Super Protocol

Customers create GPU clusters and deploy vLLM with model weights through Super Swarm. The guide supplies actual MedGemma and Apertus deployment scripts and model-serving endpoints. Inclusion covers inference hosted on this infrastructure/software, not unrelated upstream model APIs.

Covers appropriately configured trusted Super Swarm deployments of local model engines. Untrusted development mode, arbitrary applications and ordinary public HTTPS clients without evidence verification are not covered by the technical proof. Ingress, model configuration and content retention still require application-specific review.

Trusted mode admits confidential TDX/SEV-SNP VMs against registered measurements and rejects GPUs in debug mode. Untrusted mode omits these checks. GPU architecture, firmware, confidential-compute mode and inter-GPU links must match a supported configuration; a confidential CPU alone is insufficient.

At least one content layer has independently checkable technical evidence, including partial proof within a layer. The full privacy boundary is incomplete. The stage tooltip distinguishes partial findings from fully met requirements for Stage 2.

Identity and operational metadata are assessed separately below. They do not set the content stage; prompt or response content in telemetry remains part of the content-retention assessment.

Ingress requires verification. Swarm's certificate design binds VM public keys into hardware reports and exposes the network mode in the public root certificate. External verifiers must anchor trust in that root. The model-deployment example uses ordinary HTTPS and an API key; it does not establish an automatically verifying end-user channel through the published ingress to the selected workload.

VM proof; GPU gap. The published PKI design makes hardware reports, VM-key bindings, trusted-mode membership and signed deployment evidence inspectable. This establishes partial VM/deployment verification capability. Registered measurements, the bootstrap root and member CAs remain trust dependencies; the documented GPU debug-mode check alone does not establish a complete independently validated GPU firmware and topology chain for a serving workload.

Application-dependent. Customer vLLM deployments choose their serving arguments and caches; the example includes a multimodal processor cache. SwarmDB encryption protects cluster state but does not establish content-log suppression, cache clearing, backups or no training in arbitrary workloads. A deployment-specific, attested content-removal policy remains necessary.

Deployment-dependent. The deployment guide uses dashboard authentication, domains, published ingress endpoints and API keys. The reviewed technical sources do not establish end-user IP, account, billing or connection-metadata collection and deletion across model deployments.

• Intel/AMD confidential VMs and the selected NVIDIA GPU mode/topology.
• The bootstrap root certificate and registered trusted measurements; the bootstrap node does not verify itself against another node.
• Swarm members share root/subroot private keys in the documented design, expanding the CA trust boundary.
• Customer model-serving code, ingress configuration, update policy and content-retention controls.

• Trusted and untrusted modes have materially different protection; only trusted mode is assessed.
• Public deployment examples do not themselves provide an attestation-verifying inference client.
• The inspected sources establish verification capabilities, not a verified live deployment or a fleet-wide no-logging guarantee.