Next, the user's device sends an end-to-end encrypted request for AI data processing using an ephemeral encryption key, which is processed inside a Confidential Virtual Machine (CVM) isolated from Meta. WhatsApp has announced the introduction of 'Private Processing,' a new technology that enables users to utilize advanced AI features by offloading tasks to privacy-preserving cloud servers. For those who find advanced AI features useful but still need to stay in control over when data is allowed to leave their device, WhatsApp's recently launched 'Advanced Chat Privacy' feature would be the ideal solution. WhatsApp has promised to share the CVM binary and some source code to allow external validation, while a detailed white paper on the secure design of Private Processing will also be published soon. For those who opt to use Private Processing, the system performs an anonymous authentication via the user's WhatsApp client to ensure the user's validity. Finally, the AI-generated response is encrypted with a unique key only known to the device and processing CVM and is sent back over the secure session for decryption on the user's device. Despite the data security and privacy safeguarding assurances offered by Meta, there are always concerns when sensitive data leaves devices for processing on the cloud. Private Processing is not immediately available to WhatsApp users but will gradually be rolled out in the upcoming weeks. It establishes a remote attestation (RA) + TLS session between the user's device and Meta's Trusted Execution Environment (TEE). Next, the app fetches public HPKE encryption keys from a third-party CDN so that Meta cannot trace requests back to specific users, maintaining full anonymity. The user's device initiates a connection to a Meta gateway through a third-party relay, hiding their real IP address. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. Meta claims the processing environment is stateless, and all messages are deleted after they're processed, leaving only "non-sensitive" logs behind.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 30 Apr 2025 19:05:15 +0000