Google proposes cloud memory that even Google says it cannot read

Google DeepMind described a new design on September 23 for AI assistants to remember information across devices without giving the cloud provider ordinary access to that memory. The proposal combines encrypted server storage, keys held on users' devices and isolated computing environments, but Google has not announced a broad consumer rollout for the feature.

The problem with a forgetful private cloud

Private AI Compute already aims to run demanding models in protected cloud hardware. Until now, Google says the system has been stateless: context is wiped when a task ends. That can protect data but also makes continuity difficult. An assistant that helps on a phone, laptop and pair of glasses needs some way to remember what happened in the previous conversation.

The alternative of storing a short list of preferences is less capable than retaining richer context. Yet sending a lifetime of personal details to ordinary server memory would create an obvious privacy problem. Google's answer is a persistent, per-user memory database whose data remains encrypted at rest, with the keys needed to open it derived from and held by the person's devices.

When an authorized request arrives, the device connects through an encrypted channel to a secure enclave. The enclave temporarily decrypts the relevant information in isolated memory, processes the request and re-encrypts any updated context. Google says this arrangement is designed so neither other users nor Google's normal server operators can inspect the stored content.

A technical promise that needs checking

The architecture depends on more than encryption. The device must know that it is sending data to authentic software running inside the expected protected environment. Google says it is publishing a tamper-resistant record of server software to support that verification and has updated a technical brief and audit material.

Those are important parts of a security argument, but the announcement itself is not evidence that every implementation detail has been independently reproduced or tested at consumer scale. Secure enclaves can narrow who can access information, but software flaws, key handling and device compromise remain meaningful threats in any such system.

The privacy claim also should be read precisely. Google describes data being briefly decrypted inside an isolated server environment to answer a request. That is different from saying information never leaves a device or is never decrypted anywhere. The distinction matters when people decide what an assistant should remember.

Continuity with a cost

Google imagines a user viewing assembly instructions through smart glasses and later continuing the task on a laptop. Persistent memory could make that handoff smooth, especially when a frontier model is too large to run locally. The same persistence could make an assistant more sensitive to mistakes in what it stores or infers about a person.

The engineering update does not specify a launch date, which products will receive this memory, or exactly how users will inspect and delete its contents. Those controls will shape the practical privacy value as much as the cryptography. The next evidence to watch is a product implementation with verifiable software, clear controls and an audit that tests the actual deployed system.