Google Cloud's first TPU with hardware-enforced confidential computing runs on AMD's 5th Gen EPYC host CPUs
Synopsis
AMD says its 5th Gen EPYC processors provide the host infrastructure for Google Cloud TPU 8tx, the first cloud TPU system to deliver hardware-enforced confidential computing. Previously cloud TPUs lacked that protection; the design extends AMD Secure Encrypted Virtualization from the CPU to connected accelerators, keeping prompts, model weights and intermediate data encrypted in CPU memory and in transit, with hardware isolation during accelerator execution. The capability targets production inference, fine-tuning and reinforcement learning workloads, and AMD says EPYC is the host CPU choice across more than 10 leading hyperscalers and frontier AI labs.
Interpretation
Google Cloud's TPU 8tx is the first cloud TPU system to deliver hardware-enforced confidential computing, with AMD 5th Gen EPYC processors as its host CPUs. Cloud TPU systems did not previously offer this hardware-enforced confidential computing capability; Google Cloud and AMD bring the protection to cloud TPUs for the first time. The two companies pair 5th Gen EPYC with Google Cloud's 8th-generation TPU architecture inside the AI Hypercomputer to deliver the capability.
The system extends confidential computing protection from the CPU to connected TPU accelerators, so sensitive data stays protected as it moves between host and accelerators. AMD Secure Encrypted Virtualization (SEV) previously protected CPU-side workloads; working with the TPU, it now reaches the accelerators. Before granting an accelerator direct access to protected memory, the system verifies the accelerator's identity and security configuration, keeping prompts, model weights and intermediate data encrypted in CPU memory and in transit, with hardware isolation during accelerator execution.
The host CPUs handle workload orchestration, data preparation and high-throughput communication with the TPU accelerators. Accelerators depend on host processors to supply data, schedule work and connect workloads to surrounding applications and services, so CPU choice remains central to system performance and deployment. AMD says EPYC is the host CPU of choice for more than 10 leading hyperscalers and frontier AI labs, spanning GPUs and custom AI accelerator ASICs.
Perspective
The report covers what AMD and Google Cloud announced: 5th Gen EPYC as host infrastructure for TPU 8tx, and SEV working with the TPU to extend confidential computing protection to accelerators; it is aimed at readers running inference, fine-tuning and reinforcement learning workloads in the cloud.
AMD notes that Infinity Guard features vary by EPYC processor generation and series and must be enabled by server OEMs or cloud service providers to operate, so users should confirm support with their provider; the announcement gives no overhead or performance figures for confidential computing.