On October 2, 2026, Google Research announced the next generation of its Federated Learning (FL) system: training models on data that stays with users, with privacy guarantees that outsiders can verify. According to the official research blog post, the new system relies on Trusted Execution Environments (TEEs), protected hardware enclaves on the server, and moves much of the computation from the device to the server.
This is already in production in one place. Google says Gboard, its keyboard app, has adopted the new system to train English and Japanese next-word prediction models, with stronger privacy guarantees and faster training than the previous FL stack.
What changes versus classic FL
In classic federated learning, devices compute local model updates and send only summaries. Google notes that its FL systems already power features such as next-word prediction and Smart Compose in Gboard, reply suggestions in Messages, and Smart Text Selection on Android. What remained hard was letting a third party verify that the server never logged or inspected the raw uploads.
In the new design, devices encrypt training examples and upload them with a pre-authorized access policy: the set of TEE computations allowed to process that data. Decryption keys live in a key-management system that itself runs inside a cluster of TEEs, and keys are released only to workloads that match the policy. At the end, operators mainly see anonymized model weights and metrics, not private training data.
Transparency that can be checked
Google frames the work around four principles: data minimization, anonymization, transparency and control, and verifiability and auditability. Access policies are published to a public transparency log (Rekor), so external auditors can track which server workloads devices may join. Google says the KMS and data-processing binaries can be reproducibly built from open-source code in the Confidential Federated Compute repository.
To keep some proprietary logic private while preserving auditability, the data-processing TEE can sideload serialized pieces at runtime, as long as privacy-relevant logic stays hardcoded in the Python program. Google also notes current-generation TEE limits, including side-channel risks.
Why it matters for Gboard
On the old stack, training depended on diurnal device availability, on-device compute, and competition among workloads for the same devices. Training a model could take one to two months. With the new system, uploads are collected first and training runs server-side with parallel workers, so the bottleneck shifts to TEE capacity.
Google also reports that the program can tune device-participation schedules inside the training loop, which can strengthen differential-privacy guarantees or reduce noise for the same accuracy target. For Gboard, that means next-word models with stronger privacy and, Google says, improved accuracy.
What comes next
Moving gradient computation to the server, Google writes, opens the door to training larger models with FL techniques, including future TEE-backed accelerators. The company says it is also experimenting with other workloads on the same infrastructure, such as synthetic data generation, and combining it with TEEs specialized for language-model inference.
Read this as a Google Research announcement about a system already used in part of production, not a claim that every Google product already runs this way. If you are following Google’s privacy and safety work, see also SynthID Bio and Gemini 4 Argon. More updates are in AI News.
Sources
- Google Research (Katharine Daly, Daniel Ramage), Toward provably private learning from federated data, October 2, 2026: research.google/blog/toward-provably-private-learning-from-federated-data/
