trusted-execution-environment

How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees (opens in new tab)

WhatsApp’s optional Scam Alert uses an on-device machine-learning model to identify likely scam messages without sending message content to WhatsApp, Meta, or third parties. The system is designed to preserve end-to-end encryption, give users control over warnings and reporting, and make its model and privacy safeguards independently reviewable. It is being introduced gradually in Beta while security researchers test its implementation. ## Design Principles - **On-device only:** The model and messages it analyzes remain on the user’s device. - **No automatic reporting:** WhatsApp receives message content or scam-detection information only if the user explicitly reports a chat. - **User control:** Users can enable or disable Scam Alert and decide how to respond to warnings. - Recent advances in mobile machine learning make it practical to run a small, reviewable text-classification model locally. ## How Scam Alert Works - After activation, the device downloads the model and analyzes incoming messages from non-contacts. - Classification is based on conversational structure, language signals, and patterns found in previously reported scam conversations. - When a message appears suspicious, the user sees a private warning visible only to them. - The user can: - Block the sender - Report the chat - Continue the conversation - Mark the chat as trusted - Trusted chats no longer receive Scam Alert warnings. Users may optionally share the last five received messages from a trusted chat to help improve accuracy. ## Foundational Safeguards - **Privacy-preserving analytics:** Only anonymous, aggregate warning and user-action counts are collected. - **Confidential computing:** Metrics are processed inside confidential virtual machines using trusted execution environments. - **No targeted model delivery:** WhatsApp cannot send a specific model to an individual user. - **Public transparency:** Every model version, including experimental versions, is recorded in a public transparency ledger before deployment. - **Verifiable behavior:** Model weights are published so researchers can confirm that the model is designed specifically to detect scams. ## Privacy-Preserving Analytics WhatsApp wants to measure whether Scam Alert catches scams accurately without collecting message content. The system therefore limits telemetry to two categories: - **Warning counts:** Approximate aggregate counts of how often the model displays warnings, helping measure detection rates and identify regressions. - **User action counts:** Aggregate counts of whether users trust, block, or report after receiving warnings, helping estimate false-positive rates. These metrics are protected using differential privacy, which adds carefully calibrated noise so that the presence or absence of one person’s data has negligible impact on the aggregate results. ## Confidential Federated Analytics - Devices aggregate local events before transmitting them; raw signals never leave the device. - Metrics contain no device identifiers, use coarse time intervals, and are sent at randomized times. - Data is encrypted between the device and the trusted execution environment. - Devices verify the environment’s software through hardware-backed attestations and a third-party record of approved binaries. - The confidential environment prevents WhatsApp, Meta, relays, and other intermediaries from accessing individual measurements. WhatsApp’s approach aims to provide scam detection without weakening message privacy: processing remains local, reporting remains user initiated, and system performance is measured only through minimized, privacy-protected aggregates. The feature is currently best viewed as an early Beta system whose effectiveness and security will depend on continued public review and bug-bounty testing.

Confidential AI for GitLab Self-Hosted (opens in new tab)

Privatemode AI enables GitLab Duo Self-Hosted to provide modern coding agents without exposing source code to GitLab, a cloud provider, or an AI operator. It uses confidential computing and remote attestation to keep prompts, code, and completions encrypted even during inference, avoiding both the compliance risks of public AI services and the operational burden of running private GPU infrastructure. ## The productivity gap for regulated teams - GitLab Duo supports more than autocomplete, including: - Merge request reviews - Cross-file refactoring - Test generation and execution - Agentic workflows running in CI - These features normally require sending source code and prompts to an external model provider. - For organizations handling regulated software or proprietary intellectual property, that data transfer may violate contracts, regulations, or internal policy. ## Why self-hosting is difficult - Affected sectors include finance, healthcare, defense, government, and critical infrastructure. - Requirements may come from NIS2, DORA, GDPR, BaFin, BSI C5, healthcare rules, and broader data-sovereignty expectations. - Public AI SaaS is often unacceptable because code leaves the organization. - Private-cloud or VPC services reduce exposure but still require trusting the cloud and service operators with plaintext. - Running models internally preserves privacy but requires expensive GPUs, specialized staff, and ongoing model operations, while often lagging behind frontier models. ## Confidential computing as the solution - Confidential computing uses hardware-based trusted execution environments (TEEs) to encrypt data while it is being processed. - The architecture relies on technologies such as: - AMD SEV or Intel TDX for CPU protection - NVIDIA Confidential Computing for GPU protection - AES-256 encryption for data in transit and at rest - Remote attestation verifies that approved code is running inside the TEE before any data is sent. - Prompts, source code, context, and completions are decrypted only inside the protected environment. - The operator and underlying cloud provider cannot inspect the data through normal system or infrastructure access. ## Privatemode AI - Privatemode, developed by Germany-based Edgeless Systems, provides confidential inference through an OpenAI-compatible API. - Its client-side proxy manages encryption and remote attestation transparently. - Existing tools and SDKs using the standard `/v1` API can work without major changes. - The current highlighted coding model is Kimi K2.6 with a 256K context window; Kimi K3 and GLM are expected to follow. - The service is presented as production-ready and already used by public-sector, financial, defense, and regulated-industry organizations. - Its post-quantum-safe cryptography is intended to protect against “harvest now, decrypt later” attacks. ## GitLab Duo integration - GitLab Duo Self-Hosted connects to a self-hosted AI Gateway. - The Gateway forwards requests to the Privatemode proxy as an OpenAI-compatible endpoint. - The proxy: - Encrypts requests before they leave the organization’s network - Verifies the remote TEE through attestation - Forwards only after verification succeeds - Developers continue using Duo features such as Code Suggestions, Chat, Code Review, and agentic workflows without changing their experience. The recommended approach for regulated organizations is to combine GitLab Duo Self-Hosted with a confidential-computing provider such as Privatemode. This provides modern AI coding capabilities while replacing contractual privacy promises with hardware-enforced protection, without requiring the organization to operate its own LLM infrastructure.