Implementation · WhatsApp Private Processing
Evidence & limits
On this page
Evidence
- Trail of Bits reports a security review of Private Processing made before launch and dated August 2025 3 4. It found 28 issues. Eight were of high severity, four medium, four low and 12 informational 4.
- The high-severity findings include attestations without freshness, patch levels not checked against AMD's VCEK certificate, SEV-SNP attestation not bound to Meta's machines, CVM compromise through environment-variable injection, ACPI table injection by a malicious hypervisor, CVM images that could not be reproduced, and GPU-hosted models that did not verify NVIDIA GPU attestation 4.
- Trail of Bits names four fixes. Attestations now carry the TLS client nonce, patch levels are validated against AMD's VCEK certificate, environment variables are strictly validated, and a bootloader verifies ACPI table signatures 3.
- According to Trail of Bits, Meta resolved 16 issues and partly addressed four. The remaining eight are low or informational 3.
Limitations
- Trail of Bits notes that SEV-SNP does not fully protect against advanced physical attacks, and that Meta added controls on which CPUs are trusted 3. Independent researchers with physical access defeated SEV-SNP attestation on DDR4 test servers 5. On DDR5 test servers, interposers recovered a signing key from inside an SEV-SNP guest and broke its memory integrity, without a reported attestation forgery 6 7.
- Trail of Bits notes that fully reproducible server images remain challenging 3.
- Meta does not publish the model weights. The log checks can show that a server loaded a logged model, but outsiders cannot inspect its weights 1.
- Trail of Bits reviewed the system before launch, and four of its issues were only partly addressed 3.
Open questions
Blockers
Server images are not yet fully reproducible, so a third party cannot always rebuild an image and match its logged measurement.
Development assessmentMedium confidence
Meta reports running Private Processing for WhatsApp users, and Trail of Bits published the findings of a review made before launch.
Assessed use: showing WhatsApp clients which logged software and artifacts serve their AI requests
Development assessment
- R1 met: Meta's white paper describes the design, the client's checks and a threat model that includes physical attacks on hosts 1.
- R2 met: Trail of Bits reviewed the implementation before launch, on AMD SEV-SNP with NVIDIA confidential GPUs, and published its findings and the fixes it reports 3 4. Meta describes the deployment 1, and NVIDIA separately reports the adoption of its confidential computing for the service 2.
- R3 met: Meta reports that it runs the service for WhatsApp users 1. Meta's own client makes the attestation check, and no other party is documented relying on it for a verification decision.
These levels measure development and use, and they do not rate security. Trail of Bits notes that SEV-SNP does not fully protect against advanced physical attacks 3. No published work tests the TEE attacks against this deployment.
Recorded gaps
- A public evaluation of the deployed system after launch, including its GPU attestation checks.
- Evidence that the deployment resists attackers with physical access to SEV-SNP hosts.
- Fully reproducible server images.
Assessed 2026-10-15 against rubric v1.2.
Security evidence
- Adversarial evaluation
- Published analysis or argument
- Open failures
- 0 critical · 0 significant · 0 minor