Google DeepMind formally verifies Signal encryption used by WhatsApp

What DeepMind achieved

Google DeepMind has completed a formal verification of the Signal protocol, according to 9to5 Mac, citing reporting by Wired. Formal verification means mathematically proving that a cryptographic protocol meets its security promises in every possible situation, rather than simply testing for known weaknesses.

This is a much stronger guarantee than conventional security testing. Traditional methods look for flaws but cannot promise that none remain. A formal proof rules out entire classes of failure.

The work was carried out with the help of agentic AI, which 9to5 Mac describes as a significant step forward for both cryptography and artificial intelligence. Google built on earlier formal verification work that had already been done without AI.

Why the Signal protocol matters

The Signal protocol has long been regarded as the leading standard for end-to-end encrypted messaging, and Edward Snowden is among its well-known supporters. End-to-end encryption means only the sender and recipient can read a message; not even the messaging provider can.

The protocol is not limited to the Signal app. WhatsApp and Google Messages also use it, so the result covers messaging systems used by billions of people. The DeepMind analysis has been described as a landmark development in the field.

It is worth noting that the verification covers the protocol itself, not the Signal app as a whole. Bugs elsewhere in an app would not be addressed by this proof.

A check against known flaws

The result gains credibility from a test against older versions of Signal that contained known vulnerabilities. According to 9to5 Mac, the analysis flagged those versions as failing formal verification, which suggests the method can detect real weaknesses rather than rubber-stamping code.

DeepMind researchers are careful not to overstate the achievement. Swarat Chaudhuri, a research scientist at DeepMind, told Wired that the team is excited by the result but sees it as one milestone in a longer process.

The analysis took four weeks to complete. Google has not disclosed the scale of computing resources involved, so the cost of repeating the exercise elsewhere is unknown.

Limits and what comes next

The main constraint is practicality. Google told Wired that the technique is extremely computationally demanding, and it is not yet clear how practical it will be to apply more widely.

That means readers should not expect a wave of other protocols to be formally verified in the near future. Chaudhuri said a long distance remains before the approach can scale to all the world's software, adding that the team wants to do exactly that.

Even so, the result matters. It offers mathematical assurance for the encryption protecting everyday messages on Signal, WhatsApp and Google Messages, and it shows AI can help prove, not just test, the security of critical systems.