Google DeepMind formally verified the security of the Signal Protocol implementation using the AlphaProof Code tool
Google DeepMind used its AlphaProof Code AI framework to formally verify the security of the compiled Signal Protocol code. AI agents generated over 6 million lines of proofs in the Lean language, with humans reviewing only 1% of the code; the verification took four weeks and found no new bugs.
The latest details show how the formal verification process worked: AI agents built on the Gemini Carbon model generated over six million lines of code in the Lean language, which mathematically proves the correctness of the program. According to the company, human experts reviewed only about 1% of the resulting code, because the rest was automatically verified by the Lean tool itself. The verification covered security at the level of compiled code running on devices, not just at the protocol design level, which the company says is a first for a cryptographic protocol deployed this widely.
The company itself described the project as verification of the security properties of the Signal Protocol, the technology that protects communication in the Signal and Google Messages apps. The AlphaProof Code framework combines human experts, who formulate and review formal specifications, with autonomous AI agents, which produce the mathematical proofs themselves. The entire verification took four weeks, which the company describes as a significant reduction compared to the years such work has historically required. The analysis found no new vulnerabilities in the verified parts of the code, but when tested on older versions of Signal, it correctly identified two real, previously fixed bugs.
Wired adds context: according to Google DeepMind researcher Swarat Chaudhuri, this is one milestone on the long road toward making formal verification mainstream, not a finished solution for all software. The analysis did not cover the entire Signal mobile app, and Google declined to disclose the project's costs or whether it plans a commercial product for formal verification. Signal Foundation CTO Ehren Kret said that Google DeepMind's approach allows the scope of verification to be significantly expanded compared to the earlier, smaller formal verification that Signal Foundation had previously carried out itself. According to the company, the specification and proof for the Signal Protocol will be published for further research.
Why it matters
Formal verification mathematically proves that code satisfies given security properties, which is a stricter guarantee than ordinary testing or an audit. The successful verification of the Signal Protocol at the level of compiled code, not just design, shows that AI agents can handle work that previously took expert teams years, while concentrating human review on only a small part of the code.
What was added since the original report
Verified updates
-
AI agents generated over 6 million lines of Lean code as part of the verification; Humans manually reviewed only 1% of the codebase; Verification took place at the level of the compiled code implementation, not just at the design level; The framework combines human expertise with the autonomous work of AI agents; This is reportedly the first AI-driven formal verification of a cryptographic protocol at the implementation level
- AI agents generated over 6 million lines of Lean code as part of the verification
- Humans manually reviewed only 1% of the codebase
- Verification took place at the level of the compiled code implementation, not just at the design level
- The framework combines human expertise with the autonomous work of AI agents
- This is reportedly the first AI-driven formal verification of a cryptographic protocol at the implementation level
Two audiences, two different impacts
What this means
For individuals
Users of the Signal and Google Messages apps gain further independent confirmation that key cryptographic properties of their communication have been mathematically verified, not just designed and tested in the usual way.
More practical updates →For a business
Companies relying on critical cryptographic code (banks, providers of secure communication) now have a documented demonstration that AI-assisted formal verification can verify a protocol implementation in a matter of weeks instead of years; however, this is a research project with no disclosed costs and no confirmed commercial product, so practical availability and pricing for companies remains…
Risks and complianceCheck the original
Event sources
independently confirmed · 2 publishers, 1 independent. We count feeds from the same owner only once.