A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure

WIRED reported that Google DeepMind researchers conducted the work as a proof-of-concept project in just four weeks. According to WIRED, the effort serves as independent validation of the cryptography protecting global communications on platforms such as the Signal app, Google Messages, and WhatsApp, while demonstrating DeepMind's formal verification capabilities using AlphaProof Code. Formal verification uses math to check and validate that software functions as intended without critical vulnerabilities, a process proponents have long called a holy grail in software security.

Before the artificial intelligence era, humans spent significant time describing software characteristics, turning summaries into formulas, and developing proofs. WIRED noted that agentic AI cuts down the time required for the latter project, enabling analyses like DeepMind's Signal evaluation. However, the analysis had a limited scope and did not formally verify the entire Signal mobile app, with researchers emphasizing that the findings represent a single milestone in a larger process. Swarat Chaudhuri, a DeepMind research scientist, told WIRED that researchers are excited by the result but acknowledge a long distance remains before scaling this capability to all software.

The analysis found no new vulnerabilities in the tested portions of the Signal protocol. WIRED reported that when researchers tested older versions of Signal containing known and long-fixed vulnerabilities, the tool correctly identified them and showed the protocol could not be formally verified. Researchers are releasing the specification and proof developed for the analysis to support other formal verification work. Signal chief technology officer Ehren Kret stated that prior formal verification focused on smaller code portions, whereas DeepMind's approach enables significant expansion. Kret added that as AI-driven security threats grow, rigorously verifying the Signal protocol implementation provides greater confidence in code privacy guarantees.

Pushmeet Kohli, chief scientist at Google Cloud and DeepMind's vice president of research, stated that verifying the correctness of these implementations allows banks and other companies relying on assurances to prove these properties and rest easy. Despite these advancements, questions remain across the tech sector regarding whether AI-automated formal verification can truly scale at a workable cost. WIRED noted that DeepMind conducted the Signal analysis free of charge as a research project, while Google declined to share the cost or comment on whether it plans to release a commercial formal verification product or service.

The researchers developed a human-AI collaboration process allowing agents to contribute and self-correct across phases while seeking human input at key junctures. Chaudhuri told WIRED that researchers avoid a vibe world where AI generates goals and proofs, emphasizing a middle ground.