Google Updates Private AI Compute Architecture with Secure, Server-Side Persistent Memory

Google Updates Private AI Compute Architecture with Secure, Server-Side Persistent Memory Google has announced an update to its Private AI Compute platform that adds persistent, server-side memory, enabling AI models to maintain cross-device context while keeping decryption keys strictly on user devices. The new persistent memory layer stores data in dedicated cloud storage encrypted with keys held exclusively on personal devices, preventing outside access including by Google. Data is processed in cloud-based, hardware-enforced secure enclaves that temporarily decrypt context in isolated memory, apply updates, and immediately re-encrypt it. This system addresses the limitations of previous stateless cloud enclaves, which completely wiped context after each completed task. Google is providing a tamper-proof public record of server software for device-side verification, along with results from an independent cybersecurity audit. Overcoming the Limitations of Stateless Cloud Compute While on-device processing has historically set the standard for privacy, frontier AI models demand more computational power than individual devices can offer. Previous implementations of Private AI Compute and similar industry solutions were strictly stateless, wiping all context immediately once a task ended. Simple workarounds, such as saving static lists of user facts and preferences, proved insufficient for rich, continuous assistance across different devices, prompting the development of secure, server-side context retention. Hardware Enclaves and Device-Derived Encryption The architecture operates by establishing an authenticated, end-to-end encrypted link between personal devices and an isolated cloud secure enclave whenever context is needed. Data in the persistent storage layer is shielded in per-user databases protected by device-derived encryption keys that never leave the user's hardware. The secure enclave briefly decrypts the necessary data inside protected memory to execute the request, records updated context, and promptly re-encrypts the information. Verification and Transparency Measures To enable verification, Google is publishing a tamper-proof public record of its server software, allowing client devices to confirm that cloud software is authentic and unmodified prior to transmitting personal data. The release is accompanied by an updated technical brief detailing security proofs and protocols, as well as audit findings from an independent cybersecurity firm.

Google推进私有AI计算架构：引入安全服务端持久化记忆 Google Private AI Compute团队公布了一项架构更新，计划在云端引入安全的持久化记忆层，在保持设备端隐私标准的同时，实现跨设备的长期AI上下文支持。 数据存放于云端专用加密存储中，但解密密钥仅保存在用户个人设备上，即使Google也无法访问。 利用硬件安全飞地在处理请求时临时解密并即时重新加密，突破了以往飞地计算任务结束即清空上下文的无状态限制。 提供防篡改的服务器软件公开记录，并公布了由网络安全公司执行的独立审计结果。 端侧密钥与云端飞地结合 该架构将持久记忆层打造成云端数字保险库。当AI模型需要上下文信息时，设备通过经过身份验证的端到端加密信道连接至云端硬件隔离的安全飞地。飞地仅在受保护的隔离内存中临时解密数据以处理请求并记录新上下文，处理完毕后立即重新加密。解密密钥完全由本地设备派生且仅保存在设备端，确保数据私密性达到如同未离开设备的水平。 打破无状态瓶颈与透明度机制 此前的云端私有计算解决方案多属于无状态架构，每次任务结束后均需销毁所有上下文，难以支撑连续且跨设备的个人助理需求。为了建立透明度与信任，Google发布了可供防篡改验证的服务器软件公开记录，使得设备在发送数据前可核验云端软件的真实性与完整性，同时公开了第三方网络安全公司的独立审计结果与技术细节。

September 23, 2026 Responsibility & Safety Google Private AI Compute Team A technical update on our Private AI Compute architecture, which will enable persistent, cross-device AI memory with on-device privacy standards. AI is becoming more capable and intuitive — remembering what matters, understanding the world around you, and acting at your direction. Privacy and trust are core to making that possible, ensuring your data stays private and protected as AI systems evolve to provide more continuous assistance across your devices. Today, we are sharing how we will bring private, server-side memory to our Private AI Compute platform. This breakthrough resolves a longstanding dilemma in modern AI: how to give an assistant long-term continuity across devices while upholding the strict privacy standards typically limited to on-device processing. Bringing on-device privacy to cloud-scale memory With this new technical capability, a new persistent memory layer will be able to function like a secure digital vault in the cloud. Under this model, the information needed to assist you is sealed within dedicated, encrypted storage, while the cryptographic keys required to unlock it are held exclusively on your personal devices — ensuring your data is inaccessible to anyone else, even Google. The diagram below shows how this update to Private AI Compute will work. When an AI model needs to access information to assist you, an authenticated, end-to-end encrypted channel connects your device to a protected, isolated environment in the cloud. That space, or “secure enclave,” temporarily decrypts your data in isolated memory to handle the request, saves any new context, and immediately encrypts it, keeping your information private as if it never left your device. By combining hardware-enforced secure enclaves, encrypted channels, and per-user databases shielded by device-derived encryption keys, this architecture ensures your data stays fully private and under your control. This evolution is necessary to meet the computing needs of the AI era. Local, on-device processing has historically been the gold standard for privacy — but frontier AI models often require far more computing power than any one device can provide. Bringing advanced AI to personal assistants means solving how to tap into the power of the cloud while ensuring personal data can remain as protected as if it never left your device. To that end, we previously introduced our Private AI Compute platform, allowing users to process complex tasks in hardware-isolated cloud enclaves. Until now, that technology — along with similar solutions across the industry — was strictly “stateless,” meaning it wiped all context the moment a task ended. Workarounds, like having AI save a list of personal facts and preferences, aren’t enough to support the rich, continuous experiences people expect from personal AI. Making that level of assistance possible means engineering a way for cloud-scale AI to securely retain context over time and across devices. Building trust, looking ahead Imagine pulling up assembly instructions on your laptop that you previously viewed through smart glasses, or resuming complex conversations between mobile and web. Private AI Compute is designed to make that kind of seamless assistance possible – keeping the pieces it needs to remember safely locked away. But the user’s trust in that system’s privacy is also important. Building that trust starts with transparency. That’s why, alongside our updated technical whitepaper, we’re publishing a tamper-proof public record of our server software. Devices running Private AI Compute will be able to verify that our software is authentic and unaltered before sending any personal data. In addition, we’re providing an update on our technical methods, including the results of an independent audit by a leading cybersecurity firm. By sharing these resources, we invite the broader privacy community to verify Private AI Compute’s protections. Adding private, persistent memory to Private AI Compute shows how deeply personal assistance can be private by design. We invite the community to review the updated Private AI Compute Technical Brief and our system architecture, security proofs, and verification protocols. Acknowledgements This research was co-developed by Google DeepMind, Platforms & Devices, Core and Cloud teams. We would also like to thank Four Flynn, Jay Yagnik, and David Kleidermacher for their executive sponsorship of this work.