Google DeepMind is taking another step toward making AI assistants more personal without giving up the privacy protections normally associated with on-device processing.

The company has introduced a new server-side memory architecture for its Private AI Compute platform, designed to let AI securely retain information across sessions and devices while keeping the encryption keys needed to access that information on the user’s own devices.

The idea is fairly straightforward: an AI assistant needs memory if it is going to become genuinely useful over time. But storing that memory in the cloud creates an obvious privacy problem. Google says its new architecture is designed to bridge that gap by combining cloud-scale computing with protections intended to make personal information inaccessible even to Google itself.

Bringing persistent memory to Private AI Compute

Google previously introduced Private AI Compute as a way to run computationally demanding AI workloads inside isolated cloud environments known as secure enclaves. The environments are designed to protect user data while allowing AI models to use significantly more computing power than would typically be available on a personal device.

The limitation was that Private AI Compute was essentially stateless. Once a task ended, its context disappeared.

That works for individual requests, but it becomes a problem as AI assistants become more continuous and personalized. An assistant that forgets everything between sessions can’t easily understand your preferences, pick up an unfinished task or carry context from one device to another.

Google’s new server-side memory layer is intended to change that.

Under the proposed architecture, a user’s persistent AI memory is stored in dedicated encrypted storage. The encryption keys required to unlock that information are held exclusively on the user’s devices rather than by Google.

When an AI request needs access to the stored information, the user’s device establishes an authenticated, end-to-end encrypted connection with an isolated secure enclave. The enclave can temporarily decrypt the required information, process the request and store any new context before encrypting it again.

In other words, the cloud can provide the heavy computing while the user’s devices retain control over the keys.

Why server-side memory matters

The distinction between on-device and server-side AI is becoming increasingly important as AI assistants take on more complex tasks.

Running everything locally provides obvious privacy benefits, but modern frontier models can demand substantially more processing power and memory than a phone, laptop or pair of smart glasses can provide. Cloud computing solves that hardware problem, but traditionally means sending personal information to infrastructure operated by another company.

Google’s approach attempts to separate those two problems.

Private AI Compute uses hardware-enforced secure enclaves, encrypted communication channels and encryption keys derived from the user’s devices. Google says each user’s memory is protected by its own encryption setup, while the server environment is designed to handle the information only when it is needed for an AI request.

That could make persistent AI memory practical for experiences that span multiple devices.

Google gives a simple example: you could look at assembly instructions using smart glasses and later continue working with those instructions on a laptop. Similarly, a conversation started on a phone could potentially be resumed on the web without requiring the assistant to start from scratch.

The important part is that the useful context can follow the user without simply becoming permanently exposed to the cloud provider.

Google is also opening the system to scrutiny

Google DeepMind isn’t presenting the architecture as something users should simply trust because Google says it is secure.

Alongside the announcement, Google says it is publishing an updated technical whitepaper, system architecture information, security proofs and verification protocols. It is also publishing a tamper-proof public record of the server software so devices can verify that the software running Private AI Compute is authentic and hasn’t been altered before personal information is sent to it.

The company also says the updated system has undergone an independent audit by a cybersecurity firm.

That verification layer matters because secure hardware and encryption are only part of the equation. A privacy-focused system also needs a way for users’ devices to establish that the software they’re communicating with is actually the software they expect.

Google says its goal is to make that verification possible rather than asking users to take the server environment on faith.

The bigger picture for personal AI

Persistent memory is quickly becoming one of the defining features of the next generation of AI assistants.

An assistant that knows nothing about you after every conversation is useful as a chatbot. An assistant that can remember relevant preferences, previous tasks and context across devices starts to behave more like a persistent digital companion.

That also makes privacy considerably more important.

Google’s new architecture is an attempt to make those two ideas compatible: persistent memory on cloud infrastructure, while keeping the cryptographic control over that memory with the user’s devices.

For now, Google is describing this as a technical advancement to Private AI Compute rather than announcing a specific consumer feature that suddenly gives Gemini universal private memory. The significance is in the underlying infrastructure. If the approach works as intended, it could provide a foundation for more capable AI assistants that remember context without requiring users to simply hand over permanent access to their personal information.

And that may end up being one of the most important pieces of infrastructure behind truly personal AI: not just making models smarter, but figuring out how to let them remember without making privacy the price of admission.