Google DeepMind uses AI agents to formally verify compiled code behind Signal's cryptographic protocol
The approach checks running code rather than design documents, and its proofs caught deliberately reintroduced bugs.
Google DeepMind researchers used a new multi-model agentic framework, AlphaProof Code, to formally verify the actual compiled code behind Signal's cryptographic protocol, a step beyond design-level checks. Human experts first wrote the security goals as formal specifications, after which AI agents generated more than six million lines of Lean proofs in about four weeks, a task that expert teams have historically needed years to finish. The agents flagged roughly one percent of the codebase for human review, and the system proved that compiled code keeps messages protected even after a device is temporarily compromised. To test the approach, the team reintroduced two previously fixed bugs and the system produced machine-checked proofs that the buggy versions were insecure. The work is presented as the first formal verification of a widely deployed protocol's implementation by any method, and as a proof of concept for AI-assisted verification at scale.
Why it matters
Formal checks of compiled code have typically taken expert teams years, so a project of this size completed in weeks suggests AI-assisted verification could make such checks feasible for other widely used protocols. The work is presented as a proof of concept, so its wider reach is still to be tested. For readers following the field, it shows a path from specifying security goals in formal language to machine-checked proof of the implementation actually shipped, rather than the design alone.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources · 2
- Google DeepMind Blog ↗ Primary source
- Ars Technica ↗