What Google DeepMind’s AI Found When It Tested Signal’s Encryption

Imagine a team that tests a secure messaging app until every check passes, then ships it. The catch is that tests only prove the situations someone thought to try. DeepMind AI recently went looking for the situations nobody tried in Signal encryption, using a tool called AlphaProof Code and an approach few testing teams ever use. What came back was not a bug report, and that is exactly what makes it worth reading.

Instead, it returned a proof, which matters because you can't inspect the encryption behind your messages. Below, we cover what Google DeepMind tested and what it left untouched. The real takeaway: formal verification gives a different kind of assurance from testing, and its gaps are where testers still matter.

What Is Signal Encryption?

Signal encryption means only the sender and the recipient can read a message, and not even Signal's servers see the content. That is message confidentiality in practice, and it is the core of end-to-end encrypted messaging.

• Core idea: end-to-end encryption means the keys that unlock a message live only on the two devices in the conversation, so nobody in between can read it.
• Purpose: The Signal app is used for private messages, calls, and group chats with secure text messaging, free of advertising and tracking.
• Reputation: Any Signal app review turns on protocol strength, the part this result tests. Among encrypted messaging apps, the best encrypted messaging app and the most secure messaging app depend on your threat model.
• Safety: The protocol earns a reassuring verdict on whether the Signal app is safe, and this result adds evidence for that. Safety on a handset also depends on mobile phone security.

How Signal Uses Public and Private Keys

Think of sending a private note. Your friend hands you an open padlock, their public key, which anyone may hold. You snap it shut on your message, and only their private key can open it. A stranger who intercepts the box learns nothing. That is public key cryptography, also called asymmetric cryptography.

Signal's Protocol builds on this idea, with one twist. Instead of locking each message with a padlock, three parts do the work:

• Shared secret: the two devices use their public and private keys to agree on a secret that nobody else can work out.
• PQXDH: that opening exchange is the handshake DeepMind checked.
• Triple Ratchet: from the shared secret, it keeps generating fresh encryption keys, so a stolen key unlocks only a small slice of the conversation.

How DeepMind Tested Signal

DeepMind researchers tested Signal with proof instead of test cases, splitting the work between people and AI agents across four steps. AlphaProof Code, a multi-agent framework, produced the proofs in Lean, a language that rejects any argument with a gap. The target was libsignal, Signal's cryptographic library, and the Signal cryptographic protocol it implements, including the quantum-resistant cryptography of its PQXDH handshake and Triple Ratchet. This is security verification of Signal's encryption code through mathematical proofs. 

Step 1: Turn Signal's Security Goals Into a Mathematical Specification

Before any proof, the team must say exactly what secure means. Vague goals produce vague proofs, so this step sets the ceiling for everything after it. Testers will recognise it as writing the requirements, except a proof can't tolerate vague ones. The specification covers four properties:

• Forward secrecy: a leaked key cannot unlock old messages.
• Authentication: each side knows who it is talking to.
• Post-compromise security: a hacked device recovers once the attacker is shut out.
• Handshake secrecy: the opening exchange does not leak the shared secret.

Step 2: Review the Specification, Then Let AI Agents Write the Proof

People check the goals before a single proof line exists, because a perfect proof of the wrong specification proves the wrong thing. This is the same logic as reviewing requirements before writing test cases. Only then did AI agents called Gemini Carbon write over 6 million lines of Lean proof code, showing that libsignal matches the specification and reaching down to the compiled machine code. DeepMind's Swarat Chaudhuri says deciding what to verify remains the hard, human part of the work.

• Human job: decide what "secure" means and approve the goals.
• AI job: produce proof at a volume no team could write by hand in four weeks.

Step 3: Check the Proof With Lean, Then Audit the Flagged Parts

The Lean proof assistant checks every line independently and ignores who or what wrote it, so nobody has to trust the AI. Testers can think of it as an automated reviewer that never gets tired and never takes anything on faith. It confirms the proof matches the stated goals, not that the goals cover everything, which is why experts also read the flagged sections themselves.

• Machine check: every proof step is verified, with no gaps allowed.
• Human check: experts review the parts flagged for judgment.

Step 4: Plant Known Bugs to Test the Tool

To test the tool itself, the team re-introduced two real, previously patched bugs into test versions of Signal, and AlphaProof Code flagged both. Testers know this as defect seeding: if a tool can't find bugs you planted, its silence on new ones means little. This is also why the "no new vulnerabilities" result carries weight.

• Setup: two known, already-fixed bugs, added to isolated copies of the code.
• Result: both versions flagged as insecure, with no live code touched.

What DeepMind Found

The result is clean but narrow. DeepMind's AI found no new flaws in the portions it tested, and it caught two planted bugs. Machine-checked proof guarantees only what its specification states, and the full mobile app and the cryptography itself stay outside it.

No New Vulnerabilities

The AI found no new flaws in the portions of the protocol it analysed. Ehren Kret of the Signal Foundation said the result adds confidence in Signal's privacy guarantees. Formal verification does claim the absence of flaws, but only against the stated specification and its assumptions.

• Ruled out: flaws in the verified protocol logic that would break the written security goals.
• Still open: software vulnerabilities outside that frame, such as the full mobile app, goals nobody wrote down, and weaknesses in the cryptography itself.
• Takeaway: strong evidence for the protocol's design, not a clean bill of health for every app built on it.

What the Proof Establishes

Machine-checked proof confirms the code behaves as the specification says. That is formal verification in plain terms: proving behaviour rather than sampling it.

• Limits of the guarantee: the proof holds against the written specification and the assumption of perfect cryptography. Nothing outside those two limits is claimed.
• Independent checking: Lean's checker verifies every step, whoever wrote it.

Caught Known Historical Bugs

The tool flagged both re-added bugs and showed those versions were insecure. That is evidence the method can see real flaws rather than approving everything.

• Test setup: the team re-added two known, already-fixed bugs to an isolated version of the code.
• Trust: a tool that catches bugs we know exist earns more trust when it reports no new ones.
  

Speed vs. Scope

Five people over four weeks is roughly 0.4 person-years. The Register puts the seL4 microkernel at about 20 person-years and the CompCert compiler at six calendar years, so the comparison shows scale rather than a like-for-like speed gain. Those projects verified a kernel and a compiler, while this one covers a protocol library, and the scope is the catch:

The Register describes the work as a step toward verifying the full Signal app, which has not happened yet. Until it does, the last row of that table is where independent testing earns its keep.

Why This Result Matters

Recent Google DeepMind news shows AI in cybersecurity moving from spotting threats to proving code correct, which is where cybersecurity AI tools are heading. Software security needs checkable evidence, and four points show why this result matters:

• WhatsApp, Messenger and Google Messages use the Signal protocol, so the verified design matters to billions of users, although each app's own implementation sits outside the proof.
• DeepMind's Swarat Chaudhuri says offensive AI capabilities are rising, so verification technology should be applied to code broadly.
• Banks and other companies may be able to use the same method to prove their own code works as intended.
• Humans still set the goals and review the work, so AI assists security experts and doesn't replace them.

How Frugal Testing Helps You Secure Your Apps and Messaging

Consider a hypothetical team shipping a mobile app on a flawless, verified protocol. Then a tester changes one ID in an API request and reads another customer's data. The protocol held, but the product did not. DeepMind's work checks a protocol's design, not the app, APIs, mobile builds, and integrations around it.

That is where penetration testing earns its place. Our security testing covers the layers around the protocol, combining penetration testing services, vulnerability scanning and fuzzing with DevSecOps practices such as security checks on every commit.

What Our Security Testing Looks Like

• Scoping and threat modelling: We agree on scope, including any cloud security consulting needs, then map where data enters, moves, and rests, including your mobile app security exposure and mobile data security risks.
• Penetration testing: Manual attacks backed by penetration testing tools, covering vulnerability assessment and penetration testing. See our penetration testing guide.
• Automated and pipeline checks: Vulnerability scanning tools, static application security testing, and dynamic application security testing run on every build. Fuzzing sends malformed input to APIs and mobile builds to see what breaks, as our fuzzing guide explains.
• Web, API and mobile testing: Web application security testing and API checks, with our API security testing guide for details. For a mobile security app, we test data storage, network calls, and permissions on real devices.
• Findings report and ownership: Prioritised issues with reproduction steps and fixes, plus a security audit view of risk. You own the report, the evidence and the retest path.

Conclusion

DeepMind's AI found no new flaws in the tested parts of Signal, proved the code works as intended, and caught two known bugs. It covered only part of the app and assumed perfect cryptography, so the result is strong evidence, not a guarantee.

Signal encryption now has stronger evidence behind it than most software ever gets. The harder question is how much of your own software could say the same, and who has checked. A protocol proof and application security testing answer different questions, so strong teams use both.

People Also Ask (FAQs)

Q1. What is the Beneficial AI Foundation challenge?

Ans: The Beneficial AI Foundation set a challenge to verify the full Signal app. DeepMind's proof is a step toward it, but the full app is not yet verified.

Q2. How does Signal compare with Telegram and WhatsApp?

Ans: Signal and WhatsApp both use the Signal protocol for end-to-end encryption by default. Telegram's regular chats are not end-to-end encrypted by default; only its Secret Chats are. 

Q3. How does Signal protect against quantum computers?

Ans: Signal has been upgrading against future quantum threats. Its PQXDH handshake adds quantum-resistant cryptography to the Signal cryptographic protocol, alongside elliptic curve cryptography, so each backs up the other.

Q4. How can others check DeepMind's Signal proof?

Ans: DeepMind has made the Lean code and a research paper available, so others can inspect the mathematical proofs and the security verification method for themselves.

Q5. What role will AI play next to human security testers?

Ans: People set the goals and audit flagged parts, so AI assists security experts rather than replacing them. Cybersecurity AI tools speed up the work, while humans own judgement.