Google's TPU 8tx gives regulated enterprises and government agencies a confidential accelerator outside Nvidia's line, due next year, with no published price, region or attestation design. The decision you can make this quarter is whether your PyTorch workloads run well on TPUs at all.
Google announced TPU 8tx and TPU 8i Max on November 9. That post gives no availability date. Google's Amin Vahdat told Bloomberg the systems arrive next year. No independent test of either system appears in the coverage published so far, so every performance claim below is Google's.
Google's Two New Systems Reuse Chips It Already Announced
TPU 8tx and TPU 8i Max are reconfigured versions of existing chips. TPU 8tx uses the same silicon as TPU 8t, paired with 5th Generation AMD EPYC hosts, plus the Boardfly network from TPU 8i. Google claims up to 2x lower latency than TPU 8t with a "near-zero performance penalty," and says one system can handle private fine-tuning, model distillation and reinforcement learning without moving sensitive data between clusters. It publishes no test conditions for that penalty figure.
TPU 8i Max puts two TPU 8i chips in one package, for double the compute, SRAM and HBM bandwidth. Memory capacity grows less. Network World, citing Google, puts HBM at 384 GB, 33% more than TPU 8i, with 17.2 TB/s of bandwidth. If KV cache capacity is what limits your long-context serving, size against the 33%.
| System | Status on November 9, 2026 | Confidential mode | Your move |
|---|---|---|---|
| TPU 8tx | Next year, no published price or region | Claimed, design unpublished | Get terms in writing |
| TPU 8i Max | Next year, no published price or region | None claimed | Leave out of 2027 capacity math |
| TPU 8t and 8i | "Generally available later this year" per Google in April, absent from Compute Engine's TPU machine list | None claimed | Ask your account team for a date |
| Ironwood (TPU7x) | Documented machine type, with several capacity options allowlisted | Not marked as supported | Port and benchmark now |
| Confidential G4 (RTX PRO 6000) | GA since October 21 in 36 zones | AMD SEV with NVIDIA Confidential Computing | Evaluate first if your model fits g4-standard-48 |
| Confidential A3 High (H100) | Documented in three zones, reservations not supported | Intel TDX with NVIDIA Confidential Computing | Use it if your stack is validated on H100 |
TPU 8tx's Security Claim Is Spread Across Three Sources
Google has described the TPU 8tx security boundary in fragments, and none of those descriptions is a design document a security architect could review. Confidential inference means running a model inside a trusted execution environment (TEE), a hardware-isolated region whose memory the host cannot read. Remote attestation is signed hardware evidence of what is running, checked before anyone releases a secret such as a model key to the machine.
Google's own post says only "hardware-level confidential compute" and names no TEE technology. AMD's same-day release adds the most: TPU 8tx uses SEV capabilities in the EPYC CPU, data stays encrypted in CPU memory and in transit "among the host and accelerators," and an accelerator's identity and security configuration are verified before it gets direct access to protected memory. AMD's release never uses the word attestation. Network World's account does, quoting Google's Mark Lohmeyer: "that entire system is attested."
Those sources leave the questions that decide whether your security team can sign off:
- Who verifies the evidence, and can you do it without trusting a Google service?
- Does the TPU produce its own attestation evidence, separate from the CPU report?
- AMD says SEV. Which SEV generation, and does it include SEV-SNP's memory integrity protection?
- Is HBM encrypted on the TPU, and are chip-to-chip links protected? AMD's release names neither HBM nor TPU-to-TPU links.
- How do encrypted model weights get released to the TPU, and who holds that key?
The chip-to-chip question matters for any model too large for one TPU. Nvidia says Vera Rubin NVL72 is built for a trusted execution environment at rack scale, and VentureBeat reported that it encrypts every bus across the NVLink fabric. Google has not yet made a comparable statement about its TPU interconnect.
Attestation is also hard to operate. An IDC survey of more than 600 IT leaders, commissioned by the Confidential Computing Consortium, put attestation validation among adoption challenges at 84%. The figure is self-reported, and the consortium promotes the technology. Budget for that work whichever accelerator you choose.
Google's documentation is also unsettled. Its Confidential VM page says "You can't attach TPUs to Confidential VM instances," while its TPU machine table marks Confidential Computing as supported on TPU v6e, and Google's Mark Lohmeyer says TPU 8tx is "bringing hardware-enforced confidential computing to cloud TPUs for the first time." If v6e appears in a sales conversation as a confidential option, ask which of those statements holds.
Nvidia Is the Confidential Option You Can Deploy First
For a regulated workload that has to run in the next two quarters, the confidential options are GPU options. Our confidential GPU buyer's guide from November 2 covers Azure's and Google's attested H100 options in detail. Google's H100 route has limits: A3 High with H100 doesn't support reservations, and GKE's confidential GPU guide lists Spot, preemptible and flex-start provisioning without mentioning on-demand. Its newer route is Confidential G4 with RTX PRO 6000 Blackwell GPUs, generally available since October 21 across 36 zones on Compute Engine and GKE. Google's June preview post listed on-demand and reservations among its consumption models, but the GA post doesn't name them, so confirm yours. The supported-configurations page lists only g4-standard-48 for confidential G4 and says GPU VMs can't form multi-node clusters, so a model that needs more than one VM has no confidential path there.
Nvidia's next step is further along than Google's. Its May release said Vera Rubin production shipments would begin this fall and listed 11 cloud providers adopting its confidential computing, including Microsoft Azure, IBM Cloud and CoreWeave. Google Cloud is not on that list.
The strongest case for waiting on TPU 8tx is cost and supply. Bloomberg Intelligence's Mandeep Singh puts TPUs about 30% below Nvidia GPUs with competitive throughput, and a second source matters when Nvidia demand still exceeds supply. If your model already runs on TPUs, or your data already sits in Google Cloud, 8tx belongs on the 2027 shortlist. Counting on it for capacity is harder: Bloomberg also reports that every TPU Google has available is already contracted. Google says it now lets customers deploy TPUs in their own data centers, but it does not say whether 8tx is included, and for a bank or agency that may settle the question.
The Benchmarks in Google's Post Do Not Measure TPU 8tx
Google's post says its vLLM-TorchTPU stack achieved "state-of-the-art price-performance marks" on InferenceX and AgentX, with no numbers and no link to either new system. The public tests on record are SemiAnalysis's September 7 InferenceX preview and its November 5 AgentX results, and both tested Ironwood.
The September preview is worth reading for what it found on Ironwood. At 100 tokens per second per user, Ironwood cost about $0.181 per million total tokens against $0.222 for Nvidia's B200 and $0.276 for B300. The caveats are large: one model (Qwen3.5 397B in FP8), one 8k input and 1k output shape, modeled cost assumptions for a hyperscaler lab buying TPUs, Google engineers credited for the TPU performance work, software SemiAnalysis describes as still maturing, and worse time to first token at the highest-throughput points. GB300 NVL72 with disaggregated serving held roughly a 30% performance-per-dollar edge over Ironwood in the middle of the latency range.
None of this measures a confidential TPU. Ironwood is not marked as supporting Confidential Computing, so a good Ironwood result tells you nothing about the overhead of 8tx's security path. On H100, one study measured a 4-8% throughput penalty that shrinks as batch and input sizes grow, and Google reports under 3.5% throughput loss for Confidential G4 in its own tests on open-weight models. No equivalent public number exists for a TPU.
TorchTPU on Ironwood Is the Test You Can Run Today
The work worth funding now is a port test, because it answers a question that survives whichever 2027 system you pick: how much of your PyTorch stack moves to TPUs, and at what cost in engineering time.
TorchTPU went open source on October 20, under Apache 2.0, with version 0.2.0 on PyPI. Google says Transformers v5 can deploy with a single device_map="tpu" argument, and it names native backends for vLLM and SGLang. Google's PyTorch documentation says TorchTPU replaces PyTorch/XLA, so existing XLA workloads have a migration to plan. That page publishes no compatibility matrix or list of unsupported generations, so treat each model architecture as unproven until your own run says otherwise.
Pathways is a separate decision. Cloud Pathways reached GA on GKE on November 9 for TPU v5e, v5p, v6e and Ironwood, and the post lists JAX 0.10.1+ with no mention of PyTorch or eighth-generation hardware. If your team is on PyTorch, don't let a Pathways pitch stand in for a TorchTPU test.
Check capacity before you schedule the port. Compute Engine's documentation says on-demand capacity is not guaranteed, and that Spot, Flex-start, calendar-mode and capacity-block reservations for TPU7x sit behind an allowlist. Google's regions page listed TPU7x in two us-central1 zones when checked on November 9, which is its own issue for data residency. GKE dynamic slicing, which forms Ironwood slices at scheduling time, needs the Rapid release channel, and its incremental provisioning needs All Capacity mode reservations, so a pilot on a stable-channel cluster won't get it. Sub-slicing has been GA for Ironwood since August 3.
On price, check the list rate first. Spheron reported in July that Google had published no chip-hour rate for Ironwood, and our September cost comparison found the same problem, but a Google Developer Expert's October 25 review of Google's pricing page lists $12.00 per chip-hour on demand, $8.40 on a one-year commitment and $5.40 on three. We could not load those rows on Google's page ourselves, so get a written quote before you model cost.
What to Do Before You Commit 2027 Accelerator Budget
This Week:
- Name the workloads that need protection from the infrastructure operator, and have your CISO sign that list. If nothing on it requires that threat model, 8tx is a cost question and you can skip the attestation work.
- Send your Google account team the five attestation questions above, plus four more: the 8tx regions, the price basis, on-premises terms, and the date you could run a proof of concept. Ask for written answers.
This Month:
- Port one production PyTorch inference workload to TorchTPU on Ironwood, using your real model and traffic shape. Record engineer-days, every patch you had to carry, and anything that needed a custom kernel.
- Run that workload on your current Nvidia stack at the same latency target, then compare cost per million tokens at your own quote. A published curve at 8k input and 1k output won't tell you what your agent traffic costs.
Before You Sign a 2027 Commitment:
- Keep 8tx and 8i Max out of any capacity plan until you have a written date and region. Google gave TPU 8t and 8i a "later this year" target in April, and Compute Engine's TPU machine documentation still listed only TPU7x, v6e and v5p on November 9.
- Write an attestation acceptance test with your security team: an independent verifier checks signed CPU and TPU evidence before a model key is released. Make passing it a condition of any 8tx purchase.
- If you are weighing a reserved GPU commitment, keep the term short enough to move when 8tx pricing appears. Oracle's plan to offer TPUs from next year gives you a second place to ask for a TPU quote.
The Bottom Line
TPU 8tx adds a second accelerator family to confidential inference on Google Cloud, where the documented options today are NVIDIA GPUs. Confidential GPUs show how long a first release can stay narrow: our November guide found Google's confidential H100 limited to Spot or flex-start capacity, with CPU and GPU evidence that buyers have to validate separately.
Your TorchTPU results will still be useful if 8tx slips. Ask Google for the attestation design this week, and keep 8tx out of the 2027 budget until it arrives.