDate, QE UpToDate, TDX_03 UpToDate
[PASS] tdx.revocation        PCK certificate not revoked (57 entries in CRL)
[PASS] tdx.revocation        PCK CA certificate not revoked (0 entries in CRL)
[PASS] nvidia.signatures     2 NVIDIA-signed tokens verify, keys from the bundle chained to the pinned NRAS intermediate (offline)
[PASS] nvidia.nonce          NRAS eat_nonce equals SHA-256 of the manifest
[PASS] nvidia.policy         overall result true, every GPU: measurements ok, secure boot on, debug off, nonce matched, report signature and chain validated
[PASS] nvidia.freshness      token issued 0s from bundle creation

TDX: MRTD eea8b6a814569a52bd1e12f6b869bb2d...  TCB UpToDate  QE UpToDate
GPU: GPU-0 GB20X driver 595.71.05 vbios 98.02.9E.00.01 measurements success

RESULT: VERIFIED

Read it in three groups:

• manifest: the bundle belongs to this manifest and to the challenge you passed.
• tdx: the quote's structure, that it embeds the manifest hash, its signature chain up to the pinned Intel SGX root, the Intel-signed platform status (TCB UpToDate), and that nothing in the chain is revoked.
• nvidia: NVIDIA's signatures, the nonce, and NVIDIA's own verdict on the GPU: measurements ok, secure boot on, debug off.

Step 4: try to fool it

A verifier that never says no is worth nothing. First, pretend the bundle answers a different challenge, which is what a replayed bundle looks like:

voltage-verify verify bundle.json --offline \
  --challenge 0000000000000000000000000000000000000000000000000000000000000000 \
  --hwmodel GB20X --gpus 1
# [FAIL] manifest.challenge    challenge differs from the one this verifier issued (replay or foreign bundle)
# RESULT: NOT VERIFIED (manifest.challenge)

Then change a single character inside the signed part of the quote:

python3 - <<'PY'
import json
b = json.load(open("bundle.json"))
q = b["tdx"]["quote_b64"]
b["tdx"]["quote_b64"] = q[:300] + ("A" if q[300] != "A" else "B") + q[301:]
json.dump(b, open("tampered.json", "w"))
PY

voltage-verify verify tampered.json --offline \
  --challenge 627ba9c51d4719038e917c7431675b183ac576c819d712178dc8a100f4409a45 \
  --hwmodel GB20X --gpus 1
# [FAIL] tdx.signatures        quote signature does not verify with the attestation key
# RESULT: NOT VERIFIED (tdx.signatures)

Both outputs are the ones I got. Each failure names the exact check.

What it proves, and what it does not

Proved: this manifest was bound by a genuine Intel TDX guest on a platform Intel rates up to date, with an NVIDIA GPU in confidential-computing mode whose measurements NVIDIA accepted, and the bundle has not been altered since.

Not proved by this check alone: which software ran in the guest (compare the printed MRTD and RTMR values with a reference you trust), and freshness relative to you, because here the challenge was drawn by the publisher's script. For your own guarantee, draw the challenge yourself on your own VM.

Do it on your own machine next

Renting the same tier takes three API calls (quickstart). Inside the VM, voltage-verify manifest --challenge auto and voltage-verify attest produce your own bundle; the full run, which cost $0.60, is written up in Confidential GPU by API alone.

Disclosure: I work on VoltageGPU, which runs the VM this bundle came from. The verifier is open source and does not trust us: if the bundle lied, it would say so.