AI Evaluation Can Move to the Data Without Exposing the Data | G360 Technologies

A hospital wants to test a new AI model against private brain MRI scans. The model developer does not want to hand over its proprietary weights, and the hospital does not want to expose patient data.

MLCommons' MedPerf integration with Google Cloud Confidential Space demonstrates another architecture. The model and evaluation data are independently encrypted, brought into a hardware-isolated environment, and decrypted only after that environment proves through remote attestation that it is running an approved workload.

The MedPerf implementation, disclosed in July 2026 with additional technical details published by Google in August, shows how AI evaluation can occur without giving the model provider, data owner or benchmark operator direct access to the other parties' plaintext assets.

For enterprises holding regulated or proprietary datasets, the important change is where trust is placed. Access can be conditioned on a cryptographically measured execution environment rather than requiring one organization to hand its sensitive asset to another.

MedPerf has used federated evaluation to bring models to healthcare data rather than centralizing patient datasets. That approach alone does not fully address model theft, intellectual-property protection or benchmark integrity.

The 2026 implementation adds confidential computing. MLCommons demonstrated the architecture using a brain-tumor segmentation model developed by a Duke University team and real-world brain MRI data. Google says the implementation runs on A3 systems pairing Intel TDX with NVIDIA H100 confidential computing.

How the Mechanism Works

The MedPerf architecture separates possession of encrypted assets from permission to use them:

Encrypt the assets. Private model and dataset assets are encrypted using Google Cloud KMS.
Stage the encrypted inputs. The encrypted objects are uploaded to Cloud Storage. Encrypted copies can therefore move into cloud infrastructure even though usable plaintext is not provided to the benchmark operator or opposing party.
Launch the approved workload. The data owner executes the benchmark container inside a Confidential Space virtual machine.
Attest the environment. The environment produces cryptographic evidence about its configuration. Workload identity policies can restrict access based on measurements such as the benchmark container hash and input hash.
Release access and execute. After the evidence is accepted, access tokens from the model owner's and data owner's workload identity pools allow the workload to retrieve and decrypt the model and dataset. Inference runs inside the protected environment, and the result is encrypted with the data owner's public key before being returned to its storage.

The critical transition is step five. Ciphertext can exist outside the trusted environment, but the protected asset becomes usable only after the workload satisfies the required conditions.

NIST's May 2026 initial public draft IR 8320E describes the same general security pattern: evaluate TEE attestation against key-release policy and provide the decryption key only after the policy succeeds.

Analysis: Why This Matters Now

The MedPerf implementation moves an approach explored in earlier confidential-AI research into a real medical benchmarking workflow.

A late-2024 OpenMined pilot with the UK AI Safety Institute and Anthropic tested mutually confidential evaluation using GPT-2 and a five-row CAMEL-bio sample as proxies for private model and evaluation assets. The 2025 Attestable Audits research showed how model and benchmark artifacts could be cryptographically bound to an evaluation conducted inside a trusted execution environment.

MedPerf is notable because the same underlying idea is now being applied to medical benchmarking with real-world private imaging data and confidential GPU acceleration.

The architecture also clarifies what moving evaluation to the data increasingly means. Location alone is insufficient. The execution environment must establish the required measured state before protected assets become usable.

That turns remote attestation and key-release policy into part of the evaluation protocol itself.

Implications for Enterprises

For security and platform teams, confidential evaluation changes the control question from who may receive a dataset to which measured workload may decrypt it.

That brings workload integrity, attestation and key-release policy directly into the AI evaluation architecture.

The architecture can also support multi-party evaluation where neither organization wants to disclose its core asset to the other. Model weights and evaluation data can remain independently controlled, with access mediated through an approved confidential environment.

Healthcare now provides a concrete implementation through MedPerf. The primary sources reviewed for this article did not establish a comparable public 2026 confidential-AI benchmarking deployment in financial services.

Enterprises would still need governance around evaluation-code approval, output policies, accepted measurements and retention of attestation and key-release evidence.

Risks and Open Questions

The architecture narrows trust rather than removing it. Attestation establishes properties about an execution environment against a defined policy, but successful attestation does not establish that the evaluation methodology itself is correct. The approved workload therefore remains a critical shared trust object.

Accelerators add complexity. MedPerf combines CPU and GPU confidential-computing mechanisms rather than relying on CPU isolation alone, and performance is architecture-dependent. The Attestable Audits CPU-enclave prototype reported 1.84 tokens per second versus 202 tokens per second on its L40S comparison configuration, illustrating why performance results from one confidential-computing design should not be generalized to another.

Finally, key-management and attestation infrastructure become critical control points because their policies determine when protected assets become available.

The central engineering question is therefore becoming more precise: how can organizations prove that the right workload ran under the right conditions before either side surrendered decryption authority?

How the Mechanism Works

Analysis: Why This Matters Now

Implications for Enterprises

Risks and Open Questions

Further Reading