DeepMind presents AlphaProof Code

Google DeepMind says its AlphaProof Code framework helped formally verify key security properties in the code behind Signal’s protocol. The work goes beyond checking the protocol’s design. Researchers specified what the code should protect, then AI agents generated mathematical proofs that the compiled implementation meets those specifications. The proofs were checked by Lean, a tool that checks mathematical proofs.

DeepMind says the agents produced more than six million lines of Lean and flagged about one percent of the codebase for human review. The team says the process took four weeks, compared with years for work of this kind in the past. It also tested the system by putting two previously fixed bugs back into an isolated version of the code. In both cases, it produced a proof that the buggy version was insecure. These are results reported by DeepMind, not a guarantee that every part of Signal, or other software, is free of flaws. DeepMind’s report says it is open-sourcing the verification artifacts.

For a business, the important point is the gap between a system’s security design and the code that actually runs. Finding a way to check that code against precise security requirements could help teams examine critical software more deeply, though DeepMind says scaling the approach still needs research. Businesses could consider where this kind of work might fit in their own software assurance efforts.