{
  "schema_version": "1.0.0",
  "rubric_version": "1.1",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "I-0013",
    "slug": "apple-private-cloud-compute",
    "title": "Apple Private Cloud Compute",
    "aliases": [
      "PCC",
      "Private Cloud Compute"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-24",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "Apple's cloud AI inference service, in which user devices send requests only to servers that attest to running software published in a public transparency log.",
    "summary": "Private Cloud Compute (PCC) is Apple's server system for Apple Intelligence requests that need larger models than a device can run. Apple reports that user devices send a request only to servers that attest to running a software release listed in a public, append-only transparency log. Apple publishes the software images, a virtual research environment that boots them, and part of the source code. Independent researchers found flaws in how PCC authenticates requests, and one showed that a node with tampered configuration files passed attestation until Apple fixed the bug that allowed the tampering. In June 2026 Apple announced an extension of PCC to Google Cloud on Intel TDX and NVIDIA confidential computing. Independent researchers with physical access to such hardware have forged TDX attestations and relayed NVIDIA ones.",
    "category": "on-chip",
    "secondary_categories": [
      "cryptographic-computational"
    ],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "supporting",
        "note": "Attests the software release that served a request. Apple reports that model assets share the code's integrity protection (S-1800)."
      }
    ],
    "threat_model": "semi-trusted",
    "adversarial_evaluation": "independent-red-team",
    "hardware_requirement": "existing-features",
    "prover_cooperation": "required",
    "confidentiality": "preserving",
    "depends_on": [
      {
        "target": "M-0008",
        "note": "Relies on hardware attestation: the Secure Enclave on Apple silicon servers, and Intel TDX, NVIDIA confidential computing and Google's Titan chip on Google Cloud."
      }
    ],
    "readiness": {
      "assessment": true,
      "level": "R3",
      "rubric_version": "1.1",
      "rationale": "R3. PCC is a production service whose attestation, transparency log and research tools are public, but no independent evaluation has examined its attestation chain as a whole. Assessed for showing which software serves AI requests, not which model.\n\n- **R1** met: Apple published the design, the claim that devices send data only to nodes that attest to publicly listed software, and a threat model that includes attackers with physical access to a node [[S-1800]].\n- **R2** met: the software images, a research environment that boots them and part of the source code are public [[S-1800]] [[S-1801]]. Independent researchers sent queries to the production service from macOS and iOS clients between December 2025 and March 2026 [[S-1803]].\n- **R3** met: PCC is production-grade and available as the server side of Apple Intelligence (provider-reported) [[S-1800]], and independent researchers have used the production service [[S-1803]]. Its transparency log, binaries and research environment are public [[S-1801]]. The attestation check is made by Apple's own client software, and no other party is documented relying on it for a verification decision.\n- **R4** not met. The two independent public analyses are narrow. A peer-reviewed study reverse-engineered the client and found request-authentication flaws, which Apple addressed only in its documentation. Its subject is request privacy, not attestation [[S-1803]]. A researcher working in Apple's research environment showed that a node with tampered configuration files passed Apple's attestation check, and Apple fixed the path-handling bug behind it [[S-1804]] [[S-1805]]. Neither evaluates the attestation and transparency chain as a whole. The 2026 deployment on Google Cloud uses Intel TDX and NVIDIA confidential computing [[S-1802]], whose attestations independent researchers forged with physical access [[S-1202]]. No published work tests whether Apple's use of two independent roots of trust resists that attack.",
      "evidence": [
        "S-1800",
        "S-1801",
        "S-1802",
        "S-1803",
        "S-1804",
        "S-1805",
        "S-1202"
      ],
      "next_level_gaps": [
        "An independent public evaluation of the attestation and transparency-log chain, including what attestation covers at runtime, that leaves no critical flaw open.",
        "Evidence that the Google Cloud deployment's attestation resists attackers with physical access to TDX and NVIDIA hardware.",
        "Reproducible builds, so that published binaries can be checked against published source."
      ],
      "confidence": "low",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-24",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Tampered node configuration passed attestation",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "mitigated",
        "description": "Working in Apple's Virtual Research Environment, an independent researcher used a path traversal in darwin-init, which unpacks software archives when a node boots, to write files as root that survived the node's userspace reboot. The change redirected a logging daemon's telemetry and exposed per-request metadata such as token counts and timings. The researcher reports that Apple's attestation verifier treated the tampered node and a clean one identically, because attestation measured the installed software but not writable configuration files [[S-1804]]. Apple's CVE record describes an attacker in a privileged network position and a fix through improved path validation, in releases from 5E290.3 [[S-1805]].",
        "sources": [
          "S-1804",
          "S-1805"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Google Cloud deployment relies on TEEs whose attestations have been forged",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "Apple reports that PCC on Google Cloud uses NVIDIA confidential computing, Intel CPUs with TDX and Google's Titan chip, with attestation rooted in at least two separate roots of trust from independent vendors [[S-1802]]. With physical access and root privileges, independent researchers forged Intel TDX attestations and, by pairing them with relayed H100 attestations, passed a workload outside TEE protection [[S-1202]]. Whether PCC's combination of roots of trust resists this has not been tested in public.",
        "sources": [
          "S-1802",
          "S-1202"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Published binaries cannot be rebuilt from source and carry no symbols, so checking what the attested software does needs reverse engineering.",
        "theme": "evidence-binding",
        "blocked_by": null,
        "sources": [
          "S-1803"
        ]
      },
      {
        "text": "Only Apple's own client software sends requests to PCC, and there is no API for third parties.",
        "theme": "access-governance",
        "blocked_by": null,
        "sources": [
          "S-1803"
        ]
      }
    ],
    "challenge_themes": [
      "evidence-binding",
      "hardware-trust",
      "adversarial-validation"
    ],
    "organizations": [],
    "people": [],
    "sources": [
      {
        "source": "S-1800",
        "supports": "design goals, Apple silicon servers, signed trust cache, integrity protection of code and model assets, device-side attestation check against the transparency log, publication of images, threat model with physical attackers (provider-reported)"
      },
      {
        "source": "S-1801",
        "supports": "Virtual Research Environment, published source components and licence, bounty (provider-reported)"
      },
      {
        "source": "S-1802",
        "supports": "Google Cloud deployment with NVIDIA confidential computing, Intel TDX and Titan; two roots of trust; protections ramped up during a summer preview; research mode on live nodes (provider-reported)"
      },
      {
        "source": "S-1803",
        "supports": "independent reverse engineering of the client; queries to the production service; no reproducible builds or symbols; request-token flaws; Apple's documentation-only response; no third-party API",
        "locator": "abstract; §3; limitations"
      },
      {
        "source": "S-1804",
        "supports": "independent finding that a tampered node passed attestation; metadata exposure; bounty"
      },
      {
        "source": "S-1805",
        "supports": "CVE description, affected versions and fix (vendor-assigned)"
      },
      {
        "source": "S-1202",
        "supports": "independent forgery of Intel TDX attestations and H100 attestation relay",
        "locator": "Abstract; §1.1; §8.3"
      }
    ],
    "concepts": [
      "K-0004",
      "K-0005",
      "K-0006",
      "K-0019"
    ],
    "kind": "product",
    "developer": [],
    "realises": [
      "M-0008"
    ],
    "homepage": "https://security.apple.com/blog/private-cloud-compute/",
    "repo": "https://github.com/apple/security-pcc",
    "type": "implementation",
    "url": "https://trustbutveri.fyi/implementations/apple-private-cloud-compute/",
    "source_file": "content/implementations/apple-private-cloud-compute.md",
    "flags_all": [
      "provider-reported",
      "ai-drafted"
    ],
    "body_markdown": "## What it is\n\nPrivate Cloud Compute (PCC) is Apple's server system for Apple Intelligence features that need larger foundation models than a device can run [[S-1800]]. Apple built it on custom servers with Apple silicon, the Secure Enclave and Secure Boot [[S-1800]]. Apple states that security researchers must be able to verify that PCC's privacy and security guarantees match its public promises [[S-1800]].\n\nPCC applies [[M-0008|TEE remote attestation]] to show users which software handles their AI requests. It was designed to keep those requests private, and its checks concern software releases.\n\nIn June 2026 Apple announced that it was extending PCC to Google Cloud systems with NVIDIA GPUs, using NVIDIA confidential computing, Intel CPUs with TDX and Google's Titan chip [[S-1802]]. Apple stated that this deployment would reach its complete set of protections gradually during a summer preview period [[S-1802]].\n\n## How it works\n\nApple describes the chain as follows [[S-1800]]:\n\n1. Every piece of code a node can run must be in a trust cache signed by Apple and loaded by the Secure Enclave, so it cannot change at runtime. Code and model assets use the integrity protection of Apple's Signed System Volume.\n2. Apple publishes the measurements of all code running on PCC in an append-only transparency log, and the corresponding software images within 90 days.\n3. A user's device encrypts each request only to the keys of nodes whose attested measurements match a release in the log.\n\nFor research, Apple publishes a Virtual Research Environment that boots PCC releases in a virtual machine on an Apple silicon Mac, checks the transparency log and runs inference against demonstration models [[S-1801]]. Apple also publishes source code for its attestation and request-handling components under a limited-use licence, and offers bounties of up to $1,000,000 for PCC findings [[S-1801]].\n\nApple's threat model includes an attacker with physical access to a node who can subvert some hardware protections [[S-1800]]. Apple's answer is that an attacker should not be able to target particular users without compromising the whole system. It relies on a hardened hardware supply chain, including imaging each server's components before sealing it, and on routing that does not let an attacker steer chosen users' requests to a compromised node [[S-1800]]. On Google Cloud, Apple reports that attestation is rooted in at least two separate roots of trust from independent vendors, with attested keys held in a separate confidential virtual machine [[S-1802]].\n\n## Evidence\n- Researchers at the Hasso Plattner Institute, TU Darmstadt and IMDEA Networks reverse-engineered PCC's client and sent custom queries to the production service between December 2025 and March 2026 [[S-1803]]. They found that one-time request tokens could be reused, that a signature check was skipped and that token salts let requests be linked. Apple clarified its documentation but did not change the checks [[S-1803]]. The study, peer-reviewed at WiSec 2026, concerns request privacy, not attestation.\n- An independent researcher working in Apple's research environment found a path-traversal flaw that let a node's configuration be altered while its attestation stayed unchanged (CVE-2026-20685) [[S-1804]] [[S-1805]]. Apple fixed it and paid a $150,000 bounty [[S-1804]].\n- Apple reports that for the Google Cloud deployment it will publish all binaries and give researchers access to live nodes in research mode [[S-1802]].\n\n## Limitations\n- The published checks concern software releases. Apple reports that model assets share the code's integrity protection [[S-1800]], and its research environment runs demonstration models [[S-1801]].\n- PCC ships compiled binaries without reproducible builds or symbols, which its independent analysts say leaves room for differences between the specification and what is shipped [[S-1803]].\n- Attestation measured installed software but not writable configuration files in the one published attack [[S-1804]].\n- Only Apple's own client software sends requests to PCC. There is no API for third parties [[S-1803]].\n- The Google Cloud deployment runs on Intel TDX and NVIDIA confidential computing [[S-1802]]. Independent researchers have forged TDX attestations with physical access and relayed H100 attestations to a workload outside TEE protection [[S-1202]].",
    "body_text": "What it is Private Cloud Compute (PCC) is Apple's server system for Apple Intelligence features that need larger foundation models than a device can run [S-1800]. Apple built it on custom servers with Apple silicon, the Secure Enclave and Secure Boot [S-1800]. Apple states that security researchers must be able to verify that PCC's privacy and security guarantees match its public promises [S-1800]. PCC applies TEE remote attestation to show users which software handles their AI requests. It was designed to keep those requests private, and its checks concern software releases. In June 2026 Apple announced that it was extending PCC to Google Cloud systems with NVIDIA GPUs, using NVIDIA confidential computing, Intel CPUs with TDX and Google's Titan chip [S-1802]. Apple stated that this deployment would reach its complete set of protections gradually during a summer preview period [S-1802]. How it works Apple describes the chain as follows [S-1800]: 1. Every piece of code a node can run must be in a trust cache signed by Apple and loaded by the Secure Enclave, so it cannot change at runtime. Code and model assets use the integrity protection of Apple's Signed System Volume. 2. Apple publishes the measurements of all code running on PCC in an append-only transparency log, and the corresponding software images within 90 days. 3. A user's device encrypts each request only to the keys of nodes whose attested measurements match a release in the log. For research, Apple publishes a Virtual Research Environment that boots PCC releases in a virtual machine on an Apple silicon Mac, checks the transparency log and runs inference against demonstration models [S-1801]. Apple also publishes source code for its attestation and request-handling components under a limited-use licence, and offers bounties of up to $1,000,000 for PCC findings [S-1801]. Apple's threat model includes an attacker with physical access to a node who can subvert some hardware protections [S-1800]. Apple's answer is that an attacker should not be able to target particular users without compromising the whole system. It relies on a hardened hardware supply chain, including imaging each server's components before sealing it, and on routing that does not let an attacker steer chosen users' requests to a compromised node [S-1800]. On Google Cloud, Apple reports that attestation is rooted in at least two separate roots of trust from independent vendors, with attested keys held in a separate confidential virtual machine [S-1802]. Evidence - Researchers at the Hasso Plattner Institute, TU Darmstadt and IMDEA Networks reverse-engineered PCC's client and sent custom queries to the production service between December 2025 and March 2026 [S-1803]. They found that one-time request tokens could be reused, that a signature check was skipped and that token salts let requests be linked. Apple clarified its documentation but did not change the checks [S-1803]. The study, peer-reviewed at WiSec 2026, concerns request privacy, not attestation. - An independent researcher working in Apple's research environment found a path-traversal flaw that let a node's configuration be altered while its attestation stayed unchanged (CVE-2026-20685) [S-1804] [S-1805]. Apple fixed it and paid a $150,000 bounty [S-1804]. - Apple reports that for the Google Cloud deployment it will publish all binaries and give researchers access to live nodes in research mode [S-1802]. Limitations - The published checks concern software releases. Apple reports that model assets share the code's integrity protection [S-1800], and its research environment runs demonstration models [S-1801]. - PCC ships compiled binaries without reproducible builds or symbols, which its independent analysts say leaves room for differences between the specification and what is shipped [S-1803]. - Attestation measured installed software but not writable configuration files in the one published attack [S-1804]. - Only Apple's own client software sends requests to PCC. There is no API for third parties [S-1803]. - The Google Cloud deployment runs on Intel TDX and NVIDIA confidential computing [S-1802]. Independent researchers have forged TDX attestations with physical access and relayed H100 attestations to a workload outside TEE protection [S-1202].",
    "referenced_by": [
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      }
    ]
  }
}