AMD EPYC Powers Google Cloud's Confidential TPU 8tx

AMD confirmed on November 9, 2026, that its 5th Gen EPYC server processors are the host CPUs behind Google Cloud's new TPU 8tx system, which the two companies describe as the first cloud Tensor Processing Unit (TPU) deployment with hardware-enforced confidential computing. The arrangement pairs AMD's Secure Encrypted Virtualization (SEV) technology and AMD Infinity Guard security features with Google's eighth-generation TPU architecture, extending encryption and hardware isolation from the host CPU out to the connected AI accelerators — a move the companies say lets enterprises run inference, fine-tuning and reinforcement-learning workloads on sensitive data inside Google's AI Hypercomputer without exposing that data to the underlying infrastructure.

What AMD and Google Cloud announced

In a press release titled "AMD EPYC Expands Its Leadership at the Foundation of AI", AMD said its 5th Gen EPYC processors now power the host infrastructure for Google Cloud TPU 8tx. AMD frames the deployment as combining "EPYC CPU performance, AMD Infinity Guard security capabilities and x86 software compatibility with Google Cloud TPU AI acceleration to help enterprises deploy inference, fine-tuning and reinforcement learning workloads," while Google Cloud's confidential-computing architecture on TPU 8tx — backed by the EPYC host layer — is pitched as letting "organizations run their most sensitive AI workloads at scale in the cloud without compromising on data protection."

The release is light on technical specifications and contains no throughput, latency or efficiency benchmark numbers for TPU 8tx or the EPYC host tier — AMD frames the news entirely around the confidential-computing milestone and EPYC's broader role as a host CPU for AI infrastructure, rather than around raw performance claims.

Why the CPU still matters next to a TPU

It's easy to assume that in an AI cluster, the accelerator — GPU, TPU or custom ASIC — does all the meaningful work. AMD's framing pushes back on that: across systems built around accelerators, the host EPYC CPU is described as responsible for "workload orchestration, data preparation and high-throughput communication with TPU accelerators." In other words, before a TPU pod can chew through a training or inference job, something has to stage the data, schedule the work, and move it in and out of the accelerator's memory fast enough that the TPU isn't left waiting. AMD has built its EPYC marketing around exactly that role for several generations, citing core counts, memory bandwidth and I/O lanes as the reasons cloud providers keep pairing EPYC hosts with other vendors' accelerators.

What TPU 8tx is

Google Cloud's Mark Lohmeyer described TPU 8tx as built on the company's "8th-generation TPU architecture inside the AI Hypercomputer," Google Cloud's marketing term for its integrated stack of compute, networking, storage and software tuned for large-scale AI training and serving. AMD's release doesn't detail TPU 8tx's compute specifications, memory capacity or pod topology — it focuses specifically on the confidential-computing capability layered on top of that hardware. For technical specifications of Google's TPU family, Google Cloud maintains its own TPU documentation, though at publication time Google Cloud had not published a companion blog post specifically detailing TPU 8tx's confidential-computing implementation alongside AMD's release.

Confidential computing and AMD SEV, explained

Most cloud security protects data in two states: at rest (encrypted on disk) and in transit (encrypted over the network). Confidential computing targets the third, harder state — data in use, while it's actually being processed in memory. Historically, even on a fully encrypted cloud server, the data had to be decrypted in memory for the CPU to work on it, which meant a cloud provider's own hypervisor, other tenants' workloads, or a sufficiently privileged attacker could theoretically inspect or tamper with it mid-computation.

AMD Secure Encrypted Virtualization (SEV) addresses that gap by encrypting a virtual machine's memory with keys generated and managed by a dedicated security processor on the EPYC chip, isolating that memory from the hypervisor and other VMs. AMD Infinity Guard is the umbrella marketing name AMD uses for this family of EPYC security features; per AMD's own footnote on the November 9 release, Infinity Guard capabilities vary by EPYC generation and series, and must be explicitly enabled by the server OEM or cloud provider to take effect — it isn't automatically active on every EPYC deployment.

What's new in the TPU 8tx announcement is extending that same trust boundary outward from the CPU to the accelerator. According to AMD, the system "verifies an accelerator's identity and security configuration before granting it direct access to protected memory," so that "customer prompts, model weights and intermediate data remain encrypted in CPU memory and in transit among the host and accelerators, with hardware isolation during accelerator execution." Practically, that means a TPU pod working on an enterprise's proprietary model or sensitive input data is cryptographically checked before it's allowed to touch that data, and the data itself stays encrypted outside of the brief window it's actually being computed on.

Why pairing it with TPUs matters

Confidential computing on CPUs and GPUs isn't new — AMD and Google Cloud have offered SEV-protected Confidential VMs since 2020, and Nvidia has shipped confidential computing on its own GPU lines. What AMD and Google Cloud are claiming as a first here is specifically extending Google Cloud's confidential computing portfolio to a cloud TPU system. TPUs are Google's own custom AI accelerator silicon, used heavily inside Google Cloud for both Google's own models and customer workloads; until now, according to AMD's framing, there wasn't a cloud TPU deployment with this level of hardware-rooted protection spanning host to accelerator.

The timing lines up with a broader industry shift toward agentic AI systems that autonomously read, reason over and act on sensitive enterprise data — contracts, patient records, financial filings — rather than just generating text from public prompts. Lohmeyer's quote frames the motivation directly: "When teams move AI agents into production, they need confidence that their data and intellectual property stay private, even from the underlying infrastructure." Enterprises in regulated industries have historically been reluctant to run their most sensitive workloads on shared cloud infrastructure at all; confidential computing is the industry's answer to that reluctance, and extending it to TPUs specifically targets customers who want Google's accelerator but have so far held back on using it for regulated or proprietary data.

The Google Cloud VM families involved

AMD's release names five Google Cloud Compute Engine virtual machine families as part of the broader EPYC-Google Cloud collaboration that TPU 8tx builds on: C4D, N4D, H4D, Z4D and G4. The release doesn't break out what workload each family targets — it cites them collectively as evidence of a multi-generation EPYC deployment across Google Cloud's compute lineup, alongside the Google confidential-computing services (Confidential VMs, Confidential GKE, Confidential Space, Confidential Managed Service for Apache Spark and Confidential Dataflow) that AMD says SEV technology already underpins.

EPYC as an industry-wide host CPU

Beyond the Google Cloud deal, AMD used the release to restate a broader positioning claim: EPYC processors are "the host CPU of choice for more than 10 leading hyperscalers and frontier AI labs, spanning GPUs and custom AI accelerator ASICs." AMD says that includes systems built around its own Instinct GPUs, Nvidia GPUs and custom silicon from other providers — meaning EPYC's host role isn't tied to any single accelerator vendor. AMD's pitch is that regardless of which accelerator a hyperscaler chooses, EPYC's combination of core count, memory bandwidth, I/O and the mature x86 software ecosystem makes it the default way to feed that accelerator.

That "accelerator-agnostic host CPU" positioning matters competitively too. AMD's EPYC lineup competes with Intel's Xeon server processors and Arm-based designs for the same hyperscaler sockets; Pandromeda has covered how AMD's next-generation EPYC Venice chips stack up against Intel's upcoming Diamond Rapids in that ongoing server-CPU contest, and how surging AI chip demand has been lifting Arm's licensing business alongside x86 incumbents.

What the companies said

AMD's Dan McNamara, senior vice president and general manager of Compute and Enterprise AI, framed the news around CPU-accelerator balance: "The most capable AI systems need a CPU foundation that can match the demands of the accelerators they host. Across generations of EPYC, we have built leadership capabilities in the performance, memory bandwidth and I/O that keep accelerated systems productive, backed by years of engineering collaboration with the world's leading cloud providers. Our work with Google Cloud brings that strength to TPU 8tx, helping customers scale AI with the performance and protection their most important workloads demand."

Google Cloud's Mark Lohmeyer, vice president and general manager for AI and Computing Infrastructure, tied the announcement to agentic AI adoption: "When teams move AI agents into production, they need confidence that their data and intellectual property stay private, even from the underlying infrastructure. By pairing 5th Gen AMD EPYC processors with our 8th-generation TPU architecture inside the AI Hypercomputer, we are bringing hardware-enforced confidential computing to cloud TPUs for the first time. Customers get silicon-level data protection alongside the low-latency performance needed for modern reasoning models."

How this fits the wider AI infrastructure race

The TPU 8tx announcement arrives amid a wave of cloud-and-chipmaker infrastructure deals aimed at courting enterprise AI customers on security and sovereignty grounds as much as raw performance. Just a day earlier, Pandromeda reported on Nvidia, Rebellions and SK Telecom partnering on South Korea's sovereign AI push — a similar pattern of hardware vendors and cloud or telecom partners bundling compute with data-control guarantees for regulated customers. AMD and Google Cloud's confidential-TPU pitch fits that same trend: it's a security and compliance argument as much as a hardware one, aimed at unlocking AI workloads that enterprises have so far kept off shared cloud infrastructure entirely.

For AMD specifically, the release also reinforces a recurring data point in its AI server strategy: EPYC's revenue and relevance increasingly ride on being the host CPU inside other companies' accelerated systems — Nvidia's, Google's, and AMD's own Instinct lineup — rather than purely on CPU-versus-CPU competition with Intel or Arm server chips.

Frequently asked questions

What is Google Cloud TPU 8tx? It's Google Cloud's newest cloud TPU system, built on Google's 8th-generation TPU architecture inside its AI Hypercomputer stack, hosted on 5th Gen AMD EPYC server CPUs.

What makes TPU 8tx "confidential"? AMD and Google Cloud say it's the first cloud TPU system with hardware-enforced confidential computing, using AMD SEV and AMD Infinity Guard on the EPYC host to extend encryption and hardware isolation to the connected TPU accelerators, protecting data while it's actively being processed.

Does this replace Google Cloud's existing Confidential VM products? No. AMD says SEV already underpins several existing Google Cloud confidential-computing services, including Confidential VMs, Confidential GKE, Confidential Space, Confidential Managed Service for Apache Spark and Confidential Dataflow. TPU 8tx extends that same approach specifically to TPU-based AI acceleration.

Did AMD publish performance benchmarks for TPU 8tx? No. AMD's November 9, 2026 release focuses on the confidential-computing capability and EPYC's host-CPU role; it does not include throughput, latency or efficiency benchmark figures.

Which Google Cloud VM families are tied to this collaboration? AMD's release names Compute Engine C4D, N4D, H4D, Z4D and G4 as part of the broader multi-generation EPYC-Google Cloud partnership that TPU 8tx builds on.

How many hyperscalers use EPYC as a host CPU for AI accelerators? AMD says EPYC is the host CPU of choice for more than 10 leading hyperscalers and frontier AI labs, across systems using AMD Instinct GPUs, Nvidia GPUs and custom AI accelerator ASICs.

What's next

AMD and Google Cloud haven't given a public availability date, pricing, or customer rollout timeline for TPU 8tx in the November 9 release — the announcement is positioned as a capability and collaboration milestone rather than a general-availability launch notice. Watch for a possible companion technical post from Google Cloud detailing TPU 8tx's confidential-computing implementation in more depth, since Google's blog has previously accompanied major confidential-computing milestones with its own engineering write-ups. It's also worth watching whether AMD extends the same SEV-plus-accelerator confidential-computing model to its own Instinct GPU deployments or to other cloud partners' AI accelerators, given how heavily the November 9 release leans on EPYC's accelerator-agnostic host-CPU positioning across GPU and custom-ASIC systems alike. For now, the concrete, sourced facts are AMD's: a named system (TPU 8tx), a named security mechanism (SEV plus Infinity Guard), a named set of VM families, and an executive-level claim of more than 10 hyperscaler and frontier-lab customers for EPYC as a host CPU — with the deeper technical specifics still to come.

Written byMara Lindqvist

Mara Lindqvist edits the hardware desk. She covers graphics cards, processors, memory and storage, the foundries and chip designers behind them, and what the numbers on a spec sheet mean for people choosing a PC. Specifications in her stories come from manufacturer spec pages and datasheets.

More from Mara LindqvistAll Hardware coverage