A new “Private Processing” mechanism will be used by WhatsApp’s AI technologies to provide cloud access without exposing end-to-end encrypted messages to Meta or anybody else. However, specialists continue to identify hazards.

In the upcoming weeks, cloud-based AI capabilities will be introduced by WhatsApp, an end-to-end encrypted communication app that is used by approximately 3 billion people worldwide. These capabilities are intended to maintain WhatsApp’s fundamental security and privacy guarantees while providing users with tools for message composition and summarization.

Llama, an open source big language model, is the foundation for the generative AI features that Meta has been integrating into its services. A light blue circle that provides users with access to the Meta AI assistant is already incorporated into WhatsApp. However, since interactions with the AI assistant aren’t protected from Meta like end-to-end encrypted WhatsApp communications are, a lot of users have objected to this inclusion. With what the business claims is a carefully designed and purpose-built platform dedicated to processing data for AI activities without the information being accessible to Meta, WhatsApp, or any other party, the new feature, called Private Processing, is intended to allay these worries.Although the scheme’s integrity has received favorable first assessments from researchers, others point out that WhatsApp may eventually go downhill as a result of its shift to AI features.

Many different researchers and threat actors target and examine WhatsApp. This indicates that its threat model is well known internally, according to Chris Rohlf, director of security engineering at Meta. “This wasn’t just about managing the expansion of that threat model and making sure the expectations for privacy and security were met—it was about carefully considering the user experience and making this opt-in because there’s also an existing set of privacy expectations from users.”

Only the sender and the recipient, or the participants in a group chat, can access end-to-end encrypted conversations. By design, the service provider—in this example, WhatsApp and its parent firm Meta—is confined and unable to access customers’ calls or messages. Typical generative AI platforms, which require access to user requests and data in order to compute huge language models on cloud servers, cannot work with this configuration. The objective of Private Processing is to develop a different framework that integrates AI while maintaining the privacy and security assurances of end-to-end encrypted communication.Users can choose to use WhatsApp’s AI features, and by activating a new WhatsApp setting called “Advanced Chat Privacy,” they can also stop other users from using the AI features in shared discussions.

WhatsApp stated in a blog post last week that “you can block others from exporting chats, auto-downloading media to their phone, and using messages for AI features when the setting is on.” Participants just need to be aware of any changes they make because, similar to disappearing messages, anyone in a chat can switch Advanced Chat Privacy on and off, which is recorded for everyone to view.Sensitive data is isolated in a “Trusted Execution Environment,” a locked-down, isolated area of a processor, thanks to specialized hardware used in private processing. The system is designed to process and store data for as little time as possible. If it detects any tampering or changes, it will grind to a halt and issue an alert. In order to encourage the security community to report bugs and potential vulnerabilities, WhatsApp is already allowing third parties to audit various system components and will join the Meta bug bounty program.In the end, Meta adds, it intends to make the Private Processing components open source in order to facilitate the development of comparable services by others and to allow for further validation of its security and privacy assurances. 

For its Apple Intelligence AI platform, Apple introduced a comparable program last year called Private Cloud Compute. Additionally, users can activate the service in Messages, Apple’s end-to-end encrypted communication software, to create “Smart Reply” messages on Macs and iPhones and produce message summaries.

Comparing private processing versus private cloud computing is like comparing, well, apples and oranges. All applications of Apple Intelligence are supported by Apple’s Private Cloud Compute. Conversely, Private Processing was developed specifically for WhatsApp and does not support Meta’s AI capabilities in general. Additionally, Apple Intelligence is built to conduct as much AI as possible on-device and only access the Private Cloud Compute infrastructure as required. Apple only created Apple Intelligence to function at all on its most recent generations of mobile hardware because such “on device” or “local” processing necessitates sophisticated hardware. Apple Intelligence will never be supported by outdated iPads and iPhones.

While Meta is a software firm with around 3 billion users who own a variety of smartphones, including low-end and outdated models, Apple is a maker of high-end smartphones and other hardware. Designing AI features for WhatsApp that could operate locally on the variety of devices WhatsApp services was not practical, according to Rohlf and Colin Clemmons, one of the main engineers for Private Processing. Rather, WhatsApp concentrated on making Private Processing as useless as possible for hackers in the event that it was compromised.

According to Clemmons, “the design is one of risk minimization.” “The value of jeopardizing the system should be minimized.”

However, the entire endeavor begs the more fundamental question of whether a secure messaging app such as WhatsApp should even have AI capabilities. However, users now anticipate the features and will do whatever it takes to get them, according to Meta.

In an email to WIRED, WhatsApp CEO Will Cathcart stated, “A lot of people want to use AI tools to help them when they are messaging.” “We believe that creating a private method to accomplish that is crucial, as users shouldn’t have to move to a less private platform in order to access the features they require.”

A pure end-to-end system will be less dangerous than any end-to-end encrypted system that makes use of off-device AI inference. Matt Green, a cryptographer at Johns Hopkins who hasn’t evaluated the entire system but has seen some of the privacy promises of Private Processing, says, “You’re sending data to a computer in a data center, and that machine sees your private texts.” “When WhatsApp claims that they have made this as safe as possible and that they are unable to read your texts, I believe them. However, I believe there are dangers involved as well. More private information will be lost, and hackers and nation-state enemies will target the computers that handle this data.

WhatsApp also claims that Private Processing would presumably lay the groundwork for future developments of more complex and involved AI features that need processing and maybe storing more data, going beyond simple AI functions like text summarization and writing recommendations.

According to Green, “any and all of this will make the Private Processing computers into a very big target given all the crazy things people use secure messengers for.”