Google DeepMind researchers have used agentic AI to mathematically prove, or formally verify, several key cryptographic guarantees of the Signal protocol. Completed as a proof-of-concept in only four weeks, this development marks a significant milestone for both widespread cryptography and artificial intelligence.
Validating Core Communications and AI Frameworks
The project provides independent validation for the cryptography securing vast amounts of global communications across platforms such as the Signal app, WhatsApp, and Google Messages. Additionally, it highlights Google DeepMind’s formal verification capabilities through a new artificial intelligence framework named AlphaProof Code.
AI-aided formal verification is experiencing a notable rise in prominence, though questions remain regarding its practicality for mainstream adoption and its ability to secure massive codebases. Proponents have long considered formal verification the ultimate goal in software security because it employs mathematics to ensure software functions properly without critical vulnerabilities.
Challenges and Future Scaling
Prior to the rise of artificial intelligence, human experts faced arduous tasks when describing desired software characteristics, translating those summaries into formulas, and constructing proofs. Agentic AI drastically reduces the time required for the proof phase, facilitating evaluations similar to DeepMind’s assessment of Signal. Nevertheless, the evaluation had a restricted scope—omitting the formal verification of the complete Signal mobile app—and researchers stress that their discoveries represent only a single step forward.
“We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that,” Swarat Chaudhuri, a DeepMind research scientist, tells WIRED.
The assessment uncovered no new vulnerabilities within the analyzed sections of the Signal protocol. However, when researchers applied AlphaProof Code to legacy versions of Signal containing previously fixed flaws, the system successfully flagged them and demonstrated that the protocol could not be formally verified. The team is now publishing the specifications and proofs generated during the Signal analysis to support future formal verification initiatives.
