Google Introduces AISeal Architecture for On-Device AI in Android

Google’s AISeal architecture is a new Android security design for on-device AI features working with sensitive user context. On October 7, Google provided more details about the solution, which uses the Android Virtualization Framework (AVF), the pKVM hypervisor, and a protected virtual machine separated from the host operating system.

This is not a fix for a specific vulnerability, but an architectural change for a scenario in which proactive assistants and other AI features may access, for example, messages, calendars, or a local data index. The goal is to prevent such context from being processed directly in the standard Android system environment.

Google’s AISeal architecture uses AVF and pKVM

AISeal is built on AVF, Android’s virtualization layer, and pKVM. The protected virtual machine is intended to be separated from the host OS. Google describes it as a multitenant vault for protected databases, future on-device inference through AICore, and AI agents.

AppSearch is the reference database for this environment. It can store a local index of data that AI features use to provide contextual responses or suggestions. The isolation is intended to reduce the scope of data accessible from the operating system’s main environment.

Google claims that sensitive data should remain cryptographically isolated even if the host OS is fully compromised. However, this is a security goal and a claim by the manufacturer; no independent audit has been published for the specific AISeal implementation.

Components are already in Android 17

AISeal was part of Android 17’s security news. The released Android Open Source Project tree contains components and tests labeled aiseal, confirming the presence of this technology in the platform’s publicly available code.

Google speaks of actively deploying the architecture, but describes some features as future extensions. These include inference directly in the vault, direct NPU assignment for the protected virtual machine, and confidential cloud expansion. The available information therefore does not show that all of these capabilities are already active in commercial devices.

MediaTek lists AISeal for Dimensity 9600 Pro

MediaTek lists AISeal and isolation through pKVM on the Dimensity 9600 Pro chipset product page. However, this is not a complete list of phones in which the feature will actually be available to users.

Google also states that Qualcomm Snapdragon chipsets will receive future support through AVF. However, separate confirmation from Qualcomm could not be found. The availability schedule, list of supported manufacturers, and exact conditions under which the NPU can be used in an isolated virtual machine also remain unknown.

What will be important to watch

• announcements from phone manufacturers about devices with AISeal actually enabled,
• further technical documentation and changes in AOSP clarifying the threat model and isolation boundaries,
• separate confirmation of support from Qualcomm,
• independent security assessments and audits of implementations.

AISeal’s practical benefits will depend on support for specific chips, devices, and manufacturer implementations. However, the architecture shows that Android is planning a separate environment for sensitive data needed during on-device AI processing.

Verified and updated: 10/08/2026 06:23