Google Cloud's new TPU 8tx pairs Google's AI accelerators with AMD EPYC host processors, a design intended to protect prompts, model weights, and intermediate data through encryption in host memory and in transit, with hardware isolation while the accelerators run.

Because encrypted data has to be readable at the moment a chip computes on it, that moment has been the hard part of protecting artificial intelligence workloads in the cloud. Organizations that want their intellectual property to stay secure and proprietary pay close attention to that exposure whenever they move models and data onto cloud accelerators. Google Cloud and AMD announced on November 9 that TPU 8tx, a system built on Google's Tensor Processing Units, known as TPUs, uses 5th Gen AMD EPYC server processors as its host and delivers hardware-enforced confidential computing. The two companies describe it as the first cloud TPU system to do so. EPYC is AMD's brand of server processors, and a host processor is the main chip that prepares data and directs the accelerators doing the AI work.

The host processor extends confidential computing out to each accelerator

According to AMD, the host processor handles workload orchestration and data preparation, and it manages communication with the TPUs. AMD Secure Encrypted Virtualization in the EPYC processor, together with the TPU, extends confidential computing protection beyond the processor to the connected accelerators. The system verifies an accelerator's identity and security configuration before granting it direct access to protected memory, which AMD says helps keep customer prompts, model weights, and intermediate data encrypted in processor memory and in transit, with hardware isolation while the accelerator executes.

Google Cloud's Mark Lohmeyer said teams moving AI agents into production need confidence that their data and intellectual property stay private, even from the underlying infrastructure. He said customers get "silicon-level data protection" alongside the low-latency performance that reasoning models need.

EPYC hosts accelerators from several different makers

AMD states that EPYC is the host processor for more than 10 hyperscalers and frontier AI labs (AMD, 2026), across systems using GPUs from AMD and Nvidia as well as custom accelerators. AMD's Dan McNamara said the company built leadership across EPYC generations in performance, memory bandwidth, and input and output capacity, the traits that keep accelerated systems productive.

TPU 8tx adds a Google accelerator to that list, and AMD sells its own Instinct GPUs for the same kind of AI work. That gives AMD a host-processor business across systems that use its own GPUs or Nvidia's as well as custom accelerators such as Google's TPUs.

Your protection rests on AMD's silicon and on how Google implements it

AMD's footnote says Infinity Guard security features vary by EPYC generation and must be enabled by the server maker or cloud provider. In TPU 8tx, Google Cloud is both the accelerator maker and the cloud provider, so one company designs the accelerator and operates the service. The detail to look for is the evidence a customer receives that the verification step happened.

That gives AMD a host-processor business across systems that use its own GPUs or Nvidia's as well as custom accelerators such as Google's TPUs.

Google and AMD built toward TPU 8tx across several EPYC generations

AMD says the two companies have collaborated across multiple EPYC generations, from general-purpose to accelerated workloads, leading up to Google Cloud's current C4D, N4D, H4D, Z4D, and G4 virtual machines, which are the server types customers rent from Google Cloud. AMD's Secure Encrypted Virtualization technology supports five Google Cloud confidential services, including Confidential VMs and Confidential GKE, the protected versions of its virtual machines and its Google Kubernetes Engine container service. The companies have also worked together on security for years, including reviews of AMD security processor firmware by Google security experts.

For context on how another large provider approaches the same problem, Amazon Web Services, known as AWS, protects data in use through its own Nitro System hardware. According to AWS, no mechanism exists for any AWS operator to access customers' Amazon Elastic Compute Cloud instances within the Nitro System, the controls that prevent operator access are part of the AWS Service Terms, and Nitro-based instances need no code changes to receive the protection. AWS Nitro Enclaves adds an isolated environment inside an instance, with cryptographic attestation that lets a customer confirm only authorized code is running.

Three requests would let you evaluate TPU 8tx

Google's announcement claims up to 2x lower latency than TPU 8t with a near-zero performance penalty (Google, 2026), and the details behind that claim are the next thing to collect:

• Ask Google which links in the chain from host processor to accelerator it attests, and what evidence a customer receives.
• Ask for the benchmark method behind Google's performance claim and the overhead on your own workloads, and ask when TPU 8tx becomes available.
• Ask Google which protections TPU 8tx requires, how it enforces them, and which configuration details customers can verify through attestation.