Google Moves Gboard Word Prediction Training to Servers, With Outside Checks on Privacy

On October 2, Google unveiled a new training system whose privacy safeguards can be verified by outside parties. The approach moves training computations that phones used to handle into a protected enclave on Google’s servers. Google says it has applied the system to Gboard’s English and Japanese next-word prediction models, and that training is now faster and accuracy has improved.

Training moved to servers: how is the data protected?

Data uploaded from devices is processed only inside a walled-off protected area on the server. Google calls this space a trusted execution environment (TEE). Training data sent by a device arrives encrypted and is decrypted for use only inside this space, where a pre-specified program runs. The window for processing is also capped at a fixed period after upload. According to Google, the only outputs visible to whoever operates the job are metrics and values learned in training that have been processed so that individual information is not exposed.

The training in question here is the practice of jointly training a model using data spread across many devices, commonly known as federated learning. Google introduced the method in 2017 and has since used it for Gboard’s next-word prediction and writing assistance, as well as reply suggestions in Google Messages. The new system is designed to keep data use under control while relying less on the computing power of individual devices.

There are also mechanisms that let outsiders look in. The rules for any job that can access the data are recorded in a public log. Participating devices can see which server-side jobs are allowed to access the data they uploaded. External auditors can trace those jobs through a public log called “Rekor.” Google says the executables used for cryptographic key management and data processing can be rebuilt from publicly available source code and verified.

What did you have to take on trust before?

Under the previous system, Google says there was no way for outsiders to confirm that servers were not logging or inspecting the data. There was likewise no choice but to trust that the server operator had properly carried out the step of mixing in random values so that an individual’s information does not surface in the training results. The new system writes the training program directly into publicly disclosed access rules, making privacy-related processing steps checkable from the outside.

Image: research.google

That said, the verification comes with conditions. Google explains that the security level of the protected area is bound by the limits of current-generation hardware. Some information, such as model architectures that are not publicly disclosed, can be loaded separately at runtime. In exchange, all privacy-related processing must be fixed inside the program being verified. Google says it expects research into defending against attacks that infer information from indirect signals leaking during execution, along with future hardware improvements, to deliver stronger protection.

What changes for Gboard users

Google points to two changes on the user side: better accuracy in English and Japanese next-word prediction, and stronger privacy protection. On the development side, the time required for training has been cut. According to Google, training a single model previously could take one to two months. The new approach first gathers data uploaded from devices, then splits the computation across multiple servers. That reduces constraints tied to device availability and device performance.

Image: research.google

Google says lightening the computational load on devices also opens the door to training larger models. What to watch next is how far protection technologies that compensate for today’s hardware limits, and the scope of verification, can be extended. Over the long term, Google expects the work to move toward fully proving the correctness of privacy algorithms and even the implementations of system components. The core of this announcement is that, in improving an everyday typing feature, Google has also pulled the way its servers handle data into the scope of verification.