NVIDIA Confidential Computing Powers Apple Intelligence on Google Cloud
NVIDIA Confidential Computing is now at the heart of Apple’s expanded cloud AI infrastructure, marking a significant step in how major tech companies are approaching privacy in the age of artificial intelligence.
NVIDIA GPUs with Confidential Computing are being used for confidential inference in Apple’s Private Cloud Compute (PCC), as it expands beyond Apple’s own data centers to Google Cloud. The development was announced at Apple’s annual WWDC developer conference.
NVIDIA will support server-side inference for Apple Foundation Models, custom-built by Apple and Google, with the latter leveraging technologies behind the Gemini family of models. Specifically, NVIDIA Blackwell GPUs with Confidential Computing are integrated into Private Cloud Compute’s hardware security architecture running on Google Cloud.
At its core, NVIDIA Confidential Computing is a hardware-based security layer designed for accelerated AI workloads. The technology protects data during processing by isolating workloads in trusted execution environments and enabling systems to cryptographically verify that the infrastructure has not been tampered with before any sensitive data is sent to the server. In practical terms, this means no one, not even the system’s builders, can access users’ data, chats, or conversations.
The adoption of NVIDIA Confidential Computing at this scale reflects a broader shift in AI infrastructure: as AI experiences combine on-device and cloud-based processing, there is a growing need for high-performance, server-side inference alongside strong privacy and security guarantees.
Key technical capabilities underpinning the system include hardware-rooted trust to verify genuine and untampered NVIDIA GPUs, encrypted communication paths, remote attestation, and support for accelerated AI inference and training.
The collaboration between NVIDIA, Apple, and Google signals a new benchmark for how AI cloud services handle sensitive user data, one where privacy is enforced at the hardware level rather than left to policy alone.
