Google DeepMind Validates Signal Protocol Security in One Month

Google DeepMind introduces Code AlphaProof, an AI system designed to produce formal security proofs for real code. The team claims to have verified the cryptographic core of Signal in four weeks, a task that typically takes several years. Agents based on Gemini Carbon generated over six million lines of proofs in Lean and detected two bugs inserted for testing. DeepMind plans to extend this method to sectors such as energy and healthcare.

Signal Welcomes the Initiative and DeepMind Targets Energy and Healthcare

Signal's Chief Technology Officer, Ehren Kret, believes this approach enhances trust in data privacy as AI-related threats increase. DeepMind intends to apply the same method to critical sectors like power grids and medical devices through systems such as CodeMender. During testing, two deliberately inserted bugs were detected immediately. The verification focused on the actual code of the cryptographic core used on user devices.

On the Signal Protocol, Weeks Instead of Years

According to DeepMind, Code AlphaProof enabled the verification of Signal's encryption protocol in four weeks, whereas this type of work typically requires several years. Previous verification efforts had only reached the theoretical design stage. DeepMind clarifies that the verification concerned the implementation used in production on user terminals.

Gemini Carbon Agents Write Lean Proofs at Scale

After formal security requirements were defined by experts, AI agents based on Gemini Carbon generated over six million lines in the Lean proof language. About one percent of the codebase was flagged for human review. These agents participate in formalizing specifications and then independently prove that the program adheres to them. Code AlphaProof is presented by DeepMind as a system capable of mathematically proving a software's compliance with its security specifications, according to researchers Pushmeet Kohli and Swarat Chaudhuri.