Researchers from Google DeepMind conducted a formal verification of the Signal messenger's security system. This is the first case in history where artificial intelligence helped create a mathematical proof that links the fundamental security guarantees of the protocol with its actual cryptographic implementation.
To do this, the DeepMind team used the multi-agent system AlphaProof Code, built on the Lean mathematical proof language and Gemini Carbon models.
What exactly the artificial intelligence verified
AlphaProof Code analyzed Signal's key cryptographic mechanisms, checking the libsignal library for compliance with theoretical security requirements:
During the research, the AI agents generated 6.5 million lines of Lean code. After that, the system conducted an audit and identified areas that required additional analysis by humans.
Hybrid approach: human + AI
The distinctive feature of the project lies in the synergy between researchers and artificial intelligence. The scientists formulated mathematical specifications of Signal's security goals, and Gemini Carbon agents created proofs of their correctness for machine code.
"This is a system that is fundamentally designed for human-AI collaboration. Previously, it was believed that the hardest part of formal methods was the verification process itself. Thanks to AI, we have learned to scale it. Now the main question is: what exactly are we verifying? And this process of formalizing requirements remains with humans," explained Google DeepMind researcher and professor at the University of Texas at Austin, Swarat Chaudhuri.
Why this is a breakthrough for the industry
Traditional formal verification of complex software required enormous resources. For example, verification of the seL4 microkernel took 20 person-years, and development of the verified CompCert C compiler took 6 years.
Using AlphaProof Code allowed a team of five people to fully verify the Signal cryptographic protocol in just four weeks.
DeepMind notes that amid the rapid development of cyberattack tools (in particular "offensive AI"), automated code verification is becoming critically important. The company's next step will be to apply this technology at the software design stage as well — not only for cryptography, but also for general software worldwide.