Meta Private Processing

Private Processing is Meta's confidential computing infrastructure for running AI workloads on user data in its data centers. Requests are processed inside confidential virtual machines (CVMs) on CPUs and GPUs that support trusted execution environments (TEEs), and client devices check a hardware-signed attestation against a public, third-party transparency log before they send any data ^[1][3]. Meta says the design means that "even Meta cannot access your data" ^[1]. That is the company's own claim; outside auditors have described the conditions it depends on (see Security research and audits below).

Meta first described Private Processing on 29 April 2025 as a way to add cloud AI features to WhatsApp without breaking the app's end-to-end encryption promise ^[2]. It first shipped with WhatsApp Message Summaries in June 2025 and Writing Help in August 2025 ^[4][6]. In May 2026 it became the basis for Incognito Chat with Meta AI on WhatsApp and the Meta AI app ^[10][11]. On 23 September 2026, at Meta Connect 2026, Meta announced it would extend Private Processing to its AI glasses and add encrypted, stateful storage for features such as long-term recall ^[1][13]. As of September 2026 the glasses version was announced but not yet available, and Meta had not said which features it would cover or given a date ^[15].

Overview

History

WhatsApp (2025)

Meta's April 2025 post, "Building Private Processing for AI tools on WhatsApp", framed the problem this way: server-side large language models need to see a user's request, which conflicts with the privacy people expect from end-to-end encrypted chats ^[2]. Meta set three product principles: using Meta AI in WhatsApp must be optional, the app must show when a feature uses Private Processing, and users must be able to keep messages in sensitive chats out of AI features through WhatsApp's Advanced Chat Privacy setting ^[2]. The post listed as foundational requirements confidential processing, "enforceable guarantees" (tampering must either make the system fail closed or become publicly discoverable), and verifiable transparency. It added non-targetability and stateless, forward-secure processing as further requirements ^[2]. The first use cases were summarizing unread messages and writing suggestions ^[2].

In the same post Meta said it would expand its bug bounty to cover Private Processing, publish a security engineering white paper, release the CVM image binary to researchers, and publish source code for "certain components of the system, including our attestation verification code" ^[2]. The white paper followed on 10 June 2025 ^[3].

WhatsApp announced Message Summaries on 25 June 2025. The feature uses Meta AI to summarize unread messages in a chat, and WhatsApp said it runs on Private Processing, "which allows Meta AI to generate a response without Meta or WhatsApp ever seeing your messages or the private summaries" ^[4]. Private Processing features are optional and off by default ^[4]. TechCrunch reported that the feature launched first in the US in English, and that users switch it on under Settings > Chats > Private Processing ^[5]. An update to WhatsApp's post, dated 13 October 2025, said Message Summaries was "beginning to roll out in select markets" ^[4].

On 27 August 2025 WhatsApp introduced Writing Help, which suggests rewrites of a draft message in styles such as professional, funny or supportive, also built on Private Processing ^[6]. WhatsApp said it was rolling out in English, "starting with the United States and several other countries" ^[6]. The same post announced that NCC Group and Trail of Bits had published their audit reports on the system ^[6].

Incognito Chat and the Meta AI app (2026)

On 13 May 2026 Meta launched Incognito Chat with Meta AI on WhatsApp and the Meta AI app, "built on top of WhatsApp's Private Processing technology" ^[10]. Meta said Incognito Chat conversations are processed in a secure environment Meta cannot access, are not saved, and disappear by default. It said the feature would roll out "over the coming months" ^[10][11]. Meta's announcement contrasted it with other companies' incognito modes, which it said "can still see the questions coming in and the answers going out" ^[10]. Meta also said it would introduce Side Chat, a Meta AI helper inside any WhatsApp chat protected by Private Processing, "in the coming months" ^[10][11].

Meta's September 2026 engineering post says it introduced Private Processing "for WhatsApp and the Meta AI app" in 2025 ^[1]. WIRED also wrote that Private Processing came to WhatsApp and the Meta AI app "last year" ^[15]. Meta's own newsroom, however, dates the Incognito Chat launch on the Meta AI app to 13 May 2026 ^[10].

AI glasses (Connect 2026)

At Meta Connect on 23 September 2026, Meta listed "Private Processing" among "latest technology coming soon to AI glasses", saying it would "deliver rich AI experiences without anyone, including Meta, seeing your data" ^[13]. Engadget's live blog of the keynote reported, as Mark Zuckerberg talked through privacy, that Meta was also working on private processing for glasses ^[16]. The same day the Engineering at Meta blog published "Bringing Private Processing to Meta AI Glasses" by Pritam Shah and Oskar Linde, which describes the system in detail ^[1]. The @Meta_Engineers account on X promoted the post on 24 September 2026 ^[22].

Architecture

Meta's September 2026 post defines the pieces this way. Confidential computing is the goal of protecting data while it is in use, not just at rest and in transit. The TEE is the hardware feature that encrypts a CVM's memory under a key the host cannot obtain. Private Processing is Meta's infrastructure built on TEEs, which adds verifiable transparency, non-targetability and encrypted storage ^[1]. The most detailed public description is the WhatsApp white paper. Its hardware and protocol details cover the WhatsApp deployment ^[3].

Confidential computing hardware

The white paper says Meta's "initial iteration" uses AMD CPUs with AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and NVIDIA GPUs running NVIDIA Confidential Computing on the H100 Tensor Core GPU ^[3]. On the CPU side, the AMD Secure Processor measures the VM image into a launch digest, signs attestation reports with a chip-specific Versioned Chip Endorsement Key (VCEK), and encrypts memory with AES keys the hypervisor never sees ^[3]. On the GPU side, the CVM checks the NVIDIA H100's attestation report against "golden measurements" fetched from NVIDIA's Reference Integrity Manifest Service. Data moves between the CVM and the GPU over an encrypted SPDM channel that uses AES-GCM ^[3]. If GPU attestation fails, the VM shuts down ^[3].

The white paper lists hardware limitations. AMD treats some side-channel classes as out of scope for SEV-SNP. The H100's HBM memory is not encrypted. NVLink traffic between GPUs is not encrypted on Hopper. Meta said it "continue[s] to evaluate solutions" as hardware with NVLink encryption, such as NVIDIA Blackwell, becomes available ^[3].

Attestation and the boot chain

Boot is a chain of checks that starts at the CPU's hardware root of trust. The launch digest covers firmware, kernel, initrd and kernel command line. The initrd checks the root filesystem hash. The CVM attests the GPU. Then an attestation agent verifies the measurements and transparency proofs of the application containers loaded at start-up ^[3]. Each request gets a fresh key pair and a self-signed X.509 certificate that embeds the SEV-SNP attestation report, the client's nonce and the transparency proofs ^[3]. Clients hard-code AMD's root key, certificate revocation lists for AMD's intermediate (ASK) certificates, minimum TCB versions, trusted guest and platform policies, and the transparency provider's public signing key. They refuse to connect if any check fails ^[3]. The glasses post describes the same rule: if the CPU or GPU vendor certificate check fails, or the binary hash does not match the ledger, "the handshake fails and your device does not connect" ^[1]. When one CVM calls another, for example an orchestrator calling a model server, it uses the same RA-TLS checks ^[2][3].

The white paper describes an orchestrator service that receives client requests and "predictor" services that run LLM inference. Both are stateless: the predictor turns off persistent KV caching so that all state for a request ends with the request, and conversation history for multi-turn chats is sent by the client each time ^[3]. Inference uses vLLM with models in the safetensors format, which avoids code-execution risks from Python pickles. The front-end application is built on Llama Stack ^[3]. NCC Group's report says the summarization service used the open-weight Llama 3 8B Instruct model, with a separate internal Meta "Output Guard" model that checks whether summaries follow Meta's standards ^[7].

Artifact transparency

Meta works with Cloudflare, which runs a third-party, append-only log of security-critical artifacts. The log records digests of CVM images, containers, revocation lists, prompts and models ^[3]. The white paper notes that "this is not a Merkle-tree based transparency ledger but a simple log maintained by a third-party" ^[3]. It sorts artifacts into two types. Auditable ones (binaries, revocation lists, authorized host identities) are to be released to eligible researchers. Private ones (models and system prompts) are kept internal ^[3]. Artifacts expire: CVM base images on the order of weeks (Meta releases them weekly), models on the order of months. A revocation list is published every 3 hours, and each signature on it expires after 24 hours ^[3]. The glasses post says the ledger and its measurements are public, while "the corresponding binaries are available to researchers in our security program under agreement" ^[1].

Anonymous routing and non-targetability

Non-targetability means an attacker should not be able to aim at one user's session without attacking the whole system ^[2][3]. Clients get tokens from Meta's open-source Anonymous Credential Service, so the service can check that a request is authorized without learning who sent it ^[3]. Requests then travel by Oblivious HTTP. The client wraps its TLS session in an HPKE-encrypted request and sends it to a third-party relay, which strips the IP address before passing it to Meta's OHTTP gateway. The gateway checks the token and picks a CVM ^[3]. For WhatsApp the relay and the distribution of key configurations were handled by Fastly. The white paper says a third party distributes the keys so that Meta cannot hand particular users keys that would identify them ^[3]. The glasses post adds that the tokens are "blind-signed tokens fetched on randomized schedules" and names the relay as "Fastly or Cloudflare" ^[1].

Operations and logging

Engineers cannot SSH into or open a console on production CVMs ^[3]. Logs leave a CVM only through allowlisted filters that are built into the attested image. Metrics are limited to counters and coarse system figures such as total CPU, memory and GPU use ^[3]. The glasses post says operators rely on "aggregate health signals" and cannot attach debuggers, dump memory, or inspect the payload that caused a fault ^[1]. For WhatsApp, the white paper also describes opt-in in-app transparency reports. These let users export what data was sent to Private Processing, together with the attestation and Cloudflare transparency details for each TEE that handled it ^[3].

Web search

The current (V2) white paper also describes optional web search. A model inside the TEE writes a search query, and Meta infrastructure outside the TEE sends it to external search providers. Meta says queries are not linked to the user, are shown to the user, are capped at 100 characters, and are limited to five per prompt ^[3].

Threat model and stated limits

Meta's threat model names three kinds of adversary: malicious or compromised insiders, third-party or supply-chain vendors with access to parts of the infrastructure, and malicious end users ^[2][3]. The white paper sorts threats into platform threats (service exploitation, prompt injection), system software threats (logging leaks, build-system and supply-chain compromise), privileged access threats (host attacks, physical attacks, hardware supply-chain compromise) and system-level threats (attestation, transparency, rollback and routing attacks), and lists a mitigation for each ^[3].

Meta states several limits in its own documents:

• "Defeating this attestation method would require collusion with our hardware vendors and is therefore out of scope" ^[3].
• TEE exploitation is "a growing area of security research", and researchers "have repeatedly demonstrated the ability to bypass TEE guarantees". Meta's answer is defense in depth, hardening, host monitoring, encrypted DRAM, and anonymous routing to make targeted physical attacks harder ^[2][3].
• The host controls the CVM's clock, so freshness checks use a timestamp supplied by the client ^[3].
• If a vulnerability without a fix weakens the guarantees, Meta says it will "evaluate disabling Private Processing and associated features" ^[3].

Extension to AI glasses

The September 2026 post argues that useful assistants on glasses need larger models than fit on the device, and also need to be "stateful and deeply personal", so the work has to run in the cloud ^[1]. Meta says the glasses version is meant to let it offload workloads "like streaming transcription, contextual search, and long-term recall" ^[1]. It lists five engineering requirements ^[1]:

The main new element is storage. The WhatsApp design keeps nothing: it "does not store messages to disk or external storage" ^[2][3]. For glasses, Meta says output that must persist is encrypted with user-provided keys before it leaves the TEE, Meta stores only the ciphertext, and the device supplies the key when the user later asks for a memory ^[1]. Meta says it did not put encrypted records in an ordinary cloud database, for two reasons. The database would still see access patterns that could reveal a person's routine, and running semantic vector search over remote ciphertext would not scale. Instead it built "the storage engine directly inside the TEE", with query engines running inside the TEE boundary ^[1]. The post also says the system is multi-regional and fault tolerant, and that Meta is expanding its Bug Bounty program to cover Private Processing on AI glasses, with tools, CVM binaries and documentation for researchers ^[1]. Meta presents Private Processing as the base for future agentic features that act "across different sessions", which it says will need "inter-CVM communication" and "verifiable data provenance" ^[1].

The post names no glasses models, prices or launch dates ^[1]. WIRED reported that the plan was to bring Private Processing to Ray-Ban Meta glasses, that it was not yet available, and that Pritam Shah, whom WIRED identified as a director of engineering, had no timeline for it or for which features would use it ^[15]. Shah told WIRED: "We have the platform ready. We have it working. It's not just a white paper and a blog" ^[15]. He said Meta announced it early so it could "start working with the security community and the privacy community and a third-party auditor", and called the named workloads "examples" rather than "concrete features coming" ^[15]. Gizmodo's live coverage said Meta did not know yet which features it would apply to ^[17]. Help Net Security summarized the post's design ^[18].

At the same Connect event Meta promoted Muse, its personal AI agent, and said it was bringing Muse to its glasses ^[13]. WIRED noted that Muse runs in a cloud environment Meta calls Secure VM, and that Meta is working on a Confidential VM version that also promises to keep data inaccessible to Meta ^[15]. Meta's engineering post on Private Processing for glasses does not mention Muse ^[1].

Security research and audits

NCC Group

Meta engaged NCC Group in late January 2025 to assess the WhatsApp Message Summarization Service, "which is part of a broader Private Processing system" ^[7]. NCC Group's cryptography, hardware and embedded security, and AI/ML security teams spent 115 person-days on the review, mostly on source code ^[7]. The report (version 1.0, 26 August 2025) lists 21 findings. By the end of the review 16 were fixed, one low-risk finding was not fixed "due to planned development", and four were risk-accepted ^[7]. The three most notable were ^[7]:

• The CVM initialized network interfaces supplied by the hypervisor, through which private data could have been exfiltrated.
• There was no freshness check on the transparency proof for the attested image, so an old, vulnerable CVM image could have been used indefinitely.
• The HPKE key configuration was served from Meta, which could have let Meta violate the privacy and non-targetability guarantees.

All three were addressed ^[7]. NCC Group concluded that Meta "has invested a significant amount of resources to achieve the leading edge of what is currently possible" ^[7]. It also said the guarantees "primarily rely on the robustness of AMD SEV-SNP and NVIDIA Confidential Compute technologies, which are relatively recent and have imperfect track records" ^[7]. It found targeted attacks infeasible "under the assumption that Meta does not collude with a third party (e.g. Fastly, Cloudflare)" ^[7]. It wrote that users must trust Meta not to insert malicious behavior into artifacts that are not open source and to control its signing keys tightly, and it recommended open-source code and reproducible builds for all artifacts ^[7].

Trail of Bits

Six Trail of Bits consultants reviewed WhatsApp Private Processing from 3 to 28 February 2025, a total of 12 engineer-weeks. The threat model assumed Meta insiders with physical access, and fix reviews followed in April and May 2025 ^[8]. The report, dated 26 August 2025, lists 28 findings: 8 high, 4 medium, 4 low and 12 informational. Sixteen were resolved and four partly resolved. The remaining eight, all low or informational, were left unresolved with written justifications from Meta ^[8][9].

In an April 2026 blog post, Trail of Bits said the audit "identified several vulnerabilities that compromised WhatsApp's privacy model, all of which Meta has patched" ^[9]. It highlighted four ^[8][9]:

Trail of Bits concluded that TEEs can support privacy-preserving AI features, "but only with rigorous attention to implementation details" ^[9]. It named physical attacks on SEV-SNP and the difficulty of fully reproducible CVM images as continuing challenges ^[9]. Other findings in the report include "Binary transparency relies on a centralized honest party" and "LLM tokenization may leak user data via cache side channels" ^[8].

Bug bounty

Meta's Bug Bounty program has a separate payout guideline for WhatsApp Private Processing. It covers the TEE, attestation infrastructure, remote auditing mechanisms and verifiable transparency ^[12]. It lists payouts of up to $300,000 for code execution (including bypassing code attestation), privilege escalation and VM escape, up to $150,000 for data leaks, and up to $10,000 for persistence. Lower caps apply to vulnerabilities that only insiders could exploit ^[12]. The September 2026 glasses post says the program is being extended to Private Processing on AI glasses ^[1].

Comparison with similar systems

Private Processing belongs to a group of cloud AI systems that use TEEs. The TEEs for machine learning article covers the general technique. When Meta first announced Private Processing in 2025, 9to5Mac said it "appears to exactly replicate" Apple's Private Cloud Compute ^[21]. WIRED contrasted the two: Apple's system underpins all of Apple Intelligence, while Private Processing was built for WhatsApp, and Meta could not rely on on-device processing across the wide range of phones WhatsApp supports ^[14].

Apple's PCC requirements (stateless computation, enforceable guarantees, no privileged access, non-targetability and verifiable transparency) closely match the principles Meta lists ^[2][19].

Reception

Early reactions to the WhatsApp design were mixed. WIRED reported that initial reviews by researchers were positive, but some worried the move toward AI features could put WhatsApp "on a slippery slope" ^[14]. Johns Hopkins cryptographer Matthew Green, who previewed some of the guarantees without auditing the full system, told WIRED: "Any end-to-end encrypted system that uses off-device AI inference is going to be riskier than a pure end to end system" ^[14]. He added: "Given all the crazy things people use secure messengers for, any and all of this will make the Private Processing computers into a very big target" ^[14].

After the Incognito Chat launch, Malwarebytes' Pieter Arntz pointed out that Meta was promoting AI chats it says it cannot read while ending optional end-to-end encrypted direct messages on Instagram as of 8 May 2026. He argued that "incognito" and "private" are marketing terms, whereas end-to-end encryption is a technical guarantee ^[23].

Coverage of the glasses announcement put it against earlier controversy over Meta's smart glasses. WIRED linked it to months of controversy over facial recognition and fears that the glasses could be misused by predators, and said Meta was trying at Connect to present its glasses as not "creepy" ^[15]. Gizmodo called Private Processing "interesting" but noted it was unclear how significant it would be before Meta named the features it would cover ^[17].

References

1. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19 ^20 ^21 ^22Shah, Pritam; Linde, Oskar. "Bringing Private Processing to Meta AI Glasses." Engineering at Meta, September 23, 2026. engineering.fb.com/...e-processing-meta-ai-glasses
2. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16"Building Private Processing for AI tools on WhatsApp." Engineering at Meta, April 29, 2025. engineering.fb.com/...-private-processing-ai-tools
3. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19 ^20 ^21 ^22 ^23 ^24 ^25 ^26 ^27 ^28 ^29 ^30 ^31 ^32 ^33 ^34 ^35 ^36 ^37 ^38 ^39 ^40 ^41 ^42 ^43Meta. "Private Processing for WhatsApp Overview: Technical White Paper and Security Guide." V1 published June 10, 2025; V2 updated March 16, 2026. ai.meta.com/...ate-processing-technical-whitepaper
4. ^1 ^2 ^3 ^4 ^5 ^6 ^7WhatsApp. "Catch up on conversations with Private Message Summaries." WhatsApp Blog, June 25, 2025 (last updated October 13, 2025). blog.whatsapp.com/...ith-private-message-summaries
5. ^Mehta, Ivan. "Meta is adding AI-powered summaries to WhatsApp." TechCrunch, June 25, 2025. techcrunch.com/...ai-powered-summaries-to-whatsapp
6. ^1 ^2 ^3 ^4 ^5 ^6WhatsApp. "Get the Tone of Your Message Right with Private Writing Help." WhatsApp Blog, August 27, 2025. blog.whatsapp.com/...ght-with-private-writing-help
7. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13NCC Group. "Security and Privacy Assessment: WhatsApp Message Summarization Service." Version 1.0, August 26, 2025. nccgroup.com/...sapp-message-summarization-service
8. ^1 ^2 ^3 ^4 ^5 ^6 ^7Trail of Bits. "Meta WhatsApp Private Processing: Security Assessment with Fix Review." August 26, 2025. github.com/...privateprocessing-securityreview.pdf
9. ^1 ^2 ^3 ^4 ^5 ^6Trail of Bits. "What we learned about TEE security from auditing WhatsApp's Private Inference." The Trail of Bits Blog, April 7, 2026. blog.trailofbits.com/...hatsapps-private-inference
10. ^1 ^2 ^3 ^4 ^5 ^6 ^7Meta. "Introducing a Completely Private Way to Chat With AI." Meta Newsroom, May 13, 2026. about.fb.com/...incognito-chat-whatsapp-meta-ai
11. ^1 ^2 ^3 ^4WhatsApp. "Introducing Incognito Chat with Meta AI: A completely private way to chat with AI." WhatsApp Blog, May 13, 2026. blog.whatsapp.com/...y-private-way-to-chat-with-ai
12. ^1 ^2 ^3Meta Bug Bounty. "Private Processing Bounty Guidelines." Accessed September 25, 2026. bugbounty.meta.com/...private-processing
13. ^1 ^2 ^3 ^4Meta. "Your Personal Agent Coming to AI Glasses." Meta Blog, September 23, 2026. meta.com/...muse-personal-agent-ai-glasses
14. ^1 ^2 ^3 ^4Newman, Lily Hay. "WhatsApp Is Walking a Tightrope Between AI Features and Privacy." WIRED, April 29, 2025. wired.com/...ocessing-generative-ai-security-risks
15. ^1 ^2 ^3 ^4 ^5 ^6 ^7Ashworth, Boone; Newman, Lily Hay. "Meta Pinky Promises Its Smart Glasses Will Be Private Soon." WIRED, September 23, 2026. wired.com/...-glasses-are-going-to-be-private-soon
16. ^"Meta Connect 2026 Live: Updates From Mark Zuckerberg's Keynote On AI Glasses, VR And More." Engadget, September 23, 2026. engadget.com/...meta-connect-2026-live-blog-ai-vr
17. ^1 ^2Pero, James. "Shhh, It's Private," entry of September 23, 2026, in "Live Updates From Meta Connect 2026." Gizmodo. gizmodo.com/...s-from-meta-connect-2026-2000806463
18. ^Pogorelec, Anamarija. "Meta locks itself out of user data on its AI glasses." Help Net Security, September 24, 2026. helpnetsecurity.com/...e-processing-for-ai-glasses
19. ^1 ^2 ^3 ^4 ^5Apple. "Private Cloud Compute: A new frontier for AI privacy in the cloud." Apple Security Research, June 10, 2024. security.apple.com/...private-cloud-compute
20. ^1 ^2 ^3 ^4Google. "Private AI Compute: our next step in building private and helpful AI." Google Blog, November 11, 2025. blog.google/...google-private-ai-compute
21. ^Lovejoy, Ben. "WhatsApp borrowing Apple's Private Cloud Compute approach to AI privacy." 9to5Mac, April 30, 2025. 9to5mac.com/...loud-compute-approach-to-ai-privacy
22. ^Engineering at Meta (@Meta_Engineers). Post on X, September 24, 2026. x.com/...2103175786941616490
23. ^Arntz, Pieter. "Meta's confusing new approach to chat privacy." Malwarebytes, May 15, 2026. malwarebytes.com/...g-new-approach-to-chat-privacy