Google has outlined a way for its Private AI Compute service to retain an assistant's memory between sessions and across devices while keeping the keys needed to read it tied to the user's devices. The design would extend a cloud system that currently discards context after each request. Google has not said when the memory feature will reach users or which products will use it.
An assistant that resumes a project needs past context. Storing it only on a phone can make syncing across devices difficult; repeatedly sending a long history to a cloud model also adds network cost and delay. Google proposes storing each user's memory as encrypted records in its cloud and opening them only during a protected session.
Verified cloud software would unlock the memory
In Google's design, an Android client checks the cloud enclave's hardware attestation before opening an encrypted session and supplying a key derived from a secret held on the device. An orchestrator requests relevant records from the memory Oak Server, a protected service that opens the user's encrypted database for that session. Only inside the enclave is the database decrypted. The orchestrator passes the retrieved context with the new request to the AI model, then saves any updated memory in encrypted form.
Google says its infrastructure and employees cannot read the stored records in plaintext. Its technical brief also identifies a privacy trade-off: the persistent store needs a stable identifier to find the right user's records, so this design does not claim the network-level anonymity available to its stateless requests.
Security review leaves two findings open
Google linked a security assessment by Trail of Bits covering the new memory system. The firm reviewed code and architecture in June and July 2026, then checked fixes in August. Its September report says Google resolved eight of ten findings. The review did not cover every part of Private AI Compute, and the firm says some critical components remain closed to public inspection. Google's technical brief also lists independently witnessed records of deployed software among future work.
One unresolved, high-severity finding concerns hashes of short AI response segments sent outside the protected computing boundary for a copyright-repetition check. Trail of Bits says a privileged insider with access to the external checking service could use the hashes to reconstruct response text, although doing so would be technically difficult. Google says no plaintext response leaves the boundary and plans an internal filter to reduce how often such hashes are sent out.
The other open finding, rated low severity, is that someone with persistent privileged storage access could restore a previously deleted memory record. Google fixed a related record-substitution flaw but accepted the remaining rollback risk while investigating a way for clients to verify that stored state is fresh.
Sources
- Google DeepMind: Private AI Compute server-side memory announcement, September 23, 2026
- Google: Private AI Compute technical brief, September 2026
- Trail of Bits: security assessment and fix review, September 21, 2026
- Illustrative image: DonWeb data center photograph by Azraelito, CC BY-SA 4.0. The image does not show Google's infrastructure.
