DeepMind gives Private AI Compute persistent memory

Google DeepMind has published the architecture behind a persistent memory layer for Private AI Compute, the system it uses to run demanding model work in hardware-isolated cloud environments rather than on a phone or laptop. The company says the change is what allows an assistant to carry context between devices without abandoning the privacy standards it has traditionally promised for on-device processing.

A secure vault rather than a longer conversation log

Under the design DeepMind describes, the material an assistant needs to remember is sealed inside dedicated, encrypted storage, and the cryptographic keys that unlock it are held exclusively by the user’s own device. When a model needs a piece of that context, an authenticated, end-to-end encrypted channel connects the device to a protected, isolated environment in the cloud. That space, which DeepMind calls a secure enclave, decrypts only what the task in front of it requires and then releases it again.

Why stateless was the sticking point

On-device processing has long been the gold standard for privacy, but frontier models need far more computing power than any single handset or laptop can supply. Until now, DeepMind’s cloud tier was strictly stateless: it wiped context the moment a task finished. That solved the privacy problem and created a usability one. DeepMind’s own examples are a set of assembly instructions first viewed through smart glasses and then picked up on a laptop, and a conversation resumed between a phone and the web.

Per-user databases and a public record of the code

The architecture combines hardware-enforced enclaves, encrypted channels and per-user databases shielded by encryption keys derived from the user’s device. Alongside an updated technical paper, DeepMind says it will publish a tamper-proof public record of its server software, so that a device can verify the code it is about to talk to is authentic and unaltered before any personal data leaves it.

Our opinion

The interesting move here is not the memory itself but where the key lives. Every attempt to give an assistant long-term recall has run into the same trade: useful context wants to sit in a database, and a database is a liability. Holding the unlock key on the device rather than in the cloud keeps that liability with the person who owns the data, and the published record of the server software is a rarer concession still. It also asks a great deal of the hardware: enclaves are only as private as their attestation, and a fleet of consumer devices is a much larger attack surface than a data centre. The claims are checkable, which is the point. DeepMind has handed researchers a specification to attack rather than a marketing line to trust.