The Pulse
Google Moves Gboard Training Into Verifiable Server-Side Enclaves
Google has deployed a trusted-execution-environment system to train English and Japanese Gboard prediction models. The company says the system makes its privacy protections externally auditable while cutting one model’s training time from t
AI.info Team · Written with AI ·
A Gboard language model that previously took about two months to train finished in three weeks under Google’s new federated-learning system. In a live test, the company also says its best-performing version used a privacy budget three times smaller than the production model while maintaining neutral results on key typing measures.
Google announced the system on October 2, 2026, and says it is already training English and Japanese next-word prediction models for Gboard. The design shifts much of the work from users’ phones to protected server hardware, where outside auditors can inspect the code and policies governing access to uploaded data.
“Gboard has deployed this TEE-based FL system to launch English and Japanese next word prediction models with stronger privacy guarantees and improved accuracy.”
Katharine Daly, software engineer, and Daniel Ramage, research director, Google Research
Gboard’s training time drops to three weeks
The results paper reports a live A/B test on Gboard’s English typing decoder, which supports autocorrection, word completion and next-word prediction. Each test arm included 3.5 million devices. The strongest-performing arm using the new system had a zCDP privacy budget of 0.215, compared with 0.641 for the production model after adjusting for the same differential-privacy method.
A smaller privacy budget means a stronger differential-privacy guarantee. Google reports that the new model kept key usability measures—typing speed and how often people changed suggested words—at parity with the existing model. Training took three weeks rather than two months.
Encrypted uploads move training into server enclaves
The change alters what devices send. In the earlier system, phones calculated model gradients and uploaded them for aggregation; the new design has devices encrypt training examples and upload them for later use in server-side training. Google says the system operator cannot access the raw data, which can be decrypted only inside authorized Trusted Execution Environments, or TEEs.
Before uploading, devices authorize an access policy that specifies which server-side workloads can process their data. A cluster of TEE-based key-management services releases decryption keys only to workloads matching that policy. A root TEE runs the training program and can distribute tasks to worker TEEs; operators see only metrics and differentially private model weights.
Rekor logs let auditors check the permitted code
Google publishes access policies to Rekor, a public transparency log, so external auditors can inspect the workloads that may process uploaded data. The company says the key-management and data-processing binaries can be reproducibly built from source code in its open-source Confidential Federated Compute repository. The system also uses encrypted recovery state between training rounds to resume work after failures.
Collecting uploads before training lets Google choose device participation schedules after the data arrives, rather than relying on when phones happen to be available. The research paper says that flexibility improves the privacy-utility tradeoff. Its experiment compares the new and earlier systems over 5,000 training rounds with cohorts of 6,500 devices.
Google’s privacy claim still depends on TEE security
The approach gives auditors a way to check which code is allowed to run, but it does not eliminate trust in hardware. Google’s announcement acknowledges limitations in current-generation TEEs, including possible side-channel observations. The paper says the system has so far trained models with up to 10 million parameters and identifies GPU support for worker TEEs as a need for scaling to larger models.
Google describes the system as progress toward rigorous proof that server-side processing preserves privacy, not as a complete proof of every software component’s correctness. The company says it expects future TEE hardware and further work on side channels to strengthen protections; full correctness proofs for the differential-privacy software remain a future goal.