Google used artificial intelligence (AI) to analyze and verify the security properties of Signal, one of the best-known messaging apps for its privacy features. The work was conducted by Google DeepMind, the company’s AI research division, and used mathematical proofs to examine parts of the messenger’s code.
The analysis used AlphaProof Code, a system developed to work with formal proofs. For approximately four weeks, the tool examined Signal’s code and helped researchers verify whether certain security properties were mathematically valid.
The initiative represents an application of AI that goes beyond generating text, images, and programs: the technology can also help identify flaws and formally check whether computer systems follow established rules.
How did AI verify Signal’s security?
- The work used the Lean programming language, which is used to construct formal mathematical proofs. In this environment, a security property can be described mathematically and submitted to a verifier capable of checking whether the proof is correct;
- Unlike conventional analysis, which looks for potential vulnerabilities through testing and inspections, formal verification makes it possible to demonstrate that certain properties are satisfied under specific conditions and assumptions;
- During the work, the researchers also used versions of the code with old vulnerabilities deliberately introduced. The idea was to assess whether the system could identify known problems and verify the established security properties;
- The process lasted about four weeks and involved the analysis of application components.
The work was conducted by Google DeepMind, Google’s AI research division – Image: Poetra.RH/Shutterstock
Read more:
- Google launches AI chips to protect data and expand memory
- Google sued over conversations about suicide between AI and 13-year-old girl
- Google, Meta and TikTok sue California to block child protection law
What does the discovery mean for digital security?
Formal verification can help developers find problems that would go unnoticed in traditional reviews. It also makes it possible to increase confidence in important software components used to protect personal information.
In the case of Signal, the work is particularly relevant because privacy is one of the app’s main pillars.The messenger uses end-to-end encryption to protect conversations, preventing third parties from accessing the content of messages during transmission.
Still, it is important to understand the scope of the research: mathematically verifying certain properties of the code does not mean proving that the entire application is free of vulnerabilities.
Problems in other components, implementation flaws, or attacks on users’ own devices remain possibilities.
Google’s initiative shows how AI systems can help make software more secure by assisting specialists in analyzing complex code and constructing mathematical proofs that support its security guarantees.
Rodrigo Mozelli is a journalist graduated from São Paulo Methodist University (UMESP) and is currently a writer at Olhar Digital.
