Google Research announces TEE-based federated learning system with externally verifiable privacy, already deployed in Gboard

Google Research published a whitepaper and blog post describing a new federated learning system that runs inside Trusted Execution Environments (TEEs, hardware-isolated server enclaves). Devices upload encrypted training data. Access policies are logged publicly in Rekor, and a TEE-based key service releases decryption keys only to workloads that match the published policy. Training then runs server-side inside TEEs, and only metrics and differentially private model weights come out. The key management and data processing binaries can be reproducibly built from the open-source Confidential Federated Compute repository. Google says Gboard already uses it for English and Japanese next-word prediction, with better privacy, accuracy and compute speed than the old system, but the article gives no figures for those gains.

The real change is in who has to be trusted. Outsiders can now check, in principle, which code touches user data and under what policy, instead of taking Google's word for it. That is useful to regulators, auditors and other platforms weighing similar designs, and it is a production deployment rather than a lab demo. The impact is narrow for now: one product, two languages, and the system is Google-run, so most developers and enterprises cannot use it directly. The speed and accuracy benefits, including relief from the 1-2 month training cycles, are unquantified, so the practical gain is unproven.

"Provably private" is overstated, because the guarantees rest on the security of current TEE hardware and on the correctness of the published policies, and TEEs have a history of side-channel and attestation weaknesses. "Substantially faster" and "improved accuracy" come with no numbers, and the design builds on Google's earlier confidential federated analytics work, so it is an evolution rather than a clean break.

1. 01Independent audits or reproducible-build verifications of the Confidential Federated Compute repository and Rekor policy entries by third parties, within the next 6 to 12 months.
2. 02Published benchmarks for Gboard: training time per model, accuracy against the old federated system, and device coverage, plus any extension beyond English and Japanese or beyond Gboard.
3. 03Security research on the TEE hardware and attestation chain it depends on, and whether regulators or other vendors (Apple, Meta, Microsoft) cite or adopt this verifiable-policy approach.