Brave Software专门打造了一个安全空间，让使用其浏览器的用户能够私密地与公司的AI助手进行对话。当前，诸如Meta的Muse这类AI助手往往需要获取用户的大量个人信息，不少AI企业也会将用户对话内容挪作训练之用，Brave的这一举措可谓逆势而行。去年11月，Brave借助NEAR AI的可信执行环境（TEE）试行了大语言模型对话的保密通道，此次又进一步将旗下的Leo AI助手与Z.ai开发的GLM 5.3 Flash模型相衔接，全程采用端到端加密技术予以保护。
Brave Software has set up a secure space so those using its browser can converse with the company's AI assistant in private. At a time when AI agents like Meta's Muse ask for extensive access to personal information, and AI companies repurpose conversations for training, this amounts to swimming against the tide. Following up on an experiment launched last November to implement a confidential channel for LLM conversations with the help of NEAR AI's trusted execution environment (TEE), the browser maker has connected its Leo AI assistant to Z.ai's GLM 5.3 Flash under the protection of end-to-end encryption.
如此一来，Brave用户向Leo发送的指令会在本地完成加密，随后借助Oblivious HTTP协议传输至网络——该协议可确保网络请求与其关联内容相互分离。Brave的AI网关会将加密后的查询请求转发至可信执行环境，且不会泄露用户的IP地址。待Brave验证该环境的可信性后，浏览器会使用绑定至该环境的密钥对查询请求再次加密。
The result is that Brave users can submit a prompt to Leo that gets encrypted on-device and sent over the network using Oblivious HTTP, a protocol for separating network requests from associated content. Brave's AI Gateway forwards the encrypted query to the TEE without passing along the user's IP address. After Brave verifies the enclave's attestation, the browser encrypts the query using a key bound to the TEE.
可信执行环境负责解密请求、交由AI模型处理，随后返回加密后的响应结果，最终由接收请求的浏览器完成解密。
The TEE decrypts the request, runs it through the AI model, and sends back an encrypted response that gets decrypted by the receiving browser.
“2014年我在《信任但需验证》一文中提出，用户不应盲目信任自己所使用的软件，”Brave联合创始人兼首席执行官布伦丹·艾希在声明中说道，“用户理应具备验证软件可靠性的能力，这是以用户为中心的核心原则。如今AI技术虽发展迅猛，但仍有大量相关服务建立在‘相信我吧’式的承诺之上，往往损害了用户的利益。”
"In 2014, I argued in 'Trust but Verify' that users shouldn't have to place blind trust in the software they rely on," said Brendan Eich, co-founder and CEO of Brave, in a statement. "They should be able to verify it; this is a user-first principle. AI has raised the stakes, yet too much of it still runs on 'trust me bro' promises, often at the user's expense."
NEAR AI的保密型AI处理流程基于英特尔TDX与英伟达机密计算技术构建，全程采用端到端加密机制：Brave无法知晓用户的具体提问内容，NEAR AI也无法获知提问者的身份。数据处理环节还设有数据隔离机制，确保提问内容或响应结果在处理过程中不被读取。此外，响应结果会在可信执行环境中完成签名，同时提供可信性验证机制，便于用户确认所用AI模型并未被暗中替换。
NEAR AI's confidential AI pipeline is built with Intel TDX and Nvidia Confidential Compute. It includes end-to-end encryption that keeps Brave from knowing what was asked and NEAR AI from knowing who did the asking during the network hop. Data isolation prevents the prompt or response from being read during processing. Responses are signed in the TEE and there's attestation so users can confirm there's no model bait-and-switch.
Leo的GLM 5.3 Flash大脑在此场景下可能被隔离，但Brave的AI机器人仍可通过Brave Search API的LLM上下文端点在TEE内部进行搜索。通过这种方式进行的任何搜索都将通过TEE传输，而不是通过用户的浏览器，从而使得用户的IP地址不被暴露。该实现尚未完全完成：Brave计划将验证步骤移至浏览器，并发布TEE密钥日志，同时为加载到内存中的精确模型权重提供 enclave 证明，此外还有其他工作。
Leo's GLM 5.3 Flash brain may be isolated in this scenario, but Brave's AI bot can still conduct searches from within the TEE via the Brave Search API's LLM context endpoint. And any searches done this way transit via the TEE rather than the user's browser, which keeps the user's IP address out of the picture. The implementation isn't quite complete: Brave intends to work on moving the verification step into the browser and to publish a log of TEE keys, and to provide enclave attestation for exact model weights loaded into memory, among other things.
Brave并非唯一一家致力于降低AI数据暴露风险的公司。苹果、AWS、谷歌、英伟达和微软均拥有某种形式的私有云计算基础设施用于AI。此外，还有Prem AI，它承诺提供加密推理，还有宣称零数据保留的服务提供商，但其可验证性较低。使用AI时确保隐私的一种方式是在本地硬件上使用开放权重模型运行推理，前提是该模型及其运行的机器未被入侵。®
Brave is not the only company trying to make AI less of a data exposure risk. Apple, AWS, Google, Nvidia, and Microsoft all have some form of private cloud compute infrastructure for AI. Then there's Prem AI, which promises encrypted inference, not to mention providers advertising zero data retention, which isn't as verifiable. One way to ensure privacy while using AI is to run inference on local hardware using an open weight model, assuming the model and the machine running it haven't been compromised. ®