Contents

Private Cloud Compute Security Guide

A new frontier for AI privacy in the cloud.

Overview

Private Cloud Compute (PCC) delivers groundbreaking privacy and security protections to support computationally intensive requests for Apple Intelligence by bringing our industry-leading device security model into the cloud. Whenever possible, Apple Intelligence processes tasks locally on device, but more sophisticated tasks require additional processing power to execute more complex foundation models in the cloud. Private Cloud Compute makes it possible for users to take advantage of such models without sacrificing the security and privacy that they expect from Apple devices.

We designed Private Cloud Compute with an extraordinary set of core requirements that go beyond traditional models of cloud AI security, grouped into three layers:

High-security inference

Gives the service an auditable, hermetic pipeline designed to defeat the attackers that any production cloud service faces.

Verified service and cloud

Lets anyone outside Apple check what we run, so a user need not trust us as the operator.

Frontier security and privacy

Defends against well-funded adversaries who may mount side-channel attacks or reach into the hardware supply chain.

PCC serves requests from two node platforms, Apple silicon and Google Cloud. The two share the guarantees a node makes and the evidence it must produce before PCC trusts it with user data: a node presents attested measurements that match a release recorded in the public transparency log, and user data reaches it only if that proof holds. Each platform reaches that shared verification model through its own hardware and its own software stack.

This guide walks through these requirements and provides the resources a researcher needs to verify them independently, including a comprehensive look at the technical design of PCC and the specific implementation details needed to validate it.

Start with the Core Security and Privacy Requirements, which state what PCC must do, grouped by what a user has to trust at each layer. Each node platform, Apple Silicon Node Architecture and Google Cloud Node Architecture, then has its own pages for its hardware roots of trust, software stack, and attestation. The Anonymous Request Routing, the PCC cloud applications, and the Release Transparency and Management and Observability mechanisms work the same way on every node, and one set of pages covers them for both platforms.

Each platform also has a research environment. The Virtual Research Environment boots a virtual node on a Mac with Apple silicon; the Google Cloud Research Environment provisions one on real cloud hardware. Auditing the transparency log is the same work on either platform.

Topics

Core requirements

Apple silicon nodes

Google Cloud nodes

Request processing

PCC applications

Transparency and management

Resources

Apple silicon research environment

Google Cloud research environment

Reference