Google DeepMind has done something cryptographers have chased for decades: it used AI agents to mathematically prove that the code behind the Signal encryption protocol does what it promises. Announced on November 10, 2026, the work took just four weeks — a job DeepMind says would historically have taken expert teams years — and it produced more than six million lines of machine-checked proof.
The Signal protocol protects billions of private conversations in the Signal app and Google Messages, and in variants in WhatsApp and Messenger. Until now, formal verification of a widely used cryptographic protocol stopped at the design: researchers proved the math of the protocol on paper, while the actual code running on phones went unproven. DeepMind’s new framework, AlphaProof Code, closed that gap by proving the compiled code itself.
What Is Formal Verification — and Why It Matters
Formal verification is the highest standard of security assurance: instead of testing code against a list of known attacks, you write a mathematical proof that the code cannot violate its stated security properties. If the proof checks out, the guarantee holds for every possible input, not just the ones anyone thought to test.
The catch has always been the cost. Writing those proofs by hand is slow, painstaking work that demands rare expertise, which is why it has mostly been applied to small, carefully chosen pieces of software. Cryptographic protocols underpin nearly all digital communication — online banking, web browsing, private messaging — and a single flaw can expose millions of people at once. That is why experts have spent decades formally analysing them, and why most of that analysis never reached the code itself.
How AlphaProof Code Verified Signal
AlphaProof Code is a multi-LLM agentic framework that splits formal verification the way a research team would. Human experts decide what must be proven, and a group of AI agents does the proving.
First, DeepMind’s researchers worked with a mix of models to translate Signal’s security goals into formal mathematical specifications, with human experts reviewing every one. Then agents powered by Gemini Carbon did the proofs, generating over six million lines of Lean — a programming language that doubles as a strict proof checker. After that, the agents audited their own proof and highlighted the areas that needed a second look by a human: just one percent of the codebase. Because Lean automatically checks the rest, the experts could focus their review where human judgment matters most.
The whole effort took four weeks and a five-person team, led by DeepMind’s Pushmeet Kohli and Swarat Chaudhuri. The scale of what agent teams can now do in weeks is becoming a pattern: the same week, Claude Fable 5.2 reportedly coordinated around 1,000 agents to formalise a proof of Fermat’s Last Theorem in 30 hours. The research lab is increasingly a place where humans set the direction and agents do the searching.
What It Actually Proved
The target was libsignal version 0.105.4, the reference implementation of the Signal protocol, compiled with the standard Rust compiler into AArch64 machine code — about 560 kilobytes of code, roughly 140,000 machine instructions. DeepMind proved the properties against that compiled code, not against a model of the protocol. That distinction is the whole point: real-world vulnerabilities often hide in the gap between design and implementation, and this work bridges it.
The proofs cover the post-quantum PQXDH handshake, the step where two phones agree on keys at the start of a conversation, and the Triple Ratchet, the mechanism that keeps rotating those keys as messages flow. The verified properties are the ones a protocol engineer would ask for: message confidentiality and authenticity, forward secrecy (past messages stay secret even if a key leaks later), post-compromise security (the session heals after a device is briefly compromised), and handshake authentication and secrecy.
DeepMind says this is the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth — and the first time the implementation of such a protocol has been formally verified by any method, with or without AI. The work also answers a challenge issued in April 2026 by the Beneficial AI Foundation, Signal and the Lean FRO to formally verify the Signal protocol and app.
The Bug Test: Catching Flaws It Was Supposed to Catch
A proof system that approves everything it is given is worthless, so DeepMind ran a control experiment. The team reintroduced two real, previously fixed bugs into an isolated version of Signal’s code. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure. The framework can tell correct code from buggy code — it does not just rubber-stamp whatever it sees.
No new vulnerabilities turned up in the parts of the protocol that were examined. That is reassuring, but it is not the headline. The headline is the method: a verification process that used to take years now takes weeks, and the proof it produces is checked by a machine, not trusted on the word of its authors.
What the Proof Does Not Cover
The limits matter as much as the achievement, and DeepMind and independent analysts state them plainly. This is not a proof that the whole Signal app is unhackable.
First, the proof covers the core cryptographic protocol code — the PQXDH handshake and Triple Ratchet for one-to-one sessions — not the full mobile app, its interface, its servers or the operating system around it. Second, the low-level cryptographic building blocks were treated as assumed-secure contracts rather than proven from scratch. Third, the proofs target one compiled platform, AArch64 Linux, not every device architecture. Group chats and multi-device behaviour are outside the scope as well.
For Signal users, there is no emergency patch or account change tied to this announcement, and nothing new to install. This is extra assurance about code that was already running, not an app update. The practical advice is unchanged: keep the app updated, review linked devices, and verify safety numbers — the same hygiene that the November wave of exploited vulnerabilities showed matters far more than any single flaw.
Why This Matters Beyond Signal
DeepMind’s RSA findings from just four days earlier showed the other side of the same coin: AI agents finding weaknesses in legacy 1024-bit RSA in weeks rather than years. AI is now accelerating both attack research and defence. DeepMind’s answer is to scale the defensive side: verifying Signal’s core cryptography, it says, lays the groundwork to secure other vital systems, from medical device firmware to power grid software.
Paired with automated defence agents like CodeMender, formal verification could help counter the speed and scale of modern cyber threats — software with mathematical proof that its protections work, rather than software that has merely survived testing so far. DeepMind is open-sourcing its formal verification artifacts for community use, along with a technical paper, so other researchers can build on the result.
Signal CTO Ehren Kret called the approach a great breakthrough, saying that translating live code into valid Lean theorems automatically changes what verification can cover. That is the real shift: verification has always been limited by human hours. If agents can do the bulk of the proof work, the question stops being which tiny piece of software deserves verification and starts being which critical system gets it next.
What It Means for You
For most people, the practical effect is quiet confidence: the encryption protecting your Signal and Google Messages chats has now been mathematically checked at the level of the code that actually runs. You do not need to do anything differently.
For security teams, the lesson is broader. The same week this proof landed, Android’s November security update fixed 216 vulnerabilities including a critical zero-click flaw — a reminder that the bulk of real-world risk still comes from unpatched known bugs, not from exotic protocol breaks. Formal verification raises the ceiling on assurance for the most critical code; patching still sets the floor for everything else.
Bottom Line
AlphaProof Code is the most consequential security announcement of the week, not because it found a flaw but because it proved the absence of several. In four weeks, AI agents wrote more than six million lines of machine-checked proof showing that Signal’s core encryption code delivers the protections it promises — forward secrecy, post-compromise security and authentication, verified down to the compiled machine code. The proof has honest limits: it covers one protocol, one release, one platform, and it assumes the underlying crypto primitives are sound. But it turns a years-long human effort into a weeks-long agent effort, and that changes what can be verified next. Medical firmware, power grid software and the rest of the internet’s critical plumbing are now in reach.
Frequently Asked Questions
What is AlphaProof Code?
AlphaProof Code is a multi-LLM agentic framework from Google DeepMind for formal verification — mathematically proving that code behaves as specified. Human experts decide what to prove, and AI agents powered by Gemini Carbon write the proofs in Lean.
What did DeepMind prove about Signal?
That the compiled code of libsignal, the implementation of the Signal protocol, delivers key security properties: message confidentiality and authenticity, forward secrecy, post-compromise security, and handshake authentication and secrecy, for the PQXDH handshake and Triple Ratchet in one-to-one sessions.
How long did the verification take?
Four weeks, by a five-person team. DeepMind says a task of this depth historically takes expert teams years. The agents generated over six million lines of Lean proof code and flagged only one percent of it for human review.
Does this mean Signal is unhackable?
No. The proof covers the core cryptographic protocol code for one release on one compiled platform. It does not cover the full mobile app, group chats, multi-device behaviour, or the low-level crypto primitives, which were assumed secure rather than proven.
How do we know the system works?
DeepMind reintroduced two real, previously fixed bugs into an isolated copy of Signal’s code. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure — showing it catches real flaws rather than approving everything.
Do Signal users need to do anything?
No. There is no patch or account change tied to the announcement. Keep the app updated, review linked devices, and verify safety numbers as usual.
Sources
- Google DeepMind: https://deepmind.google/blog/introducing-alphaproof-code/
- ReaderSpice (scope and limits): https://www.readerspice.com/2026/11/10/alphaproof-code-signal-security-verification-limits/
- ShiftDelete: https://shiftdelete.net/en/alphaproof-code
