Google DeepMind AI Formally Verifies Signal Cryptographic Protocol
Google DeepMind used agentic AI to mathematically prove the security of the Signal protocol, marking the first formal verification of a widely deployed cryptographic implementation.
Researchers at Google DeepMind used a new agentic AI framework called AlphaProof Code to formally verify the cryptographic guarantees of the Signal protocol. Over a four-week proof-of-concept project, AI agents powered by Gemini Carbon translated security goals into mathematical specifications and generated more than six million lines of Lean code to prove the implementation functions as intended.
This project marks the first time a widely deployed cryptographic protocol—used by Signal, WhatsApp, and Google Messages—has been formally verified by any method. While the analysis focused on the core protocol rather than the entire Signal mobile application, the AI successfully identified known vulnerabilities when tested on older versions of the code, including two previously fixed bugs reintroduced for testing purposes.
DeepMind utilized a human-AI collaboration process to ensure accuracy and avoid a scenario where AI generates both the goals and the proofs. The company is open-sourcing its specifications and proofs to help secure other critical infrastructure, such as medical device firmware and power grid software. Signal leadership noted that the verification provides greater confidence in the code's privacy guarantees, though researchers acknowledged that high computational costs and scalability remain significant challenges for broader application.
