Google DeepMind Formally Verifies Key Signal Protocol Guarantees

What happened

Google DeepMind researchers used agentic AI and a framework called AlphaProof Code to formally verify selected cryptographic guarantees in the Signal protocol. The four-week proof of concept found no new vulnerabilities in the portions examined, and the researchers say AlphaProof Code identified known, long-fixed vulnerabilities in older Signal versions. They are releasing their specification and proof to support further formal verification work.

Read next

• More changes in today’s briefingGoogle DeepMind Introduces Gemini 4 Hydrogen for Fast Agentic Workflows

Reported by 5 sources

The story so far

Google DeepMind used AlphaProof Code to formally verify selected cryptographic guarantees in the compiled code underlying the Signal protocol. The four-week proof of concept generated more than six million lines of Lean proofs, which Lean checked automatically; human experts reviewed every specification and examined the roughly one percent of the codebase flagged for a second look. The work found no new vulnerabilities in the portions examined. Tests using two previously fixed bugs produced machine-checked proofs that the older, buggy versions were insecure. DeepMind is releasing its specification and proof to support further formal verification work.