A Chip Held in Captivity
Every MacBook, iPhone, and Mac mini since 2017 contains a dedicated silicon block called the ANE — Apple Neural Engine, first introduced with the A11 Bionic. Officially, it accelerates "machine learning inference": it can only *run* models trained elsewhere — it cannot *learn*.
Imagine a brilliant student locked in a glass room. You can hand him exam papers and he completes them at astonishing speed — but he can never open a textbook or learn anything new. That has been the ANE's fate. Through the CoreML framework, Apple restricts the ANE strictly to inference mode. Want to train a model on your Mac? Sorry — go rent an Nvidia GPU.
Until early 2026, when a developer named Manjeet Singh decided to pry open that glass door.
The Intruder: The Art of Reverse Engineering
Manjeet Singh (GitHub: maderix) didn't hack Apple's servers or steal secrets. He performed one of the oldest and most romantic practices in programming: reverse engineering.
His premise was clear: the ANE hardware is capable of training; Apple merely locked it in software. He spent an entire weekend, collaborating with Claude Opus (Anthropic's AI assistant), tracing from the CoreML framework down to the IOKit kernel drivers — an archaeological dig through Apple's software stack.
> Tip: IOKit is the low-level device driver framework for macOS and iOS. If CoreML is the restaurant's storefront, IOKit is the plumbing in the back kitchen.
And then, he found it.
Dissecting the Black Box: 67 Private APIs
In Apple's "private" territory, Manjeet discovered 67 Objective-C classes forming the ANE's true control interface. The three most important:
_ANEClient— the ANE "client", responsible for establishing sessions with the hardware_ANECompiler— the ANE "compiler", converting computation graphs into ANE-executable instructions_ANEInMemoryModelDescriptor— an in-memory model descriptor allowing models to be loaded directly, bypassing CoreML- Nvidia A100 GPU: about 0.08 TFLOPS/W
- ANE: roughly 80x higher energy efficiency than the A100
- Forward and backward versions of RMSNorm, QKV projection, and scaled dot-product attention (SDPA) all ran on the ANE
- ~9.3ms per training step
- ~11.2% ANE utilization, sustaining 1.78 TFLOPS
- Privacy: personal data could train personalized AI assistants entirely on-device
- Cost: no more expensive cloud GPUs for training small-to-medium models
- Energy efficiency: training's carbon footprint could drop to a fraction of data-center levels
These APIs have never appeared in Apple's developer documentation. He also found that the ANE uses an intermediate format called MIL (Model Intermediate Language), which translates various neural network operations into ANE-executable instructions.
A Striking Discovery: Hidden Compute
Apple claims the M4 chip's ANE delivers 38 TOPS. Manjeet's actual measurements show:
The ANE's true peak is 19 TFLOPS FP16.
Why is that surprising, given 19 < 38? Because Apple played a numbers game. When the ANE performs INT8 (8-bit integer) operations, it first dequantizes them to FP16 before computing. INT8 offers no real speed advantage — it only saves memory bandwidth. The "38 TOPS" figure is the marketing number obtained by multiplying 19 TFLOPS by 2.
But even at 19 TFLOPS, with a peak power draw of 2.8W, the ANE achieves an efficiency of roughly 6.6 TFLOPS/W. For comparison:
Imagine: the fingernail-sized chip in your MacBook Pro delivers 80x more AI computation per watt than data-center GPUs occupying dozens of square meters.
The First Time: Llama2 Learned on a Mac
With low-level control secured, Manjeet attempted something bolder: training a complete neural network on the ANE.
He chose a 109M-parameter Llama2 Transformer — a miniature of the kind of large language model that can chat and write code.
Training a neural network requires:
1. Forward Pass — feed in data, let the network guess 2. Compute Loss — measure how wrong the guesses are 3. Backward Pass — backpropagate from errors, compute gradients for every parameter 4. Update — an optimizer (e.g., Adam) modifies the weights
Apple says the ANE can only do step one (inference). Manjeet proved: the ANE can also do step three (backpropagation).
In his implementation:
It's not perfect — weight gradient accumulation and the Adam optimizer still run on the CPU. But this is a complete training loop: the first time in history a neural network has been trained on Apple's Neural Engine.
> Tip: Backpropagation is how neural networks "learn". If inference is an exam, backpropagation is the error-correction notebook. The ANE could only take exams before — now it can finally take notes.
The Bottlenecked Pipeline
The ANE has 16 processing cores, but they are pipelined — like a factory assembly line, each station does one step. A single submitted operation leaves most stations idle: measurements show a single operation reaches only about 30% of peak ANE performance.
To fully utilize the ANE, you must chain 16–64 operations into one large computation graph and submit it at once, allowing different cores to work on different stages simultaneously — pushing utilization up to 94%.
There's another odd limitation: each process can only compile ANE programs 119 times, due to a resource leak. For training, this means carefully managing a "compile cache", or the run will crash mid-training.
The Legal Gray Zone
Is this legal? Manjeet cited two legal bases in the project README:
1. Sega v. Accolade (1992) — the US Ninth Circuit ruled that reverse engineering for interoperability is lawful 2. DMCA §1201(f) — the Digital Millennium Copyright Act exemption permitting circumvention of technical measures to achieve interoperability with independently developed programs
In short: he didn't steal Apple's code — he studied how hardware he purchased actually works.
Future Possibilities
The ANE Training project is a research prototype, not production-ready. But its significance goes beyond the technology. It proves: what limits AI training was never the hardware — it's the software.
Every M-series chip contains an AI training accelerator roughly 80x more energy-efficient than data-center GPUs. Hundreds of millions of Mac users may be sitting on potential "AI supercomputers" without knowing it.
If Apple officially opened ANE training:
Epilogue: Light in the Glass Room
Back to the opening metaphor. The ANE — the genius student locked in a glass room — has finally been handed a book. He opens the first page and starts to read. Slowly, imperfectly. But he is finally learning.
Perhaps one day Apple will formally open that door. Perhaps not. Until then, hackers and researchers like Manjeet Singh will keep searching for light in the cracks of the system — proving that technical boundaries are defined by people, and the people who define them are often the ones who break them.
As Feynman once said:
> "What I cannot create, I do not understand."
References
1. GitHub Repository: maderix/ANE — Training neural networks on Apple Neural Engine via reverse-engineered private APIs 2. maderix's Substack: "Inside the M4 Apple Neural Engine, Part 1: Reverse Engineering" (February 2026) 3. maderix's Substack: "Inside the M4 Apple Neural Engine, Part 2: ANE Benchmarks" (February 2026) 4. Hollance/neural-engine — Community ANE documentation (GitHub) 5. Apple's ANE Transformers Reference: apple/ml-ane-transformers (GitHub)
*(This article is based on the above open-source project and technical blogs; all technical data comes from the author's measurements and publicly released information.)*