The DEF CON talk with Bruce Schneier, Heather Adkins @argvee Google VP Sec and me has been posted. A bit dated at 3 months ago but good discussion of Scaling Laws, predictions of Black October+, open weights, and why we can be optimistic about security. youtu.be/8ewe-9hf-tA?is…View quoted post on X
Announcing a major milestone achieved by my team @GoogleDeepMind: we have proven key security properties of the machine code underlying the Signal messaging protocol. This is the first time the actual production code of a widely deployed protocol has been formally verified – by any method, with or without AI – and at this depth.
More than a research breakthrough, it’s a prime example of how frontier AI can be a force multiplier to counter the speed and scale of modern cyber threats.
Formal verification offers a higher standard of security; however, it’s extremely complex and time consuming, which is why in many cases it’s considered to be impractical. Similar efforts could take teams decades of combined effort. We did it in a month’s time.
Using AlphaProof Code, Google DeepMind's new agentic framework for formal verification that runs on LLMs including Gemini Carbon, we verified the Signal protocol down to the actual code running on devices. This milestone lays the groundwork for a future in which vital systems, from medical device firmware to power grid software, ship with mathematical proof that their protections work.
Reaching that future will take continued research from our community. In that spirit, we're open-sourcing our formal specifications and verification artifacts so others can build on this work.
On a personal note, this moment is of deep significance to me. I started my own research journey more than two decades ago as an intern working on checking the consistency of complex software systems. Seeing this grand challenge made practical with modern AI is extraordinary.
I'm extremely proud of my team members: Swarat Chaudhuri, Andrew Ferraiuolo, Anton Kovsharov, Tej Chajed, Sam Schlesinger, Karn Seth, Jonathan Katz, and Charles Sutton for taking on this grand challenge and delivering, and grateful to the Signal team for their partnership.
deepmind.google/blog/formal-ve…View quoted post on X
if you’re working for a company in cybersecurity, you should be evaluating your options to abstract your companies services from the internetView quoted post on X
what i mean is: why allow an unauthenticated anonymous agent of an attacker to interact with your systems?
consider your architectural levers now, you’re going to need them
blog.google Going Beyond Zero: A New Paradigm For Enterprise Security Learn about Beyond Zero, Google's new risk-based enterprise security paradigm designed for the AI era. Calif CEO @XorNinja says cybersecurity has no playbook for stopping 1,000 AI agents attacking a network simultaneously, even if defenders can detect them:
"Attackers always adapt faster and earlier than defenders. Even the AI companies themselves don't have great security."
"Imagine you enter a cage fight, but you are blindfolded and the other guy stay in the dark, and every once in a while they would come out and punch you and then disappear."
"How could you win that fight?"
"I was at Google and that's basically the mantra at Google. In security you have three things: prevention, detection, and response. And Google accept that prevention gonna fail at scale."
"You can detect them, but does it help you if you find that there's maybe a thousand agents hacking you right now inside your network? How can you contain them without a full shutdown of your system?"
"This actually requires defense to come up with a new paradigm. I haven't seen anybody come up with a good idea here. We're not there yet."
@calif_ioView quoted post on X
