Sources

Complete bibliography

1. Tier B. Meta (2026). Private Processing for WhatsApp: Technical White Paper and Security Guide. Meta. Source recordSupports: design; AMD SEV-SNP confidential VMs with NVIDIA Hopper GPUs; client checks of the attestation report, nonce, policy and transparency-log proofs; verification of models and prompts loaded after launch; private model weights; threat model with physical host attacks and listed mitigations (provider-reported) · PDF pp. 14–18 for the client and artifact checks
2. Tier C. NVIDIA (2026). Meta Builds AI Infrastructure With NVIDIA. NVIDIA Newsroom (press release). Source recordSupports: Meta's adoption of NVIDIA Confidential Computing for WhatsApp's private processing; no GPU generation named (vendor-reported)
3. Tier C. Trail of Bits (2026). What we learned about TEE security from auditing WhatsApp's Private Inference. Trail of Bits blog. Source recordSupports: pre-launch review of the implementation on AMD SEV-SNP with NVIDIA confidential GPUs; 16 issues resolved and four partly addressed, the remaining eight low or informational; the four named fixes; SEV-SNP physical-attack caveat and Meta's CPU trust controls; fully reproducible server images remain challenging
4. Tier B. Trail of Bits (2025). Meta WhatsApp Private Processing (security review). Trail of Bits publications library. Source recordSupports: review dated August 2025; 28 issues by severity; titles of the high-severity findings
5. Tier A. J. De Meulemeester et al. (2026). Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing. 47th IEEE Symposium on Security and Privacy (S&P 2026). Source recordSupports: SEV-SNP attestation defeated with a DDR4 interposer and physical access (Battering RAM) · Abstract; site FAQ
6. Tier A. J. Chuang et al. (2026). TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition. 2026 IEEE Symposium on Security and Privacy (SP). Source recordSupports: signing-key recovery from inside an SEV-SNP guest with Ciphertext Hiding on DDR5; affected Zen 4 and Zen 5 EPYC processors; no AMD attestation key extracted (TEE.fail) · site FAQ on AMD SEV-SNP
7. Tier A. J. De Meulemeester et al. (2026). DDRop: Active Memory Interposer Attacks on Confidential VMs by Dropping DDR5 Writes. 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS '26). Source recordSupports: SEV-SNP memory-integrity break on DDR5 with an active interposer; attestation forgery reported only for Intel TDX (DDRop) · site summary; affected platforms
8. Tier A. B. Schlüter & S. Shinde (2025). RMPocalypse: How a Catch-22 Breaks AMD SEV-SNP. 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25). Source recordSupports: software-only SEV-SNP attestation forgery by a malicious hypervisor (RMPocalypse) · Abstract; site
9. Tier A. B. Schlüter et al. (2026). Fabricked: Misconfiguring Infinity Fabric to Break AMD SEV-SNP. 35th USENIX Security Symposium (USENIX Security '26). Source recordSupports: software-only SEV-SNP attestation forgery from the hypervisor and UEFI firmware (Fabricked) · Abstract; evaluation
10. Tier B. AMD (2025). SEV-SNP RMP Initialization Vulnerability (AMD-SB-3020). AMD product security bulletin. Source recordSupports: AMD firmware fixes for RMPocalypse (vendor-reported) · Mitigation tables
11. Tier B. AMD (2026). SEV-SNP Routing Misconfiguration (AMD-SB-3034). AMD product security bulletin. Source recordSupports: AMD firmware fixes for Fabricked (vendor-reported) · Summary; mitigation tables