AI tool validates security of Signal protocol in rapid test

Formal verification, a process that uses mathematical methods to ensure software functions as intended and is free of critical vulnerabilities, is considered a key goal in software security. Traditionally, this process has been time-consuming, but agentic AI has the potential to significantly accelerate it.

The DeepMind analysis did not uncover new vulnerabilities in the examined portions of the Signal protocol. However, when applied to older versions containing known vulnerabilities, the AI correctly identified them, confirming the protocol’s inability to be formally verified in those instances. The specification and proof developed for this analysis are being released to support further formal verification efforts.

“We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that,” stated Swarat Chaudhuri, a DeepMind research scientist. The project benefited from prior formal verification work conducted by the Signal Foundation.

Ehren Kret, Signal’s chief technology officer, noted, “While prior formal verification focused on smaller portions of the code, Google DeepMind’s approach enables significant expansion.” Pushmeet Kohli, chief scientist at Google Cloud and DeepMind’s vice president of research, envisions a future where companies can “prove these properties” for critical software.

The scalability and cost-effectiveness of AI-automated formal verification remain open questions. DeepMind conducted the analysis as a research project, and Google has not disclosed the cost or plans for a commercial product. The team emphasized a collaborative approach between humans and AI, ensuring human oversight and goal setting. “We don’t want this sort of vibe world where AI is generating the goals and AI is generating the proofs and basically taking tests that are self-written,” Chaudhuri explained.