en.Wedoany.com Reported - At the Confidential Computing Summit, Apple detailed the architecture of its Private Cloud Compute (PCC) for the first time and formally proposed a four-tier security framework for cloud AI systems. PCC is the cloud infrastructure powering Apple Intelligence, designed to handle AI workloads that cannot be processed directly on iPhone, iPad, or Mac. Ivan Krstić, Apple's Vice President of Security Engineering and Architecture, introduced the new framework in a keynote and revealed that Apple has expanded PCC from its fully owned infrastructure to Google Cloud, while maintaining the highest levels of privacy and security standards.
Krstić noted that traditional cloud AI systems lack transparency in the access and retention of user data. To address this, Apple designed a four-tier security framework for cloud AI systems. Tier 0 corresponds to traditional cloud AI deployments, relying primarily on policy-based protection. Tier 1 introduces auditable sealed inference environments with measurable boot chains and tamper-proof logging. Tier 2 adds verifiable transparency, anonymous authentication, and non-targetability features to prevent operators from singling out specific users. Tier 3, which Apple calls "Frontier Security and Privacy," includes defenses against sophisticated side-channel attacks and hardware supply chain intrusions, while minimizing trust requirements for cloud providers and infrastructure operators.
Private Cloud Compute was first launched in 2024, running on Apple's own servers equipped with Apple silicon, serving as the cloud extension for Apple Intelligence. The architecture is based on stateless inference, encrypted user state management, verifiable software transparency, and the elimination of privileged runtime access. Apple stated that each PCC server provides cryptographic attestation to user devices, allowing software measurements to be compared against a public transparency log. Apple also released PCC software and research tools for external security researchers to examine the platform's security.
Apple recently deployed part of PCC to Google Cloud to handle growing AI workloads, including advanced reasoning and agent tool usage. This deployment integrates Google Cloud infrastructure, Intel Trusted Domain Extensions (Intel TDX), NVIDIA Confidential Computing, and Google's Titan root-of-trust architecture. Krstić emphasized that Apple did not lower its security standards due to the migration but instead collaborated with Google to build a fully provable computing environment spanning client and host systems. Apple stated that the infrastructure mitigates supply chain risks through multiple independent hardware roots of trust and cryptographically verifiable hardware inventories, maintaining end-to-end transparency.
Apple's four-tier security framework ranges from traditional cloud deployments (Tier 0) to "Frontier Security and Privacy" (Tier 3). PCC employs stateless AI inference to avoid long-term retention of user prompts and data. Apple devices verify PCC software through cryptographic attestation bound to a public transparency log. Anonymous authentication and third-party privacy relay mechanisms prevent Apple from linking individual users to specific inference requests. PCC deployed on Google Cloud uses Intel TDX confidential virtual machines, NVIDIA Confidential Computing, and Google's Titan security architecture. Apple believes that relying solely on confidential computing is insufficient and must be combined with transparency, non-targetability, and supply chain protection. Security researchers can already access PCC binaries, documentation, research tools, and a live research system through Apple's security research program.
Krstić stated: "At Apple, we believe privacy is a fundamental human right. We believe that the immense potential of AI can only be realized by building systems worthy of the deepest user trust." Apple's PCC expansion does not transfer trust to Google Cloud; instead, Apple retains control over the software, attestation, and transparency mechanisms used to manage the service. User devices verify that PCC workloads are running Apple-approved software before processing requests, enabling Apple to extend AI inference to third-party infrastructure while maintaining its existing security and privacy model.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
