Google Details Private AI Compute Memory With Device-Held Keys
Google details persistent Private AI Compute memory with device-held keys, secure cloud enclaves and verification for cross-device personal AI assistants.
Summary
On September 23, 2026, Google detailed persistent, server-side memory for Private AI Compute, designed to preserve AI context across devices with on-device privacy standards. Each user’s data will remain in dedicated encrypted storage, protected by device-derived keys held exclusively on personal devices and inaccessible to Google. An authenticated, end-to-end encrypted channel will connect a device to a hardware-enforced cloud enclave, which temporarily decrypts data in isolated memory, processes the request, saves new context and immediately reencrypts it.
Private AI Compute already runs complex tasks in isolated cloud hardware, but its stateless design erases context after each task. Persistent memory addresses that limit because frontier models require more computing power than one device can provide, while saved lists of facts and preferences cannot support continuous assistance. Google’s examples include opening laptop instructions previously viewed through smart glasses and resuming conversations between mobile and web.
Devices will verify that server software is authentic and unaltered through a tamper-proof public record before transmitting personal data. Google is also publishing an updated whitepaper, technical brief, system architecture, security proofs and verification protocols, including an independent audit by an unnamed leading cybersecurity firm. Google DeepMind, Platforms and Devices, Core and Cloud co-developed the research, with executive sponsorship from Four Flynn, Jay Yagnik and David Kleidermacher. Google disclosed no rollout date or supported products.
Positives
- Device-derived encryption keys remain exclusively on personal devices, making stored AI context inaccessible even to Google.
- Hardware-enforced cloud enclaves temporarily decrypt data only in isolated memory before immediately reencrypting it.
- Persistent per-user databases will preserve context across devices instead of erasing it after every task.
- A tamper-proof public record will let devices verify server software before transmitting personal data.
- Published security proofs, verification protocols and independent audit results invite external scrutiny of Private AI Compute.
Risks & concerns
- Secure enclaves must temporarily decrypt personal data in isolated cloud memory to process requests and update context.
- Google disclosed no rollout date or supported products for persistent Private AI Compute memory.
- The independent cybersecurity firm conducting the audit was not identified.
- Frontier AI models require cloud computing because their processing demands exceed what one device can provide.
- Existing Private AI Compute sessions remain stateless, wiping context when each task ends.