Google DeepMind Uses AI to Verify Signal Encryption, Bringing Unhackable Software Closer to Reality

Google DeepMind has taken an important step toward making software more secure by using artificial intelligence to mathematically verify the code behind Signal’s encryption system. The research demonstrates how AI could help developers identify security weaknesses and prove that critical software components behave as intended.

The breakthrough is particularly significant because Signal’s encryption protects the private communications of millions of people worldwide. By applying AI-powered mathematical verification, researchers were able to examine the underlying code in extraordinary detail, a process that would traditionally require substantial time and human expertise.

The technology could eventually change how cybersecurity teams approach software protection. Instead of relying primarily on finding vulnerabilities after they appear, developers may be able to mathematically demonstrate that certain categories of security flaws cannot occur.

Swarat Chaudhuri, a research scientist at Google DeepMind, believes this approach could bring the industry closer to a future of software that is extremely difficult to compromise.

“You can finally get to this world of unhackable software,” Chaudhuri said.

Google DeepMind Uses Gemini AI to Verify Signal’s Encryption Security

Google DeepMind researchers revealed that they used AI agents powered by the Gemini 4 Carbon model to mathematically verify the security of the code supporting Signal’s encryption.

The project involved generating more than 3 million lines of mathematical proofs. These proofs allowed researchers to examine whether the software followed its intended security properties, providing a level of verification that would have been difficult and time-consuming to achieve through conventional methods alone.

To evaluate the system, the researchers deliberately reintroduced two vulnerabilities that had previously been discovered and fixed in Signal’s code.

The AI-powered framework successfully identified the security implications of both changes by generating mathematical proofs demonstrating that the modified software was no longer secure.

This is an important distinction. Rather than simply flagging suspicious code, the system produced formal mathematical evidence showing how the altered implementation failed to meet its security requirements.

The experiment highlights the potential of AI-assisted formal verification, an approach that uses mathematical reasoning to establish whether software behaves according to precisely defined specifications.

AI Completes Software Security Verification in Just Four Weeks

One of the most interesting aspects of the research is how quickly the AI system completed the verification work.

According to Chaudhuri, the team accomplished the task in approximately four weeks. Achieving a comparable result using human researchers alone could potentially have taken several years.

Formal verification has traditionally been a demanding process. Developers and security researchers must define the properties a program should satisfy, examine its implementation and construct mathematical proofs that establish whether those requirements are met.

For complex software systems, this can involve enormous amounts of detailed work.

AI agents could help accelerate the process by handling parts of the proof-generation and verification workflow. In this experiment, the ability to produce millions of lines of mathematical proofs demonstrated how AI could make sophisticated software analysis more practical.

However, the real significance goes beyond completing one research project faster. If these capabilities can be extended to other software systems, developers could use them to strengthen security throughout the development process.

Why Mathematically Verified Software Could Change Cybersecurity

Many cybersecurity vulnerabilities occur because software behaves differently from what its developers intended.

Even a relatively small programming mistake can create an opportunity for attackers to access sensitive information, execute unauthorized operations or compromise an entire system.

Traditional security testing helps identify these weaknesses, but testing cannot always establish that every possible execution path is safe.

Formal verification offers a different approach. Instead of relying only on testing and vulnerability detection, it uses mathematical proofs to establish that specific security properties hold under defined assumptions.

Google DeepMind’s research suggests that AI could make this technique more accessible and efficient.

One particularly important application is memory safety.

Memory safety vulnerabilities occur when software handles computer memory incorrectly. Examples include accessing memory outside permitted boundaries or using memory after it has already been released. Attackers frequently exploit these weaknesses to execute malicious code, gain unauthorized access or disrupt applications.

AI-assisted mathematical verification could eventually help developers prove that their software is protected against certain types of memory safety problems.

This would not automatically eliminate every cybersecurity threat, but it could reduce the number of vulnerabilities caused by specific programming errors.

The broader goal is to shift cybersecurity from constantly reacting to newly discovered bugs toward building software with formally verified security guarantees.

Google DeepMind Plans to Bring AI Verification into Software Development

Google DeepMind is also exploring how this research could be integrated into AI coding agents and everyday software development workflows.

The idea is to make mathematical verification part of the development process rather than treating it as a separate activity performed only after software has been written.

If successful, developers could potentially use AI agents to examine code, identify weaknesses and generate mathematical proofs supporting important security protections as applications are built and updated.

Chaudhuri also indicated that the research team is investigating ways to combine this technology with Google’s existing cybersecurity initiatives.

Two projects receiving attention include:

• Project Zero: Google’s security research team, known for investigating vulnerabilities in widely used software and technologies.
• CodeMender: Google’s AI-powered initiative focused on identifying and fixing software security vulnerabilities.

Combining formal verification with automated vulnerability discovery and patching could make software security workflows more effective. Developers would not only have tools to locate and repair weaknesses but could also use mathematical methods to verify that specific fixes satisfy their intended security requirements.

However, these possibilities are still being explored. The latest research remains an experimental project rather than a commercially available cybersecurity product.

Can AI Really Make Software Unhackable?

Google DeepMind’s research represents an important development in AI-powered cybersecurity, but the idea of completely unhackable software still requires some perspective.

Mathematical verification can provide strong guarantees about specific properties of a program, provided the underlying specifications and assumptions are correct. It does not automatically prove that an entire application, operating system or connected infrastructure is immune to every possible attack.

Security also depends on factors beyond source code, including hardware, configuration, user behaviour, third-party components and the broader computing environment.

Nevertheless, the ability to use AI to accelerate formal verification could make a meaningful difference.

If developers can verify critical software components more efficiently, they may be able to prevent entire categories of vulnerabilities before applications reach users.

For now, Google DeepMind’s work demonstrates what could become possible when advanced AI systems are combined with mathematical reasoning and software security research.

The next important step will be determining how reliably these techniques can scale across real-world software projects and become part of everyday development practices.