The browser encrypts each prompt before it leaves the device. The request can only be decrypted inside an attested TEE running the model.
The stack includes:
- Oblivious HTTP (OHTTP)
- Hybrid Public Key Encryption (HPKE)
- X25519
- HKDF-SHA256
- AES-128-GCM
- remote attestation
- Intel TDX and Nvidia confidential-computing hardware
The browser encrypts the prompt for the TEE
The request path is:
Browser → Brave AI Gateway → NEAR AI TEE → GLM-5.3 Flash
The prompt is encrypted in the browser using a public key associated with the verified TEE.
HPKE uses:
- ephemeral X25519 keys;
- ECDH for shared-secret derivation;
- HKDF-SHA256 for key derivation;
- AES-128-GCM for authenticated encryption.
The Brave gateway relays the encrypted payload but does not have the key required to decrypt it. Plaintext is available only in the browser and inside the TEE.
Inference runs inside protected memory
GLM-5.3 Flash runs inside a confidential-computing environment operated by NEAR AI.
Brave says the deployment uses:
- Intel TDX-protected CPU memory;
- Nvidia confidential-computing GPUs.
The trust model looks like this:
| Component | Sees user IP | Reads prompt |
| Browser | Yes | Yes |
| Brave gateway | Yes | No |
| Infrastructure outside TEE | No | No |
| TEE | No | Yes |
| Z.ai | No | No |
The gateway separates the user's network identity from the system performing inference.
GLM-5.3 Flash specifications
GLM-5.3 Flash is an open-weight Mixture-of-Experts model from Z.ai.
| Specification | GLM-5.3 Flash |
| Architecture | Mixture-of-Experts |
| Total parameters | ~320–321B |
| Active parameters | 18B |
| Context window | Up to 1,048,576 tokens |
| Modalities | Text, image |
| Weight format | FP8 |
| License | MIT |
| Attention | Hybrid sparse / linear |
| Tool calling | Yes |
| Reasoning mode | Yes |
| Servingv | LLM, SGLang |
The model activates about 18 billion parameters per token, despite having more than 320 billion parameters in total.
That reduces compute compared with a dense model of similar total size. The FP8 weights require roughly 306 GiB before KV cache and runtime overhead.
GLM-5.3 Flash vs. DeepSeek V3.1
Brave's previous confidential-AI experiment used DeepSeek V3.1 inside a TEE.
| GLM-5.3 Flash | DeepSeek V3.1 | |
| Total parameters | ~320B | 671B |
| Active parameters | 18B | 37B |
| Context | Up to 1M | 128K |
| Architecture | MoE | MoE |
| Multimodal | Yes | No |
| FP8 | Yes | Yes |
| License | MIT | MIT |
GLM-5.3 Flash has:
- about half the total parameter count;
- less than half the active parameters per token;
- a much larger context window;
- native multimodal support.
The privacy architecture also changed.
Previous scheme:
Browser → privacy infrastructure → TEE → DeepSeek V3.1
Current scheme:
Browser → encrypted OHTTP payload → relay → TEE → GLM-5.3 Flash
The key difference is that the relay no longer needs access to the plaintext request.
Remote attestation verifies the execution environment
Encryption alone is insufficient if the client cannot verify the machine receiving the key. The TEE therefore provides hardware-backed attestation data.
Brave verifies:
- the execution environment;
- approved software;
- the public key generated inside the TEE.
Only after successful verification does the browser encrypt the request for that environment. The security model is based on verifying the execution environment before sending data to it.
Web search also starts inside the TEE
GLM-5.3 Flash can generate search requests from inside the protected environment. These requests are sent to Brave Search's LLM Context API. The search service receives the generated query, but not the user's original IP address from the browser connection. This is relevant because generated search queries can contain context extracted from the conversation.
Current limitations
The design still has several unfinished parts.
Brave plans to:
- move more attestation verification directly into the browser;
- publish a log of TEE public keys;
- attest the exact model weights loaded into memory;
- verify that quantized model variants correspond to published weights.
Current attestation therefore verifies the protected execution environment, but does not yet provide complete cryptographic verification of the model weights themselves.
What changed technically
The main change is not simply the switch from DeepSeek V3.1 to GLM-5.3 Flash.
Brave now combines:
- browser-side encryption;
- remote attestation;
- OHTTP and HPKE;
- confidential-computing hardware;
- open model weights.
Traditional HTTPS protects prompts while they travel over the network. This architecture also attempts to protect them while they are being processed.
