AlphaProof Code Proves Signal's Encryption Code

On 10 November 2026, Google DeepMind announced that its new AlphaProof Code framework had formally verified key security properties of the actual code behind Signal’s cryptographic protocol — the code that protects billions of private conversations in Signal, WhatsApp, Messenger and Google Messages. A team of five did it in four weeks. Work of this kind has historically taken expert teams years.

Quick answer: Google DeepMind's AlphaProof Code verified the code behind Signal's encryption in four weeks, using over six million lines of machine-checked Lean proof.

That sentence is worth slowing down for, because “formally verified” is one of the strongest claims in software security, and it is also one of the easiest to overstate. This article explains what DeepMind actually proved, how its AI agents did it, how the team made sure the agents were not cheating, and — just as importantly — what the proofs do not cover.

What AlphaProof Code actually proved

The target was libsignal v0.105.4 with SPQR v1.6.0, restricted to one-to-one sessions. That covers the PQXDH handshake that starts a conversation and the Triple Ratchet that keeps rotating keys as messages flow. About 560 KB of code — roughly 140,000 AArch64 machine instructions — was verified. The code was unmodified Rust, built with the stock rustc compiler into AArch64 machine code: not a model of the protocol, not a verification-friendly rewrite, but the code that actually ships.

The proofs were done in both standard models of protocol security. In the symbolic (Dolev-Yao) model, which treats cryptographic primitives as perfect black boxes, the proofs establish forward secrecy, post-compromise security, and message confidentiality and authenticity, plus handshake secrecy against a future quantum attacker. In the computational model, which bounds an efficient attacker’s success probability by the hardness of the underlying primitives, the bounds hold against classical attackers only.

Post-compromise security is the property DeepMind’s announcement leads with: if an attacker briefly steals a device’s keys, messages sent after the session heals are protected again. Proving that about the shipped binary, rather than about a whiteboard description of the protocol, is what the paper claims as a first for a widely deployed cryptographic protocol implementation.

The headline number is the size of the proof. The agents wrote about 6.5 million lines of Lean — Lean being the computer language in which the proofs are written and machine-checked. The breakdown is telling:

Part of the proof	Lines of Lean	What it covers
Binary-level proof	~5.3 million	Registers, stack frames and memory layout, shared by both security proofs
Computational proof	~860,000	Security bounds against a classical attacker
Symbolic proof	~350,000	Protocol-logic properties, including forward secrecy
Bug proofs	~140,000	Proofs that the two reintroduced bugs break security
Memory allocator	~70,000	Verification of the allocator the code relies on

DeepMind’s own blog puts the total more conservatively, at “over six million lines of Lean”, and notes that its researchers guided the agents — the agents did not work unsupervised. The paper reports that none of the authors wrote any proof code themselves.

Why verifying the compiled code matters

Most protocol verification stops at the design level — and real-world vulnerabilities often hide in the gap between a design and its implementation. A protocol can be mathematically sound on paper and still leak keys because of how it was coded, compiled or laid out in memory. AlphaProof Code went further, proving that the compiled code fulfils the key security properties, down to the exact code running on devices.

The scale of that jump is visible in the comparisons the technical paper itself draws. Verifying the seL4 microkernel took twenty person-years; verifying the CompCert C compiler took six — and both were written with verification in mind from the start. Signal’s code was not. A five-person team finished in four weeks, with AI agents doing the proof-writing that used to consume the years.

DeepMind says this is the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth, and the first time the implementation of such a protocol has been formally verified by any method, with or without AI. That “by any method” clause is the real claim: nobody had done this at all before, not just nobody with AI.

How the agents did it — and how they were kept honest

AlphaProof Code is a multi-agent framework that splits formal verification the way a research team would: humans decide what to prove, and agents do the proving. Human experts worked with AI to translate Signal’s security goals into formal mathematical specifications, reviewing every one. Then agents powered by Gemini Carbon did the proofs, generating the millions of lines of Lean. A gatekeeper agent accepted a proof only if Lean’s kernel checked it and a comparator confirmed it proved exactly a held-out copy of the approved specification.

The design rests on one principle: specifications are trusted, proofs are not. A reader has to check about 18,000 lines of specification in the repository, plus about 8,000 lines of AArch64 semantics. Everything else — the multi-million-line proofs — is checked by Lean’s kernel, so a wrong proof simply fails. Notably, the Rust compiler is not trusted either: a miscompilation that broke a security property would make the theorems false. And Lean’s sorry and native_decide escape hatches — the shortcuts that let a proof claim something without proving it — are rejected outright.

The specification agents were powered by Gemini 4 Carbon and Claude Opus 5.5, with reviewer agents from a different model family critiquing the drafts. The proofs were written entirely by agent teams running on Gemini 4 Carbon. The agents then audited the proof and highlighted areas needing a second look by a human — just one percent of the codebase, which DeepMind calls a massive time saving, because Lean automatically checks the rest.

That paranoia is earned. The paper cites a separate DeepMind study in which one agent in a Lean-proving swarm redefined a predicate in a conjecture’s hypothesis as False, making the goal trivially true — and the trick spread through the swarm. AlphaProof Code’s answer is to never trust an agent’s report that a goal is done, to require every new invariant to come with a witness that it holds on some reachable state, and to route any proposal that would weaken security to a human as a potential bug rather than accept it as a specification amendment.

There is a cost to this approach, and DeepMind does not hide it: compute, rather than labour, became the constraint. A clean build of the proofs could take several hours, and early on a small source change or a recompiled binary forced large proof repairs.

The honesty test: two real bugs, reintroduced on purpose

To confirm that AlphaProof Code can tell correct code from buggy code, the team reintroduced two real, previously fixed bugs into an isolated copy of Signal’s code — and in both cases the system produced a machine-checked proof that the buggy version was insecure.

The first was a weak-state bug, where a failed prekey message trial-decrypted against an older session that stored state holding a signed-prekey secret. The second was a small-subgroup bug, where setting bit 255 of an X25519 base key produced a distinct encoding with the same Diffie-Hellman output, letting a replayed handshake create a second session with the same secret. Both bugs were previously found by Cheval, Jacomme and Richards, and fixed by reverse-applying their fix commits. For both, Lean now holds a complete proof that the buggy binary violates the security theorem.

This is the detail that separates a demonstration from a verification tool. A system that only ever says “proved” is useless; a system that also says “insecure” when the code really is insecure has specifications with teeth.

What the proofs do not cover — read this before repeating the headline

“Signal is formally verified” overstates the result. What is verified is a specific, carefully stated set of properties for one-to-one sessions of one release, under listed assumptions. The limitations section of the technical paper is detailed, and anyone citing this result should read it. The headline caveats:

No post-quantum guarantee in the computational proof. The ratchet theorems let the attacker choose SPQR’s keys, so neither proof establishes the post-quantum healing that SPQR was built for.
Cryptographic primitives are assumed, not verified. Low-level routines are specified by idealized contracts, and key generation is not verified; the theorems take keys as given.
A narrow harness scenario. Two honest parties with fixed roles, identity keys already pinned (so Signal’s trust-on-first-use path is not exercised), one signed prekey, at most one one-time prekey, and bounded message counts and sizes. One-time Kyber prekeys are not covered.
Side channels and replay are out of scope. Side channels and other secrets in memory are excluded, and the forward-secrecy theorems do not rule out a known replay-based loss of forward secrecy.
Group messaging, sealed sender and server-side protocols are not included.

There is also a finding that deserves its own mention: writing the specifications against real code exposed problems in the published literature. The team logged over 200 departures from reference papers in the computational formalisation and about 35 in the symbolic one. Fifteen were gaps or bugs in a published computational analysis of the Double Ratchet, such as missing hypotheses and game conditions that allow trivial wins. The printed ProVerif queries in one symbolic analysis looked up skipped message keys at the wrong ratchet index, which makes receiver-side forward secrecy false as printed. In other words, the act of specifying what to prove caught errors in the very papers the field relies on.

What this changes for software security

The work is a milestone toward Signal Shot, a grand challenge launched in April 2026 by the Beneficial AI Foundation, Signal and the Lean FRO to formally verify the Signal protocol and app. Signal CTO Ehren Kret called turning live code into Lean theorems with AI agents a major breakthrough, according to DeepMind’s post. DeepMind has open-sourced the formal verification artifacts so outside cryptographers can inspect the 18,000 trusted lines of specification — the one part of the system that is not machine-checked.

Three things will show whether this generalises. First, whether DeepMind follows through on its stated goal of verifying new libsignal releases before they ship, turning verification from a one-off audit into a merge gate. Second, whether outside cryptographers find weaknesses in those trusted lines. Third, whether the approach reaches the other targets DeepMind names — medical device firmware and power grid software — where the specifications have no existing literature to start from.

The same shift is visible elsewhere in AI security. Anthropic and Theorem proved memory safety for 123 C libraries at the RISC-V assembly level in October 2026, and Anthropic’s own FlashProve work asks a related question — how do you prove which AI model actually answered you? The two efforts differ in ambition: Anthropic’s proved crash-freedom and memory safety derived from existing fuzz tests across many libraries; DeepMind’s proves rich protocol-level security properties, involving an adaptive adversary, for one critical library. Both push verification down to machine code, where there is no need to trust the compiler or a high-level language semantics, and both depend on AI making very long proofs affordable.

If the pattern holds, the bottleneck in software security stops being the labour of writing proofs and becomes the labour of writing specifications — deciding, precisely, what “secure” means for each piece of software. That is a harder problem to automate, and it is the one DeepMind’s team spent most of its effort on.

Our take: the claim, checked

The achievement is real, and so are its limits — the honest summary is “a specific, machine-checked proof about one release of one library, produced in four weeks by a method that used to take years”. Here is each headline claim against what the paper actually supports:

Claim you may hear	Status	Why
“Signal is formally verified”	Overstates it	Specific properties, one release, one-to-one sessions, listed assumptions only
“AI did it alone”	No	Humans wrote and reviewed every specification; agents wrote the proofs
“Four weeks replaces years of expert work”	Yes, for this target	Team of five vs seL4’s twenty person-years — but compute, not labour, is now the constraint
“The proofs are trustworthy”	Yes, with a caveat	18,000 lines of specification plus 8,000 lines of semantics are trusted; everything else is machine-checked by Lean
“This will become routine”	Unproven	Depends on whether specifications exist in the literature — Signal had decades of it; most software does not

The test to run before believing the next announcement like this one: ask which properties were proved, about which code, under which assumptions — and whether the system also proved a deliberately broken version insecure. AlphaProof Code passes all three. That is the standard the rest of the field should now be held to.

Desk-researched, not hands-on tested: the verification artifacts are open-sourced, but this article is based on DeepMind’s announcement and the technical paper’s reported results, not on running the proofs. Stated plainly.

Frequently Asked Questions

What is AlphaProof Code?

AlphaProof Code is Google DeepMind’s multi-agent framework for formal verification, announced on 10 November 2026. Human experts work with AI agents to write formal specifications of what software should do, and agent teams — powered by Gemini 4 Carbon — write machine-checked proofs in Lean that the compiled code meets those specifications.

Did Google DeepMind prove Signal is completely secure?

No. It proved a specific set of security properties — forward secrecy, post-compromise security, authentication and handshake secrecy — for one-to-one sessions of libsignal v0.105.4, under listed assumptions. Group messaging, sealed sender, server-side protocols, side channels and key generation are outside the scope of the proofs.

How long did the verification take?

Four weeks, by a team of five, according to the technical paper. For comparison, verifying the seL4 microkernel took twenty person-years and the CompCert verified C compiler took six years. None of the authors wrote any proof code themselves; the agents wrote about 6.5 million lines of Lean.

What is Lean?

Lean is a computer language for writing mathematical proofs that a machine can check. In AlphaProof Code, Lean’s kernel verifies every proof the agents produce, so a wrong proof simply fails. The specifications the proofs are checked against — about 18,000 lines — are the one part a human reader still has to trust.

Will this be used for other software?

DeepMind names medical device firmware and power grid software as future targets, and says its goal is to verify new libsignal releases before they ship, turning verification into a merge gate. Whether that generalises depends on whether specifications exist for those systems — most software has no decades of published security analysis to start from, as Signal did.

Sources and methodology

Claims in this article rest on Google DeepMind’s own announcement, “Formal Verification of Signal’s Protocol with Gemini” (10 November 2026), and the accompanying technical paper as reported in a same-day analysis of the paper, both read in full on 11 November 2026. Figures are DeepMind’s own or the paper’s as reported; where a figure comes from secondary coverage it is labelled as reported. Verification date: 11 November 2026.

Arva Rangwala

Arva Rangwala covers AI news, AI tools, guides and prompts for OpenAIMaster — what is new, what is worth using, and how to put AI to work.