我们推出了一套隐私分析解决方案，该方案利用一种新型密码学协议实现安全聚合，并结合可信执行环境（TEE）的透明性，从而提供业界领先的隐私与安全保障。
快速链接
密码学聚合论文
-
- 复制链接 ×
通过在本地处理数据，设备端AI能够在保护用户隐私的同时，提供更强的防护和及时的警报。例如，安卓系统使用名为 SafetyCore 的机制，提供保护隐私的设备端功能和通用基础设施，以保护用户免受不良内容侵害。在开发设备端技术时，团队需要了解其系统在数百万台独立智能手机上的运行效果，这些手机各自拥有独特的数据分布、不同的硬件限制以及不同的用户行为。为了在仅揭示整体趋势而不泄露个体用户数据的情况下实现这一目标，团队可以将密码学安全聚合作为关键构建模块。与所有密码学协议一样，安全聚合利用先进的数学工具来提供其安全保障。
今天，我们在隐私分析服务中为高效的密码学聚合设定了更高的标准。我们遵循零信任原则，旨在减少对任何单一实体的信任需求。我们通过一种结合了密码学与硬件保护机制的新型安全设计来实现这一点。我们的解决方案利用了一种新的密码学聚合方法，该方法可证明地保证谷歌只能获取关于人群的匿名化、聚合后的洞察信息。此外，我们还使用可信执行环境（TEE）来提供严格的证明与透明性层。
挑战
当模型在设备端本地部署时，仅仅知道模型“正在运行”并不足以理解其行为、有效性或故障模式。这限制了回答以下关键问题的能力：
模型是否发生漂移？（例如，翻译模型是否难以处理特定地区新出现的俚语？）
是否存在隐藏的偏差？（例如，图像分类器在特定地理区域常见的特定光照条件下是否准确度较低？）
真实世界的错误率是多少？（例如，一条“智能回复”建议虽然技术上正确，但社交上不合时宜，是否因此被用户忽略？）
这正是隐私分析成为关键桥梁之处——它能在绝不泄露任何个人用户内容的前提下，提供关于用户群体的匿名化、聚合性洞察。
Google 团队使用联邦分析来获取此类聚合性、保护隐私的洞察，其应用涵盖 Pixel Recorder、Gboard 等产品。联邦分析需要一条隐私聚合路径，在该路径中，来自各个设备的数据在汇总之前都受到保护。目前，有两种范式用于在此场景下保护用户数据：基于硬件的隔离（TEE）和密码学协议。
两种保护方案的故事
硬件方案的核心是 TEE，例如 Intel TDX、AMD SEV-SNP 等。其核心理念是创建一个“安全飞地”——本质上是一块与设备其余部分隔离的受保护处理器和内存区域。在此飞地内，数据可以以明文形式解密和处理，即使操作系统被攻破或存在恶意虚拟机监视器，也能得到保护。
通过一个名为“证明”的过程，TEE 可以计算出飞地内运行的确切固件和软件状态的、基于硬件的加密“指纹”。对于用户或审计方而言，证明提供了一种可验证的保证，确保数据正由他们期望的、特定的、防篡改的程序处理，而非某个旨在泄露信息的修改版本。Google 已在 Pixel Recorder 应用中部署了基于 TEE 的差分隐私聚合技术，用于计算 AI 系统的洞察。
然而，TEE 隔离机制正在不断演进。研究人员经常发现侧信道漏洞，攻击者可利用这些漏洞来破坏 TEE 的保证，或应用层级的特定保证 [SNPeek, TDXray]。虽然业界正致力于强化现有解决方案以抵御已知的侧信道攻击，但预计仍会发现新的侧信道漏洞。因此，在理想系统中，数据应受到多层安全机制的保护，这样即使 TEE 的安全模型失效，数据也不会被泄露。
另一方面，密码学协议依赖于数学技术，这些技术具有可证明的保证：单个数据无法被重建，唯一可见的只有聚合后的匿名化输出。谷歌已大规模部署了两代安全聚合协议（详见最初的博文及后续文章）。然而，其广泛应用受到复杂性的限制，因为该协议要求用户设备在多轮交互中长时间保持在线状态。
加密与隔离的结合
我们的新方案引入了一种创新的密码学协议，允许用户设备通过单次一次性消息安全地提交信息，从而克服了传统交互式方案的障碍。通过实现单次消息提交，我们消除了设备需要与服务器进行多轮交互并保持在线状态的需求。
集成到谷歌的机密联合分析系统中，我们将这种更高效率的协议与在可信执行环境（TEE）内的执行相结合，构建起多层防御架构。借助这一方案，机密性不再完全依赖于硬件保护。密码学层确保单个原始数据在任何服务器内存中都不会被暴露或重建——即使在受硬件保护的边界内也是如此。唯一在设备外处理未加密数据的时刻是在最终阶段，此时数据已经过聚合和匿名化处理。此外，我们的方案利用TEE的远程证明机制，向所有参与者提供高保证、可验证的证据，证明安全聚合协议正按预期方式执行，即通过编译并正确运行公开可用的代码。
具备单次执行效率的密码学引擎
其核心在于，我们的密码学方案由一种创新的基于格（lattice）的协议驱动，该协议允许客户端以这样一种方式加密其数据：生成的密文可以在聚合底层消息的同时，也对加密密钥进行聚合。现在，要使服务器能够获取聚合值，唯一需要的是一个只能解密聚合值的解密密钥。为协助完成此任务，我们在客户端之间组建小型委员会，这些委员会持有一些“提示”，用于帮助解锁经过额外差分隐私噪声掩码处理的聚合值。客户端根据其可用性，不频繁地参与委员会工作，并促成这样一个特性：任何解密密钥都由多个参与方共同持有，每一方都保护着加密数据的机密性。
密码学协议的单次执行架构。
SafetyCore 的隐私分析功能
Android System SafetyCore 是 Google 为 Android 9 及以上设备提供的系统服务，能在保护隐私的前提下，为 Android 安全功能提供设备端支持。在设备端安全领域，像 SafetyCore 这样的工具发挥着关键作用。然而，为了让这些工具不断进化，开发者需要了解其在实际环境中的表现——具体来说，就是哪些威胁已被捕获，以及哪些方面还有机会进一步提升检测能力，而这一切都不能以牺牲用户隐私为代价。
为了弥合这一差距，我们与 Android SafetyCore 团队合作，利用我们最先进的隐私分析解决方案，在提升分类器准确性的同时，保护用户隐私。
在此过程中，依赖基于聚合的、保护隐私的匿名化洞察至关重要；它使工程师能够衡量安全模型在全球多样化设备群中的“真阳性”率，而无需查看触发本地警报的私密、敏感内容。通过观察这些宏观趋势，开发者可以优化模型阈值并部署更新，从而更好地保护用户，确保安全系统在应对新出现的威胁时依然有效，同时将原始数据严格隔离在设备本地。Android SafetyCore 将利用我们的零信任隐私分析技术，评估能够反映其工具有效性的元数据，同时恪守用户内容仅保留在设备上的隐私承诺。我们很高兴能推出一项技术，助力 Android 在保护用户隐私的同时，实现其更广泛的用户安全保护使命。
结论
用于安全计算的密码学技术，能够带来植根于数学证明的强安全性保障。我们展示了如何设计出适用于大规模分布式系统部署的安全聚合协议。由此产生的解决方案与现有安全机制相结合，提升了隐私分析的安全门槛。展望未来，我们正在探索如何扩展该模型所支持的计算类型。
致谢
本篇博文的内容反映了众多人士的贡献，包括 Bruno Alves、Carlos Balduz、Nacho Ballester Tester、James Bell-Clark、Oleg Chernyakhovskiy、Stanislav Chiknavaryan、Jim Choncholas、Stefan Dierauf、Emily Glanz、Shruthi Gorantala、Mira Holford、Mihaela Ion、Artem Lagzdin、Jean-Christophe Lilot、Peter Kairouz、Jonathan Katz、Baiyu Li、Ben Kreuter、Brett McLarnon、Mekhola Mukherjee、Amanda Nascimento、Timon Van Overveldt、Javed Ramjohn、Phillipp Schoppmann、Karn Seth、Debora Silva、Rakshita Tandon 以及 Pierre Tholoniat。我们要感谢 Elie Bursztein、Bryant Gipson、Marco Gruteser、Alex Freire、Xavier Llorà、Dan Ramage、David Sehr 和 Amanda Walker 的领导，并感谢 Corinna Cortes、Brian Roddy、Pankaj Rohatgi 和 Eduardo Tejada 的持续支持。
- 标签：
- 安全、隐私与滥用防护
快速链接
密码学聚合论文
-
- 复制链接 ×
其他相关文章
- 2026年6月10日 审计机器遗忘的新框架 * 算法与理论 · * 负责任的人工智能 · * 安全、隐私与滥用防护
- 2026年3月31日 通过负责任地披露量子漏洞来保护加密货币 * 算法与理论 · * 量子 · * 安全、隐私与滥用防护
- 2025年12月10日 用于洞察AI聊天机器人使用的差分隐私框架 * 生成式人工智能 · * 负责任的人工智能 · * 安全、隐私与滥用防护
We introduce a private analytics solution which leverages a new cryptographic protocol for secure aggregation combined with the transparency properties of TEEs to achieve state-of-the-art privacy and security guarantees.
Quick links
-
- Copy link ×
By processing data locally, on-device AI can provide enhanced protection and timely alerts while keeping user information private. For example, Android uses a system called SafetyCore to provide privacy-preserving on-device features and common infrastructure to protect users from unwanted content. When developing on-device technologies, teams need to understand how well their systems work across millions of individual smartphones, each with unique data distributions, varying hardware constraints, and different user behaviors. To achieve this in a way that reveals only collective trends without revealing individual user data, teams can leverage cryptographic secure aggregation as a key building block. Like all cryptographic protocols, secure aggregation uses advanced mathematical tools to provide its security assurance.
Today, we set a higher bar for efficient cryptographic aggregation in a private analytics service. We follow a zero-trust principle, which aims to reduce trust necessary in any single entity. We achieve this through a new security design that combines cryptographic and hardware protection mechanisms. Our solution leverages a new cryptographic aggregation method that provably guarantees only anonymized, aggregated insights about a population can be obtained by Google. Additionally, trusted execution environments (TEEs) are used to provide a strict layer of attestation and transparency.
The challenge
When models are deployed locally on-device, simply knowing that a model is 'running' isn't enough to understand its behavior, effectiveness, or failure modes. This limits the ability to answer critical questions like:
Is the model drifting? (e.g., Does a translation model struggle with new slang emerging in a specific region?)
Are there hidden biases? (e.g., Is an image classifier less accurate under specific lighting conditions common in certain geographic areas?)
What is the real-world error rate? (e.g., Is a "Smart Reply" feature being ignored because its suggestions are technically correct but socially awkward?)
This is where private analytics becomes the essential bridge, enabling anonymized, aggregated insights about a population without ever revealing individual user content.
Google teams use federated analytics for this kind of aggregated, private insight, with applications in Pixel Recorder, Gboard, and more. Federated analytics requires a private aggregation route, where the data from individual devices is protected until combined into a sum. Two paradigms have emerged to protect user data in this setting: hardware-based isolation (TEEs) and cryptographic protocols.
A tale of two protections
The hardware approach centers on TEEs, such as Intel TDX, AMD SEV-SNP and others. The core idea is to create a "secure enclave" — essentially a protected slice of the processor and memory that is isolated from the rest of the device. Inside this enclave, data can be decrypted and processed in plaintext, shielded even from a compromised operating system or a malicious hypervisor.
Through a process called attestation, TEEs can compute a hardware-backed cryptographic "fingerprint" of the exact firmware and software state running inside the enclave. For a user or an auditor, attestation offers a verifiable guarantee that the data is being handled by the specific, tamper-proof program they expect, rather than a modified version designed to leak information. Google has deployed TEE-backed differentially private aggregation for computing insights into AI systems in the Pixel Recorder app.
However, TEE isolation mechanisms are constantly evolving. Researchers regularly discover side-channel vulnerabilities that can be leveraged by an attacker to either invalidate TEE guarantees, or application-level specific guarantees [SNPeek, TDXray]. While the community is working towards hardening existing solutions against known side-channel attacks, new side-channel vulnerabilities are expected to be discovered. Therefore, in an ideal system, data would be protected by multiple layers of security so that even if a TEE’s security model fails, the data is not compromised.
On the other hand, cryptographic protocols rely on mathematical techniques which come with provable guarantees that individual data cannot be reconstructed and the only value that becomes visible is the aggregated, anonymized output. Google has deployed two generations of secure aggregation protocols at scale (detailed in the initial blogpost and follow-up). However, its widespread use has been limited by the complexity in its requirement that user devices remain online in multiround protocols over extended periods of time.
Encryption meets isolation
Our new solution introduces a novel cryptographic protocol that allows user devices to securely submit their information in a single, one-shot message, overcoming the barriers of traditional interactive schemes. By enabling a single-message submission, we eliminate the need for devices to remain online for multiple rounds of interaction with a server.
Integrated into Google’s confidential federated analytics system, we combine this higher-efficiency protocol with execution within a TEE to create a multi-layered defense architecture. With this solution, confidentiality no longer relies entirely on hardware protection. The cryptographic layer ensures that individual raw data is never exposed or reconstructed in any server memory — not even within the hardware-protected perimeters. The only time unencrypted data is ever processed off-device is at the final stage, when the data has already been aggregated and anonymized. Furthermore, our solution leverages TEE attestation mechanisms to provide high-assurance, verifiable proof to all participants that the secure aggregation protocol is being executed exactly as intended, i.e., by compiling and running correctly publicly available code.
The cryptographic engine with one-shot efficiency
At its heart, our cryptographic solution is powered by an innovative lattice-based protocol that allows clients to encrypt their data in a way that the resulting ciphertexts can be aggregated while aggregating the underlying messages as well as encryption keys. Now the only thing needed to enable the server to obtain the aggregated values is a decryption key that can only decrypt the aggregated value. To aid with this task we form small committees among the clients that hold hints which help unlock the aggregated value masked with additional differential privacy noise. Clients serve on committees infrequently according to their availability and facilitate the property that any decryption key is shared over a number of parties each one of which protects the confidentiality of the encrypted data.
Cryptographic protocol one-shot architecture.
Private analytics for SafetyCore
Android System SafetyCore is a Google system service for Android 9+ devices that provides privacy-preserving on-device support for Android safety features. In the realm of on-device safety, tools like SafetyCore play a critical role. However, for these tools to evolve, developers need to understand their real-world performance — specifically, which threats are being caught and where there are opportunities to further refine detection capabilities, all without ever compromising user privacy.
To bridge this gap, in partnership with the Android SafetyCore team, we’re using our state-of-the-art private analytics solution to improve the accuracy of classifiers and at the same time preserve privacy.
Relying on aggregate privacy-preserving, anonymized insights is essential here; it allows engineers to measure the "true positive" rate of safety models across a diverse global fleet without ever seeing the private, sensitive content that triggered a local alert. By observing these high-level trends, developers can refine model thresholds and deploy updates that better protect the user, ensuring the safety system remains effective against emerging threats while keeping the raw data private and strictly isolated on the device. Android SafetyCore will leverage our zero-trust private analytics to evaluate metadata indicative of the effectiveness of its tools while respecting its privacy commitment that user content stays only on device. We are excited to introduce a technology that aids Android’s broader mission to protect user safety while preserving their privacy.
Conclusion
Cryptographic techniques for secure computation bring strong security guarantees anchored in mathematical proofs. We showed how to design secure aggregation protocols in ways compatible with deployment in large-scale distributed systems. The resulting solution integrated with existing security mechanisms raises the security bar for private analytics. Going forward we are exploring opportunities to expand the set of computations supported in this model.
Acknowledgements
The contents of this blogpost reflect the contributions of many people, including Bruno Alves, Carlos Balduz, Nacho Ballester Tester, James Bell-Clark, Oleg Chernyakhovskiy, Stanislav Chiknavaryan, Jim Choncholas, Stefan Dierauf, Emily Glanz, Shruthi Gorantala, Mira Holford, Mihaela Ion, Artem Lagzdin, Jean-Christophe Lilot, Peter Kairouz, Jonathan Katz, Baiyu Li, Ben Kreuter, Brett McLarnon, Mekhola Mukherjee, Amanda Nascimento, Timon Van Overveldt, Javed Ramjohn, Phillipp Schoppmann, Karn Seth, Debora Silva, Rakshita Tandon, and Pierre Tholoniat. We would like to thank Elie Bursztein, Bryant Gipson, Marco Gruteser, Alex Freire, Xavier Llorà, Dan Ramage, David Sehr, and Amanda Walker for their leadership and Corinna Cortes, Brian Roddy, Pankaj Rohatgi, and Eduardo Tejada for their continued support.
Quick links
-
- Copy link ×
Other posts of interest
June 10, 2026 New framework for auditing machine unlearning * Algorithms & Theory · * Responsible AI · * Security, Privacy and Abuse Prevention
March 31, 2026 Safeguarding cryptocurrency by disclosing quantum vulnerabilities responsibly * Algorithms & Theory · * Quantum · * Security, Privacy and Abuse Prevention
December 10, 2025 A differentially private framework for gaining insights into AI chatbot use * Generative AI · * Responsible AI · * Security, Privacy and Abuse Prevention