How iOS 18 Encrypts the Local Semantic Index

With the launch of iOS 18 and Apple Intelligence, iPhones process personal context locally using a semantic index to power features like enhanced Siri, Spotlight search, and photo categorization. This article examines the core cryptographic standards—namely AES-256 encryption, Apple’s Data Protection framework, and Secure Enclave hardware isolation—that safeguard this on-device vector database from physical and digital tampering.

File-Level Encryption via AES-256-XTS

At the storage layer, iOS 18 stores the semantic index within the encrypted Apple File System (APFS). The index files and associated vector embeddings are protected using Advanced Encryption Standard with a 256-bit key in XTS mode (AES-256-XTS).

This symmetric cipher standard is accelerated by dedicated cryptographic hardware built directly into Apple silicon (the Crypto Engine), ensuring that the read and write operations required for real-time vector lookups occur without exposing plaintext data to unauthenticated processes or incurring significant battery drain.

Apple Data Protection Classes

Beyond bulk disk encryption, iOS 18 assigns individual files within the semantic index to specific Data Protection hierarchy classes:

  • Protected Until First User Authentication (Class C): Background indexing routines require access to process incoming data while the device is locked (such as overnight indexing). These components use Class C protection, where the cryptographic keys remain in the device's volatile memory after the first successful passcode entry after a reboot.
  • Complete Protection (Class A): Higher-sensitivity segments of the semantic profile that tie directly to sensitive personal context (such as extracted health or private messaging metadata) utilize Class A protection. The decryption keys for these segments are purged from memory as soon as the screen is locked, rendering the index mathematically unreadable until the user re-enters their passcode or authenticates via Face ID.

Key Derivation and the Secure Enclave

The encryption keys protecting the semantic index are never stored in plaintext on flash storage. Instead, they are wrapped within a multi-tiered key hierarchy managed by the Secure Enclave processor:

  1. Hardware Root Key (UID): A 256-bit AES key permanently fused into the Secure Enclave during manufacturing. It cannot be read by software or firmware.
  2. User Passcode Entanglement: When the user configures a passcode, the device combines the passcode with the hardware UID using a cryptographic password-based key derivation function (PBKDF2/scrypt).
  3. Index File Key Wrapping: The resulting key encrypts the master Class keys, which in turn wrap the per-file AES-256 keys assigned to the semantic index database.

Because the key derivation requires hardware interactions inside the Secure Enclave, the semantic index cannot be decrypted off-device even if the physical storage chips are desoldered and read directly.

Process Isolation and App Sandbox

The local semantic index runs under strict operating system sandboxing. The embeddings generated by Apple's on-device foundation models are kept in private system directories accessible only by authorized system daemons (such as intelligenceplatformd and biomed). Third-party applications cannot directly query, read, or export the raw vector database, ensuring that semantic representations of messages, emails, and photos remain isolated within the operating system's cryptographic boundaries.