Google DeepMind uses AlphaProof Code to formally verify parts of Signal protocol
Google DeepMind researchers say its AI framework AlphaProof Code mathematically verified key parts of the Signal protocol in about four weeks. The team plans to release its code, specification and proof openly.
1 / 1
The story, neutrally told
Mixed · 2Google DeepMind researchers used an agentic AI framework called AlphaProof Code to formally verify, meaning mathematically prove, parts of the Signal messaging protocol's code. ZDNETN “Researchers at Google DeepMind used AI to formally verify portions of Signal‘s underlying code” Read at ZDNET ↗ Ars TechnicaLC “Google DeepMind researchers used agentic AI to mathematically prove, or “formally verify,” a number of the Signal protocol’s key cryptographic guarantees” Read at Ars Technica ↗ Mixed · 2The work took about four weeks and was run as a proof-of-concept research project; ZDNET says it covered what might normally take experts years. Ars TechnicaLC “Conducted as a sort of proof-of-concept project in just four weeks” Read at Ars Technica ↗ ZDNETN “The DeepMind team’s verification took a month to do what might normally take experts years.” Read at ZDNET ↗ Mixed · 2Signal's cryptography also underpins WhatsApp and Google Messages, so the result bears on the protection of a large share of the world's messaging. ZDNETN “WhatsApp and Google Messages use the same encryption.” Read at ZDNET ↗ Ars TechnicaLC “the cryptography that protects massive quantities of the world’s communications on platforms like the Signal app, Google Messages, and WhatsApp” Read at Ars Technica ↗
Centre · 1Humans and AI agents worked together: people identified what needed to be proved, and multiple agents running Gemini Carbon, Google's latest model, carried out the proofs and flagged about 1% of the codebase for human review, according to the researchers quoted by ZDNET. ZDNETN “multiple agents running Gemini Carbon, the company’s latest model, then executed it”“highlighted areas that needed a second look by a human — just 1% of the codebase, a massive time savings” Read at ZDNET ↗ Mixed · 2The project built on earlier formal verification work by the Signal Foundation, which gave DeepMind a head start. Ars TechnicaLC “they were able to get a head start to a degree because of some past formal verification work that the Signal Foundation has conducted” Read at Ars Technica ↗ ZDNETN “building on earlier verification work by the Signal Foundation” Read at ZDNET ↗ Mixed · 2The analysis did not find new vulnerabilities in the portions examined. When run on older Signal versions with known, long-fixed flaws, AlphaProof Code correctly identified them and showed the protocol could not be verified. Ars TechnicaLC “The DeepMind analysis did not find any new vulnerabilities in the portions of the Signal protocol it looked at” Read at Ars Technica ↗ ZDNETN “showing it two previously fixed Signal bugs, for which it produced correct proofs” Read at ZDNET ↗
Mixed · 2The scope was limited: DeepMind did not verify all of Signal's code, and Ars Technica, carrying a WIRED story, notes it did not cover the entire Signal mobile app. ZDNETN “DeepMind did not verify all of Signal’s code” Read at ZDNET ↗ Ars TechnicaLC “it did not, for example, formally verify the entire Signal mobile app” Read at Ars Technica ↗ Centre · 1The researchers claim it is the first time AI has formally verified a widely deployed cryptographic protocol at this depth, and the first time such a protocol's implementation has been formally verified by any method. ZDNETN “Our work marks the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth” Read at ZDNET ↗ Mixed · 2DeepMind is releasing the specification and proof it developed, and open-sourcing its code, to aid other formal verification work. Ars TechnicaLC “The researchers are releasing the specification and proof they developed for the Signal protocol analysis to aid other formal verification work.” Read at Ars Technica ↗ ZDNETN “the researchers are open-sourcing their code to help others with formal verification efforts” Read at ZDNET ↗
Left · 1Signal chief technology officer Ehren Kret said the approach enables significant expansion over prior verification of smaller portions and gives greater confidence in Signal's privacy guarantees. Ars TechnicaLC “While prior formal verification focused on smaller portions of the code, Google DeepMind’s approach enables significant expansion” Read at Ars Technica ↗ Left · 1DeepMind research scientist Swarat Chaudhuri said there is a long way to go before scaling this to all the world's software, and Pushmeet Kohli, DeepMind's vice president of research, suggested banks and others could use such proofs. Ars TechnicaLC “there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that”“You can imagine banks, imagine all those other companies who rely on assurances and who worry about bugs” Read at Ars Technica ↗ Mixed · 2Open questions remain about whether AI-automated formal verification can scale and at what cost; Google declined to share the cost or say whether it plans a commercial product, and ZDNET says DeepMind shared no plans for a consumer product. Ars TechnicaLC “Google declined to share the cost of the analysis. The company also declined to comment on whether it has plans to release a commercial formal verification product or service.” Read at Ars Technica ↗ ZDNETN “DeepMind did not share any plans to release its findings as a consumer product” Read at ZDNET ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left1 outlet
- Framing
- Ars Technica, running a WIRED story, treats it as a landmark proof of concept while stressing uncertainty over whether AI formal verification can scale and at what cost.
- Emphasis
- Scalability and cost questions, limited scope, human-AI collaboration, and quotes from DeepMind and Signal officials.
- Leaves out or plays down
- Does not mention the Gemini Carbon model or the 1% of code flagged for human review.
- Charged language
- “holy grail”“vibe world”
- For example
-
“it is unclear how practical it will be for widespread use and how effective it can be at securing large amounts of code” — Ars Technica
Centre1 outlet
- Framing
- ZDNET presents it as reassuring news that AI proved Signal encryption works, placing it in the context of AI as both a security risk and a fix.
- Emphasis
- The speed gain, the 1% flagged for human review, the 'first time' claims, and the open-sourcing.
- Leaves out or plays down
- Gives less on cost and scaling doubts, and has no outside comment from Signal or independent experts.
- Charged language
- “distant promised land”“breakthrough”“really works”
- For example
-
“That labor-intensive barrier has made formal verification a distant promised land, until now.” — ZDNET
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- DeepMind used AlphaProof Code to formally verify parts of the Signal protocol.
- The verification was partial, not of all Signal code.
- It built on earlier Signal Foundation verification work.
- DeepMind is releasing its code, specification and proof for others to use.
Google DeepMind organisation
Presents the work as a milestone in AI-assisted formal verification with human oversight, while acknowledging a long way to go before scaling to all software.
“there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that” — Ars Technica
“is the highest standard of security assurance” — ZDNET
Signal product
Signal's CTO says the verification expands on earlier work and increases confidence in its privacy guarantees.
“rigorously verifying the Signal protocol implementation gives us even greater confidence in our code’s privacy guarantees” — Ars Technica
Google organisation
Google declined to share the cost of the analysis or say whether it will offer a commercial verification product.
“Google declined to share the cost of the analysis.” — Ars Technica
Left1 article
-
Google DeepMind just mathematically verified key parts of Signal
Mixed Calls the work a landmark but balances it with caveats on scope, scalability and cost.
Centre1 article
-
ZDNETN ·
Google’s new AI tool just proved Signal encryption really works – here’s how
Celebratory Frames the result as a breakthrough that reassures users about Signal and shows AI as a security fix.
Right0 articles
No coverage yet.
- 10 Nov 16:31 First ZDNETN Google’s new AI tool just proved Signal encryption really works – here’s how
- 11 Nov 14:08 +21h 37m Ars TechnicaLC Google DeepMind just mathematically verified key parts of Signal
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…