World's Fair 2025
The Unofficial Guide to Apple’s Private Cloud Compute - Jmo, CONFSEC
Overview
This talk provides an unofficial guide to Apple's Private Cloud Compute (PCC) system, explaining how it enables remote AI computation while maintaining user privacy. The core thesis is that Apple addresses the inherent privacy risks of sending data to remote servers by implementing a system with five key requirements: stateless computation, enforceable guarantees, non-targetability, no privileged runtime access, and verifiable transparency. The presentation outlines Apple's conceptual architecture and technical components designed to meet these requirements, offering insights into how similar privacy-preserving techniques can be adopted by developers outside the Apple ecosystem.
Who should watch
- AI engineers and builders interested in privacy-preserving AI infrastructure.
- Product Managers and engineers focused on shipping AI features with strong privacy guarantees.
- Security professionals evaluating methods for secure remote computation.
- Developers seeking to understand how to implement privacy features similar to Apple's PCC.
- Anyone concerned about data privacy when using AI services.
Key takeaways
- Apple's PCC aims to provide remote compute for AI while safeguarding user privacy, a critical value proposition for the company.
- The system is built on five core requirements: stateless computation, enforceable guarantees, non-targetability, no privileged runtime access, and verifiable transparency.
- Key technical components enabling PCC include Oblivious HTTP for anonymizing requests, blind signatures for separating authentication from identity, secure enclaves for key protection, secure boot, and hardened operating systems.
- Remote attestation allows clients to verify the software running on a server before sending data, and the transparency log provides a verifiable record of deployed software.
- While Apple's PCC offers strong privacy, it relies on trusting Apple's implementation and is currently limited to Apple devices and official apps.
- Developers can leverage similar concepts like Oblivious HTTP, blind signatures, TPMs (or vTPMs), and transparency log systems like SIGSUM or SIGSTORE for their own applications.
- Confidential VMs with GPU support are emerging in cloud environments, offering encrypted memory for enhanced privacy.
- The market is seeing increased adoption of private inferencing by other major tech companies, indicating a growing trend in privacy-focused AI.
Notable quotes
*The question that Apple is trying to answer in their PCC system is how do you get remote compute while remaining private and the simple way to do that would be to buy all of the iPhones H100s pair them in the cloud you get your own H100 boom but obviously AI is even more expensive so that's not going to work.*
*The iPhone says I trust the code that you're running. You can only decrypt my data if you're still running that code. So the iPhone can verify what they're doing.*
*You still have to trust you've shifted the trust now into like Apple's behavior rather than the hardware.*
Unofficial community note. Prefer the recording for nuance.