In June 2024 Apple described Private Cloud Compute, where a user's device will only send a request to a server node that cryptographically attests to running a specific software image, and the device checks that measurement against a public append-only transparency log before sending anything. What problem does this solve that signed code and audits do not, what does it cost, and where would copying it be a mistake?

The situation they were in

Apple had committed to processing some Apple Intelligence requests on servers while claiming the same privacy properties as on-device processing. The problem with that claim is that it is unfalsifiable by the user. A signed binary proves the vendor built it; it does not prove that the machine answering you today is running it. Audit reports and policy statements have the same gap: they describe intent at a point in time, and the person whose data is at stake cannot check them.

What they chose

Two mechanisms that only work together:

1. Attestation. The node measures its own boot chain and software image into hardware and presents a signed statement of that measurement.
2. Verifiable transparency. Every production release's measurement is published to a public append-only log, and the client refuses to send the request if the attested measurement is not in the log.

The second is the load-bearing half. Attestation alone proves a node runs something signed by the vendor, including a build made for one user. Publishing measurements to an append-only log removes the possibility of a targeted build, because using one would require either publishing it, where researchers can see it, or serving a measurement no client will accept.

Why it fit their constraints

Apple controls the silicon, the OS, the server design and the client, and it needed a claim that survives an adversary who has subpoenaed or compromised the operator. Enforcement in the client is what converts a policy into a mechanism: the guarantee does not depend on Apple behaving, it depends on the device refusing.

What it cost them

• Release engineering becomes irreversible. Every image that can ever serve traffic is public, and rollback is another published release, not a quiet redeploy.
• Debugging changes shape. You cannot attach to a production node and poke at it, because the image is fixed and observability that would expose request content cannot exist. Failures have to be diagnosed from data that was designed to be safe to emit.
• Heterogeneity gets expensive. Each distinct configuration is a measurement to publish and verify, which pushes hard toward a small number of identical node types.
• A slow client-side fail-closed path. If no attested node is available, the correct behaviour is to refuse, not to fall back.

Where copying it would be a mistake

If your threat model does not include "the operator of the service is compelled or compromised", this buys you very little for a great deal of operational rigidity. A SaaS product whose users already accept that the vendor processes their data gets more safety per unit of effort from field-level encryption, tight access review and short-lived credentials.

Two preconditions are non-negotiable and rarely present: you must control the client, because nothing works if the verifier is optional, and you must own hardware with a measured boot chain you trust. Renting general-purpose VMs gives you attestation of a hypervisor's claims about itself. The honest middle path for most teams is a confidential-computing enclave for the one workload that needs it, with the transparency log left out.

Common weak answers

• "We sign our images, so we have this." Signing proves provenance, not what is running now, and it does not prevent a build made for one user. The log is the part that removes that option.
• "We will add attestation later." Attestation is a client-enforcement change, and a client that already accepts unattested nodes cannot start refusing them without breaking every device that has not updated. Choose the fail-closed behaviour before the first release, or accept that it is permanently optional.
• "An enclave on rented hardware gives the same guarantee." It moves the trust from the operator to the cloud provider and its firmware supply chain, which is a real improvement and a different claim.