Meta locks itself out of user data on its AI glasses

Meta is expanding Private Processing to its AI glasses, extending their security protections into cloud data centers. The system runs AI models inside confidential virtual machines (CVMs) designed to prevent Meta from accessing users’ data.

Private Processing combines protected hardware, encryption and software verification to secure data during cloud processing and storage.

How Private Processing supports AI glasses

AI glasses need personal context to provide help based on a user’s surroundings and history. Their size limits how much processing they can perform on the device, so some tasks require cloud computing.

The company built it around five engineering requirements so intensive AI workloads like streaming transcription, contextual search and long-term recall can be safely offloaded.

Private Processing keeps user data cryptographically protected from host operating systems, hypervisors and Meta while it is being transferred, processed and stored.

Attempts to weaken or modify these protections must either cause the system to fail closed or become publicly detectable through a verifiable transparency system.

Every confidential virtual machine image used in production is recorded in an append-only, publicly witnessed transparency ledger.

The system is also designed to prevent attackers from targeting a specific user’s session or stored data without attempting to compromise Private Processing as a whole.

Data stored for later use is encrypted and can only be accessed using a key provided by the user.

“We’ve designed this multi-regional, fault-tolerant system to handle large amounts of data with high reliability,” Pritam Shah, Director of Engineering, and Oskar Linde, VP, Human AI at Meta, explained.

Protecting data during cloud processing

Before data leaves the glasses, Private Processing uses anonymous credentials, including tokens fetched on randomized schedules. This prevents company’s authentication service from tying a request directly to a user’s account. A third-party relay forwards the traffic to a gateway that selects a secure processing environment.

How Private Processing works for AI glasses (Source: Meta)

The glasses verify the environment’s hardware credentials and software information against the public transparency ledger before sending personal context. They refuse to connect if verification fails.

Data remains encrypted in transit and is processed inside a trusted execution environment (TEE) designed to block access by Meta and the underlying cloud infrastructure. Any other TEE must pass verification before receiving the data.

Information kept for later use is encrypted with a user-provided key before it leaves the TEE. Meta stores the encrypted data. When the information is needed, the user’s device supplies the key to a verified TEE, which decrypts and processes it within the protected environment.

Securing stored information

Features that recall previous conversations or moments require AI glasses to retain information over time. A conventional encrypted cloud database could reveal patterns in when and how that information is accessed. Large histories could also make complex queries slow.

Private Processing places storage and query systems inside a TEE, allowing it to search stored information within the protected environment across CPUs and GPUs. This limits exposure of access patterns to an external database and improves query performance.

Monitoring and independent verification

Private Processing’s protections limit how Meta engineers can diagnose failures. They cannot inspect memory, model inputs and outputs, or the user data involved. Instead, the company monitors aggregate measures such as CPU and memory use, network latency and hardware failure rates.

The public transparency ledger allows client devices and external monitors to check deployed CVM images against recorded versions. The ledger and its measurements are public, while the corresponding software binaries are available to security researchers under agreement. Meta says it partners with independent firms such as NCC Group and with researchers to review the system’s architecture, attestation mechanisms and isolation protections.

The company is expanding its Bug Bounty program to cover Private Processing on AI glasses. It plans to provide researchers with tools, CVM binaries and documentation to test the system and report vulnerabilities.