The deployment combines 5th Gen AMD EPYC processors with Google’s eighth-generation TPU architecture to protect sensitive AI models and data while supporting inference, fine-tuning and agentic AI workloads.
As enterprises move increasingly sensitive AI workloads into the cloud, protecting data not only at rest and in transit but also during processing is becoming a critical infrastructure requirement. AMD and Google Cloud are addressing this challenge through an expanded collaboration that brings hardware-enforced confidential computing to Google Cloud TPU 8tx, powered by 5th Gen AMD EPYC processors.
AMD announced that its 5th Gen EPYC server CPUs provide the host infrastructure for TPU 8tx, which Google describes as the first cloud Tensor Processing Unit system to deliver hardware-enforced confidential computing. The combination brings together EPYC processing performance, AMD Infinity Guard security capabilities and x86 software compatibility with Google’s AI acceleration platform.
The architecture is designed to support enterprise inference, fine-tuning and reinforcement learning workloads while helping protect sensitive prompts, model weights and intermediate data. It also addresses a growing concern as organisations deploy reasoning models and AI agents that interact with critical business information.
In TPU 8tx systems, AMD EPYC processors handle workload orchestration, data preparation and high-throughput communication with TPU accelerators. AMD Secure Encrypted Virtualization (SEV), working with the TPU security architecture, extends confidential computing protections beyond the host CPU to connected accelerators.
“Customers get silicon-level data protection alongside the low-latency performance needed for modern reasoning models.” — Mark Lohmeyer, Vice President and General Manager, AI and Computing Infrastructure, Google Cloud
Before an accelerator receives direct access to protected memory, its identity and security configuration can be verified. This helps keep customer prompts, model weights and intermediate data encrypted in CPU memory and during transfers between the host and accelerators, while hardware isolation protects data during accelerator execution.
“The most capable AI systems need a CPU foundation that can match the demands of the accelerators they host,” said Dan McNamara, Senior Vice President and General Manager, Compute and Enterprise AI, AMD. He said the collaboration brings EPYC performance and security capabilities to TPU 8tx, helping customers scale AI workloads with greater protection.
For Google Cloud, the development extends confidential computing into accelerated AI infrastructure. “By pairing 5th Gen AMD EPYC processors with our 8th-generation TPU architecture inside the AI Hypercomputer, we are bringing hardware-enforced confidential computing to cloud TPUs for the first time,” said Mark Lohmeyer, Vice President and General Manager for AI and Computing Infrastructure, Google Cloud.
The partnership also reinforces EPYC’s broader role as a host CPU platform across AI infrastructure. AMD says its processors are used by more than 10 leading hyperscalers and frontier AI labs, supporting systems built around AMD Instinct GPUs, NVIDIA GPUs and custom AI accelerator ASICs. Host CPUs remain essential for feeding data to accelerators, scheduling workloads and connecting AI systems with enterprise applications.
The collaboration builds on several generations of work between AMD and Google Cloud, including EPYC-powered Compute Engine instances such as C4D, N4D, H4D, Z4D and G4. AMD SEV technologies also support confidential computing across Google Cloud services including Confidential VMs, Confidential GKE, Confidential Space, Confidential Managed Service for Apache Spark and Confidential Dataflow.
With TPU 8tx, the companies are extending that foundation to confidential AI acceleration, positioning hardware-level protection as an increasingly important component of enterprise AI deployment.