Google wants to make federated learning verifiable with attested hardware enclaves

Training data is encrypted on the phone and can only be read by audited code running in secure environments. Gboard is already using it.

Google Research introduces a new federated learning architecture designed to move privacy away from the word of the operator alone. Sample training is encrypted directly on the device before being sent. Decryption keys are only delivered to Trusted Execution Environments (TEEs), hardware-isolated enclaves whose code can be verified from the outside, and access rules are publicly logged.

Only anonymized results leave the enclave

Google's teams see neither the raw data nor the individual updates: only aggregated metrics and model weights protected by differential privacy leave the secure environment. The system is already used by the Gboard keyboard to predict the next word in English and Japanese, with better accuracy and shorter workouts than before, where a model took one to two months. The authors, Katharine Daly and Daniel Ramage, report stronger privacy guarantees on cohorts of 6,500 devices and 5,000 training cycles.