Signal’s Creator Is Helping Encrypt Meta AI

Moxie Marlinspike, the privacy advocate who created the secure communication app Signal and its widely used open source encryption protocol, said this week that his privacy-focused AI platform, Confer, will start incorporating its technology into Meta’s AI systems.

Every day, billions of chat messages sent through Signal, Meta’s WhatsApp, and Apple’s Messages are protected by end-to-end encryption. The feature, which makes it impossible for tech companies and anyone other than the sender and recipient to snoop on your messages, has become mainstream over the past decade. As generative AI platforms explode in popularity, though, people are now also exchanging billions of messages a day with AI chatbots that don’t offer the protection of end-to-end encryption—making it easy for AI firms to access what you talk about.

This is by design, given that platforms often want to train their AI models on as much user data as possible and have made it hard to opt out of having your information used as training data. But as chatbots and AI agents have become more capable, some technologists and companies are pushing to create more constrained and privacy-focused systems.

“As LLMs continue to be able to do more, we should expect even more data to flow into them,” Marlinspike wrote in a short blog post about his collaboration with Meta published on Tuesday. “Right now, none of that data is private. It is shared with AI companies, their employees, hackers, subpoenas, and governments. As is always the case with unencrypted data, it will inevitably end up in the wrong hands.”

Marlinspike wrote that he will “work to integrate Confer’s privacy technology so that it underpins Meta AI.” He also emphasized that Confer, which debuted at the beginning of this year, will continue to operate independent of Meta. The project’s goal, Marlinspike added, is to offer a technology that “allows everyone to get the full power of AI along with the full privacy of an encrypted conversation.”

In 2016, Marlinspike worked with WhatsApp, which is owned by Meta, to roll out end-to-end encryption to more than a billion accounts simultaneously. Over the last year, WhatsApp has introduced a Meta AI chatbot into its app, which isn’t shielded from the company in the same way individual chats are.

“People use AI in ways that are deeply personal and require access to confidential information,” WhatsApp head Will Cathcart wrote on Wednesday on the social media platform X about the collaboration with Confer. “It's important that we build that technology in a way that gives people the power to do that privately.”

The adoption of encrypted AI is still emerging. The cryptographic schemes used in end-to-end encryption for traditional digital communication aren’t easily or directly translatable into data protections for generative AI. For its part, Confer is still a new project, and Marlinspike’s blog post did not provide specific details about how exactly the collaboration with Meta will work or what the specific goals are for integration.

Neither Marlinspike nor Meta provided WIRED with additional comment ahead of publication.

Mallory Knodel, a cryptography researcher at New York University, says it would be “great for people using chatbots that use Meta AI to have confidentiality and privacy within that exchange.” Crucially, that means Meta would not be able to access AI chat data for training, says Knodel, who along with colleagues recently published a study on end-to-end encryption and AI. “I really hope more AI chatbots adopt this approach.”

Knodel’s preliminary, initial assessments of Confer indicate that the platform isn’t perfect, but is an important example of how to build a private AI chatbot.

Cryptographer JP Aumasson, the chief security officer at the cryptocurrency platform Taurus, has come to similar conclusions about Confer thus far. “Confer is probably the best private AI solution, all things considered,” he tells WIRED. “It's not perfect, of course. It lacks documentation of its architecture, threat model, and supply chain. But Moxie knows what he's doing and has a solid track record.”

The complexity of developing encryption schemes for AI platforms is a major hurdle, and much of the privacy work so far has focused on accessible open source models or building privacy layers between AI companies and end users. For example, as Marlinspike wrote on Tuesday, “Confer’s technology has been built on top of open weight models. While many people love using Confer for a wide variety of tasks, others have missed the frontier capabilities from proprietary models.”

The collaboration with Meta gives Marlinspike an opportunity to work directly with closed models. “Meta is building advanced frontier models, so this will combine the most private AI chat technology in the world with the most capable AI models in the world,” he wrote.

Regardless of whether the project will ultimately fulfill all of those superlatives, researchers emphasized to WIRED that the collaboration is significant.

“Moxie's proposal of using trusted computing, a concept dating back at least to the 1990s, is sound to me,” Taurus’ Aumasson says. “The underlying assumptions and limitations are well understood. Again, it's not perfect, but probably sufficient for most users. The challenge is to support models that are as good as the latest frontier models from Anthropic and Google and OpenAI.”