Apple details Secure Exclaves, which keep camera and microphone data away from its own OS

Apple on 12 November published details of Secure Exclaves, a security architecture in its chips that protects camera and microphone data while a device processes it in the background. The company said data handled inside the isolated environment cannot be accessed by the main operating system, by apps or by Apple itself.

Where it is used

The architecture is designed for what Apple calls ambient sensing: a device uses its camera and microphone to understand its surroundings and recognise the voice and face of an enrolled user. Apple uses it on the HomeView smart home display, which can recognise up to six people, and for the Siri Recap and Live Rewind features. It also protects “Hey Siri” detection and the on-screen camera and microphone indicators on the iPhone 18 Pro, iPhone 18 Pro Max and iPhone Duo, as well as the camera indicators on the MacBook Neo and HomeView.

The sensor stream is reduced to simple signals, such as whether a particular sound was heard or an enrolled user was recognised. Raw audio and video stay in the isolated environment and are deleted once processing is complete.

An indicator that cannot be bypassed

The system has two modes. In ambient mode, only specific metadata may leave the isolated environment. In active mode, full sensor data can be passed to the operating system, but only while a secure indicator shows it. A dedicated controller checks that the indicator is on and has been visible long enough: on HomeView it drives the LED and its brightness directly, while on the iPhone it checks that the indicator pixels are bright enough and not covered by neighbouring pixels.

“Building a new secure runtime requires a highly secure OS foundation. For this reason, we utilised an Apple-customised version of the L4 microkernel which we originally built for some of our most security-sensitive deployments, including the Secure Enclave Processor,” Apple wrote.

The exclaves run in a separate processor execution context with their own operating system, while memory isolation is enforced by a monitor with higher privileges than the main system's kernel. Apple audits every interface to the main system so that only the metadata needed for ambient sensing gets out.