Private AI, except for the OCR, embeddings, crash reports, and plugin calls. Cute.

TEEs dont make data private, they mostly shrink who can snoop.

The bit everyone handwaves is the boundary, not the model, once the prompt, retrieved context, and logs leave the box, “private AI” turns into a policy document with a GPU attached. Federated training is mostly a red herring for the product people arguing about chat privacy anyway.