Gemma Against Chat Scams: What We Know About Google and Singapore’s Project

A project to detect scams in private conversations

Google DeepMind and GovTech Singapore have announced an artificial intelligence tool designed to identify conversational scams in private chats. The proposal relies on lightweight Gemma models that, according to the project description, would run directly on the user’s device. Its stated aim is to warn people when a conversation may be fraudulent, without needing to send the chat to the cloud for that analysis.

The announcement establishes the project’s intent and broad technical approach, but it is not enough to measure the system’s effectiveness or conclude that every piece of data associated with the feature always stays on the phone. The information available here does not identify the specific Gemma version, compatible devices, launch date or rates of correct and incorrect detections. Those gaps matter: a demonstration or institutional description is not the same as comparable results from an independent evaluation.

How Gemma fits into on-device analysis

Gemma is a family of open models developed by Google DeepMind and other Google teams. Official documentation says its models can run in different environments, including mobile devices, and that versions come in different sizes with different resource requirements. That makes local use of a lightweight model technically plausible, but it does not reveal which model was incorporated into this tool or how it was adapted to recognize scams.

In general, an on-device system could examine text available in a conversation, look for patterns associated with deception and produce an alert or recommendation. However, the materials provided do not describe the specific mechanism: they do not say which messages are analyzed, whether processing runs continuously or is triggered under certain conditions, how much context is retained, or how an alert appears. This sequence therefore illustrates one possible architecture; it should not be taken as a statement of implementation details that have not been published.

What on-device processing does—and does not—mean

On-device processing means that some AI analysis takes place on the user’s device, rather than necessarily sending the input to a remote service to get a response. This architecture can reduce exposure of chat content compared with an analysis that depends on the cloud. But on-device processing alone does not prove that no data ever leaves the phone while the app is in use.

Assessing a privacy claim requires looking at the full data journey: what content is read, where each component runs, whether diagnostics or telemetry are transmitted, what happens when someone reports an alert, and what records are stored. The description provided presents the initiative as local detection with no data sent to the cloud, but it does not include enough technical documentation to verify every step of the data flow. The cautious conclusion is that local analysis is central to the announced approach, while the full scope of the privacy guarantee needs further detail.

What signals might it look for, and what would users see?

The proposal focuses on conversational scams: deceptions carried out through messages that may seek money, personal information or actions that help a scammer. The institutional announcement describes the aim of intercepting this kind of fraud, but the information provided does not list specific categories, detection rules or verified examples of messages that would trigger a warning.

It is also unclear what action the tool would take when it detects a possible scam. An alert might prompt someone to pause and check the other person’s identity, but there is no basis here to say that the tool blocks messages, reports accounts, contacts authorities or prevents a transfer. That distinction matters in practice: a warning helps someone make a decision, while a block intervenes in the conversation. Without a detailed functional description, those possibilities should not be conflated.

Without metrics, effectiveness cannot be assessed

The evidence provided includes no quantitative results on the system’s ability to detect scams, its false-alarm rate or its performance across languages, conversation types or devices. It also does not identify the size or composition of the test set, whether the system was evaluated on real or simulated conversations, or how it was compared with an alternative. Without those details, it is not possible to conclude that the tool works effectively in everyday conditions.

Assessing a detector means measuring more than the scams it catches. It is also necessary to count legitimate conversations it flags by mistake and scams it misses. Too many incorrect warnings can lead people to ignore future alerts; too few detections can create unwarranted confidence. Tests should specify the balance between these two kinds of error and describe the conditions under which the results were obtained.

Availability, compatibility and open questions

General Gemma documentation confirms that some models are designed to run on mobile devices, but it does not establish which variant the announced tool uses or which phones can run it. The Gemma family includes models of different sizes; the existence of a mobile-ready version does not guarantee that a particular feature will be available on every device, operating system or messaging app.

No rollout schedule or details about who will be able to try the tool are provided either. Answering those questions would require access instructions, a list of compatible devices and an explanation of required permissions. On privacy, a description of the full data flow and the records generated would be useful. And to assess scam protection, we need reproducible tests reporting detections and errors across languages—not just a description of the project’s intention.

Bottom line: a promising architecture, still awaiting evaluation

The initiative from Google DeepMind and GovTech Singapore proposes bringing scam detection closer to the user’s device. Running a model locally could reduce the need to send chat text to the cloud for analysis, and Gemma documentation confirms that the family includes models intended for mobile devices. These are relevant points, but they do not substitute for evaluating the specific tool.

For now, the key questions remain open: which Gemma version is used, which conversations it can analyze, what data leaves the device, what proportion of scams it detects and how many incorrect alerts it generates. Details about languages, compatibility and availability are also missing. Until those details are published, the careful description is that this is an announced system with on-device processing—not a defense whose effectiveness or end-to-end privacy has already been demonstrated.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.