Google Cloud says Confidential G4 GPU instances are generally available in 36 zones for Compute Engine VMs and Google Kubernetes Engine. They use NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs. The company's October 21 announcement, separately checked for this edition at 1:38:36 a.m. New York time on October 23, describes protection for model weights, prompts and outputs while data is in use.
Google combines transparent memory encryption, non-exportable hardware keys and remote attestation. It frames the design as protection from host administrators, the hypervisor and the cloud provider. The near-term relevance for a quant platform is the possibility of deploying proprietary research artifacts or inference workloads while deliberately excluding that host layer from the trusted computing base.
LEON's operational interpretation is to use attestation before releasing the sensitive model weights or dataset: check whether the receiving environment satisfies the intended trust policy, then decide whether it should receive the material. That gives the boundary a testable condition. It does not establish a particular key-release implementation, customer deployment or guarantee.
The application remains a separate source of risk. Confidentiality against infrastructure operators does not prove application correctness, validate authorization policy or prevent information from leaking through the application's own behavior. Google says standard Ubuntu images, NVIDIA drivers and CUDA-X work without application refactoring; that claimed compatibility is not a security assessment of the unchanged application.
The performance evidence has two distinct owners and metrics. Google reports less than 3.5% throughput degradation in its g4-standard-48 benchmarks with Llama 3, Llama 3.3, ResNet-50 and SDXL under the post's specified configurations. A customer quoted by Google reports a 5.2% increase in end-to-end latency on its own workloads. These are neither rival estimates of a single overhead nor figures to average into a universal penalty.
Confidential Space support for G4 is still moving toward general availability in the coming weeks. That component should not be confused with the generally available instances. For an evaluation, tie artifact release to a verifiable attestation policy, measure the intended workload's overhead and document what happens when attestation fails. This is a proposed evaluation pattern, not a claim that the product implements a particular firm's policy automatically.