Toward provably private learning from federated data

* Katharine Daly and Daniel Ramage announced a new Federated Learning system on October 2, 2026.
* The system provides externally verifiable privacy guarantees by shifting computation to the server for improved training speed, accuracy, and device coverage.
* FL systems development is guided by four privacy principles: data minimization, data anonymization, transparency and control, and verifiability and auditability.
* Previous methods included matrix factorization DP-FTRL and distributed differential privacy coupled with Secure Aggregation for anonymization guarantees.
* The new system leverages Trusted Execution Environments (TEEs) to provide fully verifiable and auditable data anonymization guarantees.
* Only metrics and differentially private model weights are visible to workload operators.
* Encrypted training data is decrypted and processed only within TEEs according to access policies for a limited time after upload.
* Device participation knowledge regarding server workloads is published to Rekor, a public transparency log.
* KMS and data processing binaries are reproducible from open source code in the Confidential Federated Compute Github repository.
* Gboard has adopted this TEE-based system for English and Japanese next word prediction models.

The progression from aggregation-focused privacy methods like Secure Aggregation to a TEE-based system represents a fundamental shift in the locus of trust. The core implication is moving the burden of ensuring data integrity and privacy assurance away from trusting the central server operator toward verifiable, hardware-enforced execution environments. This moves the focus from post-hoc statistical guarantees (like DP noise addition) to provable execution control over the training logic itself.
The structure involving externally observable access policies published to Rekor creates a mechanism for external auditability, challenging the traditional monolithic trust placed in the server operator. The ability to sideload proprietary logic into TEEs while maintaining verifiability introduces a complex layer concerning the security boundaries of the TEEs themselves—specifically regarding side-channel observations and ensuring that the TEE environment truly isolates arbitrary Python workloads from potential malicious server inspection.
The performance gains, achieved by shifting computation and parallelization to the server, align with the architectural goal of enabling larger model training through FL. The narrative implies that true privacy assurance in distributed learning requires not just cryptographic protection during transit or aggregation, but verifiable control over the entire processing lifecycle, suggesting a pattern where functional security features (TEEs) are integrated to enforce desired systemic properties (verifiability). Future scrutiny must focus on whether the claims of verifiable guarantees hold against sophisticated side-channel attacks when dynamic, proprietary code is executing within these secure enclaves. What methods exist to rigorously prove that runtime behavioral analysis cannot leak information about the private model weights or the proprietary preprocessing logic that is executed inside the TEEs?