WhatsApp Scam Alert Runs ML On-Device with Confidential VM Telemetry
In this article
WhatsApp is beta-testing a feature called Scam Alert that runs a small ML model entirely on-device to flag messages from non-contacts that match patterns associated with scams. What makes the architecture worth studying is not the classifier itself but the surrounding privacy engineering: Meta has constructed a system in which message content never leaves the device during inference, model performance telemetry is processed inside confidential virtual machines, and model distribution is treated as an attack surface requiring cryptographic verification.
On-Device Classification
When a user opts in, the device downloads a compact ML model trained on conversational structure and linguistic signals extracted from scam reports previously submitted to WhatsApp. Inference runs locally against incoming messages from non-contacts only. When the model fires, a warning appears to the recipient that is invisible to the sender; the user can then block, report, or continue the conversation, or mark the chat as trusted to suppress future alerts for that thread. Users who mark a chat trusted can optionally share the last 5 messages from that conversation back to WhatsApp — the only path by which message content leaves the device, and only at explicit user discretion.
Confidential Federated Analytics
The telemetry path is architecturally distinct from the inference path. The device accumulates warning events and user actions as local aggregate counts rather than per-message records. When those metrics are transmitted, they travel through an Oblivious HTTP relay using anonymous credentials, preventing the server from correlating submissions to specific users or devices. Processing then happens inside confidential virtual machines — trusted execution environments whose code the client verifies before transmitting any data. The client also checks the privacy parameters of the aggregation before sending. Inside those environments, minimum cohort thresholds and differential privacy are applied, so only approximate population-level statistics become visible to WhatsApp. This pipeline is built on Meta's PAPAYA federated analytics system, presented at USENIX NSDI 2025, which was designed specifically to separate privacy-preserving analytics workloads from federated learning proper.
Model Distribution as a Security Boundary
Meta treats the model delivery channel as a potential vector for targeted attacks — scenarios where a server could selectively deliver a degraded or surveillance-capable model to a specific user. The countermeasure is a third-party append-only transparency ledger: every production and experimental model version, along with its SHA-256 hash, must be published to the ledger before deployment. Clients verify the ledger entry, model signature, freshness, and hash before loading any model. Downloads use anonymous credentials and OHTTP, and experiment assignment happens locally on the device rather than being determined server-side, preventing the server from steering a particular user toward a specific model variant. This transparency architecture is directly relevant to the supply-chain integrity concerns that arise when ML models are treated as executable artifacts.
Comparison with Google Messages
Google Messages provides a functionally similar scam and phishing detection capability with documented use of privacy-preserving mechanisms, and also performs some on-device detection for message safety features. The implementations diverge in where processing boundaries are drawn.
| Dimension | WhatsApp Scam Alert | Google Messages Spam Protection |
|---|---|---|
| Message classification location | On-device only | On-device for some features; Google services for others |
| Telemetry processing | Confidential VMs with differential privacy and cohort thresholds | Privacy-preserving mechanisms documented; architecture not fully disclosed |
| Model distribution integrity | SHA-256 hashes published to third-party append-only ledger; client verification required | Not publicly documented at this level |
| Telemetry transmission | OHTTP relay with anonymous credentials | Not publicly specified |
| Experiment assignment | Local; server cannot target individual users | Not publicly specified |
| Optional data sharing scope | Last 5 messages from user-designated trusted chats only | Not publicly specified at message-count granularity |
Beta Scope and Security Review
The limited beta serves a dual purpose: stress-testing the implementation and bringing external scrutiny to the confidential federated analytics pipeline through Meta's Bug Bounty program, which has been explicitly expanded to cover that component. Meta is also publishing the confidential VM binary and privacy-relevant source components for independent review. Stephanie Lio, Head of AI Product Marketing at WhatsApp, characterised the design on LinkedIn as on-device only, with no automatic reporting and user control retained throughout.
The broader implication is that the privacy engineering around a model matters as much as the model itself. As financial crimes detection moves toward agentic architectures, how telemetry flows from inference endpoints back to training pipelines — without leaking sensitive user behaviour — becomes a first-class design constraint. WhatsApp's architecture offers a concrete, production-tested answer built from confidential computing, differential privacy, and cryptographic model provenance.