Glasses are a natural home for an AI assistant: they can see what you see and hear what you hear, keeping context that a phone cannot, and they add translation, note summarization and hands-free calling without pulling you back to a screen. Simple directions run entirely on device, but richer behavior requires models far larger than a wearable can host — and compute is only half of it. A genuinely useful assistant must be stateful and personal, connecting ideas across days and working in the background. Both requirements push the work into the cloud, which raises a question classic cloud architectures were never designed to answer: how do you build a deeply personalized assistant without giving the operator access to your world?
Meta's answer is Private Processing, its confidential computing infrastructure for AI workloads. It extends the trust boundary of the glasses into the data center, running models inside confidential virtual machines (CVMs) so that even Meta cannot reach the data. The approach builds on Private Processing for WhatsApp and the Meta AI app, introduced in 2025, which allows private chats with Meta AI that neither Meta nor WhatsApp can read; the glasses work adapts that model to continuously processed personal context.
"Personal devices like glasses that understand our context — because they can see what we see, hear what we hear, and interact with us throughout the day — will become our primary computing devices." — Mark Zuckerberg, Personal Superintelligence, July 2025.
Confidential Computing, TEEs and Private Processing
Confidential computing addresses the third state of data. Disk (at rest) and network (in transit) encryption are long-standing practice, but data in use had to be decrypted in memory, exposed to the host operating system, the hypervisor and the infrastructure operator.
The hardware primitive that closes this gap is the Trusted Execution Environment (TEE), a capability in certain CPUs and GPUs. The processor encrypts the memory of a special VM under a key held by dedicated security hardware on the chip and never released to the host, the hypervisor or the machine's operator; covering both host CPUs and GPUs, it keeps a workload within the trust boundary across compute targets, and to everyone outside the CVM that memory is ciphertext.
The Confidential Computing Consortium (CCC) defines three guarantees a TEE physically enforces:
- Data Confidentiality — nobody outside the CVM, Meta and the host OS included, can read data in CVM memory while it is in use.
- Data Integrity — nobody outside the CVM can add, remove or alter that data.
- Code Integrity — the code inside the CVM cannot be modified once loaded.
Verification rests on remote attestation. The client demands a report signed by a key that exists only inside the chip, carrying a measurement of the loaded software image, then checks that the signature chains to a vendor-published root key and that the measurement matches one published to an append-only ledger witnessed by an independent third party. Failing either check, the client refuses to connect and sends nothing. Private Processing layers non-targetability and encrypted storage on top of that hardware confidentiality and attestation, with verifiable transparency.
Design requirements for glasses
Offloading transcription, contextual search and long-term recall requires five properties:
- Hardware Isolation: user data must be cryptographically unreadable to host operating systems, hypervisors and Meta in transit, in use and at rest.
- Fail-Closed Guarantees: any attempt to weaken the confidential processing guarantee must either fail closed or become publicly discoverable through verifiable transparency.
- Public Verifiability: every CVM image in production is registered to an append-only, publicly witnessed transparency ledger.
- Non-Targetability: targeting one person's session or storage must be impossible without attempting to compromise the whole system.
- Encrypted Storage: stored data that Private Processing later accesses is encrypted and reachable only with a user-provided key.
The system is multi-regional and fault-tolerant, built to handle large data volumes reliably. Its foundational threat model is documented in the Private Processing whitepaper.
How a request is handled
Non-targetable routing
Before any data leaves the glasses, the metadata problem has to be solved: if the operator knows who is sending a request, it can route that traffic to a compromised machine. Session establishment therefore uses anonymous credentials — blind-signed tokens fetched on randomized schedules — so the authentication service cannot tie a request back to an account. The device reaches the gateways through a third-party OHTTP relay (Fastly or Cloudflare) to select a TEE node, chosen by non-user-identifiable heuristics.
Remote attestation and execution
The device starts a remote attestation and TLS (RA-TLS) session, requiring a hardware-signed certificate from the server's TEE and cross-checking the TEE's binary hashes against the independent public transparency ledger. A vendor certificate failure or a hash mismatch ends the handshake, and no data is sent.
Once the server is proven trustworthy, communication continues over TLS. Infrastructure routes the encrypted blob without reading it; inside the TEE, models run isolated, and where one model must talk to another, the TEEs attest to each other over the same RA-TLS protocols before data moves.
Encrypted storage
For features needing persistent memory, output is encrypted with user-provided keys before it leaves the TEE, and Meta's infrastructure stores only ciphertext. Retrieval works the other way: the device supplies the key, and the TEE decrypts and processes the query.
Why storage belongs inside the boundary
Recalling a moment from earlier or continuing across sessions requires retaining information, which forces an architectural decision. The obvious route — encrypt on device, store in a standard cloud database — fails for two reasons. First, access patterns leak behavior: even with strongly encrypted contents, the external database sees when you read and write, how often you query and which records are touched together, and that metadata alone maps a daily routine. Encryption hides payload content, not execution patterns. Second, remote encrypted queries do not scale: semantic vector search or multi-session joins over traditional encrypted storage means pulling large ciphertext payloads across the network into a TEE just to answer one query, and latency spikes as context grows.
Instead, the storage engine sits inside the TEE. Query engines run within the boundary and state is co-located with execution in processor-encrypted memory across CPUs and GPUs, so read-write transactions never cross an external network boundary. Data stays encrypted, recalled by its owner and inaccessible to anyone else, Meta included.
Operating a system you cannot inspect
Cryptographically locking operators out creates an operational problem: how do you keep a high-availability service running when engineers cannot look inside? Inside a TEE, standard diagnostics are unavailable — no debugger attached to a running TEE, no memory dumps or model input/output logs during a crash, no way to inspect the payload behind a fault.
Visibility therefore has to be entirely out-of-band. The observability layer relies on aggregate health signals — CPU utilization, memory allocation, network latency and aggregate hardware failure rates — which provide the telemetry needed for service health and uptime without exposing a single byte of user data.
Verifiability as the Trust Anchor
Architectural guarantees carry little weight when they can only be checked by the provider making them. Private Processing is therefore built so external researchers can independently confirm each claim.
Binary transparency
Each CVM image that reaches production is recorded in an append-only transparency ledger with public witnesses. A deployment that diverged from the published record would be detectable by client devices and external monitors alike, which makes the setup tamper-evident: binaries cannot be swapped out without leaving a trace in a record Meta does not control. Binary access is the next step — it lets a researcher verify that a recorded image actually behaves as described.
Both the ledger and its measurements are visible to the public. Binaries are made available to researchers in Meta's security program under agreement.
An adversarial data center
The design assumes hostility inside Meta's own infrastructure. Conventional cloud security places its boundary at the edge, shielding servers from the outside world while extending trust to the hypervisor, the host OS, and the administrators who operate them. Private Processing draws that boundary further in, leaving all three on the untrusted side.
Validation is not left to internal review alone. Independent security firms — NCC Group among them — and external researchers audit the architectural design, scrutinize the attestation logic, and probe the isolation model's edges.
Expanding Bug Bounty coverage
Open channels for scrutiny are a precondition for transparency. Meta is extending its Bug Bounty program so that it explicitly covers Private Processing on AI glasses. Researchers in the program receive the tooling, CVM binaries, and documentation required to audit the implementation, exercise the attestation chains, and hold the platform accountable.
Built for Stateful, Agentic Assistants
Private Processing so far has handled discrete jobs such as message summarization. The direction of AI, however, is agentic and multimodal: glasses will eventually act on the wearer's behalf — across separate sessions and varied real-world contexts. Private Processing is intended as the foundation beneath those experiences.
As AI on glasses grows more stateful, multimodal, and agentic, trust boundaries grow correspondingly more complicated. An agent that carries sensitive state demands strict isolation, verifiable data provenance, and communication between CVMs. The infrastructure is designed so that capabilities can advance while the security and privacy boundary stays where it is.
