Apple Puts NVIDIA Blackwell Confidential GPUs Into Private Cloud Compute

Three tech giants are now sharing a single GPU rack for Apple Intelligence inference. Apple's Private Cloud Compute (PCC) is expanding beyond Apple's own data centers onto Google Cloud, powered by NVIDIA Blackwell GPUs with Confidential Computing — a hardware security layer that ensures nobody, not even the infrastructure operators, can peek at your data.

Announced at WWDC, this deployment means Apple Foundation Models — custom-built by Apple and Google using technologies behind the Gemini family — will run server-side inference on NVIDIA Blackwell GPUs. The Confidential Computing feature provides a hardware-based security layer for accelerated AI workloads by isolating them in trusted execution environments (TEEs). Before any sensitive data leaves a user's device, the system cryptographically verifies that the GPU firmware, the host, and the entire infrastructure haven't been tampered with.

Confidential Computing for Apple Intelligence

Here's the clever bit: NVIDIA's Confidential Computing includes three mechanisms that make this work at scale. Hardware-rooted trust confirms the GPU is genuine and unmodified. Encrypted communication paths protect data as it moves between CPU, GPU, and memory. And remote attestation lets the client software check the platform's security state before releasing any data. For end users, that means no one — not Apple, not NVIDIA, not Google Cloud — can read their chats, prompts, or generated responses.

Apple's PCC was already designed with privacy guarantees: only the code needed for a request is loaded, no persistent state is kept, and the infrastructure is auditable. Adding NVIDIA Confidential Computing onto the GPU layer closes the last hardware gap — previously, the GPU memory itself wasn't part of the trusted compute base for cloud inference.

Why This Shifts the AI Privacy Baseline

Adoption at this scale — Apple's production AI serving — signals a broader shift. As AI workloads blend on-device and cloud processing, the old model of trusting the cloud provider's word isn't enough. Cryptographic verification of the hardware stack, backed by NVIDIA's Blackwell TEEs, turns that trust into something machine-checkable.

This isn't a research prototype. It's Apple shipping Apple Intelligence features on Google Cloud with NVIDIA silicon, all protected by hardware-level attestation. For any team building privacy-sensitive AI services — healthcare, finance, enterprise — the playbook just got clearer: run inference on hardware that proves it hasn't been compromised, not one that promises it won't be.

The next step is obvious: if three of the largest tech companies can align on a hardware-enforced trust model for cloud AI, the question shifts from "can we trust the cloud?" to "why aren't all cloud AI workloads using this?"

Source: NVIDIA Confidential Computing to Help Expand Apple's Private Cloud Compute
Domain: blogs.nvidia.com