How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees

Summary

WhatsApp presents an early technical overview of Scam Alert, an optional feature that uses an on-device machine learning model to identify potential scam messages from non-contacts while keeping message content on the device. The warning appears only to the user, who can block, report, continue, or mark a chat trusted; reporting and sharing require explicit user action. To measure performance, the system sends locally aggregated warning and user action counts through confidential federated analytics using Trusted Execution Environments and differential privacy, rather than transmitting raw signals. Model versions are recorded on a public transparency ledger, while published weights, client-side logs, and an expanded Bug Bounty program support independent inspection of delivery and behavior.

Takeaways

1. 1

   Scam Alert processes incoming messages from non-contacts on the device, and message content is not automatically sent to WhatsApp, Meta, or third parties.

2. 2

   The analytics pipeline collects only locally aggregated warning and user-action counts, using confidential virtual machines and differential privacy to protect individual data.

3. 3

   Users can inspect Scam Alert Activity logs, while public model records, published weights, and Bug Bounty testing support independent verification of model delivery and behavior.