TechPrufer
Get started
Meta
Meta logoMeta · Feature trail

Private Set Intersection and Secure Compute

2 posts · Jul 2020 – Sep 2026

What this trail covers

Meta's advancements in private AI processing for messaging and user data analysis continue, with a focus on leveraging confidential computing and TEEs for privacy-preserving analytics. This includes the development of systems like Scam Alert, which uses on-device ML models and differentially private aggregates sent to TEEs for secure aggregation. The platform also supports private set intersection (PSI) and private matching for compute, enabling secure data analysis and ML training without revealing user data. This has now been extended to AI glasses, enabling hyper-personalized AI experiences while ensuring data remains inaccessible to Meta.

All Meta trails
  1. Bringing Private Processing to Meta AI GlassesThis post details the engineering effort to extend Meta's Private Processing confidential computing infrastructure to AI glasses. It describes the challenges of building hyper-personalized AI with enhanced privacy for wearable devices, introducing the concept of Confidential Virtual Machines (CVMs) within Trusted Execution Environments (TEEs). Key engineering requirements include hardware isolation, fail-closed guarantees, public verifiability, non-targetability, and encrypted storage. The post outlines the implementation details for AI glasses, including non-user-identifiable routing via OHTTP relays, remote attestation (RA-TLS) for server verification, and stateful memory management through encrypted storage engines co-located within the TEE. It also addresses the operational challenge of debugging in a locked-down environment by relying on out-of-band aggregate health signals.
  2. How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability GuaranteesThis post details the technical implementation of Scam Alert, an optional WhatsApp feature that uses on-device ML models to detect potential scam messages. It emphasizes privacy-preserving analytics through confidential federated analytics pipelines built on TEEs. Key contributions include the use of differentially private aggregates (warning counts and user action counts) processed within TEEs, anonymous credentials for non-targetability, and verifiable transparency through in-app logs and published binaries. The system builds upon Meta's prior work in federated analytics and private processing for messaging.
  3. Key Transparency Comes to MessengerThis post details the implementation of key transparency for end-to-end encrypted chats on Messenger, building upon WhatsApp's existing system. It highlights the engineering challenges of handling a high volume and frequency of key updates at scale, with hundreds of thousands of new keys added every two minutes, leading to billions of key entries. The post describes improvements made to the Auditable Key Directory (AKD) library for algorithmic efficiency, reducing proof sizes even with numerous key versions. It also details infrastructure updates for resilience to temporary outages and improved recovery from key sequencing delays, drawing lessons from WhatsApp's two years of operation.
  4. Scaling Privacy Infrastructure for GenAI Product InnovationThis post details the scaling of Meta's Privacy Aware Infrastructure (PAI) to support GenAI product innovation, specifically highlighting its application to AI glasses. It introduces the challenges of GenAI for privacy (technological evolution, shifting requirements, accelerated innovation cycles) and explains how PAI addresses them through enhanced observability (data lineage, automated tagging) and efficient privacy controls (policy-enforcement APIs, policy automation). The "Discover" stage of PAI is elaborated upon, focusing on collecting cross-stack lineage for interaction data from web servers, loggers, inference services, and training jobs. It describes building comprehensive lineage observability using a common privacy library (PrivacyLib) integrated across Meta's data systems. Finally, it explains how this lineage is transformed into proof for AI glasses by placing Policy Zones and continuously verifying data processing jobs.
  5. Building Private Processing for AI tools on WhatsAppThis post details the technical implementation of Private Processing for WhatsApp AI features, focusing on the use of Trusted Execution Environments (TEEs) and Oblivious HTTP (OHTTP) to enable privacy-preserving AI. It outlines the authentication process using anonymous credentials, third-party routing and load balancing via CDN for HPKE keys, wire session establishment with OHTTP, and application session establishment with Remote Attestation + Transport Layer Security (RA-TLS). The core of the system involves confidential processing within a Confidential Virtual Machine (CVM) where AI models analyze data without exposure, and the response is encrypted end-to-end. The post also elaborates on the threat model, identifying assets (messages, TCB, hardware, keys), threat actors (insiders, third parties, malicious users), and threat scenarios (external exploitation, CVM extraction, insider interference). It highlights the commitment to verifiable transparency through publishing CVM binary digests and images, and the use of log-filtering for observability.
  7. IPLS: Privacy-preserving storage for your WhatsApp contactsIntroduced Identity Proof Linked Storage (IPLS) for WhatsApp, a novel encrypted storage system for contact names. IPLS leverages WhatsApp's existing Auditable Key Directory (AKD) for key transparency and Hardware Security Modules (HSMs) for secure key storage and retrieval. The system uses client-generated encryption keys and authenticates clients based on primary device identity, verified against the AKD. Cloudflare is integrated as an additional witness for AKD integrity. This enables private, tamper-resistant storage and automatic restoration of contacts across devices and accounts.
  8. Private matching for compute: New solutions to the problem of enabling compute on private set intersectionsThis post introduces two new cryptographic algorithms, Private-ID and PS3I, for private matching of records. Private-ID performs an outer join, revealing only the size of the intersection, while PS3I performs an inner join and outputs encrypted additive shares of matching records. Both algorithms leverage elliptic curve cryptography and offer stronger privacy guarantees than existing options by not revealing matched records. The post also outlines how these techniques can be extended to more complex computations using multiparty computation (MPC) and homomorphic encryption (HE), addressing the challenge of aligning data within these privacy-enhancing technologies.