Google Patents a Two-Stage AI That Strips Your Personal Data Before Asking the Cloud
Google is patenting a system where the AI on your phone acts as a privacy filter, deciding whether a question is worth sending to a more powerful cloud AI and scrubbing your personal details before it does.
How Google's on-device AI decides when to call the cloud
Imagine you're chatting with your phone's assistant and it picks up on something in your calendar or a notification. Before it goes off to ask a giant cloud-based AI for help, a smaller AI sitting right on your phone has to approve that request first.
That on-device gatekeeper does two jobs: it decides whether the question is actually worth bothering a powerful remote AI about, and if it is, it removes anything personal from what gets sent. Names, addresses, and other identifying details get swapped out for bland placeholders like a fill-in-the-blank form. The cloud AI fills in those blanks with its answer, and then your phone swaps the real information back in before you ever see the response.
The result is that you get a proactive, helpful suggestion without your personal data ever hitting a remote server in a readable form. The heavy AI lifting happens in the cloud, but your private details stay on your device.
identifying personal identification information (PII) within the textual data; and redacting the PII by substituting the PII with placeholder tokens; transmitting, to the remote LLM, the remote LLM prompt; receiving, from the remote LLM, response content comprising the placeholder tokens; …
Translation: The system hides your private details before sending data to the cloud and puts them back once the answer returns.
How the local model redacts PII before the cloud sees anything
The patent describes a cascade architecture for a digital assistant, meaning a chain of AI models where each level only hands off to the next when it has to.
Here is how the sequence works:
- A contextual event triggers the assistant. This could be a notification, a calendar entry, a photo, or any non-text input. The local model converts that raw input into text it can reason about.
- The local LLM (a smaller AI model running entirely on the device, no internet needed) estimates a remote LLM prompt confidence, essentially a score for how likely it is that a more powerful cloud AI would actually add something useful. If the score is too low, the chain stops there and no external call is made.
- If the score clears a threshold, the local model builds a prompt to send to the remote AI. During that step, it scans for PII (personally identifiable information), things like your name or a street address, and replaces each piece with a placeholder token, a generic tag like [NAME_1].
- The cloud AI receives and responds to the redacted prompt, naturally including those same placeholder tokens in its answer.
- Back on the device, the local model swaps the placeholders for the real values before the assistant presents anything to the user.
The net effect is that the cloud model never processes raw personal data, only a sanitized version of the question.
… determining, using a local large language model (LLM) executing on the user device, a remote LLM prompt confidence. The method includes determining that the remote LLM prompt confidence satisfies a threshold. Based on determining that the remote LLM prompt confidence satisfies the threshold, the method includes generating a remote LLM prompt …
Translation: Your phone uses its own internal AI to decide if a request is important enough to send to Google's larger servers.
What this means for AI assistants and your private data
Digital assistant privacy has long been a tension point: the most capable AI models live in data centers, but sending personal context to those servers creates real exposure. This patent's two-layer approach tries to resolve that tension without forcing a choice between capability and privacy. For users, the practical implication is an assistant that can tap into cloud-scale reasoning for genuinely complex tasks while keeping names, locations, and other sensitive details from ever leaving the device in readable form.
For Google specifically, this matters because its assistant products sit at the intersection of personal data and cloud AI, exactly the area drawing the most regulatory and public scrutiny. Funneling only anonymized prompts to remote models could help insulate the company from data-handling complaints. The redact-then-restore pattern is technically elegant but also narrow in scope, and the breadth of protection it actually delivers will depend heavily on how well the local model identifies PII in practice. AI assistant privacy is one of the more active areas covered among new Big Tech patents, and this filing shows Google betting that on-device intelligence is the right place to draw the privacy boundary.
Google files its 38th application we've tracked since May in our on-device AI privacy watchlist, building on work like splitting protection across servers and learning preferences without personal data.
The main claim is specific enough to matter. It requires one on-device model to find and hide private information, swap it for stand-in labels, then reverse that swap later, all as separate named steps in one process.
That precision cuts both ways. Google gets a clear, defensible claim, but rivals can sidestep it by moving the privacy-scrubbing step to a remote server, or by using a simple rules-based filter instead of a small on-device AI model.
The real blocking power of this patent, if approved, hits only competitors who copy this exact two-model setup with the scrubbing done locally on the device. Whether that covers the most valuable products in this market depends on design choices rivals have not yet made public.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
5 drawing sheets from US 2026/0244856 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →