Google 发布基于 TEE 的下一代联邦学习系统，Gboard 已部署

Katharine Daly，软件工程师，Daniel Ramage，研究总监，谷歌研究院

2017 年，谷歌推出了联邦学习（Federated Learning, FL）：https://research.google/blog/federated-learning-collaborative-machine-learning-without-centralized-training-data/，这是一种在去中心化的私人数据上训练模型的机器学习技术。它已被用于支持日常有用功能，包括 Gboard 上的下一词预测：https://arxiv.org/abs/1811.03604 以及智能写作：https://support.google.com/gboard/answer/7068415，Google 信息应用中的回复建议：https://support.google.com/messages/answer/9327902?hl=en，以及 Android 上的智能文本选择：https://research.google/blog/predicting-text-selections-with-federated-learning/。

联邦学习（FL）是一种机器学习环境，其中多个实体（客户端）在服务提供者的协调下共同解决机器学习问题。完整的 FL 系统应允许客户端完全控制其数据、允许访问其数据的工作负载集合以及这些工作负载的匿名化属性。FL 系统应为被 FL 客户端管理数据的用户提供适当的透明度和控制权。

我们的基于 TEE 的 FL 系统建立在我们先前关于机密联邦分析（Confidential Federated Analytics）：https://research.google/blog/discovering-new-words-with-confidential-federated-analytics/ 和可证明私密洞察（Provably Private Insights）：https://research.google/blog/toward-provably-private-insights-into-ai-use/ 间开发的技术之上。

该系统协调四个核心操作概念：

有关基于 TEE 的 FL 系统设计的更多详细信息，请参见我们的白皮书《迈向可证明的联邦数据私密学习》：https://arxiv.org/abs/2609.31494。

在早期的 FL 系统中，设备数据被上传以用于即时聚合，但外部观察者无法验证数据是否从未被记录或检查。后来，安全聚合（Secure Aggregation）：https://arxiv.org/abs/1611.04482 允许通过加密保护上传的数据，但与最先进的集中式差分隐私保证（Central DP Guarantees）：https://arxiv.org/abs/2202.08312 不兼容。我们新的基于 TEE 的系统代表了我们在完全消除对服务器操作员信任需求方面持续努力的新里程碑。

在我们新的基于TEE的FL系统中，工作负载操作员只能看到指标和差分隐私模型权重。从设备收集的加密训练数据只能在运行访问策略中表示的Python训练程序的TEE内解密和处理，并且仅在上传后有限时间内可用。

参与我们新的基于TEE的FL系统的设备知道可能访问它们上传的数据的服务器工作负载的完整集合。表示这些潜在未来服务器工作负载的访问策略会发布到Rekor：https://docs.sigstore.dev/logging/overview/，这是一个公共透明日志，外部审计人员可以查看这些日志以跟踪设备可能参与的服务器端工作负载的完整集合。

我们FL系统中使用的KMS和数据处理二进制文件可以从发布在Confidential Federated Compute：https://github.com/google-parfait/confidential-federated-compute Github仓库中的开源代码可重复构建。

通过在运行服务器端训练工作负载之前收集所有设备的上传数据，我们不再需要担心设备可用性的昼夜变化：https://arxiv.org/abs/1912.04977 会影响训练进度。在服务器端执行时，我们可以在程序中动态计算最佳设备参与计划，并可用于调整其他DP参数。

过去，训练这些FL模型每次可能需要1-2个月，进度受设备可用性、设备计算能力以及多个训练工作负载竞争同一设备资源的限制。在新的基于TEE的系统中，瓶颈已转移到服务器端，并且通过多台机器的计算并行化使我们能够显著加快训练时间，目前仅受TEE资源可用性限制。

在我们新的基于TEE的FL系统中，客户端梯度的计算被转移到服务器端，从而消除了早期系统中与设备计算资源相关的限制。这为使用FL技术训练越来越大的模型铺平了道路。在此类用例中，将TEE与加速器集成将发挥重要作用。

我们上面描述的系统不仅能够以可验证的方式执行 FL（联邦学习）训练工作负载，还能执行所有可以用 Python 表达的任意工作负载。我们正在尝试在该基础设施上运行其他类型的工作负载，例如合成数据生成工作负载。另一个探索的方向是：将能够执行任意 Python 的数据处理 TEE 与我们专注于特定功能（如 LLM 推理）的其他数据处理 TEE 结合使用。

作者要感谢为基础设施设计和实施做出贡献的合作者：Arun Ganesh、Brendan McMahan、Brett McLarnon、Chunshan (Jake) Cheng、Emily Glanz、Maya Spivak、Michael Reneer、Nova Fallen、Stefan Dierauf、Suxinuo、Timon Van Overveldt、Yu Xiao、Zachary Charles 和 Zachary Garrett。我们还要感谢支持 Gboard 集成的密切合作伙伴：孙海成、苏恒、侯建鹏、蒋立阳、高桥纪之、毛文智、方晓娟、张彦翔、刘英杰、张远波和王云。这项工作得到了 Corinna Cortes、Shumin Zhai 和 Yossi Matias 的支持。我们还感谢 Maysam Moussalem 对本文撰写的反馈。

Katharine Daly, Software Engineer, and Daniel Ramage, Research Director, Google Research

In 2017, Google introduced Federated Learning：https://research.google/blog/federated-learning-collaborative-machine-learning-without-centralized-training-data/ (FL) a machine learning technique that trains models across decentralized, private data. It has been used to power everyday helpful features, including next-word prediction：https://arxiv.org/abs/1811.03604 and Smart Compose：https://support.google.com/gboard/answer/7068415 on Gboard, reply suggestions：https://support.google.com/messages/answer/9327902?hl=en in Google Messages, and Smart Text Selection：https://research.google/blog/predicting-text-selections-with-federated-learning/ in Android.

Federated learning (FL) is a machine learning setting where multiple entities (clients) collaborate in solving a machine learning problem, under the coordination of a service provider. A complete FL system should enable clients to maintain full control over their data, the set of workloads allowed to access their data, and the anonymization properties of those workloads. FL systems should provide appropriate transparency and control to the users whose data is managed by FL clients.

Our TEE-based FL system builds on techniques developed in our earlier work on confidential federated analytics：https://research.google/blog/discovering-new-words-with-confidential-federated-analytics/ and provably private insights：https://research.google/blog/toward-provably-private-insights-into-ai-use/.

The system coordinates four core operational concepts:

For more details on the TEE-based FL system design please see our whitepaper, Toward provably private learning from federated data：https://arxiv.org/abs/2609.31494.

In earlier FL systems, device data was uploaded for the purpose of immediate aggregation, but there was no way for external observers to verify that the data was never logged or inspected. Later, Secure Aggregation：https://arxiv.org/abs/1611.04482 allowed uploads to be protected cryptographically, but was not compatible with state-of-the-art central DP guarantees：https://arxiv.org/abs/2202.08312. Our new TEE-based system represents the next milestone in our ongoing effort to completely remove the need to trust the server operator.

In our new TEE-based FL system, only metrics and differentially private model weights are visible to workload operators. Encrypted training data collected from devices can only be decrypted and processed within TEEs running Python training programs represented in the access policies, and only for a limited amount of time after upload.

Devices participating in our new TEE-based FL system know the full set of server workloads that may access data they’re uploading. The access policies representing these potential future server workloads are published to Rekor：https://docs.sigstore.dev/logging/overview/, a public transparency log, and external auditors are able to observe these logs to track the full set of server-side workloads that devices could potentially be participating in.

The KMS and data processing binaries used in our FL system can be reproducibly built from open source code published in the Confidential Federated Compute：https://github.com/google-parfait/confidential-federated-compute Github repository.

By collecting all device uploads before running the server-side training workload, we no longer have to worry about diurnal variations：https://arxiv.org/abs/1912.04977 in device availability impacting training progress. At server-side execution time, we can dynamically calculate the optimal device participation schedule within the program, and can use it to tune other DP parameters.

In the past, training these FL models could take 1-2 months each, with progress limited by device availability, on-device compute, and competition across multiple training workloads for the same set of device resources. With the new TEE-based system, bottlenecks have been moved to the server, and computation parallelization across many machines allows us to achieve significant speedups in training time, currently only limited by TEE resource availability.

In our new TEE-based FL system, computation of client gradients is shifted to the server, lifting limitations related to on-device compute resources that were present in earlier systems. This paves the way for training increasingly larger models using FL techniques. Integrating TEEs with accelerators will play an important role in such use cases.

The system we have described above is capable of executing not just FL training workloads in a verifiable manner, but also arbitrary workloads that can be expressed using Python. We are experimenting with running other types of workloads on this infrastructure, such as synthetic data generation workloads. Another area of exploration: using the data processing TEEs that execute arbitrary Python in combination with our other data processing TEEs that specialize in functionality such as LLM inference.

The authors would like to thank the collaborators who contributed to the infrastructure design and implementation: Arun Ganesh, Brendan McMahan, Brett McLarnon, Chunxiang (Jake) Zheng, Emily Glanz, Maya Spivak, Michael Reneer, Nova Fallen, Stefan Dierauf, Suxin Guo, Timon Van Overveldt, Yu Xiao, Zachary Charles, and Zachary Garrett. We also thank close partners who supported the Gboard integration: Haicheng Sun, Heng Su, Jianpeng Hou, Liyang Jiang, Noriyuki Takahashi, Wenzhi Mao, Xiaojuan Fang, Yanxiang Zhang, Yingjie Liu, Yuanbo Zhang, and Yun Wang. This work was supported by Corinna Cortes, Shumin Zhai, and Yossi Matias. We additionally thank Maysam Moussalem for feedback on the writing of this post.