How confidential computing protects data in use, and what falls outside it

Google says TPU 8tx builds security directly into the hardware layer, keeping data and model weights isolated during active use, in a blog post of November 9, 2026.

Built on the same silicon as TPU 8t and paired with 5th Generation AMD EPYC CPU hosts, TPU 8tx builds security directly into the hardware layer, keeping sensitive data and model weights protected and isolated even while in active use.

Google says TPU 8tx uses the same silicon as TPU 8t and is paired with 5th Generation AMD EPYC CPU hosts, and the post gives no availability date or pricing for it.

Built on the same silicon as TPU 8t and paired with 5th Generation AMD EPYC CPU hosts

The Confidential Computing Consortium's technical analysis, version 1.3, defines Confidential Computing as the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment.

Confidential Computing is the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment.

The paper says data in transit is moving over a network, data in storage is at rest, and data being processed is in use, and that protecting data in use is the new frontier because techniques to protect data in transit and at rest are now commonly deployed.

Data traversing the network is "in transit," data in storage is "at rest," and data being processed is "in use." ... While techniques to protect data in transit and at rest are now commonly deployed, the third state - protecting data in use - is the new frontier.

The paper says the CCC defines a Trusted Execution Environment as an environment that provides a level of assurance of three properties: data confidentiality, data integrity and code integrity.

A Trusted Execution Environment (TEE) is defined by the CCC, following common industry practice, as an environment that provides a level of assurance of the following three properties:

The paper defines data confidentiality as unauthorized entities not being able to view data while it is in use within the TEE, and data integrity and code integrity as unauthorized entities not being able to add, remove or alter the data or the code executing in the TEE.

Data confidentiality: Unauthorized entities cannot view data while it is in use within the TEE. Data integrity: Unauthorized entities cannot add, remove, or alter data while it is in use within the TEE. Code integrity: Unauthorized entities cannot add, remove, or alter code executing in the TEE.

The paper says that in the context of confidential computing, unauthorized entities could include other applications on the host, the host operating system and hypervisor, system administrators, service providers, and the infrastructure owner, or anyone else with physical access to the hardware.

In the context of confidential computing, unauthorized entities could include other applications on the host, the host operating system and hypervisor, system administrators, service providers, and the infrastructure owner--or anyone else with physical access to the hardware.

The paper describes attestation as the process by which one party, the Verifier, assesses the trustworthiness of a potentially untrusted peer, the Attester, by obtaining an authentic, accurate and timely report about the software and data state of the Attester.

Attestation is the process by which one party, called a "Verifier", assesses the trustworthiness of a potentially untrusted peer, i.e., the "Attester". ... by obtaining an authentic, accurate, and timely report about the software and data state of the Attester.

In the paper's example attestation protocol, the Verifier sends a challenge, the Attester's trusted hardware component gathers evidence and signs it together with the challenge, and the Verifier verifies the signature and appraises the evidence against reference values deemed trustworthy.

the Verifier generates a challenge and sends it to the Attester; ... The trusted hardware component gathers the evidence on the attesting platform and signs the attestation data and challenge; ... The Verifier verifies the signature and appraises the evidence by applying some appraisal policy, such as comparing the attested platform state against a set of reference values that are deemed to be trustworthy

The paper lists sophisticated physical attacks, upstream hardware supply-chain attacks and availability attacks such as DoS or DDoS as threat vectors generally considered out of scope for Confidential Computing.

Threat vectors which are generally considered to be out-of-scope for Confidential Computing include: Sophisticated physical attacks: these are physical attacks that typically require long-term and/or invasive access to hardware ... Upstream hardware supply-chain attacks ... Availability attacks (such as DoS or DDoS) attacks

The paper says the data confidentiality assurance of TEEs rests on assumptions, a key one being that there are no exploitable side-channels, and that academic researchers have demonstrated vulnerabilities in the design of certain TEEs that allow side-channel attacks.

However, this assurance rests on some assumptions, a key one being that there are no exploitable side-channels the owner (or any other entities with access to the system) could use to infer information about the data or execution. Over the last few years, academic researchers have identified and demonstrated vulnerabilities in the design of certain TEEs that allow for side-channel attacks

The paper says the definition is not limited to cloud uses and not limited to any particular processor, since trusted processing might also be in a GPU or a network interface card.

Importantly, the definition is not limited to "cloud" uses ... It is also not limited to such trusted execution being done by any particular processor, since trusted processing might also be in various other places such as a GPU or a network interface card.