DeepMind Used AI to Mathematically Prove the Signal Protocol Is Secure

In an operation that took just four weeks — against months or years of equivalent human effort — Google DeepMind researchers used an agentic AI system to formally verify the fundamental cryptographic guarantees of the Signal protocol, the same standard that secures billions of daily messages across applications like Signal, WhatsApp, and Google Messages. The result: no new vulnerabilities were found in the sections analyzed, and the work marks an inflection point at the intersection of artificial intelligence and software security.

The project used AlphaProof Code, DeepMind's latest agentic AI framework, in a proof-of-concept project conducted entirely at zero cost to the security community. Google declined to disclose the cost of the analysis or to comment on whether it plans to launch a commercial formal verification product based on the work.

What formal verification is and why it matters

Formal verification has been the holy grail of software security for decades. Unlike traditional testing, which checks whether software works for specific inputs, formal verification uses mathematical proofs to demonstrate that software behaves exactly as specified — under every possible circumstance. It is, in the words of the field's advocates, the only way to know with absolute certainty that a piece of code does not contain critical vulnerabilities.

For cryptographic protocols like Signal, this is especially relevant. The Double Ratchet protocol, Signal's core component, is responsible for establishing and rotating encryption keys that protect every conversation. Before the AI era, it was incredibly time-consuming for researchers to describe the desired properties of software, translate them into mathematical formulas, and then develop proofs. It was a task that required weeks or months of specialized work by formal verification teams.

DeepMind's AlphaProof Code automated this process. The system managed, in four weeks, to elaborate and validate mathematical proofs for several security properties of the protocol — including authentication and secrecy of the core components.

The fire test

What makes the work particularly convincing is not just the speed of its execution, but the fire test the researchers applied to the system. When the researchers ran AlphaProof Code on older versions of Signal containing long-fixed known vulnerabilities, the system correctly identified them and showed that the protocol in that version could not be formally verified. This demonstrates that the framework does not just produce proofs, but also detects genuine flaws when they exist — the kind of behavior that separates a serious analysis tool from a superficial results generator.

It is the same principle that validated DeepMind's AlphaFold in 2020: if a system cannot detect known defects, you cannot trust its ability to confirm the correctness of defect-free versions. AlphaProof Code passed that test.

Expanding the scope of verification

DeepMind's work did not happen in a vacuum. It built on prior formal verification conducted by the Signal Foundation, which had already analyzed smaller parts of the protocol. Ehren Kret, Signal's CTO, noted that while prior verification focused on smaller code fragments, DeepMind's approach allows for "significant expansion" in what can be verified.

"As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code's privacy guarantees," Kret said in a statement.

The DeepMind team published the specification and proofs they created for Signal protocol analysis, making them available for other research groups to build upon. It is a practice that aligns with the open-source culture of the cryptographic security community.

What was not verified — and why it matters

It is crucial to note what the project did not do. DeepMind's analysis did not verify the complete Signal protocol implementation or the Signal application itself. It covered only selected sections of the protocol, focusing on specific cryptographic properties. The researchers are transparent about this limitation.

Furthermore, independent academic work published in September 2026 in the Proceedings of the IEEE Symposium on Security and Privacy presented the first complete formal analysis of the Double Ratchet covering all its functionalities, including out-of-order message arrivals — something the DeepMind project did not address in depth. That analysis, conducted by researchers at the University of Oxford and Université de Lorraine, discovered three attacks on the protocol, two of which were confirmed present in the main implementation. This work shows both how much remains to be verified and the importance of complementary approaches to AI-assisted formal verification.

Another project, presented at the ACM CCS 2026 conference, developed SpecMon, a runtime monitor that instrumented WhatsApp Web and Signal Desktop to capture network and cryptographic interactions, verifying whether observed executions conform to formal protocol models — an approach that complements DeepMind's static verification with dynamic monitoring.

The cost and scale question

The most important open question about the work is not technical — it is economic. DeepMind conducted the Signal analysis as a research project, free of charge. Google declined to disclose how much the project cost and also declined to comment on whether it has plans to launch a commercial formal verification product or service.

The question that permeates the sector is whether AI-automated formal verification can truly scale to complete software systems — not just protocol sections, but entire applications and software supply chains — at a cost that makes commercial sense.

For everyday users, the meaning is clear: messages protected by end-to-end encryption gain an additional layer of mathematical assurance. For companies that rely on encrypted communication — banks, healthcare providers, journalists — the technology could, one day, offer legally verifiable guarantees that the software used contains no critical flaws.

For DeepMind, the work is one more step in expanding AlphaProof Code's capabilities toward the company's declared ambition: to formally verify all software. The Signal protocol was the first real target. The next will likely be even more ambitious — and harder.

Sources: WIRED, AI Understanding, Atlabyte

✓ Independent sources cross-checked and verified before publishing