Many organizations want to train machine learning models on data that stays on user devices, but they also need strong privacy guarantees that can be checked by anyone. Early federated learning kept the model update computation on the phones, which meant that the central server had to be trusted to add differential‑privacy noise correctly and could not prove that raw data was never seen. Cryptographic secure aggregation helped hide individual updates, yet it could not work with the latest central‑DP algorithms and still required trust in the server’s noise generation.
Google’s new TEE‑based federated learning solves this by moving the gradient calculation into attested trusted execution environments on the server. Devices first encrypt their training examples locally and attach an access policy that is written to a public transparency log. A key‑management service built from TEEs using RAFT releases decryption keys only to workloads whose hash matches the logged policy. The root TEE runs the Python training loop, optionally delegating to worker TEEs, and only releases differentially‑private model weights. All code that touches the data is reproducible and open‑source, so external auditors can verify that the server follows the published policy and that the DP noise is added correctly. Fault‑tolerant checkpoints let the system recover from TEE failures without losing privacy guarantees.
The result is a system where privacy guarantees are not just claimed but can be independently checked, while training speed is limited only by available TEE resources instead of months of sequential phone‑side computation. Gboard already uses it for English and Japanese next‑word prediction, showing better accuracy and stronger, auditable privacy.
#AI #Product #Privacy #FederatedLearning #TEE #ML