Google Cloud and MLCommons Bring Privacy-First AI to Brain Tumor Research with Confidential Computing

Google Cloud Advances Privacy-First Medical AI with Confidential Computing and MedPerf

Artificial intelligence continues to reshape healthcare by helping clinicians analyse medical images, detect diseases earlier, and support treatment planning. Yet despite rapid advances in AI models, one challenge remains difficult to overcome. Medical AI systems must be validated using diverse, real-world patient data before healthcare providers can trust them in clinical environments. At the same time, strict privacy requirements often prevent sensitive patient information from being shared across organisations.

Google Cloud believes the answer lies in combining privacy-preserving cloud infrastructure with collaborative AI evaluation. In a new announcement, the company detailed its work with MLCommons through the MedPerf initiative, using Google Cloud Confidential Computing to create secure environments where AI models can be evaluated against real clinical data without exposing either patient records or proprietary AI models.

The collaboration represents another step toward privacy-first healthcare AI, enabling researchers, hospitals, and AI developers to work together while maintaining strong security guarantees throughout the evaluation process.

Rather than focusing on training models, the initiative addresses one of healthcare AI's most critical stages: proving that an AI system performs consistently across different hospitals, patient populations, and imaging environments before clinical deployment.

Why Medical AI Validation Remains a Challenge

Medical AI systems are only as reliable as the evidence supporting their performance. A model that demonstrates excellent accuracy within one healthcare institution may perform differently when applied elsewhere.

Hospitals often differ in several important ways, including:

• Patient demographics

• Imaging equipment

• MRI acquisition protocols

• Clinical workflows

• Disease prevalence

These variations can significantly influence how well an AI model performs in practice.

Developers therefore need access to representative datasets collected from multiple healthcare organisations. However, regulations governing patient privacy, institutional policies, and intellectual property concerns make sharing either medical data or proprietary AI models extremely difficult.

This creates a difficult trade-off. Researchers need broader evaluation to improve clinical confidence, while healthcare providers must ensure sensitive patient information never leaves their control.

Google Cloud's latest collaboration aims to remove this compromise by allowing evaluation to occur where both the model and the data remain protected.

MedPerf: An Open Framework for Medical AI Benchmarking

Launched by MLCommons in 2023, MedPerf is an open-source benchmarking platform designed specifically for medical AI evaluation.

Instead of requiring hospitals to send patient datasets to a central repository, MedPerf uses a federated evaluation approach.

Under this model:

• AI models travel securely to participating healthcare institutions.

• Patient datasets remain within their original environments.

• Evaluation results are shared without exposing underlying medical records.

• Organisations retain ownership and control of their sensitive information.

This approach helps researchers compare AI model performance across multiple healthcare environments while respecting regulatory and privacy requirements.

According to Google Cloud, integrating MedPerf with Confidential Computing strengthens this federated approach by protecting not only patient data but also the AI models themselves throughout the evaluation process.

Building a Secure Clean Room for Medical AI

Google Cloud describes the combined MedPerf environment as a secure clean room for AI benchmarking.

Rather than relying solely on software controls, the platform uses hardware-backed security to isolate workloads during execution.

At the centre of this architecture is Google Cloud Confidential Space, which runs workloads inside Trusted Execution Environments (TEEs).

These environments provide several important protections:

• Memory remains encrypted while applications are running.

• Operating systems are hardened against unauthorised access.

• AI model code remains inaccessible to participating organisations.

• Patient data cannot be viewed by Google Cloud or external parties.

• Processing occurs within isolated hardware-protected environments.

This design allows proprietary AI models to execute directly against confidential healthcare datasets without revealing either side of the collaboration.

For healthcare institutions, this means patient information never needs to be exposed during benchmarking. For AI developers, valuable model intellectual property also remains protected throughout the evaluation process.

Confidential Computing Extends Protection Beyond the CPU

Medical AI workloads frequently rely on high-performance graphics processors because analysing complex medical images requires significant computational power.

Traditional confidential computing solutions have primarily focused on protecting CPU memory. However, modern AI inference increasingly depends on GPUs, creating an additional security consideration during model evaluation.

Google Cloud addresses this by extending Confidential Computing across both processing environments. According to the announcement, MedPerf runs on Google Cloud A3 machine series equipped with NVIDIA H100 GPUs, combining Intel Trust Domain Extensions (TDX) on the CPU with NVIDIA Confidential Computing capabilities on the GPU.

This architecture allows encrypted processing to continue during GPU-accelerated inference, helping protect both patient data and AI model weights while computationally intensive workloads are executed.

Before any clinical data is processed, the environment also provides cryptographic attestation. This process verifies that only approved software is running on genuine Confidential Computing hardware and confirms that the execution environment has been securely configured.

For healthcare organisations handling highly sensitive medical information, this additional verification helps establish trust that AI benchmarking occurs only within authorised, hardware-protected environments.

From Secure Infrastructure to Clinical Research

The value of privacy-preserving AI extends beyond technical architecture. Google Cloud's collaboration with MLCommons is already supporting medical research through the Federated Tumor Segmentation (FeTS) initiative, demonstrating how confidential computing can help researchers validate AI models using geographically distributed clinical datasets.

The project focuses on one of the most challenging areas in medical imaging: brain tumour segmentation.

Brain tumours, particularly aggressive forms such as glioblastomas, are relatively rare. As a result, individual hospitals often lack enough patient cases to build or comprehensively evaluate AI models on their own. Even large academic medical centres may only have access to a limited number of cases, making it difficult to determine whether an AI system will perform reliably across broader patient populations.

This scarcity of representative data has long slowed the development of trustworthy medical AI.

By combining MedPerf with Google Cloud Confidential Computing, participating organisations can evaluate AI models against private MRI datasets without transferring patient records outside their institutions. The result is a collaborative validation framework that supports broader clinical evaluation while maintaining strict privacy protections.

Why Diverse Clinical Data Matters

Developing an accurate medical AI model is only part of the challenge. Healthcare providers also need confidence that the model performs consistently in different clinical settings.

Several factors can influence AI performance, including:

• Differences in patient demographics

• MRI scanner manufacturers and hardware

• Imaging protocols

• Clinical workflows

• Regional variations in disease presentation

• Data acquisition techniques

These variations may appear subtle to humans but can significantly affect AI inference accuracy.

Google Cloud highlights this issue through a practical example from the announcement. A medical AI model could achieve 95 percent accuracy at one healthcare site yet perform at 63 percent accuracy at another because of differences in local clinical environments.

Although the announcement does not identify a specific model associated with these figures, the example illustrates why evaluating AI systems across multiple institutions is essential before they are introduced into patient care.

Instead of assuming performance generalises automatically, MedPerf enables researchers to identify these gaps early and improve model robustness before deployment.

Federated Tumor Segmentation Demonstrates Real-World Collaboration

The Federated Tumor Segmentation (FeTS) initiative represents one of the first large-scale demonstrations of this privacy-preserving evaluation approach.

According to Google Cloud, MedPerf on Google Cloud is helping validate AI models using private brain MRI datasets collected from institutions around the world.

The collaboration includes researchers from several leading academic organisations, including:

• Indiana University, represented by Dr. Spyridon Bakas

• Northwestern University, represented by Dr. Yury Velichko

• University of Alberta, represented by Dr. Amber Simpson

Rather than centralising MRI datasets, each institution maintains control over its own patient information while participating in collaborative benchmarking.

This model enables researchers to compare AI performance across multiple clinical environments without exposing confidential medical records or proprietary algorithms.

For healthcare organisations, this approach reduces many of the barriers that have traditionally limited multi-centre AI research.

Clinical Researchers Emphasise Production-Ready Security

Google Cloud's announcement includes perspectives from researchers directly involved in testing federated AI workflows.

Dr. Yury Velichko, Associate Professor of Radiology at Northwestern University, described the collaboration as an opportunity to move beyond controlled laboratory environments.

According to Velichko, testing federated learning within Google Cloud's production-ready infrastructure provided valuable insight into how secure and scalable cloud platforms can support real-world clinical AI research.

His comments reflect a broader challenge facing healthcare AI. Demonstrating technical feasibility in research settings is no longer enough. Healthcare providers increasingly expect AI systems to operate securely within production environments that meet both operational and regulatory requirements.

The use of Confidential Computing therefore addresses not only data protection concerns but also practical deployment considerations for collaborative research projects.

Benchmark Integrity Is Just as Important as Privacy

Protecting patient information is only one side of trustworthy medical AI evaluation.

Researchers also need confidence that benchmark results themselves cannot be manipulated or influenced by unauthorised changes to the execution environment.

Google Cloud explains that Confidential Computing helps establish this trust through cryptographic attestation.

Before any medical data is processed, the infrastructure verifies:

• Approved software is running.

• The workload has not been modified.

• Genuine Confidential Computing hardware is being used.

• Security hardening requirements have been satisfied.

This verification process helps ensure that benchmark results accurately represent model performance under controlled conditions.

For healthcare regulators and research organisations, reproducible evaluation is becoming increasingly important as AI systems move closer to routine clinical use.

MLCommons Focuses on Trustworthy AI Evaluation

Google Cloud also shared comments from Alexandros Karargyris, MedPerf Lead at MLCommons.

According to Karargyris, medical AI can only achieve its full potential if clinicians, researchers and regulators trust the benchmarks used to evaluate models.

He noted that deploying MedPerf on Google Cloud's Confidential Computing infrastructure represents a significant step toward securely testing AI models on real patient data while protecting:

• Patient privacy

• Intellectual property

• Benchmark integrity

These three objectives have historically been difficult to achieve simultaneously.

Traditional benchmarking often requires either sharing sensitive datasets or revealing proprietary model implementations. The MedPerf architecture instead allows both assets to remain protected throughout evaluation.

Industry Perspective: Privacy by Design Is Becoming Essential

While Google's announcement focuses on healthcare research, the underlying architecture reflects a broader shift occurring across enterprise AI.

As organisations increasingly deploy foundation models and specialised AI systems, they must also address growing concerns around:

• Sensitive data exposure

• Intellectual property protection

• Regulatory compliance

• Cross-organisational collaboration

• Secure model validation

Healthcare represents one of the most demanding environments because patient information is subject to strict privacy regulations and ethical obligations.

Technologies such as Confidential Computing demonstrate how hardware-backed isolation can enable collaboration without requiring organisations to surrender ownership of their most valuable assets.

Rather than treating privacy as an additional security layer applied after deployment, the Google Cloud and MLCommons collaboration illustrates a privacy-by-design approach where security controls are embedded directly into the computing environment from the beginning.

The Future: Scaling Secure Medical AI Collaboration

Google Cloud believes its collaboration with MLCommons marks an important step towards making privacy-preserving AI evaluation more practical for healthcare organisations worldwide.

According to the company, combining MedPerf with Confidential Computing makes it easier for research institutions and medical AI developers to evaluate models using diverse clinical datasets without compromising patient privacy or exposing valuable intellectual property.

As healthcare AI continues to mature, developers are expected to face increasing scrutiny from clinicians, healthcare providers and regulators regarding how models are tested before deployment. Demonstrating strong performance in isolated research environments may no longer be sufficient. Instead, evidence gathered from diverse, representative clinical settings is likely to become an increasingly important part of building confidence in AI-assisted healthcare.

By enabling secure benchmarking across multiple organisations, the collaboration seeks to reduce one of the longstanding barriers to wider medical AI adoption: the inability to evaluate models against sufficiently diverse patient populations while respecting privacy requirements.

Google Cloud also noted that research institutions and healthcare model developers interested in using MedPerf on Google Cloud can contact medical@mlcommons.org or work through their Google Cloud account teams to explore participation.

Enterprise Perspective

Although the announcement focuses on healthcare, the technologies underpinning the project have implications beyond medical research.

Many industries now face similar challenges when developing AI systems using confidential information. Financial services, pharmaceuticals, government agencies, insurance providers and critical infrastructure operators often need to collaborate across organisational boundaries while protecting highly sensitive datasets and proprietary machine learning models.

The approach outlined by Google Cloud demonstrates how hardware-backed confidential computing can support these collaborations without requiring participants to relinquish control of their most valuable digital assets.

For enterprises investing in generative AI and specialised machine learning models, confidential computing also offers an additional security layer that extends beyond traditional encryption.

Instead of protecting information only while it is stored or transmitted, confidential computing helps safeguard workloads while they are actively processing sensitive data. This capability is becoming increasingly relevant as AI inference workloads move into cloud-based production environments.

The collaboration therefore reflects a broader industry trend towards secure AI infrastructure where privacy, security and regulatory compliance are integrated directly into computing platforms rather than treated as separate operational controls.

Industry Analysis

Google Cloud's announcement highlights an important shift in how healthcare AI is being evaluated.

Historically, organisations attempting to collaborate on AI research often had to choose between two imperfect options:

• Centralise patient datasets and increase privacy risks.

• Keep datasets isolated and limit the scale of AI validation.

The MedPerf and Confidential Computing architecture offers an alternative model in which computation moves securely to the data rather than moving the data to the computation.

From an enterprise technology perspective, this represents a practical application of confidential computing beyond traditional cloud security use cases.

The announcement also reinforces another trend across the AI industry: trust is becoming just as important as model performance.

Healthcare providers increasingly expect evidence that AI systems have been evaluated across representative patient populations. Regulators want confidence that benchmarks cannot be manipulated. AI developers seek to protect proprietary model weights. Hospitals must safeguard sensitive patient information.

By combining hardware-backed isolation, cryptographic attestation and federated benchmarking, Google Cloud and MLCommons are addressing several of these requirements within a single architecture.

While additional details regarding future deployments or broader adoption were not disclosed in the announcement, the collaboration illustrates how privacy-preserving infrastructure can support more rigorous AI evaluation without requiring organisations to compromise on security.

Conclusion

The collaboration between Google Cloud and MLCommons demonstrates how confidential computing can help address one of healthcare AI's most significant challenges: validating models against diverse real-world clinical data while protecting both patient privacy and intellectual property.

By integrating the open-source MedPerf benchmarking platform with Google Cloud Confidential Space, Trusted Execution Environments and GPU-enabled Confidential Computing, the initiative enables secure evaluation workflows that would otherwise be difficult to achieve using conventional cloud infrastructure.

The real-world application within the Federated Tumor Segmentation initiative further illustrates how this approach can support collaborative research involving multiple institutions while maintaining local control over sensitive MRI datasets.

Although the announcement centres on brain tumour research, its broader significance lies in demonstrating how privacy-by-design architectures can strengthen trust in AI across highly regulated industries.

As organisations continue deploying increasingly sophisticated AI systems, secure model validation is likely to become an essential component of responsible AI development. Google's latest collaboration suggests that confidential computing could play an increasingly important role in enabling that future.