Google DeepMind uses an agentic AI tool to formally verify key security guarantees of the Signal protocol
WIRED reports the four-week proof-of-concept with a new framework, AlphaProof Code, found no new flaws in the parts it checked and caught known, long-fixed bugs in older versions; it did not cover the whole Signal app and Google did not disclose the cost.
Why it matters
Formal verification uses mathematical proof to show software behaves as specified, but writing specifications and proofs by hand has made it too slow for most code. DeepMind says agents did much of the proof work with human review at key points, and Signal's CTO Ehren Kret said the approach goes beyond earlier verification that covered smaller portions of the code. The researchers are releasing the specification and proof. The open question is whether AI-driven verification can scale to large code bases at a workable cost; watch for independent checks of the released proof and any commercial product.
Key facts
- Framework: AlphaProof Code, from Google DeepMind
- Project took four weeks
- No new vulnerabilities found in the parts analysed
- Correctly flagged known, long-fixed flaws in older Signal versions
- Did not verify the entire Signal mobile app
- Specification and proof are being released