Google DeepMind’s AI Proves Key Security Guarantees of Signal’s Code
Google DeepMind says its AlphaProof Code agents wrote over 6 million lines of machine-checked proof for Signal's encryption code in four weeks.
Google DeepMind, the artificial intelligence research lab owned by Alphabet’s Google, said on Tuesday that AI agents had mathematically proven key security properties of the real code behind the Signal protocol, the encryption system that protects private messages in the Signal app and Google Messages. The company said the work took four weeks and produced more than 6 million lines of machine-checked proof, a task it said has historically taken teams of experts years.
What happened
In a blog post, DeepMind introduced AlphaProof Code, which it described as an agentic framework for formal verification. Formal verification is a way of using mathematics to show that software behaves exactly as intended under stated assumptions, rather than simply testing it and hoping no bugs slip through.
The system splits the work between people and machines. According to DeepMind, human experts decided which security goals mattered and, with the help of a mix of AI models, turned them into formal specifications that experts then reviewed one by one. Agents powered by a Gemini model the company calls Gemini Carbon wrote the proofs. Other agents then audited those proofs and flagged sections for human attention.
The proofs are written in Lean, a programming language and proof assistant that can check mathematical arguments automatically. DeepMind said only about 1% of the resulting codebase was flagged for review by people, while Lean checked the rest.
One of the properties the team proved, DeepMind said, is that messages stay protected both before and after a device is temporarily compromised. Startup Fortune, citing reporting by Wired, said the work also covered guarantees such as forward secrecy and authentication for one-to-one conversations, and that researchers found no new flaws in the parts they examined.
Testing the tester
To show the system could catch real problems rather than rubber-stamp code, the researchers reintroduced two genuine bugs that had previously been fixed into an isolated copy of Signal’s code. In both cases, DeepMind said, the system produced a machine-checked proof that the buggy version was insecure.
Signal’s own engineers were involved in reviewing the approach. Ehren Kret, chief technology officer of Signal, said in DeepMind’s announcement that “using AI agents to translate live code into valid Lean theorems is a major breakthrough.” DeepMind credited Signal’s Rolfe Schmidt, Michael Rosenberg and Kret with giving feedback on the methodology.
DeepMind said it has published the formal verification artifacts as open source so others can examine and build on them. The tech news site TUN reported that the lab also released a technical paper.
Why it matters
The Signal protocol is one of the most widely used encryption designs in the world. Academic studies have examined its design for years without finding major flaws, but, as Startup Fortune noted, the harder question has been whether the code actually running on phones matches that design. DeepMind said its work is notable because it checks the live implementation, not only the protocol on paper, and TUN reported that the team calls it the first AI-assisted formal verification of a widely deployed cryptographic protocol at this depth.
Established tools such as ProVerif and the Tamarin Prover work mainly at the design level, TUN noted. Other groups are also pursuing AI-driven proofs, including startups Harmonic AI and Logical Intelligence. A separate effort called Signal Shot, run by the Beneficial AI Foundation, a nonprofit co-founded by MIT professor Max Tegmark, is working with Signal and the Lean FRO, the organization that develops Lean, to verify the protocol and its Rust implementation. Startup Fortune described DeepMind’s project as tackling the same problem from a different direction.
DeepMind said it wants to apply the approach to other critical systems, naming medical device firmware and power grid software as examples. It also plans to pair the technique with CodeMender, its automated agent for finding and fixing security flaws, to counter cyberattacks carried out by AI agents.
The limits
The reports agree that the work is not a blanket guarantee that Signal can never be hacked. Key caveats include:
- The verification covered selected security properties of the core cryptographic code, not the entire Signal mobile app, according to TUN and Startup Fortune.
- A formal proof is only as strong as its written specification and assumptions, Startup Fortune noted.
- DeepMind ran the analysis at no charge and has not disclosed its cost or announced a commercial product, TUN reported.
- Signal’s protocol is relatively small and well documented, making it an unusually favorable target compared with most commercial software.
DeepMind itself said scaling the techniques “requires continued research.” Swarat Chaudhuri, a DeepMind research scientist and one of the blog post’s authors alongside DeepMind’s Pushmeet Kohli, told Wired that the team is excited but that “there is a long distance to go” before the method can be applied to all software, according to Startup Fortune.
