TL;DR: Google DeepMind says its new AlphaProof Code framework used AI agents to mathematically prove key security properties of libsignal, the code behind the Signal protocol, down to the compiled machine code. Humans wrote and reviewed the specifications, Gemini Carbon agents generated about 6.5 million lines of Lean proofs, and Lean’s checker verified every step. The work took a team of five people four weeks. It covers a test harness around unmodified libsignal under stated assumptions, not the entire Signal app, and the proof artifacts are open source.
AlphaProof Code is Google DeepMind’s new agentic system for formal software verification, and its first big target was one of the most widely used pieces of security code in the world. In a blog post published November 10, 2026, DeepMind said its researchers guided AI agents to prove that Signal’s core cryptographic code delivers the protections its experts specified. DeepMind calls it the first time the implementation of a widely deployed protocol like this has been formally verified by any method, with or without AI. That is the company’s own claim, so here’s what was actually done and where the limits are.
What is AlphaProof Code?
AlphaProof Code is a multi-model, multi-agent framework for formal verification, which means mathematically proving that software behaves exactly as a written specification says it should. According to the technical paper, it has three main parts:
- A human-guided specification agent that helps experts write Lean theorem statements describing what “correct” and “secure” mean for the code.
- A formal model of AArch64 machine code (the instruction set used by most phones), so the proofs are about the compiled program, not just its source code.
- A team of autonomous prover agents, powered by Gemini Carbon, whose proofs only count if Lean’s kernel accepts them against the approved specification.
The key design idea is that the AI-written proofs don’t need to be trusted. If a prover agent makes a logical mistake, Lean rejects the proof. What humans must trust is the specification, and the paper is upfront that a flaw there could weaken the guarantee.
What exactly did it prove about Signal?
The target was libsignal, the official Rust implementation of the Signal protocol, which DeepMind notes is also used in Google Messages. As The Register reported, the proofs cover Signal’s post-quantum PQXDH handshake and its Triple Ratchet, the mechanism that keeps changing encryption keys as a conversation goes on.
The paper says the proofs establish four security properties:
| Property | What it means in plain English |
|---|---|
| Forward secrecy | If keys are stolen later, past messages stay protected. |
| Post-compromise security | After a device is temporarily compromised, the conversation can become secure again. |
| Authentication | You are talking to the party you think you are talking to. |
| Handshake secrecy | The secret set up when a chat starts isn’t revealed to an attacker. |
The numbers behind the project
Here are the figures DeepMind and The Register gave:
- About 6.5 million lines of machine-checked Lean proof code, generated by AI agents.
- About 26,000 lines of trusted material that people must actually read and trust: roughly 18,000 lines of specifications plus about 8,000 lines of AArch64 semantics and related definitions.
- About 1% of the work flagged by auditing agents for a second look by a human, according to DeepMind’s blog.
- Four weeks of work by a team of five people, and, in researcher Swarat Chaudhuri’s words to The Register, “quite a few tokens.”
For context, the paper cites past landmark projects: formally verifying the seL4 microkernel took 20 person-years, and building the verified CompCert C compiler took six years.
Did it catch real bugs?
As a test, the team reintroduced two real libsignal bugs that had already been fixed into an isolated copy of the code. DeepMind says that in both cases the system produced a machine-checked proof that the buggy version was insecure. That matters, because it shows the specifications are strict enough to tell good code from flawed code, not just rubber-stamp whatever they’re given.
What Signal and the researchers said
Signal’s Chief Technology Officer, Ehren Kret, is quoted in DeepMind’s announcement: “Using AI agents to translate live code into valid Lean theorems is a major breakthrough. As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code’s privacy guarantees.”
Chaudhuri, a research scientist at Google DeepMind and a professor at the University of Texas at Austin, told The Register the system is “fundamentally built for human AI collaboration.” He argued the bottleneck has moved: “In formal methods, we always had this belief that verification is the hard bit… Now we are able to do that. So now the question is what are we verifying?”
The limits you should know about
This is impressive work, but it isn’t a guarantee that Signal can never be hacked. Based on the paper, the GitHub repository and The Register’s coverage:
- The proofs are about a command-line test harness built around unmodified libsignal, with the cryptographic primitives hooked, not the whole Signal app on your phone.
- The Register notes the symbolic result assumes perfect cryptography. The open-source repository also includes a separate proof under a computational model.
- Everything depends on the human-written specifications being right, which Lean can’t check automatically.
- Bugs outside the verified code, such as in the operating system, the app’s interface or the hardware, aren’t covered.
Why AlphaProof Code matters beyond Signal
Formal verification has long been the gold standard for security, but it has usually been too slow and expensive for everyday software. If AI agents can handle the proof-writing, the hard human work shifts to deciding what to prove. DeepMind says verifying Signal “lays the groundwork” for other critical systems, naming medical device firmware and power grid software as examples, and suggests pairing it with automated defense agents like its CodeMender project.
It also connects to a wider trend we’ve been tracking. Google’s Gemini 4 Carbon launched with a heavy focus on cyber defense, and it now does the heavy lifting here. As AI tools make attacks like prompt injection and automated exploit hunting easier, and as more code is written by AI through approaches like vibe coding, mathematically checked guarantees could become a lot more valuable.
The bottom line
AlphaProof Code shows AI agents can write millions of lines of proofs that a strict checker accepts, turning a job that used to take years into weeks. For Signal users, it adds strong evidence that the core protocol code does what it promises, within clearly stated limits. The bigger question, as the researchers themselves say, is whether the same approach can scale to the much messier code the rest of the internet runs on.
Sources
- Google DeepMind: Introducing AlphaProof Code
- Google DeepMind paper: AlphaProof Code, Verifying Signal’s Security at the Machine-Code Level (PDF)
- GitHub: google-deepmind/code-verification
- The Register: Google DeepMind melds humans and AI agents to vet Signal’s secure messaging techniques
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
