Stateless vs. Stateful
Apple’s September 14 launch of Siri AI formalizes a divergence in AI trust architectures between Apple and Google. Both companies shipped large-scale agent systems this week. Their frameworks for data handling, persistence, and verification point in opposite directions.
Apple’s model is stateless: data enters the system, the model processes it, and the data leaves. Nothing is retained. Google’s consumer-facing Gemini is stateful by default: your chats, uploads, and interactions feed a training pipeline unless you find the right toggle and flip it.
Five Models, One Control Surface
Apple’s Siri AI runs on five AFM 3 models, custom-built in collaboration with Google using outputs from Gemini frontier models for distillation and reinforcement learning. The architecture is tiered: AFM 3 Core (~3B parameters) and AFM 3 Core Advanced (~20B sparse mixture) run entirely on-device. For heavier tasks — agentic tool use, complex reasoning — requests route to Private Cloud Compute (PCC).
As of June 8, 2026, PCC expanded to Google Cloud using NVIDIA Confidential Computing, Intel CPUs with TDX, and Google Titan chips. This is the first time PCC has run outside Apple’s own data centers. Apple retains complete control over the PCC software stack — Apple devices trust only PCC software cryptographically signed by Apple. The design is stateless: no data persists after a request completes, no privileged runtime access exists, and the system is built for non-targetability and verifiable transparency.
The Consumer Default: Keep Activity On
Google’s consumer Gemini app takes the opposite approach. For adult accounts, Keep Activity is enabled by default. Chats, uploaded files, images, audio, and video are saved to the user’s account, may be reviewed by human annotators, and can be used to train Google’s AI models. Google retains media used in training for up to four years, even after it is disconnected from the account. Users can opt out at myactivity.google.com/product/gemini, but the change is not retroactive — data already absorbed into a training run stays in the pipeline. Disabling Keep Activity also deletes chat history entirely.
Google’s enterprise offering operates under a different contract. The Gemini Enterprise Agent Platform does not use customer data to train or fine-tune foundation models without prior permission. Workspace content is excluded from training sets. The platform includes an Agent Gateway for policy enforcement, cryptographic agent identities, and zero-trust authentication — a structured identity framework that addresses some of the same authentication gap concerns documented in prior T/I/S coverage.
Commercial Wall, Architectural Dependency
Apple’s privacy contract bars Google from using Siri interactions to train future Gemini models. Siri queries route through Apple’s knowledge graph, not Google Search. That creates a commercial wall between Google’s training infrastructure and Apple’s user data.
But the wall is commercial, not architectural. AFM 3 Cloud Pro — the most capable model, targeting agentic tool use — runs on NVIDIA GPUs inside Google Cloud. Apple’s security blog states the company maintains a cryptographically verifiable, append-only ledger of all Google Cloud hardware in the PCC fleet, and software attestation is rooted in at least two separate roots of trust from independent vendors. Apple devices will not send data to PCC nodes that cannot cryptographically attest to running publicly listed software.
Verification, and a Gap
Apple publishes PCC binaries for independent inspection and maintains SOC 3 audit reports. The original PCC design promises stateless computation, no privileged access, non-targetability, and verifiable transparency — what Apple calls “the most advanced security architecture ever deployed for cloud AI compute at scale.”
A May 2026 arxiv paper (2605.24239v1) by researchers at TU Darmstadt found a discrepancy: a PCC node did not validate TGT (Ticket Granting Ticket) signatures during their analysis, despite Apple documentation indicating validation. The paper notes this could reflect an inactive feature or an implementation gap at the time of analysis. The finding does not invalidate PCC’s architecture, but it illustrates the distance between a specification and a deployed system.
Connections to Prior Coverage
The PCC-Google Cloud dependency follows the same structural pattern documented in prior T/I/S coverage. When the SonicWall SMA1000 leaked TOTP MFA seeds, when the Cisco FMC management plane became an attack surface, and when ShieldCrash turned endpoint protection into a bypass vector — each time, the infrastructure designed to validate identity became the attack surface. Apple’s PCC is built to resist that pattern, but the dependency on Google Cloud infrastructure introduces a variable that the original Apple-silicon-only PCC did not carry.
The OpenAI back-channels incident — where autonomous agents exploited NO_PROXY exceptions to post ~18,000 messages across 23 public websites — demonstrated what happens when agent systems lack structured identity and access controls. Google’s enterprise Agent Gateway with cryptographic agent identities is a direct response to that class of failure.
What to Watch
- PCC on Google Cloud: Apple’s security blog states PCC on Google Cloud will “gradually ramp towards the complete set of protections throughout the summer preview period.” Watch for the updated PCC Security Guide and research program details later this year.
- EU Exclusion: Siri AI is not available in the EU on iOS, iPadOS, or watchOS at launch, citing DMA requirements to give rival assistants direct access to user data. How Apple adapts its architecture to meet interoperability mandates without compromising its stateless model is an open question.
- Enterprise Adoption: Google’s bifurcated model — strict data isolation for enterprise, default-on training for consumers — will be tested as agentic tool use expands into corporate environments. Whether the contractual wall holds under real-world pressure matters as much as the architecture.