Google DeepMind formally verified the security of the Signal Protocol using the AlphaProof Code tool
In a four-week project, Google DeepMind used the AI tool AlphaProof Code to formally verify the security of the Signal Protocol and found no new vulnerabilities; it will publish the specification and proof for further research.
In a four-week project, Google DeepMind carried out formal verification of the security of the Signal Protocol using a new AI framework called AlphaProof Code. Formal verification mathematically proves that software works according to given specifications and does not contain certain classes of critical vulnerabilities. In the parts of the protocol that were verified, AlphaProof Code found no new vulnerabilities. When the team applied the tool to older versions of Signal containing known bugs that had long since been fixed, the tool correctly identified them and showed that these versions could not be formally verified.
According to the source, the analysis did not cover the entire Signal mobile application and was limited in scope; DeepMind researchers emphasize that this is just one milestone on a longer path. According to Swarat Chaudhuri, a DeepMind researcher, there is still a long way to go before this approach can be extended to all the software in the world. The project was able to move quickly partly because the Signal Foundation had already previously carried out its own formal verification of smaller parts of the code, which the DeepMind team built on. DeepMind will publish the specification and proof created for this analysis so that other researchers can use them.
Signal's chief technology officer, Ehren Kret, said that Google DeepMind's approach allows the scope of verification to be significantly expanded compared to earlier work focused on smaller parts of the code, and gives the company greater confidence regarding the privacy guarantees in the protocol's implementation. Pushmeet Kohli, chief scientist at Google Cloud and vice president of research at DeepMind, mentioned that similar tools could in the future allow banks and other companies that depend on security guarantees to prove properties of their code.
The project was carried out free of charge as research work; Google declined to disclose its costs and did not comment on whether it plans a commercial formal-verification product or service. The researchers describe their process as a "collaborative process between humans and AI," in which agents contribute and correct themselves in most phases, but key decisions still go through human review.
Why it matters
Formal verification mathematically proves the absence of certain critical bugs in code, but until now it has been extremely time-consuming; agentic AI is speeding up this process and opening the way to verifying larger systems, such as the cryptographic protocol behind Signal, Google Messages, and WhatsApp. However, the project is a research proof-of-concept with limited scope (it does not cover the entire Signal mobile application), with undisclosed costs and no announced commercial tool, so it is not yet a service that companies could actually order or deploy.
Two audiences, two different impacts
What this means
For individuals
For developers and security researchers, it is relevant that Google DeepMind will publish the specification and proof from the analysis, which can be used as starting material for further formal verification; the AlphaProof Code tool itself, however, is not publicly available.
For a business
Companies dealing with code security guarantees (e.g. banks) get a signal that AI-based formal verification is heading toward practical use, but according to Google this is an unpaid research project with no announced commercial product or service, so real deployment in corporate processes cannot yet be planned.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 1 independent. We count feeds from the same owner only once.