Google DeepMind uses AI to formally verify Signal protocol encryption
Also covered by 4 sources
What happened
Google DeepMind used its AlphaProof Code AI framework to formally verify the security properties of the Signal protocol’s compiled code. Over four weeks, a five-person team combined AI agents and human oversight to produce 6.5 million lines of machine-checked proofs. The verification targeted the core one-to-one session code used in Signal, WhatsApp, and Google Messages, confirming key cryptographic guarantees. This was the first time a widely used cryptographic protocol’s actual implementation received such deep formal verification by AI.
Key details
- AlphaProof Code generated 6.5 million lines of Lean proof code.
- The verification covered the compiled libsignal v0.105.4 and SPQR v1.6.0 code.
- The project was completed by five researchers in four weeks.
- Human review was reduced to about 1% of the codebase; AI agents handled the rest.
- The verified properties included forward secrecy, authentication, and post-compromise security.
Why it matters
Users of Signal, WhatsApp, and Google Messages now have independent, machine-checked assurance that the core encryption protocol in these apps meets key security properties. Developers and organizations relying on these protocols gain a new level of confidence in their cryptographic foundations, reducing the risk of undetected vulnerabilities in the verified code. The process also demonstrates that AI can automate large-scale formal verification, potentially lowering the cost and effort required to secure critical software.