Private Cloud Compute: how Apple tries to make cloud AI requests unreadable to Apple
Private Cloud Compute is Apple's server system for Apple Intelligence requests that exceed on-device models. Apple says even it cannot read the data. Here is how the design works and what remains to verify.
Private Cloud Compute (PCC) is Apple’s system for running AI requests on its own servers when a task is too big for the model on a user’s device. Apple says it is built so that personal data sent to PCC is not accessible to anyone other than the user, including Apple itself. The company announced the design on June 10, 2024, alongside Apple Intelligence.
Sending only what a request needs, then forgetting it
Most AI assistants face a split. Small models on a phone or set-top box keep data local but are limited. Large models in a data center are more capable, but a request has to leave the device and sit, at least briefly, on someone else’s machine. PCC is Apple’s attempt to make that second path behave more like the first.
A useful analogy is a rented workshop with no storage and no staff on the floor. A request arrives, the job is done, and nothing is left behind. In Apple’s description, data is used only to fulfill the request and is not retained, logged or kept for debugging. The post says PCC deletes the user’s data after fulfilling the request.
Five requirements that shape the design
Apple’s security team, in its June 2024 post, lists five requirements that PCC is meant to satisfy:
- Stateless computation: data is used only for the request and then deleted.
- Enforceable guarantees: protections are enforced technically and do not depend on outside components, such as load balancers that terminate TLS encryption.
- No privileged runtime access: Apple’s own site reliability staff have no interface that bypasses the privacy guarantees, and that access cannot be widened while the system runs.
- Non-targetability: an attacker should not be able to aim at one specific user without first attempting a broad compromise of the system. Apple calls its approach target diffusion.
- Verifiable transparency: outside researchers must be able to check that the guarantees hold and that production software matches what they inspected.
The first four are engineering constraints. The fifth is what separates PCC from a plain promise, because it is meant to make the claims checkable.
Custom servers, a stripped-down operating system
According to Apple, each PCC node is custom server hardware built on Apple silicon, using the same security technologies found in the iPhone, including the Secure Enclave and Secure Boot. Apple also describes a hardened supply chain, with component imaging, tamper switches and third-party observation during provisioning.
The software is a new operating system that Apple describes as a hardened subset of the foundations of iOS and macOS, tailored for large language model inference. It has a narrow attack surface, uses code signing, sandboxing and Pointer Authentication Codes, and leaves out remote shells and general-purpose debugging and observability tools. The inference stack is written in Swift, a memory-safe language.
The idea echoes what the security field calls confidential computing, where hardware-backed protections keep data private even from the operator of the machine. Apple’s version is notable mainly because it controls the whole stack, from chip to operating system to the client software on the device.
Letting outsiders check the claims
Verifiable transparency works through attestation and a public record. Apple said a user’s device will only send data to nodes that can cryptographically attest to running publicly listed software. The measurements of all code running on PCC are to be published in an append-only, tamper-proof log, so a release cannot be removed without detection. Apple also committed to publishing software images within 90 days of log inclusion, or after relevant updates are available, whichever comes first.
On October 24, 2024, Apple expanded the research access. It released a Private Cloud Compute Security Guide covering how attestations build on hardware features, how requests are authenticated and routed, and how the system holds up in attack scenarios. It also released a Virtual Research Environment (VRE), which runs the PCC node software in a virtual machine on a Mac with Apple silicon and at least 16GB of unified memory, with a virtual Secure Enclave Processor. The VRE shipped in the macOS Sequoia 15.1 Developer Preview. Apple published source code for key components, including CloudAttestation, under a limited-use license.
The Apple Security Bounty covers the PCC software stack. Apple’s October 2024 post sets these top rewards, here described in condensed form:
| Type of finding | Top reward |
|---|---|
| A remote compromise that exposes user requests and lets the attacker run code with any privileges | $1,000,000 |
| Reading user requests from beyond the system’s trusted perimeter | $250,000 |
| Capturing user requests by an adversary with a privileged position on the network | $150,000 |
| Running code that has not been attested | $100,000 |
| Unintended exposure of data caused by a deployment or configuration mistake | $50,000 |
Where Siri AI on the living room TV uses it
PCC first served Apple Intelligence on iPhone, iPad and Mac. It now appears in Apple’s description of the new Apple TV 4K. As our report on the $299 box notes, Apple says Siri requests on the device use on-device processing or Private Cloud Compute, and that microphone data is handled in Secure Exclaves that tvOS, apps, the user and Apple cannot access. That matters because the box has far-field microphones that listen for a wake word while audio plays.
Those statements come from Apple and have not been independently tested. Apple has also not said how much of Siri AI runs on the box itself, and the usage limits it mentions suggest some requests do leave the device.
Limits of the model, and what to watch
PCC reduces the amount of trust a user must place in Apple, but does not remove it. Several limits are worth keeping in view:
- The user still trusts the client. Attestation is checked by software on the device, which Apple also builds.
- Source access is partial. Apple released key components under a limited-use license, not everything under an open license.
- Verification takes effort. Few people can audit attestation logic, so assurance depends on independent researchers publishing results.
- Metadata is a separate question. The design targets request content; the post does not claim that the existence or timing of requests is hidden.
Things to watch include whether researchers publish findings from the VRE and the bounty program, whether the transparency log and image publication keep to the stated 90-day window, and what independent testing shows after the Apple TV 4K ships on November 13 about how often Siri AI requests actually reach PCC.
Sign Up for the Daily AI Pulse
One email a day. All the stories that matter.
By signing up, you agree to our Terms of Use and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Daniel ReedAI Research, Safety & Ethics AnalystDaniel Reed currently works as an AI Research, Safety & Ethics Analyst at Aiholics, writing about how changes in artificial intelligence are affecting and will affect scholarship,…
