Siri AI is Apple’s 1.2-trillion-parameter assistant overhaul, announced at WWDC 2026. Underneath the conversational interface sits a distributed-trust architecture spanning three tiers, each with hardware-enforced privacy boundaries. The most capable tier runs on Google’s infrastructure, inside Nvidia GPUs that even Google cannot inspect.
Apple licensed Google’s Gemini model family, reportedly in a $1 billion-per-year deal, to co-develop and distil the Apple Foundation Models that power every tier. The product is blocked on EU iPhones under the Digital Markets Act — see the broader Siri AI and EU lockout story for the full regulatory picture. The architecture Apple built now depends on its largest competitor’s infrastructure, and the market that values privacy regulation most cannot use it.
If you’re evaluating build-versus-buy decisions for AI infrastructure, this architecture is worth understanding: a case study in how far you can push a privacy story while relying on a competitor’s hardware to run your most capable model.
What is Siri AI and how is it different from the old Siri?
The Siri that launched in 2011 was a command-execution system. It sent your speech to Apple’s servers for processing, matched patterns against a growing but rigid intent catalogue, and returned results. It had no language model, no contextual reasoning, and its privacy model amounted to policy promises about data handling.
Siri AI replaces that architecture entirely. It is powered by Apple Foundation Models co-developed with Google Gemini, orchestrated by an on-device System Orchestrator that routes queries across three processing tiers. The Orchestrator pulls from the Semantic Index (Spotlight), onscreen awareness, and the App Toolbox, but does not expose raw personal data to any cloud model. Siri AI maintains awareness across apps and performs cross-app actions without you opening individual applications.
The old Siri relied on SiriKit, now formally deprecated and replaced by App Intents. Legacy Siri was also the subject of a $250 million class action settlement, and understanding that settlement is key to understanding why the new architecture looks the way it does. Siri AI runs on iPhone 16 and later, M1 iPads and Macs, Apple Watch Series 9, and Apple Vision Pro. It is blocked on iOS, iPadOS, and watchOS in the EU, a regulatory dimension we cover in the broader lockout story.
Does the $250 million Siri settlement reflect on Apple’s ability to deliver Siri AI?
The $250 million class action, finalised in May 2026, covered iPhone 15 and 16 buyers who were promised AI-powered Siri capabilities that did not arrive on schedule. Separately, the legacy Siri architecture from 2011 to 2019 had a well-documented failure mode: accidental activations recorded private conversations, which Apple contractors could then access for quality review.
Siri AI is architecturally incapable of that specific failure. Tier 1 processing stays on-device, so data never leaves the phone. Tier 2 Private Cloud Compute nodes are stateless, with cryptographic attestation verifying that data is deleted after inference and nodes are recycled. Tier 3 queries run inside hardware-enforced trusted execution environments where even Google operators cannot inspect the workload.
The settlement reflects on the old architecture’s failure mode, not on the new architecture’s delivery risk. Whether Siri AI delivers reliably is a question answered by independent verification, not by Apple’s past. And independent researchers at WiSec ’26 confirmed that PCC responses are state-independent and the model remained consistent across months of testing. The same researchers found deviations in the cryptographic protocol: certain token signature fields could be nullified and requests still processed, which suggests the abuse mitigation path is not yet fully active. The architecture’s guarantees are testable but not yet flawless. Apple publishes PCC binaries through its Virtual Research Environment for external inspection, and the Security Bounty Program incentivises finding gaps in the attestation chain.
The settlement is best understood as the subtext for Apple’s privacy investment. Whether the new architecture holds up will depend on sustained adversarial review, not on Apple’s assertions.
Why did Apple license Google Gemini instead of building its own large language model?
Apple did not license Gemini as a live API. It licensed full model access for distillation: feeding Gemini’s outputs and reasoning traces into smaller Apple Foundation Models that run on Apple-controlled infrastructure. This preserves the privacy architecture in a way that live API calls to a third party could not.
The resulting AFM family spans five models: AFM 3 Core (3 billion parameters, on-device), AFM 3 Core Advanced (20 billion sparse, on-device, activating 1 to 4 billion per request), AFM 3 Cloud (Apple silicon servers), ADM 3 Cloud Image (image generation), and AFM 3 Cloud Pro (frontier-class, on Nvidia GPUs in Google Cloud).
Google provided TPU access for training. Apple ran its own multi-stage post-training pipeline combining supervised fine-tuning, reinforcement learning, and Quantization-Aware Training. Apple explicitly rejected RLHF using stored user interactions, a practice competitors use, which constrained AFM training differently from Google, OpenAI, and Anthropic’s approaches.
Apple reportedly evaluated proposals from OpenAI and Anthropic before selecting Google. The deal reverses the traditional search-revenue relationship where Google paid Apple for default placement; here Apple is the customer. And Google now powers a product that EU regulation then blocks, an irony worth sitting with.
How does Apple’s three-tier privacy architecture actually work?
Every Siri AI query passes through an on-device tokenisation and anonymisation layer that strips personally identifiable information before any data leaves the device. From there, the System Orchestrator routes the query to one of three tiers.
Tier 1 handles roughly 60 to 70 percent of queries on-device, using AFM 3 Core and AFM 3 Core Advanced running on the A18 or M4 Neural Engine and GPU. The models fit into 3 to 4 GB of unified memory. Instruction-Following Pruning, an Apple-developed technique, stores the full sparse model in NAND flash and loads only the parameters relevant to each prompt. No data leaves the device.
Tier 2, Private Cloud Compute, runs on Apple silicon in Apple data centres. PCC nodes are stateless: data is deleted after inference, nodes are recycled with short time-to-live durations, and dedicated processes handle each request in isolated namespaces. Cryptographic attestation verifies the software running on each node. An OHTTP relay separates IP addresses from request contents, and RSA Blind Signature-based tokens authorise usage without identifying the user.
Tier 3 runs AFM 3 Cloud Pro on Nvidia Blackwell B200 GPUs inside Google Cloud, under hardware-enforced trusted execution environments. Apple extends its attestation chain into Google’s infrastructure, maintaining a cryptographically verifiable, append-only ledger of all Google Cloud hardware in the PCC fleet.
How does Nvidia confidential computing protect Siri AI queries in Google Cloud?
Intel TDX and Google Titan chips provide dual-vendor roots of trust for PCC nodes running in Google Cloud. Both attestation chains must succeed for a node to be authorised, and Apple layers its own software attestation on top. Firmware through application code is treated as part of the trusted computing base, with cryptographically verifiable append-only ledgers extending Apple’s hardware root of trust into Google’s infrastructure.
Each Nvidia Blackwell B200 chip packs 208 billion transistors with a second-generation Transformer Engine built for LLM inference. The TEE encrypts user input, model weights, and inference results inside GPU memory while computation is actively running. The GPU silicon itself enforces the trust boundary.
The answer to the obvious question is no: Google cannot see Siri AI queries processed in Google Cloud. The TEE makes inspection impossible at the hardware level. Apple’s contract with Google additionally prevents Google from using Siri queries to train future Gemini models. Confidential computing is what made Tier 3 structurally acceptable for Apple. Without it, running Siri AI’s most capable model on Google’s infrastructure would have been impossible.
What are the strategic trade-offs of licensing Gemini versus building in-house?
Time-to-market was the deciding factor. Gemini was production-ready with proven frontier-model capability. Apple’s in-house large-model programme was not, and Siri AI was already two years late. The features previewed at WWDC 2024 (personal context, onscreen awareness, cross-app automation) are only shipping now. If you’ve ever faced a board asking why your AI features aren’t shipping while competitors are announcing weekly, you recognise the math.
The cost structure differs fundamentally. Licensing is opex: $1 billion per year is predictable. Training comparable models in-house requires billions in compute infrastructure with no guarantee of matching Gemini’s quality. Apple’s AI infrastructure spend was $12.7 billion in fiscal 2025, compared to Google’s roughly $90 billion. Apple chose not to match the hyperscaler arms race.
Architectural control is where the cost is highest. AFM 3 Cloud Pro runs on Google Cloud infrastructure, not Apple silicon. Apple cannot independently evolve the model architecture without Google’s continued cooperation. Your flagship AI feature depends on your largest competitor’s infrastructure, and that competitor could use the relationship to shape your AI roadmap. The negotiating leverage sits with Google.
Apple did build in-house where it mattered most. The on-device and PCC-tier models are Apple-trained and run on Apple silicon. The AFM team is still developing models distinct from Gemini, suggesting the deal is a bridge rather than a permanent dependency. By treating the model as a commodity, Apple keeps the door open to swap backends without users noticing.
Apple has spent 15 years positioning itself against Google’s data-collection model, so licensing Google Cloud creates a messaging problem. Nvidia confidential computing partially resolves it by providing hardware-enforced separation, but the optics tension remains. If you are weighing a similar dependency, the question is whether your privacy architecture can bear the weight of where your most capable model actually runs.
How should you assess privacy risk in a multi-tier AI architecture?
Apple’s architecture maps cleanly to an evaluation framework that applies beyond Apple. The first dimension is trust boundaries: for each tier, ask who can access the data, under what conditions, and with what cryptographic guarantees.
Data classification determines routing. Queries are categorised by sensitivity and compute requirements before tier assignment, and the tokenisation layer strips PII before anything leaves the device. The pattern is transferable: classify your data before you choose where it runs.
Confidential computing provides hardware-enforced isolation but does not protect against application-level vulnerabilities. The prompt injection risk surface is what security researchers call the lethal trifecta: an assistant that can read private data (Semantic Index), ingest untrusted content (onscreen awareness of emails and web pages), and transmit information (cross-app actions). The EchoLeak attack against Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3) demonstrated exactly this pattern in a production system, where attackers extracted email contents via prompt injection into Copilot’s onscreen-awareness pipeline.
Apple’s stateless computation design mitigates data retention risk but does not address semantic security. A prompt injection attack could exfiltrate data within a single stateless session before the PCC node is recycled. For your own architecture, the question is whether your threat model requires hardware-enforced separation, cryptographic unlinkability, application-level sandboxing, or some combination, and whether your data classification justifies the infrastructure cost of each. The broader story of how regulation shapes these architectural choices is playing out in real time with the Siri AI EU lockout.
Independent verifiability matters. Apple publishes PCC binaries for researcher inspection. For your own architecture, the test is whether your privacy guarantees are auditable or merely asserted.
Apple built three distinct trust boundaries with hardware-enforced separation at every tier. The Google Gemini deal was build-versus-buy, not outsourcing. Distillation preserves Apple’s privacy model in a way live API calls cannot, and Nvidia confidential computing made the Google dependency structurally defensible. The strategic cost remains: Apple ceded architectural control of its most capable tier to its largest competitor’s infrastructure, and the DMA interoperability dispute that is blocking it from EU iPhones entirely adds a regulatory dimension to that dependency.
Siri AI is a distributed-trust architecture with hardware-enforced privacy boundaries at every tier. The Google dependency, far from being a contradiction, is the architecture’s most revealing component. Apple licensed Gemini because it had to move fast and could not match frontier-model quality in-house, and confidential computing made that dependency structurally acceptable. The architecture is the answer to a $250 million question Apple cannot afford to answer twice.
For your own evaluation, the framework is the takeaway. Classify data by sensitivity. Map each tier’s trust boundary explicitly. Choose isolation mechanisms (hardware, cryptographic, or application-level) that match the threat model, not the marketing budget. Apple’s architecture is testable, not yet flawless, and worth watching as the first large-scale case study in whether you can use a competitor’s frontier models without ceding your privacy story. How the DMA dispute shapes the stakes for this architecture is the broader question.
Frequently Asked Questions
Does Siri AI work without an internet connection?
Yes, for roughly 60 to 70 percent of queries. Tier 1 runs fully on-device using AFM 3 Core (3B parameters) and AFM 3 Core Advanced (20B sparse, activating 1 to 4B per request) on the A18 or M4 Neural Engine and GPU. No data leaves the device for these queries. More complex requests that require Private Cloud Compute or Google Cloud inference demand connectivity, so Siri AI degrades gracefully rather than failing outright when offline.
Can I choose which processing tier handles my Siri AI queries?
No. The on-device System Orchestrator automatically classifies each query by sensitivity and compute requirements and routes it to the appropriate tier. There is no user-facing toggle to force local-only or cloud processing. The design philosophy prioritises privacy by default: the orchestrator keeps data on-device whenever possible and only escalates to PCC or Google Cloud when the query genuinely requires more capable models.
What happens if Apple’s deal with Google Gemini ends?
Apple would lose access to the frontier-scale tier. AFM 3 Cloud Pro, which runs on Nvidia Blackwell B200 GPUs inside Google Cloud, would need to be replaced with an in-house equivalent or another licensed model. The on-device and PCC tiers, which run Apple-trained models on Apple silicon, would continue operating independently. The strategic risk is concentrated in Tier 3: Apple’s most capable inference would require either a new licensing partner or a multi-year in-house training programme to match Gemini’s quality.
Is the Google Gemini licensing deal exclusive, or could Apple use other models?
Apple has not disclosed exclusivity terms, but the architecture does not structurally require Gemini. The distillation pipeline could in principle use any frontier model as a teacher. Apple’s reported sidelining of the earlier OpenAI ChatGPT integration suggests a preference for deep co-development rather than multi-vendor hedging. If the deal permits, Apple could theoretically run multiple third-party backends through Tier 3, though the attestation and confidential computing stack would need to extend to each new provider.
How does Siri AI compare to using ChatGPT directly?
Siri AI is not designed to compete with ChatGPT as a standalone chatbot. It is a system-level orchestrator that reasons across your apps, messages, calendar, and onscreen content without requiring you to copy data into a separate interface. ChatGPT offers broader world knowledge and creative capability, but Siri AI’s advantage is context: it can act on your personal data without that data leaving the device for most queries. The two products solve different problems.
What data does Apple collect from Siri AI, and who can see it?
Apple collects no persistent data from Tier 1 processing because nothing leaves the device. Tier 2 PCC nodes are stateless: data is deleted after inference, nodes are recycled, and cryptographic attestation verifies this behaviour. Tier 3 queries run inside Nvidia hardware-enforced TEEs where not even Google Cloud operators can inspect the workload. The OHTTP relay separates IP addresses from request contents, and RSA Blind Signature-based tokens authorise usage without identifying the user. Apple’s claim is that no human, including Apple staff, sees your Siri AI queries.
Does Apple’s AI privacy architecture actually beat what Google offers?
They address different threat models. Google’s approach relies on data centre security and policy controls, meaning Google as the operator can technically access inference workloads under certain conditions. Apple’s architecture adds hardware-enforced separation: Tier 3 queries run inside GPU-level TEEs where the silicon itself blocks inspection, and PCC adds cryptographic attestation with published binaries. Apple’s model is more resistant to insider threats and operator access, but Google’s model supports a broader range of cloud-native AI services that Apple does not attempt to match.
Will Siri AI replace Google Search as the default on iPhones?
Unlikely in the near term. Siri AI is an assistant that uses a Semantic Index of your personal data, onscreen awareness, and app integration to perform actions and answer contextual queries. It is not a general-purpose web search engine. Apple could theoretically route some informational queries through Siri AI instead of Safari search, but the assistant lacks the web-scale index and ranking infrastructure that makes Google Search valuable. The two products are complementary, not competing, in their current form.
Can third-party apps integrate with Siri AI’s cross-app actions?
Yes, through the App Toolbox framework. Developers register their app’s capabilities and intents, and the System Orchestrator can then invoke those actions as part of cross-app workflows. This is not an open API in the traditional sense: integration requires apps to declare structured intents that Siri AI can reason over, and the orchestrator mediates all access. The design prevents apps from directly querying the assistant’s reasoning state while still enabling the cross-app automation that defines Siri AI’s value proposition.
How do we know Apple’s privacy claims about Siri AI are real?
Apple publishes PCC binaries for external inspection through the Virtual Research Environment, where security researchers can run the same software as production nodes and verify behaviour. The Security Bounty Program incentivises finding flaws in the attestation chain or data retention claims. For Tier 3, the Nvidia TEE provides hardware-level guarantees that are independently auditable through the dual-vendor root of trust (Intel TDX and Google Titan). Apple’s claims are testable, not merely asserted, though the full architecture has not yet faced sustained independent adversarial review at scale.
