Google says its English and Japanese Gboard next-word models now train on servers inside hardware-protected enclaves. The setup lets outside auditors check which published programs may process encrypted training data.
In many earlier federated-learning systems, phones compute model updates and send those updates to a central service. Google’s new system instead lets devices upload encrypted examples, then runs the training workload on servers. A Trusted Execution Environment (TEE) is a hardware-protected area that runs code in isolation and can provide evidence of which code is running.
Before upload, each device ties its encrypted data to an access policy listing the server programs allowed to use it. A TEE-hosted key service releases the decryption key only to workloads that match the policy, which Google publishes to the Rekor transparency log. Differential privacy adds calibrated statistical noise during training to limit what the resulting model can reveal about any one participant. Some per-user data-transformation rules may also be supplied at runtime and kept proprietary. The rules themselves are not published or encrypted, so auditors cannot inspect their contents. They can inspect the published program to see how it uses those rules to preserve differential-privacy guarantees, the paper says.
In Google’s English Gboard A/B test, each test group included 3.5 million devices. Under the same MF-DP-FTRL privacy method, the best new model had a zCDP budget of 0.215, compared with 0.641 for the production model. A lower budget sets a tighter formal limit on how much any one participant’s data can affect the result. Google reports no change in key usability measures such as typing speed and suggestion edits; training took three weeks, down from two months.
The results come from Google’s production tests, not an independent replication. The authors also warn that current TEEs leave side-channel risks: details of how code runs can be observed and may leak information despite enclave protections. A separate NDSS 2026 study found such leakage in other privacy workloads on confidential virtual machines; it did not test Google’s Gboard system. The paper says Google’s system has so far trained models up to 10 million parameters; larger models would need accelerator support inside TEEs.
Sources
- Original paper: Toward provably private learning from federated data
- Google Research: system design and Gboard deployment
- NDSS 2026 paper on side-channel leakage in confidential virtual machines
- Image: Server racks at NERSC by Derrick Coetzee, CC0 1.0; illustrative image, not Google equipment. Wikimedia Commons source and license.
