Craig Federighi, senior vice president of software at Apple, has shed some light on how the company manages data privacy in the artificial intelligence cloud. According to Federighi, the servers that Apple uses for these functions, called Private Cloud Compute (PCC), are deliberately designed to be “basic,” and this is not a coincidence. This simplicity aims to ensure that our data remains private.
Simplicity as the key to privacy
Apple’s approach to its Apple Intelligence features and data handling is structured in three stages. First, the company performs as much processing as possible directly on our device, without sending data to external servers. Only when strictly necessary, and the device does not have the capacity to handle the required processing, the data is sent to Apple’s servers. As a last resort, and only with our consent, the company uses external services like ChatGPT to complete processing tasks.
In this context, one of Apple’s biggest challenges has been achieving a level of privacy equivalent to end-to-end encryption (E2E) on servers that perform natural language processing. The problem with this type of processing is that servers need to access the data we send them to perform AI inference, which goes against the principles of E2E, where not even the server should be able to read the data.
To solve this, Apple has implemented three main solutions. First, they have placed all server management tools outside the protected zone, such as load balancers and data loggers, preventing them from decrypting the data. Second, they use non-persistent storage.
One of Apple’s key decisions has been to design PCC servers in an extremely simple way. These servers do not have persistent storage, such as hard drives or solid-state drives, which means they cannot store processed data. This decision aims to eliminate any possibility of data being retained beyond the moment it is processed and returned to our device.
In his interview with Wired, Federighi explains that PCC servers cannot retain any data after a restart, as the encryption system is designed to destroy any encryption key every time the server restarts. As a result, after each restart, the servers start from scratch with a new encryption key, making any previously processed data completely irrecoverable.
Thirdly, and in line with the previous two, Apple has made each production version of the PCC servers publicly available for inspection. This allows anyone to verify that the servers function according to Apple’s claims, but this system goes further.
The records of all versions of PCC servers are stored in a cryptographic attestation log, preventing any unverified server from processing data. In fact, any Apple device would even refuse to send data to a server that has not been properly authenticated.
“Creating the trust model in which our device will refuse to send a request to a server unless the signature of all the software that the server is running has been published in a transparency log has undoubtedly been one of the most unique elements of the solution, and completely critical to the trust model,” comments Federhigi.
