Google Research Moves Federated Learning Into TEEs: Gboard Now Trains With Externally Verifiable Differential Privacy

Google Research has announced a next-generation Federated Learning (FL) system built on Trusted Execution Environments (TEEs). The research team claims externally verifiable central differential privacy (DP) guarantees for FL for the first time.

What Problem Does TEE-Based Federated Learning Solve?

Google introduced Federated Learning FL in 2017. It powers next-word prediction and Smart Compose on Gboard, reply suggestions in Google Messages, and Smart Text Selection in Android.

Earlier systems had a trust gap. Devices uploaded data for immediate aggregation, but outsiders could not verify that data was never logged or inspected. Secure Aggregation added cryptographic protection. However, it was not compatible with state-of-the-art central DP algorithms like matrix factorization DP-FTRL. Google also had to be trusted to add DP noise correctly.

The new design moves client gradient computation to the server. It then makes that server logic attestable, so the operator no longer needs to be trusted.

How Does the System Work?

The system builds on Google’s earlier confidential federated analytics work. It coordinates 4 core components:

• Data upload: Devices encrypt training examples locally and pre-authorize an access policy. The policy lists which TEE computations may process the data. Policies must appear in a public transparency log.
• KMS and policy verification: A Key Management System, built from TEEs running the RAFT consensus protocol, releases keys only to workloads matching the policy.
• Workload execution: A root TEE runs a Python training loop and delegates subtasks to worker TEEs. Orchestration uses Federated Language, derived from TensorFlow Federated. Only DP model weights are released.
• Fault-tolerant recovery: Each round saves a KMS-encrypted recovery state for handling root or worker failures.

Why Is the Privacy Guarantee Verifiable?

Access policies are published to Rekor, Sigstore’s public transparency log. External auditors can track every server workload a device could feed. The KMS and data processing binaries are reproducibly buildable from open source code.

The policies directly describe the Python training program. To protect proprietary model architectures, TEEs support sideloading serialized logic at runtime. All privacy-relevant logic must stay hardcoded in the attested program. Workload operators see only metrics and DP model weights. Encrypted data can be decrypted only for a limited time after upload.

What Did Gboard Gain?

Gboard used the system to launch English and Japanese next-word prediction models with stronger privacy guarantees and improved accuracy. Two design choices drive this:

• First, all uploads are collected before server-side training runs. Diurnal swings in device availability no longer slow training. The program can compute an optimal participation schedule and tune DP parameters. Google’s privacy-utility curves come from training an English model for 5000 rounds with cohorts of 6500 devices on both systems.
• Second, the bottleneck moved to the server. Previous FL models took 1 to 2 months each to train. Training now parallelizes across machines, limited only by TEE resource availability. Google reports substantially faster compute times but does not publish a single speedup figure.

Interactive Explainer: Inside the TEE-Based FL Pipeline

(function(){
var R=document.getElementById(‘mtp-tfl’);
var C=[‘#4285F4′,’#EA4335′,’#34A853′,’#FBBC05′];
var S=[
{t:’Data upload’,d:’Each device encrypts its training examples locally before upload and pre-authorizes an access policy: the exact set of TEE computations allowed to touch that data. Devices require the policy to be published to a public transparency log first.’,n:[‘n1’],e:[‘e1’],k:[‘k1′]},
{t:’KMS and policy verification’,d:’A Key Management System built from TEEs running the RAFT consensus protocol hands decryption keys only to server-side TEE workloads whose attested code matches the access policy.’,n:[‘n2’],e:[‘e2’],k:[‘k2′]},
{t:’Workload execution’,d:’A root TEE runs a Python training loop and delegates parallel subtasks to worker TEEs, orchestrated with the open-source Federated Language. The loop periodically releases differentially private model weights to the analyst.’,n:[‘n3′,’n4’],e:[‘e3’],k:[‘k3′]},
{t:’Fault-tolerant recovery’,d:’At the end of each round the program saves a KMS-encrypted recovery state, so root or worker failures can be recovered without leaking extra privacy-sensitive information.’,n:[‘n3’],e:[‘e4’],k:[‘k4’]}
];
var cur=0,timer=null;
function q(s){return R.querySelectorAll(s)}
function show(i){
cur=i;var s=S[i],col=C[i];
q(‘.node’).forEach(function(n){n.classList.remove(‘act’);n.querySelector(‘rect’).style.stroke=”});
q(‘.path’).forEach(function(p){p.classList.remove(‘act’);p.style.stroke=”});
q(‘.pkt’).forEach(function(p){p.classList.remove(‘act’)});
s.n.forEach(function(id){var n=R.querySelector(‘#’+id);n.classList.add(‘act’);n.querySelector(‘rect’).style.stroke=col});
s.e.forEach(function(id){var p=R.querySelector(‘#’+id);p.classList.add(‘act’);p.style.stroke=col});
s.k.forEach(function(id){R.querySelector(‘#’+id).classList.add(‘act’)});
q(‘.sb’).forEach(function(b,j){b.classList.toggle(‘on’,j===i);if(j===i){b.style.setProperty(‘background’,col,’important’);b.style.setProperty(‘border-color’,col,’important’)}else{b.style.removeProperty(‘background’);b.style.removeProperty(‘border-color’)}});
var c=R.querySelector(‘#scard’);c.style.borderLeftColor=col;c.innerHTML=’‘+s.t+’‘+s.d;
}
q(‘.sb’).forEach(function(b){b.onclick=function(){stop();show(+b.dataset.s)}});
R.querySelector(‘#next’).onclick=function(){stop();show((cur+1)%4)};
function stop(){if(timer){clearInterval(timer);timer=null;R.querySelector(‘#play’).innerHTML=’▶ Auto-play’}}
R.querySelector(‘#play’).onclick=function(){if(timer){stop();return}this.innerHTML=’❚❚ Pause’;timer=setInterval(function(){show((cur+1)%4)},3500)};
show(0);

q(‘.tab’).forEach(function(t){t.onclick=function(){q(‘.tab’).forEach(function(x){x.classList.remove(‘on’)});q(‘.pane’).forEach(function(x){x.classList.remove(‘on’)});t.classList.add(‘on’);R.querySelector(‘#’+t.dataset.p).classList.add(‘on’);ping()}});

var V={
old:{rows:[[‘Server logic verifiable by devices or auditors?’,’No’,0],[‘Where client gradients are computed’,’On device’,1],[‘DP noise addition’,’Operator must be trusted’,0],[‘Training bottleneck’,’Device availability (1 to 2 months per model)’,0]],note:’Earlier systems uploaded data for immediate aggregation. Secure Aggregation added cryptographic protection but was not compatible with state-of-the-art central DP.’},
tee:{rows:[[‘Server logic verifiable by devices or auditors?’,’Yes, via Rekor log + reproducible builds’,1],[‘Where client gradients are computed’,’Server-side TEEs’,1],[‘What operators can see’,’Metrics and DP model weights only’,1],[‘Training bottleneck’,’TEE resource availability’,1]],note:’Encrypted uploads can only be decrypted inside TEEs running policy-listed Python programs, and only for a limited time after upload.’}
};
function view(m){
q(‘.sw button’).forEach(function(b){b.classList.toggle(‘on’,b.dataset.m===m)});
var g=R.querySelector(‘#vgrid’);g.innerHTML=”;
V[m].rows.forEach(function(r,i){var d=document.createElement(‘div’);d.className=’cell’;d.innerHTML=’

‘;g.appendChild(d);setTimeout(function(){d.classList.add(r[2]?’ok’:’no’)},120*i+60)});
R.querySelector(‘#vnote’).textContent=V[m].note;ping();
}
q(‘.sw button’).forEach(function(b){b.onclick=function(){view(b.dataset.m)}});
view(‘old’);

var w=’ok’;
q(‘.opt’).forEach(function(o){o.onclick=function(){q(‘.opt’).forEach(function(x){x.classList.remove(‘on’)});o.classList.add(‘on’);w=o.dataset.w;var L=R.querySelector(‘#lock’);L.className=’lock’;L.innerHTML=’🔒’;R.querySelector(‘#res’).textContent=’Waiting for a request. The KMS verifies the TEE’s remote attestation against the access policy.’}});
R.querySelector(‘#req’).onclick=function(){
var L=R.querySelector(‘#lock’),T=R.querySelector(‘#res’);
L.className=’lock spin’;L.innerHTML=”;T.textContent=’Verifying remote attestation against the published access policy…’;
setTimeout(function(){
if(w===’ok’){L.className=’lock ok’;L.innerHTML=’🔓’;T.innerHTML=’Key released. The attested code matches the policy, so this TEE may decrypt and train. Only DP weights leave it.’}
else{L.className=’lock no’;L.innerHTML=’🔒’;T.innerHTML=’Key denied. This binary is not in the access policy, so the uploaded data stays encrypted. Auditors watching Rekor would also see any new policy.’}
ping();
},1300);
};

function ping(){try{parent.postMessage({mtpTflHeight:R.offsetHeight+40},’*’)}catch(e){}}
window.addEventListener(‘load’,ping);window.addEventListener(‘resize’,ping);setTimeout(ping,300);
})();

How Does It Compare With Other FL Frameworks?

Sources: Google Research blog, Confidential Federated Compute repo, NVIDIA FLARE docs, FLARE attestation guide, Flower 1.8 release notes, pfl-research repo. Verified October 4, 2026.

Key Takeaways

• Google moved FL gradient computation from phones into attested server-side TEEs.
• Central DP guarantees are now externally verifiable via Rekor and reproducible builds.
• Gboard ships English and Japanese next-word models on the new system.
• Training once took 1 to 2 months per model; TEE capacity is now the limit.
• Core TEE binaries and Federated Language are open source under Apache 2.0.

Check out the Paper, Technical details and GitHub Repo. All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.

Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us

The post Google Research Moves Federated Learning Into TEEs: Gboard Now Trains With Externally Verifiable Differential Privacy appeared first on MarkTechPost.