{ "schema_version": "1.8.0", "rubric_version": "1.2", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)", "record": { "id": "I-0026", "slug": "whatsapp-private-processing", "title": "WhatsApp Private Processing", "aliases": [ "Private Processing", "WhatsApp Private Inference" ], "status": "published", "last_reviewed": "2026-10-15", "review_interval_days": 90, "steward": null, "provenance": { "drafted_by": "ai", "reviewed_by": [ "claude-opus-5-5" ] }, "risk_flags": [], "flags": [ "provider-reported" ], "one_liner": "Meta's server system for WhatsApp AI features, whose clients check a confidential virtual machine's attestation and transparency-log proofs before connecting.", "summary": "Private Processing is Meta's server system for AI features in WhatsApp. Meta reports that it runs requests in confidential virtual machines on AMD SEV-SNP processors with NVIDIA Hopper GPUs. In Meta's description, the client checks the server's attestation report, a fresh client nonce, the service's policy and proofs from a third-party transparency log before connecting. Models and prompts loaded after launch are also verified against the log, but the model weights stay private. NVIDIA reported in February 2026 that Meta had adopted NVIDIA Confidential Computing for the service. [Trail of Bits](https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/)' pre-launch review found 28 issues, eight of high severity, including unmeasured configuration and attestations without freshness. Meta resolved 16 issues and partly addressed four. Trail of Bits notes that SEV-SNP does not fully protect against advanced physical attacks, and that fully reproducible server images remain challenging.", "category": "on-chip", "secondary_categories": [ "cryptographic-computational" ], "verifies": [ { "claim": "C-0005", "role": "supporting", "note": "Meta reports that models loaded after launch are verified against a transparency log (S-3120). If the attestation is genuine, a request is tied to a logged model. The weights stay private, so outsiders cannot inspect that model." } ], "threat_model": "semi-trusted", "adversarial_evaluation": "analysis", "hardware_requirement": "existing-features", "prover_cooperation": "required", "confidentiality": "preserving", "depends_on": [ { "target": "M-0008", "note": "Relies on AMD SEV-SNP attestation and NVIDIA GPU confidential computing (S-3120)." } ], "readiness": { "assessment": true, "level": "R3", "scope": "showing WhatsApp clients which logged software and artifacts serve their AI requests", "rubric_version": "1.2", "rationale": "Meta reports running Private Processing for WhatsApp users, and [Trail of Bits](https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/) published the findings of a review made before launch.\n\n- **R1** met: Meta's [white paper](https://ai.meta.com/static-resource/private-processing-technical-whitepaper) describes the design, the client's checks and a threat model that includes physical attacks on hosts [[S-3120]].\n- **R2** met: Trail of Bits reviewed the implementation before launch, on AMD SEV-SNP with NVIDIA confidential GPUs, and published its findings and the fixes it reports [[S-3121]] [[S-3124]]. Meta describes the deployment [[S-3120]], and NVIDIA separately reports the adoption of its confidential computing for the service [[S-3620]].\n- **R3** met: Meta reports that it runs the service for WhatsApp users [[S-3120]]. Meta's own client makes the attestation check, and no other party is documented relying on it for a verification decision.\n\nThese levels measure development and use, and they do not rate security. Trail of Bits notes that SEV-SNP does not fully protect against advanced physical attacks [[S-3121]]. No published work tests the [[M-0008|TEE attacks]] against this deployment.", "evidence": [ "S-3120", "S-3620", "S-3121", "S-3124" ], "next_level_gaps": [ "A public evaluation of the deployed system after launch, including its GPU attestation checks.", "Evidence that the deployment resists attackers with physical access to SEV-SNP hosts.", "Fully reproducible server images." ], "gap_annotations": [ { "gap": 1, "gap_type": "evaluation" }, { "gap": 2, "gap_type": "technical" }, { "gap": 3, "gap_type": "engineering", "gap_group": "reproducible-images" } ], "confidence": "medium", "assessed_by": [ "claude-opus-5-5" ], "assessed_on": "2026-10-15", "status": "current", "dispute": null }, "flaws": [ { "assessment": true, "title": "Published SEV-SNP attacks have not been tested against this deployment", "historical": false, "classification": "open-question", "kind": "open-question", "severity": "significant", "status": "open", "description": "Meta reports that Private Processing runs on AMD SEV-SNP. Its threat model includes physical attacks on hosts, with data-centre security, memory encryption and third-party relays as mitigations [[S-3120]]. [Trail of Bits](https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/) notes that SEV-SNP does not fully protect against advanced physical attacks, and that Meta added controls on which CPUs are trusted [[S-3121]]. The [[M-0008|TEE findings]] record SEV-SNP attestation defeated with a DDR4 memory-bus interposer [[S-1210]], and forged from malicious host software on platforms without AMD's firmware fixes [[S-1212]] [[S-3127]] [[S-1213]] [[S-3128]]. Whether this deployment's protections resist those attacks remains an open question.", "sources": [ "S-3120", "S-3121", "S-1210", "S-1202", "S-3126", "S-1212", "S-3127", "S-1213", "S-3128" ], "response": null, "evidence_scope": "inherited", "scope_note": "An applicability question for Private Processing on AMD SEV-SNP. [Battering RAM](https://batteringram.eu/) needed physical access to DDR4 servers. Interposers on SEV-SNP servers with DDR5 memory recovered a signing key from inside a guest with Ciphertext Hiding enabled, and broke memory integrity. The [TEE.fail](https://tee.fail/) authors list EPYC processors based on Zen 4 and Zen 5 as affected, and neither team reports an SEV-SNP attestation forgery [[S-1202]] [[S-3126]]. [RMPocalypse](https://rmpocalypse.github.io/) and [Fabricked](https://www.usenix.org/conference/usenixsecurity26/presentation/schlueter-1) needed privileged host software on platforms without AMD's fixes. None of them was demonstrated against this deployment [[S-1210]] [[S-1212]] [[S-3127]].", "related_finding": { "record": "M-0008", "flaw": 2 }, "n": 1, "url": "https://trustbutveri.fyi/implementations/whatsapp-private-processing/evidence/flaws/1/" } ], "blockers": [ { "text": "Server images are not yet fully reproducible, so a third party cannot always rebuild an image and match its logged measurement.", "historical": false, "gap_type": "engineering", "gap_group": "reproducible-images", "theme": "evidence-binding", "blocked_by": null, "sources": [ "S-3121", "S-3124" ] } ], "challenge_themes": [ "evidence-binding", "hardware-trust", "adversarial-validation" ], "organizations": [ "O-0218" ], "people": [], "sources": [ { "source": "S-3120", "supports": "design; AMD SEV-SNP confidential VMs with NVIDIA Hopper GPUs; client checks of the attestation report, nonce, policy and transparency-log proofs; verification of models and prompts loaded after launch; private model weights; threat model with physical host attacks and listed mitigations (provider-reported)", "locator": "PDF pp. 14–18 for the client and artifact checks" }, { "source": "S-3620", "supports": "Meta's adoption of NVIDIA Confidential Computing for WhatsApp's private processing; no GPU generation named (vendor-reported)" }, { "source": "S-3121", "supports": "pre-launch review of the implementation on AMD SEV-SNP with NVIDIA confidential GPUs; 16 issues resolved and four partly addressed, the remaining eight low or informational; the four named fixes; SEV-SNP physical-attack caveat and Meta's CPU trust controls; fully reproducible server images remain challenging" }, { "source": "S-3124", "supports": "review dated August 2025; 28 issues by severity; titles of the high-severity findings" }, { "source": "S-1210", "supports": "SEV-SNP attestation defeated with a DDR4 interposer and physical access (Battering RAM)", "locator": "Abstract; site FAQ" }, { "source": "S-1202", "supports": "signing-key recovery from inside an SEV-SNP guest with Ciphertext Hiding on DDR5; affected Zen 4 and Zen 5 EPYC processors; no AMD attestation key extracted (TEE.fail)", "locator": "site FAQ on AMD SEV-SNP" }, { "source": "S-3126", "supports": "SEV-SNP memory-integrity break on DDR5 with an active interposer; attestation forgery reported only for Intel TDX (DDRop)", "locator": "site summary; affected platforms" }, { "source": "S-1212", "supports": "software-only SEV-SNP attestation forgery by a malicious hypervisor (RMPocalypse)", "locator": "Abstract; site" }, { "source": "S-3127", "supports": "software-only SEV-SNP attestation forgery from the hypervisor and UEFI firmware (Fabricked)", "locator": "Abstract; evaluation" }, { "source": "S-1213", "supports": "AMD firmware fixes for RMPocalypse (vendor-reported)", "locator": "Mitigation tables" }, { "source": "S-3128", "supports": "AMD firmware fixes for Fabricked (vendor-reported)", "locator": "Summary; mitigation tables" } ], "concepts": [ "K-0004", "K-0005", "K-0006", "K-0019" ], "kind": "product", "developer": [ "O-0218" ], "realises": [ "M-0008" ], "type": "implementation", "url": "https://trustbutveri.fyi/implementations/whatsapp-private-processing/", "source_file": "content/implementations/whatsapp-private-processing.md", "flags_all": [ "provider-reported" ], "body_markdown": "## What it is\n\nPrivate Processing is Meta's server system for AI features in WhatsApp [[S-3120]]. Meta reports that it runs requests in confidential virtual machines (CVMs) on AMD EPYC processors with SEV-SNP and NVIDIA Hopper GPUs [[S-3120]]. NVIDIA [reported in February 2026](https://nvidianews.nvidia.com/news/meta-builds-ai-infrastructure-with-nvidia) that Meta had adopted NVIDIA Confidential Computing for WhatsApp's private processing [[S-3620]].\n\nPrivate Processing applies [[M-0008|TEE remote attestation]] so that the WhatsApp client can check which software will handle a request before it connects [[S-3120]].\n\n## How it works\n\nMeta describes the checks as follows [[S-3120]]:\n\n1. Before it connects, the WhatsApp client checks the server's attestation report, a fresh nonce from the client, the service's policy and proofs from a third-party transparency log run with Cloudflare.\n2. Models and prompts loaded after launch are also verified against the log.\n\nMeta does not publish the model weights [[S-3120]].\n\nMeta's threat model includes physical attacks on hosts. Meta lists data-centre security, memory encryption and third-party relays as mitigations [[S-3120]].\n\n## Evidence\n- [Trail of Bits](https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/) reports a security review of Private Processing made before launch and dated August 2025 [[S-3121]] [[S-3124]]. It found 28 issues. Eight were of high severity, four medium, four low and 12 informational [[S-3124]].\n- The high-severity findings include attestations without freshness, patch levels not checked against AMD's VCEK certificate, SEV-SNP attestation not bound to Meta's machines, CVM compromise through environment-variable injection, ACPI table injection by a malicious hypervisor, CVM images that could not be reproduced, and GPU-hosted models that did not verify NVIDIA GPU attestation [[S-3124]].\n- Trail of Bits names four fixes. Attestations now carry the TLS client nonce, patch levels are validated against AMD's VCEK certificate, environment variables are strictly validated, and a bootloader verifies ACPI table signatures [[S-3121]].\n- According to Trail of Bits, Meta resolved 16 issues and partly addressed four. The remaining eight are low or informational [[S-3121]].\n\n## Limitations\n- [Trail of Bits](https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/) notes that SEV-SNP does not fully protect against advanced physical attacks, and that Meta added controls on which CPUs are trusted [[S-3121]]. [Independent researchers](https://batteringram.eu/) with physical access defeated SEV-SNP attestation on DDR4 test servers [[S-1210]]. On DDR5 test servers, interposers recovered a signing key from inside an SEV-SNP guest and broke its memory integrity, without a reported attestation forgery [[S-1202]] [[S-3126]].\n- Trail of Bits notes that fully reproducible server images remain challenging [[S-3121]].\n- Meta does not publish the model weights. The log checks can show that a server loaded a logged model, but outsiders cannot inspect its weights [[S-3120]].\n- Trail of Bits reviewed the system before launch, and four of its issues were only partly addressed [[S-3121]].", "body_text": "What it is Private Processing is Meta's server system for AI features in WhatsApp [S-3120]. Meta reports that it runs requests in confidential virtual machines (CVMs) on AMD EPYC processors with SEV-SNP and NVIDIA Hopper GPUs [S-3120]. NVIDIA reported in February 2026 that Meta had adopted NVIDIA Confidential Computing for WhatsApp's private processing [S-3620]. Private Processing applies TEE remote attestation so that the WhatsApp client can check which software will handle a request before it connects [S-3120]. How it works Meta describes the checks as follows [S-3120]: 1. Before it connects, the WhatsApp client checks the server's attestation report, a fresh nonce from the client, the service's policy and proofs from a third-party transparency log run with Cloudflare. 2. Models and prompts loaded after launch are also verified against the log. Meta does not publish the model weights [S-3120]. Meta's threat model includes physical attacks on hosts. Meta lists data-centre security, memory encryption and third-party relays as mitigations [S-3120]. Evidence - Trail of Bits reports a security review of Private Processing made before launch and dated August 2025 [S-3121] [S-3124]. It found 28 issues. Eight were of high severity, four medium, four low and 12 informational [S-3124]. - The high-severity findings include attestations without freshness, patch levels not checked against AMD's VCEK certificate, SEV-SNP attestation not bound to Meta's machines, CVM compromise through environment-variable injection, ACPI table injection by a malicious hypervisor, CVM images that could not be reproduced, and GPU-hosted models that did not verify NVIDIA GPU attestation [S-3124]. - Trail of Bits names four fixes. Attestations now carry the TLS client nonce, patch levels are validated against AMD's VCEK certificate, environment variables are strictly validated, and a bootloader verifies ACPI table signatures [S-3121]. - According to Trail of Bits, Meta resolved 16 issues and partly addressed four. The remaining eight are low or informational [S-3121]. Limitations - Trail of Bits notes that SEV-SNP does not fully protect against advanced physical attacks, and that Meta added controls on which CPUs are trusted [S-3121]. Independent researchers with physical access defeated SEV-SNP attestation on DDR4 test servers [S-1210]. On DDR5 test servers, interposers recovered a signing key from inside an SEV-SNP guest and broke its memory integrity, without a reported attestation forgery [S-1202] [S-3126]. - Trail of Bits notes that fully reproducible server images remain challenging [S-3121]. - Meta does not publish the model weights. The log checks can show that a server loaded a logged model, but outsiders cannot inspect its weights [S-3120]. - Trail of Bits reviewed the system before launch, and four of its issues were only partly addressed [S-3121].", "development_status": { "code": "R3", "label": "Operational use", "short": "Operational use", "rank": 3, "legacy_code": "R3" }, "security_evidence": { "attack_testing": { "status": "analysis", "label": "Published analysis or argument", "kind": "analysis" }, "independent_evaluation": { "status": "unassessed" }, "formal_proof": { "status": "unassessed" }, "deployment_assurance": { "status": "unassessed" }, "legacy_evaluation_code": null, "scoped_findings": [], "open_failures": { "critical": 0, "significant": 0, "minor": 0 } }, "finding_counts": { "failure": 0, "scope_limitation": 0, "open_question": 1, "open_failures": { "critical": 0, "significant": 0, "minor": 0 } }, "referenced_by": [ { "id": "M-0012", "title": "Hardware-attested weight binding", "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/" }, { "id": "M-0008", "title": "TEE remote attestation for AI workloads", "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/" }, { "id": "O-0218", "title": "Meta", "url": "https://www.meta.com/" } ] } }