Buterin says formal verification can prove software meets defined security requirements instead of relying only on vulnerability discovery. AI could make full-program verification more practi
Vitalik Buterin says AI-driven hacking does not make cybersecurity unwinnable, pointing instead to formal verification as a way to prove software security. In a May 18 blog post, the Ethereum co-founder argued that AI could help verify programs mathematically. He said the approach matters for critical systems, including cryptography, message protocols and blockchain software.
Buterin said proving a program secure requires defining what security actually means. He used Signal as an example, noting that encryption alone does not cover every security concern. The definition can include message forgery, delivery failures, replayed messages, hacked devices and leaked keys.
Additionally, hardware can leak information through physical signals. Message size, sender identity and timing can also reveal information. These details can make security definitions exceed 1,000 lines of code. However, Buterin said definitions provide a smaller target for verification than the implementation.
Buterin argued that AI could make full-program verification more practical. Historically, developers verified only self-identified security-critical sections because verification required substantial effort. He now said developers should verify the entire program, including databases, networking and caching layers.
The goal differs from having defenders discover vulnerabilities first. Buterin described an approach that makes software more resilient by proving that it meets security requirements. He said definitions can also be combined when groups establish separate requirements.
If two definitions cannot coexist, developers can isolate the underlying design conflict. However, he noted that some user interfaces remain harder to handle.
Buterin identified message-passing protocols, sandboxes, SNARKs and fully homomorphic encryption as areas where the distinction can matter. He linked the approach to Ethereum’s development direction.
He said blockchains need stronger software security, particularly in systems pursuing scalability and privacy. His argument centers on mathematical verification rather than relying only on vulnerability discovery.
Buterin also said verification must cover more than selected code sections. The definition requires careful work, while the implementation remains subject to verification. He argued that AI could help handle the scale of this process, covering databases, networking, caching and other components.
