Intel / article

Bringing Private Processing to Meta AI Glasses

Source: engineering.fb.com
Date: Published Sep 24, 2026

Context

Meta describes a cloud architecture for AI glasses designed to keep personal inaccessible to the infrastructure operator while models process it. Its Private Processing design runs workloads inside hardware-isolated virtual machines. Before sending context, glasses check hardware-signed evidence about the server and compare its software measurement with a public transparency ledger; failed checks stop the connection.

For features that retain memories, the design encrypts stored output with user-provided keys and runs queries inside the protected environment. The public ledger makes software substitutions detectable. Inspecting what that software actually does requires access to the binaries, which Meta says researchers receive under agreement.

Key takeaways · AI-distilled

Meta says the glasses verify servers before sending any context: an RA-TLS handshake checks a hardware-signed attestation and matches the CVM binary hash against a public, third-party-witnessed ledger, and the device refuses to connect if either check fails.
To keep operators from targeting one user, Meta describes anonymous blind-signed credentials fetched on randomized schedules plus a third-party OHTTP relay (Fastly or Cloudflare), so its auth service cannot tie a request to an account.
Meta argues that encrypting data on-device and storing it in a normal cloud database fails: access patterns still reveal a user's routine, and encrypted vector search means hauling ciphertext into a TEE per query. Its answer is running storage and query engines inside the TEE.
Because engineers cannot attach debuggers, dump memory, or log model inputs inside the TEE, Meta says observability relies only on out-of-band aggregate signals such as CPU utilization, memory allocation, network latency and hardware failure rates.
Meta is expanding its bug bounty to cover Private Processing on AI glasses. Ledger measurements are public, but the CVM binaries themselves are available only to researchers in its security program under agreement.

Terms in this piece · Glossary

context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.

Read the source engineering.fb.com