Apple takes the stance that our data belongs to us, and they’re just the conduit by which it is passed and stored. Sadly, this makes them stand out in the current marketplace in which the user, and our data, is the product that is strip-mined and used in unwanted ways, often without our consent in the United States and many other countries. (And even in states, countries, and regions where that’s forbidden.)
All major chatbots harvest what we tell them in the spirit of training their models further. Some have privacy policies that limit what they extract, but it’s all kind of beyond our control, because the models run in their data centers, and whenever we interact with them, we’re sending them our data in the clear, often directly connected to our accounts. That means that over time, chatbots learn a great deal about us, and some of that becomes the basis for future responses to other people.
For Apple Intelligence, Apple said they brought the same privacy-minded approach to using large language model processing. The company started down this path in June 2024 and updated and revised how they approach it with Siri AI. This ensures Siri can maintain conversational context, provide analysis, and deliver information without compromising our privacy.
Apple uses a combination of on-device and Private Cloud Compute to provide this sort of privacy protection:
- On-device models allow Siri AI to provide responses and Apple Intelligence to perform analysis or generation, which could include internet information requests and retrieving information from your data, without the chatbot component leaving your device.
- Private Cloud Compute is a privacy-protecting framework in which only certain kinds of data from your device leave it to head to Apple’s cloud, where they use models derived from Google Gemini without exposing data of any kind to Gemini.
On-device vs. Private Cloud Compute
As Apple describes it, any task that can performed on your device will be, avoiding privacy issues altogether. However, for the vaguely described “more sophisticated requests” Apple must send some information to their cloud for processing. This cloud system is called Private Cloud Compute (PCC).
Apple enumerates many principles of PCC in their foundational 2024 announcement, but I can summarize this for you (without involving an AI):
- Nobody but you should see your data, including Apple.
- Apple has to have control and understanding of all components that handle data, and not have modes that let their staff access information in special cases, such as debugging modes.
- The system must be designed to prevent targeted attacks that would let an attacker know exactly where an individual’s personal data was being processed and attempt to break in and exfiltrate information from it. _Apple_ doesn’t even know which server will handle the cloud portion of queries. And someone would have to overcome the system’s extreme global protections just to even begin trying to figure that out. Because of the architecture and security, it’s beyond exceedingly unlikely that a global exploit could work.
- Nonetheless, a lot of companies claim they’re impenetrable and privacy-forward. Thus, Apple said outside researchers must be able to verify Apple’s claims.
Apple first built PCC using the same secure components that protect data on their hardware, including the Secure Enclave, which protects encryption keys and biometric information (among many other security bits), and Secure Boot, which prevents devices from starting up with compromised operating systems. This cloud is a collection of nodes that sound like Macs running a highly customized, secure version of macOS that’s stripped down to the necessary components and infused with the PCC sauce.
Data is sent from your device to PCC through end-to-end encrypted connections. Information transmitted is used for the user’s specific purpose (an “inferential request”) and is destroyed after the task is completed. This data can never be accessed by Apple staff or other people, though there are limits Apple does not advertise.
How Google Gemini powers Siri AI
To make Siri AI and expanded Apple Intelligence features work, Apple collaborated with Google to draw on the technologies behind Google’s Gemini model to add to the Apple Foundation Models (the Apple frameworks used for access to large language models). Apple is not handing off data to Google. Heavens, no! Rather, they are “collaborating”—ostensibly involving some form of licensing that isn’t disclosed.
Apple Foundation Models run both on-device and in new PCC nodes on Google Cloud, where Google runs Intel-based servers with Nvidia graphics processing units (GPUs). (GPUs turned out to be ideal for AI operations.) Apple’s in-house PCC uses Apple silicon. The Intel CPU is paired with Google Titan, a security chip that verifies the server’s boot firmware before the CPU is allowed to run it, so that an infiltrator couldn’t slip in a compromised server image.
To achieve this, Apple ensures that every piece of hardware is cryptographically tracked—so another server couldn’t be slipped in, say—and that these new nodes have the same integrity as Apple’s own.