DeepMind Uses AlphaProof Code to Verify the Signal Protocol's Security
Google DeepMind's research team used an AI framework called AlphaProof Code to formally prove that the Signal protocol, used for encrypted communications in Google Messages and elsewhere, has sufficient security protections.
1 source 11h ago
Reporting from 1 source: GIGAZINE.
Why it matters
The team reinserted two already-fixed bugs and AlphaProof Code flagged the buggy version as not secure, which is the concrete evidence that this kind of AI proof work can catch real defects rather than only confirm code that already passed review.
Key Facts
- Google DeepMind used its AlphaProof Code framework to formally verify the Signal protocol down to compiled device code.
- Agents running Gemini 4 Carbon generated 6 million lines of Lean proofs.
- About 1% of the codebase required human review, with Lean checking the rest.
- DeepMind says the verification took four weeks rather than years of expert manual work.
- The team reinserted two already-fixed bugs, and AlphaProof Code reported the buggy version as not secure.
Agents running Gemini 4 Carbon generated 6 million lines of machine-checked Lean proofs. About 1% of the codebase needed human review. DeepMind says the work, normally years of expert manual verification, took four weeks.
The proof effort went down to compiled device code, the layer where DeepMind says real bugs hide. Multiple AI models first translated the protocol's security goals into formal mathematical specifications, and human experts reviewed those specifications before any proof work began. Agents then carried out the proofs in Lean, a language for mathematically proving code correctness, and flagged the spots that needed human visual inspection, which came to roughly 1% of the total. DeepMind open sourced the results for the security community.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google