During Google Cloud Next 2026 in Las Vegas, the MLCommons Medical AI working group and Google Cloud announced the enablement of MedPerf, MLCommons’ federated benchmarking orchestrator, on Google Cloud’s confidential compute capabilities. Both teams demonstrated this integration on a compelling real-world clinical use case: brain tumor segmentation.
A brain tumor (glioblastoma) is a rare disease with devastating outcomes for life expectancy. AI has the potential to improve the diagnosis and prognosis of brain tumor patients through a multitude of automated processes – including boundary definition/segmentation, tumor classification, and tumor quantification. Thanks to the Federated Tumor Segmentation (FeTS) consortium, coordinated by Dr. Spyridon Bakas at Indiana University School of Medicine and the Response Assessment in Neuro-Oncology (RANO) cooperative group, the MedPerf team demonstrated evaluation of a clinically valuable AI model – designed by Dr. Evan Calabrese’s team at Duke University – on real-world brain tumor MRI data.
With MedPerf on Google Cloud’s Confidential Computing, we aim to advance medical AI research worldwide while securely evaluating models on medical data. Using Google Cloud’s Confidential Space, a Trusted Execution Environment (TEE), medical data, model weights, and benchmarks are fully protected throughout the benchmarking process.
The Problem: Life-Threatening Disease, Locked-Down Data
Protecting both AI models and patient data in the medical space is paramount, driven by privacy, ethical, sovereign, and regulatory considerations. At the same time, measuring the performance of AI models on real-world patient data is critical for enabling trust and adoption of AI among clinicians, patients, regulators, and payors.
The MLCommons community built MedPerf to address exactly this gap. MedPerf uses a federated approach – introduced to healthcare by Dr. Bakas’ team – in which AI models move to the medical data owners (such as healthcare organizations, hospitals, and data brokers), rather than requiring data to move to the benchmark operator. This allows data owners to keep their data private while sharing only summarized results with the benchmark operator.
However, while this federated approach protects patient data, it does not fully address concerns around model theft, intellectual property, and benchmark integrity. Without additional guarantees, there is no assurance that model weights won’t leak or that benchmark results won’t be tampered with at the time of execution – raising serious concerns about trust and participation in the benchmark itself.
The Solution: MedPerf on Google Cloud Confidential Space
MedPerf’s integration with Google Cloud’s Confidential Space solves exactly this problem: protecting both model weights and benchmark results while simultaneously safeguarding medical data.
This integration brings four key benefits to MedPerf users:
- A global test dataset for healthcare AI – enabling evaluation at unprecedented scale
- Patient data is protected – data never leaves the data owner’s secure environment
- Model IP is protected – model weights remain encrypted and inaccessible to unauthorized parties
- No data sharing required – results are summarized and encrypted before transmission
The Demo: A Step-by-Step Secure Benchmark
A benchmark authority first publishes a benchmark on the MedPerf server, describing the benchmark’s aim, data preparation guidelines, and evaluation criteria. Data owners and AI model owners then register metadata for their private assets with the MedPerf server and link their registrations to the benchmark.
Private assets are encrypted using Google Cloud’s Cloud Key Management Service (Cloud KMS) and uploaded to a Google Cloud Storage bucket. Access to Cloud KMS and the bucket is governed by a Google Cloud workload identity pool, which allows access only if the request originates from a confidential virtual machine with specific measurements – such as the benchmark container hash and input hash.
When it’s time to run, data owners execute the benchmark container inside a Confidential Space virtual machine. The container receives cryptographic evidence of the trusted execution environment’s configuration, which is exchanged for access tokens from the model owner’s and data owner’s workload identity pools. These tokens retrieve and decrypt the model and dataset, inference is executed, results are encrypted with the data owner’s public key, and the encrypted results are returned to the data owner’s bucket.
The video below demonstrates a brain tumor segmentation AI model running on a clinical dataset in Google Cloud:
Voices from the Community
“My experience testing federated learning on Google Cloud has shown that the future of medical AI lies in secure, scalable, and collaborative cloud environments. Moving beyond the controlled lab setting to test these workflows in a production-ready infrastructure provided a unique opportunity to evaluate the performance and security of federated learning in real-world clinical applications. This collaboration between the FeTS community, MLCommons, and Google Cloud demonstrates how scalable cloud solutions can accelerate the development of high-precision diagnostic tools in neuroradiology.” – Dr. Yury Velichko, Northwestern University
“Federated Learning offers a paradigm shift in healthcare multi-site collaborations that expedites access to unprecedented amounts of knowledge from diverse patient populations, towards robust generalizable AI models with real clinical impact. Security and privacy are prime considerations to ensure that FL-related assets are always protected. Training and evaluating AI models on confidential compute infrastructure, using MLCommons’ MedPerf on Google Cloud, describes a complete exemplary solution for large-scale real-world clinically-relevant AI studies in healthcare, providing the ability to track how well an AI model continues to perform after it has received regulatory approval, for example, from the FDA.” – Dr. Spyridon Bakas, Indiana University School of Medicine
“One of the greatest barriers to trustworthy medical AI has been the tension between the need for real-world data and the need to protect it. The integration of MedPerf with Google Cloud’s Confidential Space is a tangible solution to that tension – one that the MLCommons community has worked hard to bring to life. We are proud to demonstrate what is possible when open collaboration meets production-grade security infrastructure.” – Alexandros Karargyris, MedPerf Lead, MLCommons
Join the MedPerf Community
MedPerf is an open-source effort developed by the medical AI community to address real community needs. Thanks to contributions from the MLCommons community, MedPerf has already supported impactful clinical AI studies, including the FeTS challenge and FeTS 2.0 for brain tumors.
We know we still have much more to do – and we need your help. We are looking for:
- Research investigators with the ambition to lead global clinical AI studies
- Computational experts who want to build disruptive AI on real-world medical data
- Infrastructure engineers to improve real-world benchmarking technologies
- Privacy and governance experts to provide input on medical data access controls and policy
- Regulatory experts to provide feedback on bringing regulatory alignment to real-world benchmarking
Acknowledgments
Contributors to the MedPerf confidential compute integration include Google Cloud team lead Nelly Porter, Dr. Spyridon Bakas from Indiana University School of Medicine, Dr. Yury Velichko from Northwestern University, and Dr. Amber Simpson from the University of Alberta (formerly at Queen’s University).