Quick Answer: Intel TDX overhead on NVIDIA H200 dropped from 12% to 4-6% in 12 months. We measured it. Same GPUs. Same code. The difference is firmware, drivers, and NVIDIA finally caring about confidential computing.
TL;DR: 2025 TDX H200: 12% throughput loss vs bare metal. 2026 TDX H200: 4-6%. That's the difference between "unusable for production" and "turn it on and forget it."
"Just Use Confidential VMs" — Said No One Who Actually Tried
I spent three days in January 2025 trying to get a TDX-enabled H100 to run Llama-70B without a 30% latency spike. Gave up. The firmware was buggy, the NVIDIA driver didn't expose the right CUDA paths, and Intel's attestation tooling felt like it was designed by someone who hated users.
Twelve months later, I ran the same test on H200. Bare metal vs TDX-sealed. Same model (Qwen2.5-72B), same batch size, same temperature. The numbers shocked me.
What We Actually Measured
Our stack: Qwen2.5-72B-Instruct running inside Intel TDX enclaves on NVIDIA H200 141 GB. Hardware attestation on every boot. Memory AES-256 encrypted at runtime.
| Metric | Bare Metal H200 | TDX H200 (2026) | Overhead |
|---|---|---|---|
| TTFT (Time to First Token) | 720 ms | 755 ms | 4.9% |
| Throughput (tok/s) | 120.4 | 114.8 | 4.6% |
| P99 Latency | 1.12 s | 1.18 s | 5.4% |
| vLLM Startup | 8.2 s | 11.4 s | 39%* |
*Startup overhead is cold-boot TDX attestation + GPU passthrough init. Happens once per pod lifecycle, not per request.
The throughput number matters most. 4.6% means your 100 req/s workload drops to 95.4 req/s. In 2025, that same gap was 12%. You felt it. Your users felt it.
Why the Drop? Three Real Reasons
NVIDIA H200 driver stack, version 550+. NVIDIA finally shipped a CUDA driver that doesn't panic when it sees a TDX-sealed memory region. The H200's newer NVLink and memory controller also handle encrypted page tables better than H100.
Intel TDX 2.0 firmware. The 2025 firmware had a bug where GPU DMA transfers triggered unnecessary TLB shootdowns. Fixed in March 2025. We verified with tdx-attest-verify — attestation report now includes firmware version 2.0.4-build20250314.
vLLM + TDX patches merged upstream. No more maintaining a fork. The community did the work.
The Honest Comparison Table
| VoltageGPU TDX H200 | Azure Confidential H100 | RunPod H100 (Non-Confidential) | |
|---|---|---|---|
| Price | $4.635/hr | ~$14/hr | ~$2.77/hr |
| GPU | H200 141 GB | H100 80 GB | H100 80 GB |
| TDX Overhead | 4-6% | 8-12% (H100 gen) | N/A (no encryption) |
| Setup Time | <60s deploy | 6+ months DIY | <60s deploy |
| Hardware Attestation | Yes, CPU-signed | Yes | No |
| GDPR Art. 25 Native | Yes | Retrofit | No |
RunPod wins on price. They should — there's no encryption overhead because there's no encryption. Azure wins on enterprise certifications (SOC 2, ISO 27001) that we don't have yet. Our bet: GDPR Art. 25 + Intel TDX attestation is the compliance stack that actually matters for EU AI workloads.
What Still Sucks
I promised honesty. Here's what still hurts:
- Cold start: 30-60s on shared pools. The TDX attestation handshake with NVIDIA's GPU driver isn't instant. If your pod gets rescheduled, you wait.
- No SOC 2 certification. We rely on GDPR Art. 25 + Intel TDX attestation + DPA on request. If your procurement requires a checkbox, we're not there yet.
- H100 TDX still at 8-12% overhead. The improvements are H200-specific. If you're on H100, the pain continues.
How to Verify Yourself
Don't trust my numbers. Run your own.
from openai import OpenAI
import time
client = OpenAI(
base_url="https://api.voltagegpu.com/v1/confidential?utm_source=devto&utm_medium=article",
api_key="vgpu_YOUR_KEY"
)
start = time.time()
response = client.chat.completions.create(
model="qwen2-5-72b-tee",
messages=[{"role": "user", "content": "Explain quantum computing in 3 paragraphs"}],
max_tokens=512
)
elapsed = time.time() - start
tokens = response.usage.completion_tokens
print(f"TTFT: ~{elapsed*1000:.0f}ms, Throughput: ~{tokens/elapsed:.1f} tok/s")
Hit it 100 times. Compare against our [bare metal H200 pricing](https://voltagegpu.com/compare/gpu-cloud-pricing?utm_source=devto&utm_medium=article) if you want the non-TDX baseline. Or just trust that 4-6% overhead is close enough to free that you should enable encryption by default.
Why This Matters Now
The EU AI Act enforcement timeline is real. 2026 is when high-risk AI systems need demonstrable data protection. "We use AWS" isn't a compliance strategy. "We use Intel TDX with hardware attestation" is.
The Medical Records Analyst and Contract Analyst agents we run process documents that would trigger €20M fines if leaked. The 4-6% overhead is the cost of not being in a news article.
Don't trust me. Test it. 5 free agent requests/day -> https://voltagegpu.com/?utm_source=devto&utm_medium=article
Top comments (0)