Toward provably private learning from federated data

Google is pushing federated learning into a new phase. The company says its next system uses trusted execution environments, or TEEs, to make data anonymization fully verifiable and auditable, and Google says Gboard is already using it for next-word prediction in English and Japanese.

Federated learning has been part of Google’s product stack since 2017, helping with things like Smart Compose in Gboard, reply suggestions in Google Messages, and Smart Text Selection in Android. The pitch has always been the same: train models across private, decentralized data without pulling everything into one place. But Google says earlier systems still depended on trust, because external observers could not verify what server-side code actually did with uploads.

The new setup is built around a stricter model. Devices locally encrypt training examples, publish access policies to a public transparency log, and only let approved TEE workloads decrypt and process the data. A key management system made up of TEEs running RAFT hands out decryption keys only to workloads that match those published policies. The training itself runs in Python inside a root TEE, which can delegate work to worker TEEs, and the system saves encrypted recovery state so it can survive failures without leaking extra information.

Google says this design changes the privacy story in a meaningful way. Workload operators can see only metrics and differentially private model weights, while the training data stays confined to TEEs for a limited time after upload. The company also says the KMS and processing binaries can be reproducibly built from open source code in its Confidential Federated Compute GitHub repository. That matters because it turns privacy from a promise into something auditors can inspect, at least within the limits of current TEE hardware.

There’s also a performance angle here. Google says the new Gboard system brings substantially faster compute times than the previous one, and that earlier training runs for these models could take one to two months. By moving bottlenecks to the server and parallelizing across many machines, Google says it can train faster and get around the old problem of devices being unavailable when training needed them most.