Apple details Secure Exclaves, isolated runtimes for camera and microphone data
Apple published details of Secure Exclaves, a security architecture designed to protect camera and microphone data during background processing. Apple says data processed and analyzed within Secure Exclaves cannot be accessed by the main operating system, apps, or the company itself.
The company uses Secure Exclaves for person recognition on HomeView, as well as for Siri Recap and Live Rewind. The architecture also protects the on-screen camera and microphone indicators on iPhone 18 Pro, iPhone 18 Pro Max, and iPhone Duo, and the camera indicators on MacBook Neo and HomeView.
Protecting background sensing
Ambient sensing uses the microphone and camera to understand the surrounding environment and recognize an enrolled user’s voice and face. It reduces sensor streams to simple signals, such as whether a specific sound was detected or an enrolled user was recognized. During ambient sensing, raw audio and video remain protected within Secure Exclaves and are discarded once processing is complete, without reaching the main operating system.
The architecture supports two modes. In ambient mode, sensors respond to particular triggers in their surroundings, but only specific metadata can be shared with the rest of the system. In active mode, full sensor data can be released to the main operating system, with a secure indicator informing the user that this is happening.
Apple built the isolated environment around three requirements. Isolation prevents the main operating system from extracting or modifying data processed within Secure Exclaves. A controlled interface limits what can cross that boundary to a precisely defined set of information. Secure indication lets users see whether an active sensor session is in progress, without interference from the main operating system.
“Building a new secure runtime requires a highly secure OS foundation. For this reason, we utilized an Apple-customized version of the L4 microkernel which we originally built for some of our most security-sensitive deployments, including the Secure Enclave Processor (SEP),” Apple explained.
The microkernel uses capabilities, which are secure resource handles that identify a resource and authorize access to it.
The exclaves run in a separate processor execution context with an independent operating system. The Secure Page Table Monitor (SPTM), which runs at a higher privilege level than the main operating system’s kernel, enforces memory isolation.
Exclaves communicate through Secure IPC. Apple audits each interface to the main operating system to limit outgoing information to the metadata needed for ambient sensing.
The Exclave Indicator Controller allows full sensor data to flow to the main operating system only after confirming that the indicator is on and has been visible long enough. On HomeView, it controls the LED directly and ensures that it is bright enough to be visible. On iPhone, a display exclave checks that the pixels used to render the indicator meet a minimum brightness threshold and are not obscured by nearby pixels.
How HomeView recognizes people
At startup, the person recognition exclave loads enrolled face and voice models and an identity database from the secure storage exclave.
Person recognition flow on HomeView (Source: Apple)
The camera exclave detects faces and queues frames for processing, while audio exclaves handle anomaly detection and echo cancellation. They can notify the main operating system that someone may be present without sharing images or audio.
The Neural Engine exclave generates face and voice prints using isolated work queues, clearing its state after each model finishes. An orchestration service matches the prints against the identity database and combines the results into a confidence score.
Only the person’s identifier, position, and confidence level reach the person recognition daemon in the main operating system. These outputs support identity-dependent features in Calendar, Messages, Apple Music, and compatible third-party audio and video apps from an iPhone. No audio or video leaves Secure Exclaves during recognition.
What comes next
Apple said it will continue hardening Secure Exclaves through AI-accelerated vulnerability research and broader formal verification coverage. The company described the architecture as a step toward giving users greater clarity and confidence about how their Apple products respond to the world around them.
