Maybe I misunderstood, but Apple lays out the process starting at 5:17 in the State of The Union address:
“Still, there are some more advanced features that require larger models to reason over more complex data. So we've extended Apple Intelligence to the cloud with Private Cloud Compute to run those larger foundation models. Because these models process users' personal information, we needed to rethink Cloud Compute and extend the privacy approach of our devices to servers. Private Cloud Compute is designed specifically for processing AI, privately. It runs on a new OS using a hardened subset of the foundations of iOS, based on our industry leading operating system security work. To mitigate entire classes of privacy risks, we have omitted features that are not strictly necessary in a dedicated AI server, such as persistent data storage. On top of this secure foundation, we have completely replaced the tools normally used to manage servers. Our tooling is designed to prevent privileged access, such as via remote shell, that could allow access to user data. And finally, Private Cloud Compute includes a full machine learning stack that powers intelligence. The result is an unprecedented cloud security foundation based on Apple Silicon. It starts with the Secure Enclave to protect critical encryption keys. Secure Boot ensures the OS is signed and verified just like on iOS, Trusted Execution Monitor makes sure that only signed and verified code runs. And attestation enables a user's device to securely verify the identity and configuration of a Private Cloud Compute cluster before ever sending a request. For each request, a user's device establishes an end-to-end encrypted connection with a Private Cloud Compute cluster. Only the chosen cluster can decrypt the request data, which is not retained after the response is returned and is never accessible to Apple. But we're going even further: we're committing to making virtual images of every production build of Private Cloud Compute publicly available for inspection by security researchers, so they can verify the promises that we're making, and findings will be rewarded through the Apple Security Bounty. Second, we're making sure a user's device will only communicate with Private Cloud Compute clusters that are running a signed build that has been publicly logged for inspection. This is verified with the strong cryptographic attestation mechanisms in Apple silicon. We believe this is the most advanced security architecture ever deployed for cloud AI compute at scale. Apple Intelligence is the personal intelligence system that brings this all together. It includes an on-device semantic index that can organize personal information from across apps as well as an App Intents Toolbox that can understand capabilities of apps and tap into them on a user's behalf. When a user makes a request, Apple Intelligence orchestrates how it's handled either through its on-device intelligence stack or using Private Cloud Compute. And it draws on its semantic index to ground each request in the relevant personal context and uses its App Intents Toolbox to take actions for the user. It's specialized to be absolutely great at the features it enables. It's built with the best possible performance and energy efficiency, and of course, it's designed around privacy and security from the ground up. And that's Apple Intelligence”