Google Research Moves Federated Learning Into TEEs: Gboard Now Trains With Externally Verifiable Differential Privacy

Google Research has introduced a federated learning architecture that relocates gradient computation from user devices into trusted execution environments (TEEs) on server-side hardware. The system is currently deployed for Gboard, Google's keyboard app, to train models without exposing raw user data.

The key innovation is verifiable privacy. By moving computation to attested TEEs, Google can apply central differential privacy with mathematical guarantees that are externally auditable. Access policies are published to Sigstore's Rekor transparency log, and the training binaries are reproducibly buildable, allowing third parties to verify that the code running inside the TEE matches what was published.

This matters because federated learning has long faced a trust gap: while data stays local, users had no way to verify how server-side aggregation handled their gradients. Google's approach closes that gap by making the entire pipeline cryptographically attestable, turning privacy claims into checkable facts rather than promises.

The broader impact could be significant for privacy-sensitive AI training. If the pattern proves scalable, it may become a standard for on-device AI features that require personalization data, from keyboards to voice assistants. It also demonstrates how transparency logs and reproducible builds—tools more common in software supply-chain security—can be applied to ML privacy assurance.

This page provides an editorial summary based on publicly available information. It is not a republished article. Use the source link below for the original report.