SEV-SNP and TDX make CPU confidentiality cheap; H100 confidential mode loses up to 20% throughput

A dev.to analysis compares the practical performance cost of the three hardware technologies most likely to carry confidential computing into production — AMD SEV-SNP, Intel TDX and Nvidia's H100 confidential computing mode — and finds the overhead lands very unevenly: close to free for CPU workloads, expensive for anything that touches a GPU or moves large volumes of data.

The post argues the move into production is driven by commercial necessity rather than enthusiasm: customers who refuse to send data to a model whose execution they cannot verify. Memory encryption plus attestation lets those customers rely on the mathematics rather than the operator's goodwill. The catch is that every guarantee costs throughput, and the cost is spread unevenly across the stack.

CPU confidentiality is nearly free

According to the analysis, SEV-SNP and TDX both encrypt guest memory with a key the hypervisor never holds, using hardware AES engines built into the memory controller. Drawing on published benchmarks, the author puts the CPU-side overhead in the low single digits for memory-bound workloads and near zero for compute-bound ones. For a database, an API server or a batch job, the confidentiality tax is negligible, and the operational burden amounts to a boot parameter plus an attestation flow.

Where the cost concentrates

The post identifies three pressure points.

Attestation. Every confidential VM must produce a report that a relying party verifies, tied to a key the guest generated. The round trip — key generation, report request, signature-chain checks against the vendor's root, token return, secret unwrap — adds one to three seconds of startup latency, which matters for autoscaling and for services that create many short-lived workers.

I/O. Confidential VMs cannot rely on the hypervisor's device emulation, so virtio traffic requires shared memory regions, bounce buffers and an encrypted channel. Every network packet and disk block takes an extra copy, and the post estimates a double-digit percentage loss for workloads that move a lot of bytes.

GPUs. The most expensive tier. H100 confidential mode encrypts the PCIe link between host and device and adds a bounce buffer to every transfer. Citing early access figures, the author reports roughly 10-20% throughput loss for large-model inference, and worse for small-batch workloads where transfers make up a larger share of each step.

The premium that decides adoption

Combining throughput loss with the pricing of confidential SKUs, the author models an effective cost premium of about 4-5% for CPU-only confidential VMs, around 22% for H100 confidential mode, and up to 38% for confidential GPU SKUs that also carry a list-price premium.

The predicted market split is stark. Regulated workloads — health records, financial positions, anything governed by a data processing agreement with an audit clause — will absorb the premium because the alternative is not running the workload in the cloud at all. Everyone else will not, because the guarantee is invisible to their users. The author's verdict is that the technology gets bought for compliance reasons, not performance, and teams adopting it without a contractual requirement pay more than 20% for a guarantee no customer actually requested.

Architectures that soften the bill

Three patterns are recommended. Split the workload: keep orchestration, tokenisation and business logic inside a confidential VM where the tax is a few percent, and send only tensor operations to the confidential GPU. Batch aggressively on the GPU: the overhead is dominated by transfers per kernel launch, so a confidential H100 at batch size 1 is described as a bad deal, while at batch 64 it approaches the cost per token of a plaintext H100 at batch 32. Cache attestation results: attest once per instance, hold the token with a time-to-live, and treat the instance as trusted until it expires.

What to measure before committing

The post advises benchmarking your own workload rather than trusting vendor figures, which reflect large-batch inference and memory-bound microbenchmarks. Three measurements matter: tokens per second at production batch size, p99 latency including the encrypted transfer, and how often per hour the autoscaler would trigger a fresh attestation. The last figure is the one the author says surprises teams, because a scale-to-zero design can attest hundreds of times a day.

Why it matters

Confidential computing is moving from compliance slideware into production pricing, and this analysis offers a concrete map of where the costs sit. The structural lesson generalises: hardware security features that run as wide, parallel operations, such as memory encryption, are cheap, while features sitting on the critical path of a serial interconnect, such as encrypted PCIe, are not. Whether a roughly 22% GPU premium is a cost of goods or wasted insurance depends entirely on whether a customer's contract demands verifiable execution — so name the threat model before paying the tax.