Google's Confidential TPU Runs on AMD Chips, Not Its Own CPU
Google's new TPU 8tx pairs its custom AI chip with AMD Epyc host processors, skipping its own Axion CPU for confidential AI work.
Google has added two systems to its eighth-generation Tensor Processing Unit family, and one of them is designed for confidential AI. According to TechRadar, the TPU 8tx combines Google's TPU 8t accelerator silicon with fifth-generation AMD Epyc "Turin" processors acting as host machines. The chip was detailed in a Google Cloud blog post alongside the TPU 8i Max, a dual-chip design.
TechRadar reports that the choice is notable because Google's own Axion CPU hosts the TPU 8t and TPU 8i. Instead, the 8tx relies on an AMD processor, which TechRadar suggests is likely because Google's audited confidential computing stack currently runs only on x86 processors. Axion is an Arm-based design, so the stack's hardware requirements appear to have shaped the decision.
The 8tx is positioned for confidential AI inference, meaning the running of trained models on data that should stay protected during processing. TechRadar notes that the product joins a growing group of chips with similar capabilities. Google and Nvidia already offer confidential GPUs to cloud customers, so the 8tx extends an existing trend rather than starting one.
TechRadar also points out that key security details about the new system have not been published. The report does not describe how the protections are implemented or how independent auditors have assessed them, so those questions remain open for now.
Background
Confidential computing is a set of techniques for protecting data while it is being used, not only when it is stored or moving across a network. Most approaches rely on hardware-based trusted execution environments, which isolate a workload's memory and keep it encrypted from the rest of the system, including the cloud provider's own software. The idea has gained attention as companies move sensitive workloads into shared data centers and ask for stronger assurances about who can see their information.
Artificial intelligence raises the stakes. Running a model often means sending prompts, documents or customer records to a remote server, and the model's own weights can be valuable intellectual property. Protecting both the input data and the model during inference, the stage where a trained model produces answers, is a harder problem than protecting stored files, because the data must be readable by the processor in order to be computed on.
Specialized accelerators add another layer. Tensor Processing Units are custom chips built by Google to speed up the matrix math behind modern AI. They work alongside host processors that manage memory, input and output. The host is part of the trust boundary, so a confidential accelerator is only as trustworthy as the processor and software surrounding it. That is why the choice of host chip matters for security as well as performance.
Processor makers such as AMD and Intel have built confidential computing features into their server chips for several years, and cloud providers have layered these into their own offerings. Each platform has its own attestation methods, which let a customer verify that a workload is running in a protected environment. Certification and auditing practices differ between vendors, which can make it difficult to compare protections across providers.
Why it matters
The detail that Google chose an AMD host for its confidential accelerator is a signal about where the technology stands. Cloud companies are building their own silicon to control costs and reduce reliance on outside suppliers, yet a security feature can still depend on a rival's processor if the audited software only supports that architecture. For customers, the practical question is whether the protections work as promised regardless of which company's logo appears on each component.
The unpublished details matter for the same reason. Organizations in regulated fields such as health care, finance and government often need documentation they can hand to auditors before moving data into a new system. Without public specifics, those buyers may have to rely on Google's assurances or wait for third-party reviews. Confidential computing is valuable only when its claims can be checked.
The move also shows how fast AI infrastructure is changing. Google is releasing multiple variants within a single generation, including a dual-chip design, which suggests the company is segmenting its hardware for different jobs. Customers who build on these platforms will need to understand which variant fits which workload, and that may become a planning task of its own.
What to watch
Watch whether Google publishes more technical detail about the 8tx's security design, including how the trusted environment is established and how it can be verified by customers. Independent security researchers and auditors may also weigh in once documentation is available.
Pay attention to whether Google extends its confidential stack beyond x86 processors. If it does, the choice of host chip could change in future generations, and the reasons for the current AMD pairing would become clearer.
Also watch pricing, availability and regional rollout. Early access programs and enterprise contracts often reveal how seriously cloud customers are taking confidential AI, and how quickly competing platforms respond.
Viewpoints
Commentary from our columns: three angles on this story.
The Skeptic open questions and weak points
The headline is about a chip, but the most important part of this story is what is missing. TechRadar reports that key security details for the TPU 8tx have not been published. That leaves a gap between the promise of confidential AI and what anyone outside Google can actually check. Confidential computing only earns trust when its claims are testable, and a product announcement is not a test.
There is also a reasonable question about the host processor. If the audited stack currently runs only on x86 hardware, then the protections described for this system depend on a particular architecture and a particular set of assumptions. Those assumptions deserve scrutiny before buyers treat them as settled. Customers should ask which parts of the system they are trusting, and who has verified each one.
None of this means the design is flawed. It means the burden of proof sits with the vendor. Until detailed documentation and independent review appear, the sensible stance is curiosity rather than confidence. Skepticism here is not hostility. It is the normal discipline that any security claim should face.
The Builder the engineer's view
From an engineering standpoint, the interesting decision is the host. Accelerators like the TPU 8t do the heavy math, but the host processor manages memory, scheduling and data movement, so it sits inside the trust boundary whether anyone likes it or not. Pairing the 8tx with an AMD Epyc Turin host means the software stack has to be validated across a different hardware foundation than the rest of Google's TPU line.
That is a real cost. Every additional platform multiplies testing, firmware review and attestation work. Google likely chose the path with the shortest route to an audited, working product, which is often the right call for a first confidential accelerator. The tradeoff is that the team now maintains compatibility across architectures for a feature that customers will expect to behave identically everywhere.
For builders, the practical takeaway is to read the documentation closely once it arrives. Pay attention to attestation flows, supported memory and model sizes, and how the dual-chip TPU 8i Max handles the same guarantees. The details will decide whether confidential inference is a checkbox or something you can design around.
The Rulebook privacy, safety and regulation
Confidential inference speaks directly to privacy concerns that have slowed AI adoption in sensitive sectors. The idea that data remains protected while a model processes it could help hospitals, banks and public agencies consider tools they have so far kept at arm's length. Any such benefit depends on the protections being specific, verifiable and documented in terms that compliance teams and regulators can review.
That is why the unpublished security details matter. Privacy claims in technology often rely on language that sounds reassuring but offers little to test. Regulators and auditors will expect concrete descriptions of how data is isolated, who can access keys, and what happens if a system fails. Until those answers are available, customers will need to ask hard questions before signing contracts.
The broader trend is worth watching too. As more chips and clouds advertise confidential computing, policymakers may begin asking for common standards so that a protection in one product means the same thing in another. Clear definitions would help buyers compare offerings honestly, and they would make the privacy promises of AI infrastructure easier to hold to account.