WhatsApp Puts Its Scam Classifier on a Public Ledger, Not on Its Servers

WhatsApp has begun a limited beta of Scam Alert, an optional feature that runs an on-device machine learning model to flag suspicious messages from people who are not in a user's contacts ^[1]. The part worth attention is not the classifier but the plumbing around its distribution: WhatsApp says every model release must be logged on a third-party, append-only transparency ledger before it can be sent to any device, specifically to prevent a model being pushed to one named person ^[6].

Once a user turns the feature on, a model is downloaded to the device and evaluates incoming messages from non-contacts for patterns associated with known scams, drawing on conversational structure and linguistic cues ^[2]. The model is trained on scam conversations reported by users ^[4]. A flagged message produces a warning visible only to the recipient, and the sender is not notified ^[7]. The recipient can block, report, ignore the warning, or mark the conversation as trusted, which stops future alerts in that chat ^[8]. Users who mark a chat trusted can separately opt in to send WhatsApp the last five messages they received to help refine accuracy ^[5]. WhatsApp says no message content leaves the device for classification and nothing is auto-reported to WhatsApp, Meta or anyone else ^[9].

The distribution controls are concrete. Each release is accompanied by a manifest of SHA-256 hashes covering the model weights and related files, and the manifest digest is signed with Ed25519 keys held by Cloudflare rather than Meta ^[11]. Devices verify that signature, cross-check it against the ledger, and confirm the downloaded files match the published hashes before the model is allowed to run ^[12].

If those checks work as described, what they buy is uniformity: a device only runs an artifact whose hashes were published in advance, so a bespoke model built for a single account has nowhere to hide ^[1]. They say nothing about what the globally distributed model looks for. Neither published account describes training data or classification criteria being published alongside ledger entries, and neither names the operator of the ledger itself, although Cloudflare holds the signing keys ^[2]. Cloudflare is accumulating this role: it and Trail of Bits act as independent auditors of Signal's key transparency log, which underpins Signal's newly announced automatic key verification ^[19][4].

Because no content leaves the device, WhatsApp needs another way to tell whether the feature is working. It built what it calls a confidential federated analytics pipeline, which it says collects only two categories of data: counts of how often warnings were triggered, and counts of what users did afterwards, such as blocking or marking a chat trusted ^[13]. The company outlines a threat model covering external attackers, compromised infrastructure insiders and supply-chain risk, and says the pipeline's defences are meant to ensure that targeting one user's data would require compromising the entire system ^[14]. On that accounting, the only stated route for message content to reach WhatsApp is the opt-in five-message share after a user marks a chat trusted ^[5].

Users will be able to review an in-app log at Account > Request Info > Scam Alert Activity showing which messages were scanned, the outcome, and which model version made the call ^[15]. The bug bounty programme is being extended to cover Scam Alert ^[16], and WhatsApp calls the release an early technical preview rather than a finished product ^[17]. The service has more than 3 billion users across more than 180 countries ^[18].

Worth watching: who operates the ledger and whether outside parties can read it, whether model version history in the in-app log can be reconciled against ledger entries, and what the bug bounty community reports before any wider rollout.