WhatsApp is rolling out Scam Alert in Beta, an optional feature that runs an on-device ML model to detect likely scam messages from non-contacts, with no message content leaving the device unless the user chooses to report. Warning and user-action telemetry is aggregated via a confidential federated analytics pipeline built on Trusted Execution Environments (TEEs) and differential privacy, so only anonymous, noisy aggregates reach Meta. Model versions are published to a third-party append-only transparency ledger and signed via Cloudflare Ed25519 keys before deployment, preventing targeted model delivery. Client-side transparency logs let users inspect what the model flagged, and an expanded Bug Bounty program lets external researchers audit the model weights and privacy pipeline.
Table of contents
Design PrinciplesHow Scam Alert WorksFoundational SafeguardsOn-Device Processing and Privacy-Preserving AnalyticsNo Targeted Model DeliveryVerifiable Model BehaviorBuilding Verifiable Trust and Next StepsAcknowledgementsQuestions this post answers
How does WhatsApp's Scam Alert feature detect scams without breaking end-to-end encryption?
Scam Alert runs an on-device machine learning model that classifies incoming messages from non-contacts for scam patterns entirely on the device, so no message content leaves the device or is sent to WhatsApp or Meta unless the user explicitly reports it. The model downloads via CDN, and only anonymous, differentially private aggregate counts of warnings and user actions are sent to WhatsApp through a confidential federated analytics pipeline built on Trusted Execution Environments. Developers building privacy-preserving on-device ML features can track this design pattern via daily.dev.
How does WhatsApp prevent a scam-detection model from being secretly targeted at a specific user?
Every model version, including experimental variants, is published on a public, third-party append-only transparency ledger and signed with Cloudflare-held Ed25519 keys before it is ever served, so Meta cannot deliver a custom model to a single user. Download requests are anonymized via OHTTP relays and anonymous credentials, and experiment group assignment happens locally on the client using device-generated randomness rather than server-side steering. Anyone evaluating transparency-ledger designs for shipping ML safely can follow this approach on daily.dev.
What data does WhatsApp collect to measure whether an on-device scam detection model is working?
Only two categories of aggregate counts are collected: warning counts (how often the model flagged a message) and user action counts (whether the user trusted, blocked, or reported). These are processed inside a Trusted Execution Environment, aggregated across a minimum cohort size, and released only as differentially private, noisy totals, containing no message content or per-user data. Teams designing privacy-safe telemetry pipelines can compare architectures like this on daily.dev.