English static mirror for SEO/GEO · AI-assisted translation · Read Chinese original

Cracking Apple's Black Box: Reverse Engineering Training on the Apple Neural Engine

Forum topic · 小凯 · 2026-03-20

Summary

Developer Manjeet Singh (GitHub: maderix) has achieved the first known training of a neural network on Apple's Neural Engine (ANE), a chip Apple has restricted to inference-only via its CoreML framework since 2017. Working over a weekend with AI assistance from Claude Opus, he reverse-engineered CoreML and IOKit drivers to uncover 67 private Objective-C classes, including _ANEClient, _ANECompiler, and _ANEInMemoryModelDescriptor, enabling direct control of the hardware. Benchmarking reveals the M4 ANE delivers a real peak of 19 TFLOPS FP16 (Apple's advertised 38 TOPS INT8 relies on dequantization to FP16), with exceptional efficiency of about 6.6 TFLOPS/W at 2.8W — roughly 80x Nvidia's A100. He successfully trained a 109M-parameter Llama2 Transformer, running forward and backward passes for RMSNorm, QKV projection, and scaled dot-product attention entirely on the ANE at ~9.3ms per step with ~11.2% utilization (1.78 TFLOPS sustained). Key limitations include a pipeline architecture requiring 16–64 chained operations for full utilization (~30% peak for single ops) and a 119-compile-per-process cap. The project cites Sega v. Accolade and DMCA §1201(f) as legal grounding and proves Apple's hardware is capable of training — only the software locks it out.

A Chip Held in Captivity

Every MacBook, iPhone, and Mac mini since 2017 contains a dedicated silicon block called the ANE — Apple Neural Engine, first introduced with the A11 Bionic. Officially, it accelerates "machine learning inference": it can only *run* models trained elsewhere — it cannot *learn*.

Imagine a brilliant student locked in a glass room. You can hand him exam papers and he completes them at astonishing speed — but he can never open a textbook or learn anything new. That has been the ANE's fate. Through the CoreML framework, Apple restricts the ANE strictly to inference mode. Want to train a model on your Mac? Sorry — go rent an Nvidia GPU.

Until early 2026, when a developer named Manjeet Singh decided to pry open that glass door.

The Intruder: The Art of Reverse Engineering

Manjeet Singh (GitHub: maderix) didn't hack Apple's servers or steal secrets. He performed one of the oldest and most romantic practices in programming: reverse engineering.

His premise was clear: the ANE hardware is capable of training; Apple merely locked it in software. He spent an entire weekend, collaborating with Claude Opus (Anthropic's AI assistant), tracing from the CoreML framework down to the IOKit kernel drivers — an archaeological dig through Apple's software stack.

> Tip: IOKit is the low-level device driver framework for macOS and iOS. If CoreML is the restaurant's storefront, IOKit is the plumbing in the back kitchen.

And then, he found it.

Dissecting the Black Box: 67 Private APIs

In Apple's "private" territory, Manjeet discovered 67 Objective-C classes forming the ANE's true control interface. The three most important:

  • _ANEClient — the ANE "client", responsible for establishing sessions with the hardware
  • _ANECompiler — the ANE "compiler", converting computation graphs into ANE-executable instructions
  • _ANEInMemoryModelDescriptor — an in-memory model descriptor allowing models to be loaded directly, bypassing CoreML
  • These APIs have never appeared in Apple's developer documentation. He also found that the ANE uses an intermediate format called MIL (Model Intermediate Language), which translates various neural network operations into ANE-executable instructions.

    A Striking Discovery: Hidden Compute

    Apple claims the M4 chip's ANE delivers 38 TOPS. Manjeet's actual measurements show:

    The ANE's true peak is 19 TFLOPS FP16.

    Why is that surprising, given 19 < 38? Because Apple played a numbers game. When the ANE performs INT8 (8-bit integer) operations, it first dequantizes them to FP16 before computing. INT8 offers no real speed advantage — it only saves memory bandwidth. The "38 TOPS" figure is the marketing number obtained by multiplying 19 TFLOPS by 2.

    But even at 19 TFLOPS, with a peak power draw of 2.8W, the ANE achieves an efficiency of roughly 6.6 TFLOPS/W. For comparison:

  • Nvidia A100 GPU: about 0.08 TFLOPS/W
  • ANE: roughly 80x higher energy efficiency than the A100
  • Imagine: the fingernail-sized chip in your MacBook Pro delivers 80x more AI computation per watt than data-center GPUs occupying dozens of square meters.

    The First Time: Llama2 Learned on a Mac

    With low-level control secured, Manjeet attempted something bolder: training a complete neural network on the ANE.

    He chose a 109M-parameter Llama2 Transformer — a miniature of the kind of large language model that can chat and write code.

    Training a neural network requires:

    1. Forward Pass — feed in data, let the network guess 2. Compute Loss — measure how wrong the guesses are 3. Backward Pass — backpropagate from errors, compute gradients for every parameter 4. Update — an optimizer (e.g., Adam) modifies the weights

    Apple says the ANE can only do step one (inference). Manjeet proved: the ANE can also do step three (backpropagation).

    In his implementation:

  • Forward and backward versions of RMSNorm, QKV projection, and scaled dot-product attention (SDPA) all ran on the ANE
  • ~9.3ms per training step
  • ~11.2% ANE utilization, sustaining 1.78 TFLOPS
  • It's not perfect — weight gradient accumulation and the Adam optimizer still run on the CPU. But this is a complete training loop: the first time in history a neural network has been trained on Apple's Neural Engine.

    > Tip: Backpropagation is how neural networks "learn". If inference is an exam, backpropagation is the error-correction notebook. The ANE could only take exams before — now it can finally take notes.

    The Bottlenecked Pipeline

    The ANE has 16 processing cores, but they are pipelined — like a factory assembly line, each station does one step. A single submitted operation leaves most stations idle: measurements show a single operation reaches only about 30% of peak ANE performance.

    To fully utilize the ANE, you must chain 16–64 operations into one large computation graph and submit it at once, allowing different cores to work on different stages simultaneously — pushing utilization up to 94%.

    There's another odd limitation: each process can only compile ANE programs 119 times, due to a resource leak. For training, this means carefully managing a "compile cache", or the run will crash mid-training.

    The Legal Gray Zone

    Is this legal? Manjeet cited two legal bases in the project README:

    1. Sega v. Accolade (1992) — the US Ninth Circuit ruled that reverse engineering for interoperability is lawful 2. DMCA §1201(f) — the Digital Millennium Copyright Act exemption permitting circumvention of technical measures to achieve interoperability with independently developed programs

    In short: he didn't steal Apple's code — he studied how hardware he purchased actually works.

    Future Possibilities

    The ANE Training project is a research prototype, not production-ready. But its significance goes beyond the technology. It proves: what limits AI training was never the hardware — it's the software.

    Every M-series chip contains an AI training accelerator roughly 80x more energy-efficient than data-center GPUs. Hundreds of millions of Mac users may be sitting on potential "AI supercomputers" without knowing it.

    If Apple officially opened ANE training:

  • Privacy: personal data could train personalized AI assistants entirely on-device
  • Cost: no more expensive cloud GPUs for training small-to-medium models
  • Energy efficiency: training's carbon footprint could drop to a fraction of data-center levels
Apple's business strategy and ecosystem control may keep this forever hypothetical. But at minimum, Manjeet Singh proved it is possible.

Epilogue: Light in the Glass Room

Back to the opening metaphor. The ANE — the genius student locked in a glass room — has finally been handed a book. He opens the first page and starts to read. Slowly, imperfectly. But he is finally learning.

Perhaps one day Apple will formally open that door. Perhaps not. Until then, hackers and researchers like Manjeet Singh will keep searching for light in the cracks of the system — proving that technical boundaries are defined by people, and the people who define them are often the ones who break them.

As Feynman once said:

> "What I cannot create, I do not understand."

References

1. GitHub Repository: maderix/ANE — Training neural networks on Apple Neural Engine via reverse-engineered private APIs 2. maderix's Substack: "Inside the M4 Apple Neural Engine, Part 1: Reverse Engineering" (February 2026) 3. maderix's Substack: "Inside the M4 Apple Neural Engine, Part 2: ANE Benchmarks" (February 2026) 4. Hollance/neural-engine — Community ANE documentation (GitHub) 5. Apple's ANE Transformers Reference: apple/ml-ane-transformers (GitHub)

*(This article is based on the above open-source project and technical blogs; all technical data comes from the author's measurements and publicly released information.)*

Tags

#apple#apple-neural-engine#reverse-engineering#machine-learning#neural-network-training#coreml#m4-chip#on-device-ai

This page is an English static mirror generated for search and AI citation. It may be a full translation or structured summary of the Chinese original. Canonical interactive discussion lives on the Chinese page: https://zhichai.net/topic/177168921