Private analytics via zero-trust aggregation (opens in new tab)

Google presents a private analytics architecture combining one-shot cryptographic secure aggregation with trusted execution environments (TEEs). The design follows a zero-trust model: cryptography prevents individual data from being reconstructed, while TEE attestation verifies that approved, publicly auditable code is running. It aims to provide useful population-level insights without exposing raw user data, even if hardware protections are compromised.

Why Private Analytics Matters

• On-device AI protects user information, but developers still need to measure performance across millions of devices.
• Aggregated analytics can reveal:
  • Model drift, such as difficulty handling new language or slang.
  • Hidden biases across regions, environments, or demographic conditions.
  • Real-world error rates and user reactions to model outputs.
• Google already uses federated analytics in products including Pixel Recorder and Gboard.

Limitations of Existing Protections

• TEEs isolate sensitive computation from compromised operating systems and hypervisors.
• Hardware attestation produces a cryptographic fingerprint proving which firmware and software are running.
• However, TEEs remain vulnerable to newly discovered side-channel attacks.
• Traditional cryptographic aggregation offers mathematical privacy guarantees, but many protocols require devices to stay online through several interactive rounds.
• Extended multiround participation limits practical deployment at large scale.

Combining Encryption and Isolation

• The new system allows devices to submit data in a single message.
• This removes the need for devices to remain connected for multiple protocol rounds.
• Data is encrypted before leaving the device and is never reconstructed in server memory, including inside a TEE.
• Unencrypted information is processed off-device only after it has been aggregated and anonymized.
• TEE attestation provides verifiable evidence that the intended secure aggregation implementation is running correctly.
• The cryptographic and hardware layers provide defense in depth: failure of one layer does not automatically expose individual data.

One-Shot Lattice-Based Aggregation

• The protocol uses lattice-based cryptography.
• Ciphertexts can be combined so that their underlying data—and encryption keys—are aggregated together.
• A resulting decryption key can reveal only the aggregate, not individual contributions.
• Small client committees hold decryption hints and help unlock the aggregated result.
• Differential privacy noise is added to further protect the aggregate.
• Decryption authority is distributed across multiple parties, preventing any single party from accessing encrypted data.

Application to Android SafetyCore

• SafetyCore provides privacy-preserving, on-device safety features for Android 9 and later.
• Private analytics can help measure which threats are detected and identify areas where detection needs improvement.
• Google is working with the Android SafetyCore team to apply this system while preserving the confidentiality of individual users’ data.

Practical Takeaway

The approach pairs the scalability of one-shot cryptographic aggregation with the verifiability of TEEs. It is designed for private, large-scale analytics where neither individual data nor trust in a single hardware or software component is required.