Here’s how Apple’s AI model tries to keep your data private

On Monday at WWDC, Apple unveiled Apple Intelligence, a set of features that provide generative artificial intelligence tools such as email draft rewriting, notification summarization and custom emoji creation for iPhone, iPad and Mac. Apple spent much of its keynote explaining how useful these tools will be, and almost as much time assuring customers how private data the novel artificial intelligence system will provide.

This privacy is made possible by a two-pronged approach to generative AI, which Apple began explaining in its keynote and later provided more detail in documents and presentations. They show that Apple Intelligence is based on an on-device philosophy that enables it to quickly perform common AI tasks that users expect, such as transcribing calls and organizing schedules. However, Apple Intelligence can also contact cloud servers for more sophisticated AI requests that involve sending personal context data – and making sure both deliver good results while maintaining data privacy, which is where Apple has focused its efforts.

The gigantic news is that Apple is using its own home-grown AI models for Apple Intelligence. Apple notes that yes it doesn’t train its models using private data or user interactionswhich is unique compared to other companies. Instead, Apple uses both licensed material and publicly available online data, which is pulled by the company’s Applebot web crawler. Publishers must opt ​​out if they don’t want their data processed by Apple, which sounds similar to Google and OpenAI’s policies. Apple also says it suppresses Social Security and credit card numbers provided online and ignores “profanity and other low-quality content.”

Apple Intelligence’s gigantic advantage is its deep integration with Apple’s operating systems and apps, as well as the way the company optimizes its models for power efficiency and size to fit iPhones. Storing AI requests locally is key to solving many privacy issues, but the trade-off is using smaller and less effective models on the device.

To make these local models useful, Apple uses tuning that trains models to be better at specific tasks, such as proofreading and summarizing text. Skills come in the form of “adapters” that can be applied to the base model and swapped out depending on the task at hand, much like using character-enhancing attributes in an RPG. Similarly, Apple’s diffusion model for Image Playground and Genmoji also uses adapters to achieve different graphic styles, such as illustrations or animations (which make people and animals look like low-cost Pixar characters).

The approach is similar to what we see in the Windows world: Intel has launched its 14th generation Meteor Lake architecture, which includes an NPU chip, as well as novel Qualcomm Snapdragon X chips for Microsoft’s Copilot Plus computers. As a result, many of the AI ​​features in Windows are available to novel devices that can perform work locally on these chips.

According to Apple Researchof 750 text summary responses tested, Apple’s on-device AI (with the appropriate adapter) provided more compelling results for humans than Microsoft’s Phi-3-mini model. This sounds like a great achievement, but most chatbot services now apply much larger cloud models to achieve better results, and this is where Apple tries to be cautious about privacy. For Apple to compete with larger models, it must develop a seamless process that sends sophisticated requests to cloud servers while also trying to prove to users that their data remains private.

If a user’s request requires a more effective AI model, Apple sends the request to its Private Cloud Compute (PCC) servers. PCC runs its own operating system based on “iOS foundations” and has its own machine learning stack that powers Apple Intelligence. According to Apple, PCC has its own secure boot and secure enclave to store encryption keys, which only work with the device making the request, and Trusted Execution Monitor makes sure only signed and verified code works.

Apple claims that the user’s device creates an end-to-end encrypted connection to the PCC cluster before sending the request. Apple says it can’t access data on PCC because it has no server management tools, so there’s no remote shell. Apple also doesn’t provide PCC with any persistent storage, so requests and possible personal context data retrieved from the Apple Intelligence Semantic Index are apparently later deleted in the cloud.

Each PCC build will have a virtual version that can be reviewed by the public or researchers, and only signed builds that will be registered as reviewed will go into production.

One of the main open questions is what types of requests will be directed to the cloud. When processing a request, Apple Intelligence performs a step called Orchestration, during which it decides whether to continue on the device or apply PCC. We don’t yet know what exactly constitutes a request sophisticated enough to trigger a cloud process, and we probably won’t know until Apple Intelligence becomes available in the fall.

There’s another way Apple deals with privacy issues: making it someone else’s problem. Apple’s revamped Siri can query ChatGPT in the cloud, but only with permission after asking really tough questions. This process puts the privacy issue in the hands of OpenAI, which has its own rules, and the user, who must agree to have their query taken over. IN interview alongside Marques Brownlee, Apple CEO Tim Cook said ChatGPT would be invoked for requests for “world knowledge” that “go beyond personal context.”

Apple’s approach to dividing on-premises and cloud solutions for Apple Intelligence isn’t entirely novel. Google has a Gemini Nano model that can run locally on Android devices, along with Pro and Flash models that do cloud computing. Meanwhile, Microsoft Copilot Plus PCs can process AI requests locally, while the company continues to rely on its contract with OpenAI and also builds its own in-house MAI-1 model. However, none of Apple’s competitors have emphasized their privacy commitments so thoroughly in comparison.

Of course, all this looks great in staged demonstrations and edited articles. However, the real test will come later this year when we see Apple Intelligence in action. We’ll have to see if Apple can strike a balance between AI quality and privacy – and continue to develop it in the years to come.