Want your AI chats to stay private? Brave TEEs up end-to-end encryption
Browser maker using trusted hardware to protect conversations with GLM 5.3 Flash
Brave Software has introduced a secure environment for users to converse with its AI assistant in private. Amidst growing concerns over AI agents requesting extensive personal information and repurposing conversations for training, this marks a step against the prevailing trend. Building upon an experiment initiated last November to create a confidential channel for Large Language Model (LLM) conversations, Brave has integrated Leo AI assistant with Z.ai's GLM 5.3 Flash, safeguarded by end-to-end encryption.
Prompt submitted to Leo are encrypted on-device, then sent over the network via Oblivious HTTP, a protocol that separates network requests from associated content. The AI Gateway forwards the encrypted query to the Trusted Execution Environment (TEE) without revealing the user's IP address. Upon verifying the enclave's attestation, Brave encrypts the query using a key bound to the TEE.
The TEE decrypts the request, runs it through the AI model, and then sends back an encrypted response, which the receiving browser decrypts. This approach, developed in collaboration with Intel TDX and Nvidia Confidential Compute, ensures end-to-end encryption, keeping Brave from knowing the user's queries and NEAR AI from knowing the user.
Responses are signed within the TEE, with attestation enabling users to confirm no manipulation of the model. While Leo's GLM 5.3 Flash model operates within the TEE, Brave's AI bot can still perform searches via the Brave Search API's LLM context endpoint, with the search transit happening within the TEE, keeping the user's IP address hidden.
However, the implementation is not yet finalized. Brave plans to incorporate verification steps into the browser, publish TEE key logs, and provide enclave attestation for exact model weights loaded into memory. While other tech giants like Apple, AWS, Google, Nvidia, and Microsoft offer private cloud compute infrastructure for AI, companies such as Prem AI promise encrypted inference, and providers advertising zero data retention are not as verifiable.
Running inference on local hardware using open weight models remains one way to ensure privacy, provided the model and machine remain uncompromised.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
