Google Cloud's first TPU with hardware-enforced confidential computing runs on 5th Gen AMD EPYC hosts
Synopsis
AMD says its 5th Gen EPYC processors provide the host infrastructure for Google Cloud TPU 8tx, the first cloud TPU system to deliver hardware-enforced confidential computing. Previously, Google Cloud's confidential computing portfolio covered CPU-side workloads such as Confidential VMs, Confidential GKE and Confidential Space, not confidential AI acceleration. TPU 8tx uses EPYC's Secure Encrypted Virtualization to extend protection to connected accelerators, keeping prompts, model weights and intermediate data encrypted in CPU memory and in transit, with hardware isolation during accelerator execution, for enterprise inference, fine-tuning and reinforcement learning workloads.
Interpretation
Google Cloud TPU 8tx is the first cloud TPU system to deliver hardware-enforced confidential computing, and its host CPU is 5th Gen AMD EPYC. Google Cloud's confidential computing portfolio previously covered CPU-side workloads such as Confidential VMs, Confidential GKE and Confidential Space, not confidential AI acceleration. AMD says TPU 8tx extends the collaboration from CPU-side confidential computing to confidential AI acceleration, and calls it the first time cloud TPUs get hardware-enforced confidential computing.
In TPU 8tx systems, 5th Gen EPYC manages workload orchestration, data preparation and high-throughput communication with the TPU accelerators. Accelerators depend on host processors to supply data, schedule work and connect AI workloads with surrounding applications and services, so host CPU choice bears on system performance and deployment. The system uses AMD Secure Encrypted Virtualization (SEV) in the EPYC CPU, which together with the TPU extends confidential computing protection beyond the CPU to connected accelerators.
The protection verifies an accelerator's identity and security configuration before granting it direct access to protected memory. That check keeps customer prompts, model weights and intermediate data encrypted in CPU memory and in transit between host and accelerators. AMD says hardware isolation is also in place during accelerator execution, aimed at sensitive information in reasoning and agentic AI applications.
Perspective
The report covers what AMD and Google Cloud announced: 5th Gen EPYC as host infrastructure for TPU 8tx, plus that system's confidential computing mechanism and the workload types it targets.
AMD notes that Infinity Guard security features vary by EPYC generation and series and must be enabled by server OEMs or cloud service providers to operate, so users should confirm support with their provider.