Is Signal secure? DeepMind’s math check says yes, with limits

DeepMind proved that selected security promises in Signal’s encryption design hold up under formal verification. That term means using math, checked by software, to show a program does exactly what its designers claim. People first write down the properties they want to guarantee, turn them into formulas, then build a proof that a separate checker accepts or rejects. One wrong step and the proof fails.

The team ran the project as a proof of concept and finished it in four weeks. It focused on the Signal protocol, the encryption design that protects chats in the Signal app and, in modified form, in WhatsApp and Google Messages. That reach is why the result matters beyond one app: it adds independent backing for protections that cover a huge share of the world’s private messages.

The most convincing part was a deliberate stress test. The researchers aimed AlphaProof Code at older versions of Signal that contained known security bugs, all fixed long ago. The tool spotted those flaws and showed the older protocol could not be formally verified. In plain terms, the checker isn’t a rubber stamp. It fails broken designs.

DeepMind is releasing the specification and the proof it built, so other researchers can inspect and reuse them. The work was done free of charge as research. Google declined to say what it cost or whether it plans to sell formal verification as a product or service.

Signal’s protocol now has a proof behind it in the areas DeepMind checked, which is narrower than saying the Signal app is proven safe. The researchers did not formally verify the entire Signal mobile app, and they call the result one milestone in a longer process.

A proof is also only as strong as the written specification and the assumptions behind it. So “Signal is proven secure” is really shorthand for “these stated properties hold under these stated conditions.” The work checked chosen guarantees, not every part of the app or every way an account or phone can be attacked.

Nobody expected the design to fall apart. Academic studies, including a 2017 Oxford analysis of the double ratchet (a core piece of how Signal encrypts conversations), found no major flaws. The harder thing to show has always been that the software installed on real phones faithfully follows that published design.

DeepMind had a head start there, thanks to earlier formal verification work by the Signal Foundation. According to Ehren Kret, who runs technology at Signal as its CTO, those past checks looked at limited slices of the code, while DeepMind’s method “enables significant expansion.” A separate effort called Signal Shot, run by the Beneficial AI Foundation (the group Max Tegmark co-founded) together with the Lean FRO and Signal, is working to verify both the protocol and its Rust implementation, meaning the actual code.

The serious attacks on Signal users have gone around the encryption, not through it. When Dutch intelligence agencies warned that Russian state-backed hackers were going after officials, journalists and military staff on Signal and WhatsApp, Signal replied that its encryption and infrastructure had not been compromised. The attackers had tricked people into giving up their SMS verification codes or their Signal PIN.

Two tricks stand out:

• Fake support messages. A message pretending to be a Signal security chatbot claims there’s suspicious activity on your account and asks you to pass on a verification code. Once an attacker has that code plus your PIN, they can register your account on their own phone and even switch it to a phone number they control.
• Booby-trapped QR codes. Signal lets you connect a computer or tablet by scanning a QR code. Attackers dress up a device-linking code as a group invite or as pairing instructions, so the victim ends up connecting the attacker’s device. Google’s threat researchers described this as the most common and most inventive trick in Russian-aligned attempts on Signal accounts.

The linked-device trick is the sneakier one. You keep using your account as normal while someone else reads along, so it can go unnoticed for a long time. The takeover has its own trap: because Signal keeps chat history on the phone, a victim who signs up again with the same number gets old messages back and may assume all is fine. Dutch officials warned that this assumption could be wrong.

Google’s researchers also saw groups hunting for Signal’s message database files on Android phones and Windows PCs with malware and scripts. That kind of attack targets the files sitting on a device, not the encryption DeepMind checked.

On encryption design, Signal, WhatsApp and Google Messages are closer than many people think, because the Signal protocol underpins encryption in all three, with changes in the other two. So the new proof adds confidence in protections WhatsApp and Google Messages users rely on as well.

A shared protocol is not the same thing as identical apps, though. The DeepMind work does not show that any of these apps is secure end to end. And the spy campaigns described above hit both Signal and WhatsApp through the same kind of linked-device feature, which shows the weak point is often the account, not the cipher.

The proof is good news, but your own habits decide whether someone gets into your chats. These steps come straight from the advice of Google’s threat researchers and Dutch intelligence officials:

1. Keep Signal updated. The latest versions include improved protections against the phishing tricks Google observed.
2. Never share your SMS code or Signal PIN. Signal’s code messages already warn you not to give them to anyone, Signal staff included.
3. Check your linked devices regularly and remove any computer or tablet you don’t recognize right away.
4. Ignore unexpected QR codes, links and group invites unless you’ve confirmed them with the sender through another channel you trust.
5. Lock your phone with a long, complex password and turn on two-factor authentication.

Dutch officials go one step further for government staff: don’t share sensitive or classified information through messaging apps at all unless it’s been approved.

The big question is whether AI-driven formal verification can scale beyond a small, well-studied target like Signal at a cost that makes sense. Supporters have long called formal verification a kind of holy grail in software security, but it was painfully slow when people had to describe the software, write the formulas and build every proof by hand. AI can shrink the proof-building part.

DeepMind research scientist Swarat Chaudhuri said there is still “a long distance to go” before the approach can cover all the world’s software. The team says a key advance was its working process: AI agents contribute and fix their own mistakes at almost every stage, while people set the goals and review key steps. Chaudhuri said they don’t want AI writing both the goals and the proofs, calling their approach “a middle ground.”

Pushmeet Kohli, DeepMind’s vice president of research, pictured banks and other bug-wary companies being able to prove properties of their own code. Signal’s protocol, though, is small, heavily studied and publicly documented, close to a best-case target. Most commercial software is bigger and messier, with no clean specification to prove against, so watch whether the method shows up beyond research projects.