This architecture solves the tension between high-compute AI needs and user privacy. By using confidential computing, engineers can build hyper-personalized, stateful AI in the cloud while providing cryptographic guarantees that user data remains inaccessible to the service provider.
We believe glasses are the best form factor for having AI help throughout your day. They can understand your personal context better than other kinds of devices and keep you present without picking up a mobile phone.
Most of the time, glasses are helping you see well, protecting your eyes and complementing your look, and that’s it. But AI glasses have the capacity to provide superpowers like translating a conversation or summarizing notes or a conversation.
Many directions people give their glasses today, like placing a call or answering a text hands-free, occur entirely on device, though more advanced features would require larger, more capable AI models – far larger than can be packed into a pair of glasses.
And compute is only half the problem. For an AI assistant to be truly useful in everyday life, it must also be stateful and deeply personal — understanding your context, connecting ideas across days or weeks, and working proactively in the background to get things done for you.
Taken together, these demands mean the work has to happen in the cloud. AI glasses present a challenge that traditional cloud architectures were never built to solve: How do you build a hyper-personalized AI that knows your world deeply with enhanced privacy?
Our answer is Private Processing, Meta’s confidential computing infrastructure for AI workloads. It extends the trust boundary of AI glasses directly into cloud data centers, executing AI models inside confidential virtual machines (CVMs) such that even Meta cannot access your data.
This isn’t a new idea for us. In 2025, we introduced Private Processing for WhatsApp and the Meta AI app, allowing you to have completely private chats with Meta AI, without Meta or WhatsApp ever seeing the data. We’ve learned from that initial approach and we’re expanding it to bring these same privacy benefits to our AI glasses. This blog highlights how we engineered a cloud runtime that processes personal context at scale.
“Personal devices like glasses that understand our context — because they can see what we see, hear what we hear, and interact with us throughout the day — will become our primary computing devices.” — Mark Zuckerberg, Personal Superintelligence, July 2025.
Confidential Computing is the paradigm. Historically, the industry encrypted data in two states: at rest (on disk) and in transit (over the network). The vulnerability has always been the third state: in use. Data had to be decrypted in memory to be computed on, leaving it exposed to the host operating system, the hypervisor, and the infrastructure operator. Confidential computing is the industry-wide movement to close that gap, ensuring data remains protected even while being processed.
The Trusted Execution Environment (TEE) is the hardware primitive. The TEE is a hardware capability in certain CPUs and GPUs that enables confidential computing. The processor encrypts the memory of a special virtual machine, a CVM, under a key held by dedicated security hardware on the chip. That key is never released to the host operating system, the hypervisor, or anyone operating the machine.
This capability spans host CPUs and GPUs, so a workload that needs both of these compute targets stays inside the trust boundary across them. To the host operating system, the hypervisor, and the infrastructure administrator, the CVM memory is ciphertext.
As defined by the Confidential Computing Consortium (CCC), a TEE physically enforces three strict guarantees:
The client demands a remote attestation report, signed by a key that exists only inside that chip, carrying a measurement of the software image the CVM loaded. It then checks that the signature chains back to a root key the chip vendor publishes, and that the measurement matches one we published to an append-only ledger witnessed by an independent third party. If either check fails, the client refuses to connect and no data is sent.
Private Processing is Meta’s confidential computing infrastructure, built on TEEs with verifiable transparency. On top of the confidentiality and attestation the hardware provides, it adds non-targetability and encrypted storage.
The more you use an AI assistant, the more useful it gets as it learns your style, preferences and context. Wearable AI assistants will help you in similar ways, including with everyday life. To do that they need to know you and your context. That can include connecting ideas across days or weeks, and working proactively in the background to get things done for you without requiring rework from you. This would demand compute capabilities beyond what an ergonomic form factor like a pair of glasses can host locally.
That’s where Private Processing comes into the picture. Traditional cloud architectures encrypt data in transit and at rest, but must decrypt it in host memory during processing — potentially exposing it to the underlying system while in use. Private Processing helps us solve this problem, ensuring off-device data stays inaccessible to anyone including Meta.
To make this work, we built Private Processing for AI glasses on five engineering requirements, all designed so that we can safely offload intensive AI workloads like streaming transcription, contextual search, and long-term recall:
We’ve designed this multi-regional, fault-tolerant system to handle large amounts of data with high reliability.
Private Processing defends against a specific set of threats. The foundational threat model is documented in the Private Processing whitepaper.
Before data even leaves your glasses we have to solve a metadata problem. If we know who is sending a request, the operator can possibly route your traffic to a compromised machine. During session establishment, we use anonymous credentials — blind-signed tokens fetched on randomized schedules — so that when your device makes a request, our authentication service cannot tie it back to your account. Next, your device connects to our gateways through a third-party OHTTP relay (Fastly or Cloudflare) to select a TEE node. An incoming request is serviced by a TEE that was selected based on non-user-identifiable heuristics.
Before your glasses send any context, they verify our servers. Your device initiates a remote attestation and TLS (RA-TLS) session, demanding a hardware-signed certificate from the server’s TEE. Your glasses cross-check the TEE’s binary hashes against an independent, public transparency ledger. If the CPU/GPU vendor certificate check fails, or the binary hash does not match the ledger, the handshake fails and your device does not connect.
Once the server proves it is trustworthy, your device communicates securely over TLS. Our infrastructure routes the encrypted blob, but cannot read it. Inside the TEE, AI models go to work in an isolated environment, where even Meta cannot access your data. If our models need to communicate with other models, the TEEs must attest to over the same strict RA-TLS protocols before transferring the data.
When a feature requires persistent memory, the output is encrypted with user-provided keys before it ever leaves the TEE. Meta’s infrastructure stores the ciphertext. When you need to retrieve a memory later, your device provides the key and the TEE decrypts the data and processes your query.
The experiences people want from AI on their glasses, like picking up across sessions or recalling a moment from earlier, only work if the system can retain information over time. Building stateful experiences for AI glasses forces an architectural choice. The obvious approach is to encrypt user data on the device and store it in a standard cloud database.
That approach breaks down under scrutiny for two reasons:
To solve both problems, we built the storage engine directly inside the TEE. We have extended the trust boundary so that data isn’t just processed confidentially; it is stored confidentially. Your data remains encrypted. It is accessible only from within the TEE across CPUs and GPUs; ready to be recalled by you, and completely inaccessible to anyone else – including Meta.
Instead of treating the cloud as a distant database, stateful Private Processing on demand co-locates execution and state inside processor-encrypted memory. Query engines run directly within the TEE boundary. Read Write transactions are fast because reads never cross an external network boundary.
When you build an infrastructure that cryptographically locks out operators, you create a fundamental operational challenge: How do you maintain a high-availability system when engineers are unable to look inside?
Standard engineering diagnostics are useless inside a TEE:
Operational visibility must be achieved entirely out-of-band. We architected our observability layer to rely on aggregate health signals — CPU utilization, memory allocation, network latency, and aggregate hardware failure rates. These signals give us the telemetry required to maintain service health and uptime without ever exposing a single byte of user data.
Security claims are meaningless if they depend on trusting the provider. Private Processing is designed so that every architectural guarantee we make can be verified independently by external researchers.
Every CVM image deployed in production is registered to an append-only, publicly-witnessed transparency ledger. If we ever attempted to deploy code that differed from what was published, client devices and external monitors would be able to discover the mismatch. What that establishes is tamper-evidence. Because every deployed image is recorded, we cannot substitute different binary without the change being visible in a record we do not control. Binary access is what lets a researcher go further and confirm that a recorded image behaves as we describe.
The ledger and the measurements it records are publicly visible. The corresponding binaries are available to researchers in our security program under agreement.
This design assumes an adversarial environment inside our own data centers. Traditional cloud security draws its boundary at the edge: It protects servers from the outside world while trusting the hypervisor, the host operating system, and the administrators who run them. Private Processing moves that boundary inward and puts all three outside it.
To validate this stance, we don’t rely solely on internal reviews. We actively partner with independent security firms (like NCC Group) and researchers to audit our architectural design, review our attestation logic and probe the boundaries of our isolation model.
Transparency requires open avenues for validation. To enable further independent security research into Private Processing’s design and implementation, we are expanding our Bug Bounty program to explicitly cover Private Processing on AI glasses. We’ll be providing external researchers with the tools, CVM binaries, and documentation needed to audit our implementation, test our attestation chains, and hold our platform accountable.
To date, Private Processing has focused on discrete tasks, like summarizing a message. But the future of AI is agentic and multimodal. In the future, your glasses will have the capacity to take actions on your behalf across different sessions, in a range of real-world contexts. As we work towards launching the kinds of experiences that will help you throughout your day, Private Processing will serve as our foundation.
AI on glasses is going to become increasingly stateful, multimodal, and agentic, which means that the trust boundaries also become more complex. An agent holding a sensitive state requires strict isolation, verifiable data provenance, and inter-CVM communication. Our Private Processing infrastructure is the foundation for that future. AI capabilities will grow, but the security and privacy boundary will remain intact.
The post Bringing Private Processing to Meta AI Glasses appeared first on Engineering at Meta.
Continue reading on the original blog to support the author
Read full articleThis article details how Meta scaled invisible video watermarking, a critical technology for content provenance. It's vital for engineers tackling challenges like detecting AI-generated media and ensuring content authenticity at massive scale with operational efficiency.
Meta is shifting AI infrastructure from proprietary silos to open, Ethernet-based standards. These innovations in liquid cooling, petabit-scale fabrics, and standardized switch layers enable the massive scale required for next-gen AI models while fostering an open hardware ecosystem.
Prometheus showcases the hardware and software co-design needed to scale AI infrastructure to a million GPUs. It provides a blueprint for achieving high training 'goodput' and reliability at the gigawatt scale, essential for the next generation of foundational models.
Meta demonstrates how to apply LLM-scale architectures and scaling laws to recommendation systems. By unifying disparate models into a single foundation model and optimizing GPU utilization with 5D parallelism, they achieve massive performance gains while maintaining serving efficiency.
