Security1 publisher2 min readPublished
Google plans to store Private AI Compute context in per-user databases keyed to the user's device
Private AI Compute has erased all context at the end of each task. Google plans to keep per-user context in encrypted cloud storage instead, with the decryption keys held only on the user's own devices.
The Watch · Security desk
What happened
- Google plans to add server-side memory to Private AI Compute, its hardware-isolated cloud platform for running Gemini models on sensitive data, so an assistant can keep context across sessions and devices.
- Until now the platform has been stateless, erasing all context when a task ends.
- Context will sit in dedicated encrypted storage, and Google says the cryptographic keys that unlock it will be held exclusively on users' devices, leaving the data inaccessible to anyone else including Google.
- When a model needs the data, an authenticated end-to-end encrypted channel links the device to a cloud enclave that decrypts in isolated memory, processes the request, saves new context and encrypts it again.
- Google has published an updated technical brief, a tamper-proof public record of its server software and independent audit results, and devices will be able to verify the software is authentic before sending data.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The payoff for beating the enclave grows from one task's context to whatever the assistant has accumulated, and an attacker who fails today has a target still sitting there tomorrow.
- constraint If the keys genuinely never leave the handset, that one design choice leaves Google with no plaintext to produce under legal process and no way to restore a user's memory after a lost device.
- decision Google has asked the privacy community to attack the architecture, protections, security proofs and verification protocols, so researchers choose now whether to review a design or wait for a deployment to test.
Google's stated reason for adding persistence is that the alternative does not work: keeping lists of personal facts and preferences does not give an assistant the context continuous assistance requires [6]. "With this new technical capability, a new persistent memory layer will be able to function like a secure digital vault in the cloud," the Google Private AI Compute team said [4].
The strongest sentence in the material is a guarantee about architecture. Google wrote that "By combining hardware-enforced secure enclaves, encrypted channels, and per-user databases shielded by device-derived encryption keys, this architecture ensures your data stays fully private and under your control" [9]. That guarantee rests on the keys being device-derived, so anyone who wants plaintext needs a user's device or its key material [16].
Google presents the cross-device scenarios as illustrations. It describes pulling up assembly instructions on a laptop after viewing them through smart glasses, and resuming conversations between mobile and web, as examples of the architecture's potential and not as current product features [8]. Help Net Security's report, published on 24 September, is silent on three points: when this ships, who the independent auditor is, and what happens to stored context when a user loses the device [13][14].
Defenders will have to reclassify the platform. Private AI Compute has been a processor of data passing through an enclave; per-user databases holding session history make it a repository of user data in Google's cloud, with the keys to it on handsets [1][5][15]. Malware on a phone that already holds those keys does not need to beat the enclave at all [16]. The store belongs on the data-flow inventory even though the design says Google cannot read it.
What to watch
- Whether Google names the independent auditor and publishes the audit in full rather than summarised results.
- Published retention and deletion behaviour for the per-user databases, including recovery after device loss.
- Whether the smart-glasses-to-laptop and mobile-to-web continuity examples turn up as shipping features on a named surface.