DeepMind Formally Verifies Signal's Cryptography with AI

Google DeepMind has formally verified the cryptographic protocol underlying Signal using AlphaProof Code, a framework that combines AI agents with human expertise. Researchers mathematically proved that Signal’s core security properties hold in the actual deployed code—not just the theoretical design. This marks the first time AI has formally verified a widely deployed cryptographic protocol at implementation depth, and the first time any method has achieved this for an implementation of such a protocol.

The verification process split work between human experts and Gemini Carbon–powered AI agents. Agents translated Signal’s security goals into formal specifications and generated over six million lines of Lean code to prove correctness, while humans reviewed critical specifications. The system flagged only one percent of the codebase for human review and automatically verified the rest—compressing work that historically takes expert teams years into four weeks. Validation testing reintroduced two real, previously fixed bugs into isolated code versions; the system successfully detected both as insecure.

The breakthrough bridges the gap between design-level and implementation-level verification, where real-world vulnerabilities typically hide. Formal verification of production code has demanded extensive manual effort; automating this with AI agents advances security assurance for critical infrastructure. DeepMind is open-sourcing the verification artifacts to enable broader use.