Apple says its AI is still private, even when it's running on Google's servers

Taking Private Cloud Compute on the road

Federighi outlines the high-level architecture of its new Apple Intelligence capabilities.

Credit: Andrew Cunningham

“This is the amount of the Google system we use, which is none,” says Federighi, standing in front of a blank slide in a much more intimate theater than the giant outdoor auditorium where he had introduced CEO Tim Cook a couple of hours before.

Federighi has just outlined a “traditional chatbot architecture”—a client app running on your device that reaches out to cloud-based models running on third-party servers. Those models can then reach out to Google Search or something similar “to [ground themselves] in world knowledge.”

Apple’s system still depends on an on-device model for simpler queries. In this year’s OS releases, most Apple Intelligence devices get AFM 3 Core, a new Gemini-based model co-developed by Google and Apple. Newer devices with at least 12GB of RAM and a relatively recent chip (M3 and newer for Macs, M4 and newer for iPads, just the A19 Pro for iPhones) use AFM 3 Core Advanced instead, which leverages the extra hardware as well as your device’s storage to function (it’s used to improve dictation and power Siri’s more expressive voice).

For “more sophisticated” questions, your device will contact cloud-based models, again co-developed by Apple and Google: a general-use model called AFM 3 Cloud, an image-generation model called ADM 3 Cloud, and an advanced model called AFM 3 Cloud Pro for “agentic tool use and complex reasoning.” The first two models, Apple says, still run on Apple’s silicon on Apple’s servers. The Cloud Pro model is the one running on Google-owned Nvidia hardware.

To do this while still making the same privacy promises, Apple has introduced a new iteration of Private Cloud Compute, this one designed to run on third-party hardware. Apple is using Nvidia’s Confidential Computing, Intel’s Trust Domain Extensions, and Google’s Titan security chip to provide layers of protection similar to what Apple provides for its own servers. To provide additional protection, Apple keeps “a cryptographically verifiable, append-only ledger of all Google Cloud hardware that is part of the PCC fleet,” and Apple’s devices will only trust software on these servers that is signed by Apple.