Apple Silicon Node Architecture

Overview

To support Apple Intelligence workloads that require models too large to run on device, we brought the power and security of Apple silicon to the data center with custom server hardware, using the same hardware security technologies found in Apple devices, including the Cryptographic identity and Secure Boot. We paired that hardware with a purpose-built operating system: a hardened subset of the foundations of iOS and macOS, tailored to inference workloads while presenting an extremely narrow attack surface.

A node satisfies PCC’s Core Security and Privacy Requirements using Apple Silicon Software Foundations and a stack of signed, measured cryptexes. User data is released only to nodes that present attested measurements matching a release recorded in the Release Transparency.

Custom server hardware

Apple designs and operates custom server hardware dedicated to Private Cloud Compute. Multiple nodes sit within each server chassis alongside an Apple silicon baseboard management controller (BMC), which manages system state and provisions configuration over chassis-internal networking.

Each node runs directly on bare metal as the sole tenant: the operating system runs on the hardware with no hypervisor beneath it, and no other workload shares the node. That leaves no virtualization layer to escape and no co-resident workload from which to mount a microarchitectural side-channel attack.

Apple silicon

The hardware roots its security in two main components of the Apple silicon System-on-Chip (SoC):

Secure Enclave

The node’s primary Apple Silicon Root of Trust, a dedicated security coprocessor with immutable ROM and a hardware-fused identity that derives the Data Center Identity Key (DCIK). The Secure Enclave evaluates system measurements and signs the node’s remote attestations.

Application Processor

The primary compute engine, integrating CPU cores, a GPU, and unified memory. The Application Processor boots from immutable Secure and measured boot, which locks the digest of the node’s boot manifest into a write-once register before passing control to the system boot loader.

PCC nodes run in Ephemeral Data Mode: the Secure Enclave randomizes the data volume’s storage-key hierarchy at every boot, so no data written in one boot session is readable in the next.

Node software

PCC nodes run a minimal operating system based on iOS and macOS, and layer PCC software above it as Cryptexes.

The node’s software stack includes:

Operating system

A hardened Apple Silicon Software Foundations that excludes shells, interpreters, and debuggers to maintain a minimal attack surface.

Private Cloud Extensions

A Private Cloud Extensions providing services for node initialization, attestation generation, and Distributed inference coordination.

Cloud applications

PCC cloud applications containing request handling, The Inference Engine, and workload processing.

Foundation models and adapters

Foundation model and adapter cryptexes containing model weights and parameters, marked as data only.

During boot, darwin-init configures the node, activates the cryptexes, and ratchets their manifests into the Secure Enclave before entering Restricted Execution Mode. Apple Silicon Node Attestation reports this measured state, which Node validation checks against the transparency log before any user data reaches the node.