Bringing Private Processing to Meta AI Glasses
Bringing Private Processing to Meta AI Glasses
将私密处理（Private Processing）引入 Meta AI 眼镜
By Pritam Shah, Oskar Linde 作者：Pritam Shah, Oskar Linde
We believe glasses are the best form factor for having AI help throughout your day. They can understand your personal context better than other kinds of devices and keep you present without picking up a mobile phone. Most of the time, glasses are helping you see well, protecting your eyes and complementing your look, and that’s it. But AI glasses have the capacity to provide superpowers like translating a conversation or summarizing notes or a conversation. 我们认为，眼镜是全天候提供 AI 辅助的最佳外形设备。相比其他设备，它们能更好地理解你的个人语境，让你无需拿起手机即可保持专注。大多数时候，眼镜的作用仅限于辅助视力、保护眼睛和修饰外观。但 AI 眼镜具备提供“超能力”的潜力，例如实时翻译对话、总结笔记或会议内容。
Many directions people give their glasses today, like placing a call or answering a text hands-free, occur entirely on device, though more advanced features would require larger, more capable AI models – far larger than can be packed into a pair of glasses. And compute is only half the problem. For an AI assistant to be truly useful in everyday life, it must also be stateful and deeply personal — understanding your context, connecting ideas across days or weeks, and working proactively in the background to get things done for you. Taken together, these demands mean the work has to happen in the cloud. 目前人们对眼镜下达的许多指令（如免提拨打电话或回复短信）完全是在设备本地完成的，但更高级的功能需要更大、能力更强的 AI 模型——其规模远超一副眼镜所能承载的极限。计算能力只是问题的一半。要让 AI 助手在日常生活中真正有用，它还必须具备状态感知能力并深度个性化——理解你的语境，跨越数天或数周关联信息，并在后台主动为你处理事务。综合来看，这些需求意味着相关工作必须在云端完成。
AI glasses present a challenge that traditional cloud architectures were never built to solve: How do you build a hyper-personalized AI that knows your world deeply with enhanced privacy? Our answer is Private Processing, Meta’s confidential computing infrastructure for AI workloads. It extends the trust boundary of AI glasses directly into cloud data centers, executing AI models inside confidential virtual machines (CVMs) such that even Meta cannot access your data. AI 眼镜带来了一个传统云架构从未解决过的挑战：如何在增强隐私保护的前提下，构建一个深度了解你世界的超个性化 AI？我们的答案是“私密处理”（Private Processing），这是 Meta 专为 AI 工作负载打造的机密计算基础设施。它将 AI 眼镜的信任边界直接扩展到云数据中心，在机密虚拟机（CVM）中执行 AI 模型，确保即使是 Meta 也无法访问你的数据。
This isn’t a new idea for us. In 2025, we introduced Private Processing for WhatsApp and the Meta AI app, allowing you to have completely private chats with Meta AI, without Meta or WhatsApp ever seeing the data. We’ve learned from that initial approach and we’re expanding it to bring these same privacy benefits to our AI glasses. This blog highlights how we engineered a cloud runtime that processes personal context at scale. 这对我们来说并非新概念。2025 年，我们为 WhatsApp 和 Meta AI 应用引入了私密处理功能，让你能与 Meta AI 进行完全私密的聊天，而 Meta 或 WhatsApp 永远无法查看这些数据。我们从最初的尝试中汲取了经验，并正在将其扩展，以便将同样的隐私保护优势带给我们的 AI 眼镜。本篇博客重点介绍了我们如何设计一种能够大规模处理个人语境的云端运行时环境。
“Personal devices like glasses that understand our context — because they can see what we see, hear what we hear, and interact with us throughout the day — will become our primary computing devices.” — Mark Zuckerberg, Personal Superintelligence, July 2025. “像眼镜这样能够理解我们语境的个人设备——因为它们能看到我们所见、听到我们所闻，并全天候与我们互动——将成为我们的主要计算设备。”——马克·扎克伯格，《个人超级智能》，2025 年 7 月。
What are Confidential Computing, the TEE, and Private Processing?
什么是机密计算、TEE 和私密处理？
Confidential Computing is the paradigm. Historically, the industry encrypted data in two states: at rest (on disk) and in transit (over the network). The vulnerability has always been the third state: in use. Data had to be decrypted in memory to be computed on, leaving it exposed to the host operating system, the hypervisor, and the infrastructure operator. Confidential computing is the industry-wide movement to close that gap, ensuring data remains protected even while being processed. 机密计算是一种范式。从历史上看，行业内对数据的加密主要处于两种状态：静态（存储在磁盘上）和传输中（通过网络）。而第三种状态——使用中——一直存在漏洞。数据必须在内存中解密才能进行计算，这使其暴露在宿主操作系统、虚拟机管理程序（Hypervisor）和基础设施运营商面前。机密计算是全行业旨在弥补这一差距的举措，确保数据即使在处理过程中也能保持受保护状态。
The Trusted Execution Environment (TEE) is the hardware primitive. The TEE is a hardware capability in certain CPUs and GPUs that enables confidential computing. The processor encrypts the memory of a special virtual machine, a CVM, under a key held by dedicated security hardware on the chip. That key is never released to the host operating system, the hypervisor, or anyone operating the machine. This capability spans host CPUs and GPUs, so a workload that needs both of these compute targets stays inside the trust boundary across them. To the host operating system, the hypervisor, and the infrastructure administrator, the CVM memory is ciphertext. 可信执行环境（TEE）是硬件原语。TEE 是某些 CPU 和 GPU 中支持机密计算的硬件功能。处理器使用芯片上专用安全硬件持有的密钥，对特殊虚拟机（CVM）的内存进行加密。该密钥绝不会泄露给宿主操作系统、虚拟机管理程序或任何操作该机器的人。此功能涵盖宿主 CPU 和 GPU，因此需要这两种计算目标的工作负载可以在整个过程中保持在信任边界内。对于宿主操作系统、虚拟机管理程序和基础设施管理员而言，CVM 内存表现为密文。
As defined by the Confidential Computing Consortium (CCC), a TEE physically enforces three strict guarantees: 根据机密计算联盟（CCC）的定义，TEE 在物理层面强制执行三项严格保证：
- Data Confidentiality: No one outside the CVM, including Meta and the host operating system, can read data in CVM memory while it is in use.
- 数据机密性： CVM 外部的任何人（包括 Meta 和宿主操作系统）都无法在数据使用过程中读取 CVM 内存中的数据。
- Data Integrity: No one outside the CVM can add, remove, or alter that data.
- 数据完整性： CVM 外部的任何人无法添加、删除或篡改该数据。
- Code Integrity: No one can modify the code executing inside the CVM once it has loaded.
- 代码完整性： 一旦代码加载完成，任何人无法修改在 CVM 内部执行的代码。
The client demands a remote attestation report, signed by a key that exists only inside that chip, carrying a measurement of the software image the CVM loaded. It then checks that the signature chains back to a root key the chip vendor publishes, and that the measurement matches one we published to an append-only ledger witnessed by an independent third party. If either check fails, the client refuses to connect and no data is sent. 客户端会要求提供一份远程证明报告，该报告由仅存在于芯片内部的密钥签名，并包含 CVM 所加载软件镜像的度量值。随后，客户端会验证该签名是否追溯至芯片供应商发布的根密钥，并核对该度量值是否与我们发布在由第三方见证的仅追加账本上的记录相符。如果任何一项检查失败，客户端将拒绝连接，且不会发送任何数据。
Private Processing is Meta’s confidential computing infrastructure, built on TEEs with verifiable transparency. On top of the confidentiality and attestation the hardware provides, it adds non-targetability and encrypted storage. 私密处理是 Meta 的机密计算基础设施，建立在具有可验证透明度的 TEE 之上。在硬件提供的机密性和证明功能之外，它还增加了不可定位性和加密存储功能。
Private Processing for AI Glasses: Extending the Device Boundary
AI 眼镜的私密处理：扩展设备边界
The more you use an AI assistant, the more useful it gets as it learns your style, preferences and context. Wearable AI assistants will help you in similar ways, including with everyday life. To do that they need to know you and your context. That can include connecting ideas across days or weeks, and working proactively in the background to get things done for you without requiring rework from you. This would demand compute capabilities beyond what an ergonomic form factor like a pair of glasses can host locally. That’s where Private Processing comes into the picture. 你使用 AI 助手的频率越高，它就越能学习你的风格、偏好和语境，从而变得越有用。可穿戴 AI 助手将以类似的方式为你提供帮助，包括处理日常生活事务。要做到这一点，它们需要了解你和你的语境。这可能包括跨越数天或数周关联信息，并在后台主动为你完成任务，而无需你反复操作。这需要超出眼镜这种人体工学外形设备本地所能承载的计算能力。这就是“私密处理”发挥作用的地方。
Traditional cloud architectures encrypt data in transit and at rest, but must decrypt it in host memory during processing — potentially exposing it to the underlying system while in use. Private Processing helps us solve this problem, ensuring off-device data stays inaccessible to anyone including Meta. To make this work, we built Private Processing for AI glasses on five engineering requirements, all designed so that we can safely offload intensive AI workloads like streaming transcription, contextual search, and long-term recall: 传统的云架构会对传输中和静态数据进行加密，但在处理过程中必须在宿主内存中解密——这可能导致数据在使用时暴露给底层系统。私密处理帮助我们解决了这个问题，确保设备外的数据对包括 Meta 在内的任何人都是不可见的。为了实现这一点，我们基于五项工程要求构建了 AI 眼镜的私密处理功能，旨在安全地卸载诸如流式转录、语境搜索和长期记忆回溯等高强度的 AI 工作负载：
- Hardware Isolation: User data must be cryptographically unreadable to host operating systems, hypervisors, and Meta in transit, in use, and at rest.
- 硬件隔离： 用户数据在传输中、使用中和静态存储时，对于宿主操作系统、虚拟机管理程序和 Meta 而言，必须在加密层面是不可读的。
- Fail-Closed Guarantees: An attempt to modify the confidential processing guarantee must either cause the system to fail…
- 故障关闭保证： 任何试图修改机密处理保证的行为，必须导致系统停止运行……