DeepMind verified part of Signal’s cryptographic code in a month using AI

Your tests pass, code review finds no issues, yet you still lack confidence in critical code. This is especially troubling in cryptography: a rare combination of conditions can matter more than a thousand successful test runs. According to ZDNET, Google DeepMind applied AlphaProof Code to part of Signal’s cryptographic code and completed the verification in a month. The practical appeal lies in the attempt to reduce the manual work involved in constructing mathematical proofs.

The scope of the result needs to be clear from the outset: the report does not establish that the researchers proved the security of the entire messaging app. The work concerns specific parts of the implementation and properties the team chose to verify. For developers, that is a fundamental distinction: a proof answers a specific question about a program; it does not provide a universal certificate of reliability.

What mathematical verification checks

Imagine a function that updates cryptographic state after processing a message. A conventional test passes it selected data and compares the result with the expected output. You can add random inputs, boundary values, and long sequences of calls. But each run still checks a particular scenario.

Formal verification starts by specifying a precise requirement for the function’s behavior. The next step is to prove that the code satisfies it in every case covered by the specified model. A hypothetical example: an operation must preserve a particular relationship between the old and new states. This illustrates the method; it does not describe a specific property proved by the DeepMind team.

The most expensive part of this work often begins before the proof itself. You need to decide exactly what the program promises, which assumptions are acceptable, and where the scope of verification ends. If a requirement is incorrect or incomplete, even a valid proof will not answer the real question about the product’s security.

How humans and agents divided the work

According to ZDNET’s account, the researchers built on earlier work by the Signal Foundation. Humans worked with agents to determine which claims needed to be proved. Several agents then constructed proofs; separately, the system helped check the results and flagged areas requiring human attention.

The publication reports that about 1% of the codebase was flagged for another manual review. That figure needs careful interpretation: the text does not make clear how the denominator was defined or exactly what counted as a verified section. It does not mean that AI independently confirmed the security of the other 99% of the entire Signal application.

Another reported result involved work with two previously fixed Signal bugs. Such checks are useful: a tool should distinguish a correct implementation from a defective one. However, a brief account is not enough to reconstruct the experiment, understand its conditions, or assess which classes of bugs the system can actually detect.

The one-month timeline also needs context. ZDNET compares it with work that could have taken experts years, but provides no comparable project, computational costs, or detailed accounting of human labor. It is therefore too early to promise teams the same speedup.

What developers and product managers should do

If the approach is validated by publicly available materials, it will be particularly interesting for small modules where errors are costly and requirements can be specified precisely. You can start with a single function and describe its valid inputs, expected properties, and dependencies. That will make it clearer whether there is a formal verification problem to solve and what result the team can accept.

Product managers should define the limits of the promise to users in advance. A proved property of a cryptographic module says nothing automatically about device protection, the interface, backups, or the correctness of updates. Those issues require their own checks.

According to the report, DeepMind plans to release AlphaProof Code as open source. Assessing the tool’s suitability will require the repository itself, specifications, checkable proofs, and a description of its limitations. For now, this is a substantive example of AI applied to an engineering problem: agents can help prepare proofs, but humans remain responsible for the quality of the requirements and the scope of the result.