Google DeepMind open-sources artifacts from its four-week Signal verification

Top News · 600 HN points

Google DeepMind's AlphaProof Code proved key security properties in the actual compiled code underlying Signal's cryptographic protocol. Google DeepMind says the verification took four weeks, versus years for similar work by expert teams.

Here is what makes this credible:

• Humans and models help define formal specifications, then agents powered by Gemini Carbon generate Lean proofs.
• Lean checks the proofs, while agents audit them and flag areas for human attention. The reported human review covered one percent of the codebase.
• Researchers reintroduced two previously fixed bugs into an isolated Signal version, and the system proved both buggy versions insecure.
• Google DeepMind is open-sourcing the formal verification artifacts and has linked a technical paper.

One catch: Scaling these techniques remains ongoing research. This result does not establish that the framework is broadly ready for other systems.

Sources: deepmind.google