Google DeepMind Uses AI to Verify Key Signal Security Protections

AlphaProof Code could help Google extend its security tools beyond finding flaws to proving that specific software safeguards work.

(For more news, click here)

AI is giving cyberattackers new ways to automate their work. In a September threat report, Google described hackers using AI agents to accelerate operations. That puts pressure on defenders to strengthen software resilience to this new age.

Google DeepMind has reported progress toward that goal. It introduced AlphaProof Code, an AI framework used to mathematically verify important security protections in code implementing the Signal messaging protocol. The work could make a demanding form of security checking more practical.

Stronger evidence that protections work

The advance addresses a gap between designing secure software and proving that its code follows that design. Testing can expose flaws in particular situations. Formal verification goes further by proving that specified protections hold under defined assumptions.

In this project, researchers set the security requirements with AI assistance. Agents then generated proofs, which were checked by Lean, a mathematical proof checker. Human experts remained responsible for reviewing what the system was asked to prove.

Among the checked protections are safeguards for earlier messages if keys are later exposed. Others address restoring security after certain compromises. These guarantees could help limit the damage of a breach, within the conditions covered by the proofs.

According to the technical paper, five researchers worked with agents over four weeks. The agents produced about 6.5 million lines of proof code. The researchers also reintroduced two previously fixed Signal bugs into isolated versions of the code. The system demonstrated that those versions failed its security requirements. This helped test whether the checks could distinguish secure behavior from known failures.

Signal's Chief Technology Officer, Ehren Kret, said in DeepMind's announcement:

“Using AI agents to translate live code into valid Lean theorems is a major breakthrough.”

A broader role for Google's security tools

The result provides a concrete example of Gemini supporting demanding cybersecurity work. It also suggests a potential addition to the company's existing software-defense tools.

Google Cloud introduced a preview of CodeMender in July. That service scans code and helps repair vulnerabilities. Formal verification could complement those capabilities by establishing whether selected protections hold.

The timing connects the research to Google's wider AI strategy. The company made Gemini 4 Carbon broadly available on November 10, highlighting cybersecurity and complex software work among its uses. AlphaProof Code offers a research demonstration of that direction, although it remains separate from a finished commercial verification service.

Competition is also developing. In October, Anthropic and Theorem reported verification work across 123 open-source libraries. Their results focused on crash-related guarantees under specified conditions. DeepMind's work targets messaging security properties, illustrating how AI-assisted verification is expanding across different software problems.

A useful advance with defined limits

The paper does not establish that the entire Signal app is free of vulnerabilities. Its results cover a particular implementation and modeled environment. Group messaging and server protocols remain outside the work, and the proofs do not establish all of the protocol's intended protections against future quantum threats.

Google has published the proofs and specifications for outside scrutiny. The repository states that the release is not an official Google product.

The practical opportunity is to make rigorous security checks easier to repeat as software changes. If that becomes workable at scale, developers could establish stronger safeguards before release. For Google, that would extend AI's value from helping write and repair software to providing evidence that important protections work.