Apple built Private Cloud Compute exclusively on Apple silicon, in Apple's own data centers, and said so as the whole point of it. That has changed. Private Cloud Compute, the company's confidential inference system, is being extended onto Google Cloud servers running NVIDIA GPUs.
Private Cloud Compute, or PCC, is the machinery that catches Apple Intelligence requests too heavy for the phone in your pocket. Think of it as a soundproof booth rather than a filing cabinet. The point was never to lock the data away afterwards; it was to make sure nobody outside the booth could hear anything while the work was going on. Until now, Apple built the booth end to end.
The company is blunt about what changed and what did not. "What's new with PCC on Google Cloud is the implementation: NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs with TDX, and Google's Titan chip." TDX is Trust Domain Extensions, Intel's method of walling a virtual machine off from the machine underneath it, and Titan is Google's own security chip. Three vendors of silicon inside one booth, and not one of them is Apple. Apple's answer to the obvious objection is unambiguous: "Regardless of where the infrastructure is hosted, Apple retains complete control over PCC software; Apple devices will only trust PCC software that is cryptographically approved by Apple."
What has not moved is the list of promises. "Our core PCC requirements remain exactly the same: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency." Those five words are load-bearing, and they make this an engineering story rather than a procurement one. Renting someone else's servers is easy. Renting them without loosening any of five commitments is the hard part.
Confidential computing is worth a slow paragraph. A GPU normally trusts whoever owns the box it is bolted into, which means privileged software on that host sits above the workload rather than outside it. Confidential computing inverts the arrangement: the accelerator keeps its working data encrypted and will prove, cryptographically, that nothing has been tampered with before sensitive data is sent to it. NVIDIA describes the consequence for the person holding the handset: "For end users, NVIDIA Confidential Computing means that no one, not even the system’s builders, can look at their data, chats or conversations."
NVIDIA says the parts involved are Blackwell GPUs, integrated into PCC's hardware security architecture on Google Cloud. Apple says the heaviest tasks it is moving include agentic tool use and complex reasoning, the workloads that consume accelerators fastest. Read it as a capacity story and it makes sense. Apple silicon is superb and Apple does not have infinite quantities of it sitting in data centers.
There is a supply-chain wrinkle in the fine print that only the paranoid will enjoy. Apple says it keeps a cryptographically verifiable, append-only ledger of every piece of Google Cloud hardware in the PCC fleet, and that for components that could be abused to exfiltrate user data if compromised, its software attestation is rooted in at least two separate roots of trust from independent vendors. Two vendors have to be wrong at once before the guarantee fails.
None of this is switched on wholesale. "PCC on Google Cloud will be gradually ramping towards the complete set of protections throughout the summer preview period." Apple also says the binaries will be published for inspection and that researchers will get access to live PCC nodes in research mode, which is the part that would let anyone outside the three companies check whether the booth is really soundproof.
Leave a Reply