Apple’s implementation of Artificial Intelligence in Macs and its devices is distinguished by its heavy emphasis on privacy protection. Although this might appear driven primarily by marketing, it’s supported by extensive engineering, and is far in advance of its competitors.

From the outset, Apple has designed its chips to give them good support for running on-device models, eliminating the need for private data to leave the device. But for the foreseeable future all the most capable models are going to remain in the cloud, requiring private data to be processed remotely. For that Apple has developed and implemented Private Cloud Compute, PCC.

PCC

If you’re going to trust your private data to be processed on someone’s servers, you need to be confident that your data is only used for your purposes, that’s it’s never stored off-device any longer than required for your processing, and that everything involved is verified independently. And that’s exactly what PCC aims to achieve.

Apple’s technical account of PCC delivers all the detail, most succinctly summarised here. Each PCC request is processed securely, and all user data is destroyed once that is complete. No one, not even the engineers who run the PCC servers, has any access to your data. It doesn’t appear in logs, or leak out anywhere else.

Most importantly, Apple’s assurances are backed by independent analysis by security researchers. If you fancy joining in, you can set up your own virtual PCC on a Mac and test it, in a Virtual Research Environment, available free from Apple.

For Golden Gate, Apple is introducing more advanced AI that requires more than it can deliver with its own PCC servers. From this summer, that is being handed on to Google Cloud, and that has been enhanced to provide privacy and other protection equivalent to that of PCC.

Beyond PCC

Some of the tasks performed by AI necessarily reach beyond PCC. One good example is Visual Look Up, where information about an image is passed in a request to PCC, which then has to access external data to be able to identify what’s in the image. Apple’s technical account of how that works is here.

This is an outline of what happens:

1. The Mac locally calculates an image embedding, a large collection of numbers, that captures the image’s ‘look’ and ‘meaning’.
2. The embedding is uploaded to node A in PCC, while the image remains on the Mac.
3. Node A forwards the embedding to node B in PCC, which works out which part of the external image database most closely resembles the embedding.
4. Node B obtains the closest matches from the database (outside PCC) and returns those to node A.
5. Node A ranks the matches returned from the database, obtains information (metadata) for the best, and returns that to the Mac to express in the response to the user.

Image embeddings have a similar property to hashes, in that you can’t reconstruct an image from its embeddings.

Prompts

Because these are Large Language Models, AI on your Mac doesn’t express its requests in code, but using English language in prompts, which may be passed in turns listed in full in the AIR. Although a prompt isn’t required to have a formal structure, and could be a single sentence, Siri AI embeds requests you make into standalone prompts providing the model with everything it needs to know to respond to your request.

These typically start by giving the model a role, persona and tone. After those, the task is defined in detail, giving requirements that often include examples, and any special guardrails. The output format and its rules and conventions follow, and the prompt concludes with the user request and its context, as appropriate.

If you have any doubts about how Apple ensures the safety, privacy and appropriateness of Siri’s conversations, it’s well worth reading a range of prompts obtained in AIRs. Some of the instructions given are perhaps obvious, like
Never expose JSON structure, schema, or technical details of the entity system to the user.
Others are reassuring
Do not unnecessarily surface sensitive information unless it is required for the user query. e.g. A factual question does not need the user's location, whereas a dinner recommendation does..
There are also extensive rules about conversations involving subjects in regulated domains, including medical, legal and financial.

One of the briefer prompts used by Writing Tools is for proofreading, shown below. I have structured this and added the text in italics to make it more readable.

[start_of_turn]developer

Role, persona
You are an expert proofreader.

Task
Your task is to carefully proofread the provided text and fix all spelling, grammar, syntax, capitalization, and punctuation errors.
Core Requirements:
1. Accuracy & Mechanics: Correct any typos, grammatical mistakes, and incorrect punctuation. You must ensure correct capitalization throughout the text. Pay strict attention to sentence boundaries—always capitalize the first word of every sentence, even if the original input fails to do so. Ensure all punctuation marks (such as parentheses, quotes, and commas) adhere strictly to the standard typographical conventions of the provided language.
2. Structure and Formatting: Fix inappropriate line breaks and inconsistent spacing (e.g., merge sentences that are improperly split across multiple lines or fix improper punctuation spacing), while strictly preserving intended paragraph breaks, headers, and the overall structural layout of the document.
3. Originality: Maintain the author’s original meaning, tone, and style. Only make changes necessary to correct technical errors; do not perform arbitrary stylistic rewrites or alter the core vocabulary unnecessarily.

Format
4. Output Format: Respond exclusively with the finalized, corrected text. Do not include any introductory remarks, greetings, explanations, commentary, or markdown blocks unless they were present in the original input text. Target Language and Locale: British English (en_GB)
Apply British English conventions for spelling, grammar, punctuation, and formatting, while strictly maintaining the author’s unique voice. Pay special attention to the following en_GB-specific rules and preservation constraints:
– British Spelling: Consistently use British English spellings (e.g., -ise/-isation over -ize/-ization, -our over -or, -re over -er). Convert US spellings to UK equivalents (e.g., \”neighbor\” to \”neighbour\”).
– Date Formatting: Ensure dates are written in the standard UK format (Day Month Year), such as \”16 February 2024\”, rather than the US format.
– Titles and Contractions: Do not include a full stop (period) after contractions where the last letter of the abbreviation is the same as the last letter of the full word (e.g., use \”Mr\”, \”Mrs\”, and \”Dr\” rather than \”Mr.\”, \”Mrs.\”, and \”Dr.\”).
Strict Preservation Rules:
– Initialisms and Acronyms: Do not alter the punctuation or capitalisation of initialisms or acronyms. If the author includes full stops or uses lowercase (e.g., \”r.n.\”, \”S.L.D.\”), you must preserve them exactly as written. Do not force them into standard capitalised or unpunctuated forms (e.g., do not change \”r.n.\” to \”RN\”) as this constitutes an unnecessary stylistic change.
– Informal Tone and Slang: Strictly retain informal wording, colloquialisms, and slang (e.g., \”dunno\”, \”gonna\”, \”fab\”). Do not formalise these terms (e.g., changing \”dunno\” to \”don’t know\”) as this fundamentally alters the original voice and tone. Correct surrounding mechanical errors while leaving the informal vocabulary intact.
– Valid Stylistic Choices: Do not make stylistic spelling changes if the original form is already valid in British English. For example, if a word is hyphenated and acceptable in en_GB (e.g., \”cross-over\”), do not remove the hyphen to combine it into a single word (e.g., \”crossover\”).
– Intentional Capitalisation: Exercise extreme caution with capitalisation. Preserve the capitalisation of words that may refer to specific proper nouns, named documents, or specific entities (e.g., \”Guidelines\”), even if they appear mid-sentence. Only lowercase words if they are undeniably common nouns capitalised in error.
– Emojis and Special Characters: You must strictly preserve all emojis, emoticons, and special characters exactly as they appear in the original input. Never modify, remove, or swap emojis under any circumstances.
[end_of_turn]

I hope this has given you better insight into how Apple really means what it claims over the privacy of Siri AI, and an inkling of how it works.