Google DeepMind says its AI agents have mathematically proved that the real code behind the Signal encryption protocol keeps its key security promises, and that the job took four weeks. Along the way the agents wrote more than six million lines of proof in Lean, a programming language whose checker accepts only proofs that are logically airtight.
The lab described the work in a November 10 post by Pushmeet Kohli and Swarat Chaudhuri, introducing a system it calls AlphaProof Code. DeepMind says this is the first time the implementation of a widely deployed protocol like Signal’s has been formally verified by any method, with or without AI.
Why Signal’s code matters
The Signal Protocol was created in 2013 by Trevor Perrin and Moxie Marlinspike at Open Whisper Systems. It now protects chats in the Signal app and Google Messages, and WhatsApp uses it too. The protocol’s design was analyzed formally by university researchers in 2016 and found cryptographically sound. That checked the blueprint, though, not the software people actually run.
DeepMind’s point is the gap between the two. Bugs often live where a correct design meets real code, so the team set out to prove properties of the compiled code itself, including that messages stay protected both before and after a device is briefly compromised. Those properties are known as forward secrecy and post-compromise security.
The scale, worked out
Six million lines in four weeks, or 28 days, works out to roughly 214,000 lines of Lean a day. One percent flagged for review still means people had to read a slice of the work, but far less than checking every line by hand, which DeepMind says has historically taken expert teams years.
How AlphaProof Code works
The system splits the labor the way a research group might. Human experts worked with a mix of AI models to turn Signal’s security goals into formal mathematical statements, and people reviewed every one. Agents running on Gemini Carbon then produced the proofs. The agents also audited their own output and flagged about one percent of the codebase for a human second look, while Lean’s checker verified the rest automatically.
As a test, the researchers reinserted two real, previously fixed bugs into an isolated copy of Signal’s code. Each time, AlphaProof Code returned a Lean-checked proof showing the tampered copy was not secure.
What it does not cover
A proof is only as broad as its specification. The guarantees cover the properties the experts chose to state, written by humans, so anything left out of those statements is not proven. The protocol also does not stop a messaging company from keeping records of who talks to whom and when; that is a matter of each service’s policy. And the claims here come from DeepMind’s own announcement and technical paper rather than an outside audit.
“As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code’s privacy guarantees,” said Ehren Kret, Signal’s chief technology officer, in a statement in the post.
The work adds to Google’s push to have Gemini models do more of their own engineering, a theme Sergey Brin raised when he described an “RSI treadmill” at Google. Secret messages have a longer history, too; the Navajo Code Talkers’ World War II code was never broken.
DeepMind says it is open-sourcing the formal verification artifacts from the Signal project for anyone to inspect.
Further reading
Image: rawpixel.com rawpixel, CC0 via Wikimedia Commons
This article was produced with AI assistance and reviewed by our Editorial Desk. How we work.
