Confidential AI in practice: how Apple, Google and Meta process AI requests privately

On this page

• The problem they all solve
• The shared pattern
• Apple Private Cloud Compute
• Google Private AI Compute
• Meta’s Private Processing for WhatsApp
• Enterprise and the AI labs
• Comparison
• Where confidential AI falls short
• Seven questions to ask a vendor that claims confidential AI
• Frequently asked questions
• Sources

This part is new in the 2026 version of the series. When I wrote the original articles for Kin in early 2025, confidential computing for AI was something a few teams were betting on. Today the largest consumer platforms route sensitive AI requests through confidential clouds. Looking at how they do it is the best way to understand what “private AI in the cloud” can and cannot mean.

The problem they all solve

The best models are too big for a phone, so requests have to go to a data centre. Normally that means your message, your context and the answer exist in plaintext on servers the provider controls, where they can be logged, inspected, kept or demanded by a court. The goal of confidential AI is to keep the capability of the cloud while removing the provider’s ability to see the data.

The shared pattern

Apple, Google and Meta have built different systems, but they share five building blocks:

1. Stateless processing. The server uses your data only to answer the request and keeps nothing afterwards. No persistent storage, no logging of content.
2. Hardware enclaves. The model runs inside a trusted execution environment, so the operator, the host system and administrators cannot read memory.
3. Remote attestation. The device checks a signed measurement of the server’s software before sending anything, and refuses to talk to servers running unknown code.
4. Verifiable transparency. The software images are published, so independent researchers can inspect what the servers actually run and confirm that what the device attests to is the same code.
5. Anonymising relays. Requests travel through a third-party relay, typically using Oblivious HTTP, so the AI provider does not see your IP address and the relay does not see the content.

The combination is what matters. Encryption alone does not stop the operator. Enclaves alone do not prove which code runs. Attestation and published images turn a privacy promise into something that can be checked.

Apple Private Cloud Compute

Apple announced Private Cloud Compute (PCC) in June 2024 for Apple Intelligence requests that are too large for the device. It runs on Apple silicon servers built for the purpose, without persistent storage and without remote shell access for administrators. Apple’s server foundation model runs on PCC.

A device only sends a request to PCC nodes whose software has been published and whose attestation matches. In October 2024 Apple released a Virtual Research Environment that lets security researchers run the PCC software on a Mac, published parts of the source code and extended its bug bounty to PCC with rewards of up to one million dollars.

Apple has since confirmed that Google’s Gemini models will power the next generation of Siri. Apple and Google say Apple Intelligence will continue to run on Apple devices and Private Cloud Compute. How the Gemini-based models fit into that in practice is one of the questions worth watching as it rolls out.

Google Private AI Compute

Google announced Private AI Compute in November 2025 as its counterpart for Gemini features on Android. It runs on Google’s own TPUs inside what Google calls Titanium Intelligence Enclaves, built on an AMD-based hardware TEE.

The phone and the enclave attest to each other before they exchange data, over an encrypted channel, and third-party relays hide the user’s IP address. Sessions are ephemeral. Before launch, NCC Group assessed the system from April to September 2025 and reported a low-risk timing side channel in the relay and some attestation denial-of-service issues, which is a good example of the kind of independent review these systems need. The first features to use it were Magic Cue on the Pixel 10 and summaries in the Recorder app.

Meta’s Private Processing for WhatsApp

Meta presented Private Processing in April 2025 to bring AI features to WhatsApp without breaking the promise of end-to-end encryption. The first use was summarising unread messages.

Requests run in confidential virtual machines with GPUs in confidential computing mode. They arrive through Oblivious HTTP via a third-party relay, with anonymous credentials, so Meta cannot link a request to a user. The phone verifies the server through remote attestation over TLS against a public, third-party ledger of acceptable software, and the processing is stateless.

Enterprise and the AI labs

The same pattern is spreading to business AI. NVIDIA made multi-GPU confidential computing generally available in April 2025, and Azure and Google Cloud offer confidential virtual machines with H100 GPUs. Anthropic published a research sketch of confidential inference using trusted virtual machines in June 2025, explicitly as research rather than a product. In September 2026 OpenAI announced “Private Intelligence” for enterprises, including a confidential-computing-based private inference service in preview, though it has not said which hardware it uses.

Comparison

	Apple Private Cloud Compute	Google Private AI Compute	WhatsApp Private Processing
Announced	June 2024	November 2025	April 2025
Used for	Apple Intelligence requests too large for the device	Gemini features on Android, such as Magic Cue and Recorder	AI features in WhatsApp, starting with message summaries
Hardware	Apple silicon servers	Google TPUs in Titanium Intelligence Enclaves (AMD-based TEE)	Confidential VMs with GPUs in confidential mode
Attestation	Device verifies published, attested software images	Mutual attestation between phone and enclave	Remote attestation over TLS against a third-party ledger
Hides your IP address	Yes, via a third-party relay	Yes, via third-party relays	Yes, via Oblivious HTTP and a third-party relay
Data kept after the request	No	No (ephemeral sessions)	No (stateless)
Independent review	Public research environment, bug bounty up to $1M	NCC Group assessment before launch	Published design, bug bounty

Where confidential AI falls short

These systems are a big step forward, but they are not magic. Four limits are worth knowing.

Physical attacks work. In autumn 2025 three research teams published attacks on the memory bus. Battering RAM used an interposer costing under 50 dollars to break Intel’s scalable SGX and AMD SEV-SNP. WireTap extracted an SGX attestation key with equipment costing around 1,000 dollars. TEE.fail extracted attestation keys from Intel TDX and SGX and signing keys from inside AMD SEV-SNP virtual machines on DDR5 systems, and showed that NVIDIA’s GPU attestation could be faked so a workload appears to run in a TEE when it does not. In September 2026 the DDRop attack, using an interposer costing around 160 dollars that can be fitted in minutes, read a TDX virtual machine’s private memory and forged its attestation. All of these need physical access to the server, and Intel and AMD treat physical attacks as out of scope. In practice, confidential AI protects you from the provider’s software, administrators and anyone who compels them remotely, but not from someone with hands on the hardware.

You trust the chip maker. The root of trust is a key in the processor. If the manufacturer, its supply chain or its signing keys are compromised, the guarantees go with it.

Metadata still leaks. Relays hide who you are from the AI provider, but timing, request sizes and usage patterns can still reveal information, as NCC Group’s side-channel finding on Google’s relay illustrates.

Privacy of processing is not privacy of the product. A confidential cloud protects a request while it is processed. It says nothing about what the app stores on your device, what it syncs to an ordinary cloud, what goes into memory, or what the provider’s policies allow elsewhere. Read the whole architecture, not only the enclave.

Seven questions to ask a vendor that claims confidential AI

1. Which TEE do you use, and is the GPU inside the trusted boundary?
2. Does the client verify attestation before it sends data, or is attestation only checked on the server side?
3. Are the software images published so independent researchers can inspect them?
4. Is anything kept after the request, including logs, caches and prompts used for debugging?
5. Do requests go through a relay that hides the user’s identity from you?
6. What independent security assessments have been done, and are the results public?
7. What is your answer to physical attacks such as TEE.fail and DDRop: who has physical access to the servers, and how is it controlled?

In the last part we put this together with on-device processing into an architecture for a private personal AI, and a checklist for choosing one.

Frequently asked questions

What is confidential AI? +

Confidential AI is AI inference or training that runs inside a trusted execution environment, so the data and the model are protected in memory, the operator cannot inspect them, and clients can verify through attestation which software processes their data.

How does Apple Private Cloud Compute protect my data? +

Private Cloud Compute runs Apple Intelligence requests that are too large for the device on Apple silicon servers with no persistent storage and no remote shell. Your device only sends data to servers whose software image has been published and attested, requests are routed through a relay that hides your IP address, and data is deleted after the request.

Is confidential computing safe from hackers? +

It is strong against remote attackers and against the cloud operator, but not perfect. In 2025 researchers showed that Intel SGX, Intel TDX and AMD SEV-SNP can be broken by an attacker with physical access who installs a memory-bus interposer. Software bugs and side channels are further risks.

What should I ask an AI vendor that claims confidential computing? +

Ask which hardware enclave they use, whether the GPU is inside the trusted boundary, whether clients verify attestation before sending data, whether the software images are published for independent inspection, whether data is retained after the request, and how they handle logs and metadata.

Sources

1. MacRumors: Apple opens Private Cloud Compute to security researchers (October 2024): Virtual Research Environment and bounties up to $1M
2. Apple Intelligence Foundation Language Models tech report (July 2025): Apple's server model running on Private Cloud Compute
3. The Hacker News: Google launches Private AI Compute (November 2025): TPUs, Titanium Intelligence Enclaves, attestation and NCC Group findings
4. 9to5Google: Private AI Compute on Pixel (November 2025): Magic Cue and Recorder as the first features
5. Meta Engineering: Building Private Processing for AI tools on WhatsApp (April 2025): Design of WhatsApp Private Processing
6. NVIDIA: Secure AI general availability (April 2025): Multi-GPU confidential computing
7. Google Cloud: Confidential computing expands with Intel TDX (August 2025): Confidential A3 VMs with H100 GPUs
8. Anthropic: Confidential inference via trusted virtual machines (June 2025): Anthropic's research sketch
9. VentureBeat: OpenAI's Private Intelligence (September 2026): OpenAI's confidential inference preview
10. MacRumors: Gemini to power the next Siri (January 2026): Apple confirming Gemini for Siri
11. The Hacker News: Battering RAM (October 2025): Interposer attack on SGX and SEV-SNP
12. The Hacker News: WireTap extracts Intel SGX keys (October 2025): SGX attestation key extraction
13. BleepingComputer: TEE.fail (October 2025): Attack on TDX, SEV-SNP and NVIDIA GPU attestation
14. The Hacker News: DDRop breaks Intel TDX (September 2026): Reading TDX memory and forging attestation