Google DeepMind says two AI agents reproduced a known 1024-bit cryptography computation over nearly four days with about 20 human messages, mostly approvals, carrying the research through coding, large-scale execution and debugging.
The test concerns RSA digital signatures. After billions of advance queries to a simulated signing service, the agents computed a mathematical root needed for a new signature once access ended. They did not recover a private key.
The working paper reports 391 CPU core-years for the completed computation, compared with an earlier team's rounded 1,380 on the same instance and algorithm. That is about a 3.5-fold reduction in measured CPU use. GPU work and preliminary probes are excluded.
Related Company Google An American multinational technology company
DeepMind researcher @pushmeet announced the work on Nov. 6, describing a sandboxed reproduction of a previously solved benchmark instance. The papers say these results do not threaten deployed cryptosystems based on 2048-bit or larger RSA.
The human chose the problem, instance and limits on the signing service, then approved conditions for irreversible steps. According to the paper, the researcher wrote no code, launched no jobs and diagnosed no faults.
A supervisor agent maintained the design, budgets and checks. An executor wrote and tested code, launched distributed jobs and repaired failures. The supervisor also enlisted a specialist sub-agent to accelerate one linear-algebra step.
The agents produced about 33,500 new lines of code, ran 336 distributed experiments and exchanged 218 messages. From design to the verified result, the work took three days and 22 hours.
Their first computed root was wrong because a 32-bit offset overflowed. A correctness check caught the error, and the agents located and fixed it without repeating the advance signing queries. Limited human messaging still came with a human-selected task and approval gates.
Few human messages. A large supervised system.
DeepMind reports a two-agent research run with a specialist helper, human approval gates and extensive parallel computing.
THE DIVISION OF WORKHuman researcherProblem + instanceSigning-service limitsApproves gate conditionsAbout 20 messagesSupervisor agentDesigns and budgetsSets checksReviews resultsExecutor agentWrites and tests codeRuns distributed jobsDiagnoses and fixes
tasks
results + logs
delegatesSpecialist helperOne linear-algebra task218messages between agents336distributed experiments
Reported workflow. Human gates remained in place.
THE DIVISION OF WORKHuman researcherChooses problem + instanceSets signing-service limitsApproves gates; about 20 messages
Supervisor agentDesign, budgets and stage checksReviews results; decides go/no-go
tasksExecutor agentWrites and tests code; runs jobsDiagnoses and fixes failures
results + logs218 messages between agents
Linear-algebra specialistDelegated by the supervisor336 distributed experimentsA supervised workflow with feedbackand checks at each stage.
Explore what the speedup measuresExplore what the speedup measuresCPU workElapsed time
The same computation used less CPU time through implementation and execution changes; GPU work and probes are separate.
SAME INSTANCE. SAME ALGORITHM.CPU core-years for the first verified rootEarlier study1,380DeepMind run391
05001,0001,500About 3.5-fold lower measured CPU use391 excludes GPU work and 7.5 core-years of probes and rehearsals.
SAME INSTANCE. SAME ALGORITHM.CPU core-yearsFirst verified root, including precomputationEarlier study1,380DeepMind run391About 3.5-fold lower CPU use391 excludes GPU work and 7.5 core-yearsof probes and rehearsals.Bars use the same zero baseline.
Design-to-result took 3 days 22 hours; the full-scale-sieving clock took 3.2 days. Large parallel resources explain much of the calendar gain.
TWO CLOCKS FOR THE SAME RUNDifferent start points explain the two durations
Design startsFull-scale sieve startsRoot verified
3 days 22 hours
3.2 daysPeak: about 300,000 CPU cores + 16 GPUs. Stage spacing is schematic.
TWO CLOCKS FOR THE SAME RUNDifferent starting points
Design startsFull-scale sieve startsRoot verified
3 days 22 hours from design3.2 days from full-scale sievingPeak resourcesAbout 300,000 CPU cores+ 16 GPUsStage spacing is schematic, not to scale.
About 20 human messages accompanied a supervised, resource-intensive computation with measurable implementation gains.
Authors' working-paper account on a known 1024-bit instance. CPU total excludes GPU work and 7.5 core-years of probes. Calendar comparison mainly reflects parallelism. These figures do not measure total financial cost or demonstrate the new theoretical algorithms.
Sources and evidence
Sources
- DeepMind computation paper
- Original computation
- DeepMind's working paper reports that two principal AI agents designed, implemented, ran and debugged a known 1024-bit modular-root computation; the human researcher sent about 20 messages, mostly approvals. [1]
- The human researcher chose the problem, oracle bound and instance and approved conditions for irreversible steps; according to the paper, the human wrote no code, launched no jobs and diagnosed no faults. [1]
- A supervisor agent maintained the design, budgets and checks; an executor wrote and tested code, monitored jobs and diagnosed faults, and a specialist sub-agent accelerated one linear-algebra step. [1]
- For the same modulus, algorithm, polynomials and factor-base bounds, DeepMind reports 391 CPU core-years for the first root versus the original team's rounded 1,380, about a 3.5-fold reduction in measured CPU usage from implementation and execution changes; GPU work and probes are excluded from that headline comparison. [1] [2]
- The 391-core-year figure excludes GPU time, with about 330 GPU-hours reserved and about 100 busy, and 7.5 core-years of probes and rehearsals; the paper says charging GPUs at the prior CPU linear-algebra cost gives a 3.4-fold gain, or 3.3-fold including probes. [1]
- The reported run took 3 days and 22 hours from design to verified root, or 3.2 days from the first full-scale sieving job, using peak resources of about 300,000 CPU cores and 16 GPUs; the comparison with the original five months mainly reflects parallelism. [1] [2]
- The agents produced about 33,500 new lines of code, launched 336 distributed experiments and exchanged 218 messages; the system made 16,292 tool calls including those of the specialist. [1]
- The first computed root was wrong because of a 32-bit offset overflow; the agents located and fixed it after a correctness check failed, without repeating the oracle batch. [1]
Supporting facts
Method
Source-bound role and feedback diagram. CPU bars share a zero baseline and widths proportional to reported 1,380 and 391 core-years. Reported 3.5-fold ratio is rounded. Time diagrams show two start points; stage spacing is schematic. Native panel switches CPU accounting and elapsed-time views.
Scope
Authors' working-paper account on a known 1024-bit instance. CPU total excludes GPU work and 7.5 core-years of probes. Calendar comparison mainly reflects parallelism. These figures do not measure total financial cost or demonstrate the new theoretical algorithms.
Infographic by CryptoSlate
What the speedup measures
The earlier academic computation took about five months. DeepMind's run took 3.2 days from its first full-scale sieving job to the verified root, reaching about 300,000 CPU cores and 16 GPUs at peak. The authors attribute that calendar-time difference mainly to parallelism.
The CPU saving arose from implementation and execution changes within the existing algorithm. The 391-core-year total excludes about 330 reserved GPU-hours, of which about 100 were busy, and 7.5 core-years of probes and rehearsals. The CPU totals also come from different hardware, so this is not a controlled like-for-like comparison.
The cryptographic setup also matters: a separate program holding the modulus factorization answered roughly 4 billion advance queries. It was withdrawn before the target was drawn. The agents then computed the target's root without further queries.
The measured reproduction did not demonstrate the paper's new algorithm for more restricted signing access at cryptographic size. A separate Fan Factories paper estimates roughly 30-fold lower costs per additional 1024-bit target than the multiple number field sieve, after shared precomputation costing about one general number field sieve factorization. These are leading-order heuristic estimates; no fan factory has been implemented.
The working paper identifies the principal models only as A and B and links no public implementation repository, limiting outside comparisons.