Confidential computing is becoming a practical deployment requirement for AI inference workloads that process sensitive inputs or protect proprietary model assets. However, the performance cost of enabling confidential execution for GPU-accelerated large language model (LLM) serving remains a critical factor for operational planning.
Methodology and Test Environment
The study presented a benchmark comparison between standard non-confidential execution and confidential computing mode on a single NVIDIA H100 80GB GPU hosted within an Intel TDX confidential instance. The evaluation utilized two representative language models: Mistral-7B v0.1 and Qwen3-30B-A3B. Researchers measured key metrics including Time to First Token (TTFT), end-to-end request latency, and token generation throughput under varying levels of concurrency.
Performance Impact Results
The benchmarking results reveal a consistent performance penalty when confidential mode is enabled:
- Average TTFT increased by 21.8% for Mistral-7B and 27.8% for Qwen3-30B-A3B.
- Global token throughput dropped by 17.7% for the smaller model and 21.1% for the larger model.
- In closed-loop concurrency experiments, the throughput gap remained in the 11.5% to 20.2% range.
A significant observation from the data is that larger models reach their performance saturation "knee" earlier under confidential mode. This suggests that while confidential GPU inference retains usable throughput under load, capacity planning must account for both the steady-state throughput penalty and the accelerated saturation behavior observed in larger architectures.
