In my initial exploration of Apple Intelligence Reports (AIR), I pointed out that the bulk of most AIRs are privateCloudComputeRequests, metadata for requests processed by PCC, whose main contents are attestation bundles. Those are provided in Protobuf format, and encoded using Base64, making them difficult to access.

However, Apple states that “you can parse, canonicalize, and verify attestation bundles from the Apple Intelligence Report using the pccvre attestation subcommands.” This article explains how you can do that without compromising the security of your Mac, using a Virtual Machine.

VM setup

I cloned my current Golden Gate 27.0 VM with 100 GB storage, then started it up in Recovery mode, an option in Viable. Once in Recovery, I opened Terminal and entered the command
csrutil allow-research-guests enable
to enable the PCC Virtual Research Environment. It isn’t necessary to manually alter Startup Security Utility to enable that. To confirm the change had been applied, I checked with
csrutil allow-research-guests status

I then restarted the VM back into regular user mode, logged in and opened Terminal.

Before you can use the Virtual Research Environment and the pccvre command, you’re expected to agree to its multiple and lengthy licensing terms, by entering a command like
sudo pccvre --help

With a suitable addition to your shell path to save you entering the full path to pccvre of /System/Library/SecurityResearch/usr/bin/pccvre you’re then ready to run.

Parse and export an attestation bundle

pccvre is currently documented using its layered help information, and the outlines in the PCC Security Guide. An outline is provided for inspecting attestation bundles, but as ever there’s a lot more to it than that.

To parse and export an attestation bundle from an AIR (copied into the VM, as ironically VMs can’t support AI) requires a command of the format given,
pccvre attestation parse [--debug] [--input-format <input-format>] [--request-index <request-index>] [--attestation-index <attestation-index>] [--bundle-version <bundle-version>] [--output-format <output-format>] [--output <output>] <file>

I’ll explain that using the command I used, broken down:

• pccvre attestation parse the command, subcommand and subsubcommand
• --input-format apple-intelligence-report the default
• --request-index 1 this is the index of the request within that AIR
• --attestation-index 1 this is the index of the attestation bundle for that request
• --output-format json again, the default which should at least be human-readable
• --output ~/Documents/att1.text the path of the output file
• ~/Documents/Apple_Intelligence_ReportWriteTools.json the source AIR, copied across from the host Mac.

Attestation bundle in JSON

I’m afraid this is the anti-climax. The 53 KB JSON output for a single attestation bundle contains a few recognisable words referring to the extensive security used in transactions with the PCC, but it’s overwhelmingly more Base64 encoded data, not intended for human consumption but for security researchers to investigate the protection provided by the PCC.

Who is the AIR for?

Although some of the content of model requests in an AIR is fascinating, in particular how AI turns your simple requests into long verbose prompts for the model, this isn’t of much value to the ordinary user seeking an answer to apparently simple questions about the security and privacy of AI. I’m puzzled why Apple has made this such a prominent feature referred to in user documentation.

I haven’t abandoned hope that it might be possible to distill an AIR into something both more accessible and understandable to the likes of you and me. But, as they come, AIRs are of precious little use to us.