Perhaps never a true guarantee, but level 4 HSMs are still impressive.

> The 4769 HSM has been verified to meet the FIPS 140-2 Level 4 requirements by protecting against attacks that include penetration of the secure module, side-channel attacks, and environmental failure protection (power or temperature manipulation). From the time of manufacture, the hardware is fully self-protecting. If tamper sensors detect a possible attack, all critical keys and other sensitive data are immediately destroyed and the HSM is rendered permanently inoperable. Note therefore that the 4769 HSM must be maintained at all times within the temperature, humidity, and barometric pressure ranges specified.

https://public.dhe.ibm.com/security/cryptocards/pciecc4/docs...