Introduction
I have spent enough of my career staring at security audits to know the uncomfortable truth about them: most of the time, we do not actually prove our code is secure. We test it, we review it, we run scanners over it, and then we ship it and hope. The code that encrypts your private messages has always lived in that same hopeful category — reviewed by brilliant people, tested hard, but never mathematically proven correct at the level of the machine code that actually runs on your phone.
On November 10, 2026, Google DeepMind said that changed. Its researchers used a new agentic framework called AlphaProof Code to formally verify key security properties of the actual code behind the Signal protocol — the technology that protects billions of private conversations in Signal, WhatsApp, Messenger, and Google Messages. AI agents, guided by human experts, produced more than 6.5 million lines of machine-checked proof in four weeks. A task that has historically taken expert teams years.
What DeepMind Actually Announced
The announcement came in a Google DeepMind blog post on November 10, 2026, written by Pushmeet Kohli and Swarat Chaudhuri, alongside a technical paper and an open-source release of the verification artifacts. The claim is that this is the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth.
The target was not a whiteboard design or a simplified model of Signal. It was libsignal version 0.105.4, the Rust reference implementation of the Signal protocol, together with spqr version 1.6.0, the library behind its post-quantum key exchange. The code was compiled with the stock Rust compiler, version 1.98.1, statically linked against musl, and emitted as a single AArch64 Linux executable — roughly 560 KB of source code, about 140,000 machine instructions.
What AlphaProof Code Is, and How It Works
AlphaProof Code is not a model you can download or an API you can call. It is a multi-agent framework — a harness that organises teams of AI agents the way a research group organises people. Human experts decide what must be true. Then agents do the proving.
The workflow has three stages, and the division of labour between humans and machines is the most interesting part of the whole project.
First, human researchers worked with a mix of models to translate Signal's security goals into formal mathematical specifications — precise statements, written in Lean, of what "secure" actually means for this code. Every specification was reviewed by a human expert. The paper is blunt about where the effort went: the majority of the work was in writing these specifications, not in the proofs. The trusted specification base is about 26,000 lines — roughly 18,000 lines of specification, 28,000 with documentation, plus about 8,000 lines describing the semantics of the AArch64 instruction set. Once agents can prove things cheaply, deciding what to prove becomes the hard part.
Second, teams of proof-writing agents, powered by Gemini Carbon, Google's newest frontier model, generated the proofs. A typical run had 40 to 80 agents working for 24 to 72 hours on a single machine. The agents wrote more than 6.5 million lines of Lean, the computer language used to express mathematical proofs that a machine can check. Claude Opus 5.5 helped on the specification side, according to early technical write-ups of the release.
Third, and this is the part that makes the whole thing trustworthy, none of it is taken on faith. Every proof was checked by Lean's kernel — the small, rigorous core of the Lean system that either accepts a proof as valid or rejects it. There is no partial credit.
The Numbers That Actually Matter
The headline figure is 6.5 million lines of Lean proof, and it is worth understanding what that number contains, because within a day of the announcement, independent researchers were already counting.
The paper's own breakdown is roughly this: about 5.3 million lines of proof about the compiled libsignal binary, around 860,000 lines for the symbolic model, and about 350,000 lines for the computational model — approximately 6.5 million lines in total. One independent researcher cloned the published repository the next day, counted every Lean file with a line counter, and found 7,528,293 lines across 11,323 files. The difference is comments and blank lines, which the paper's count excludes and the raw count includes.
The repository itself is a single commit dated November 10, 2026, weighing in at 529 MB on disk, with libsignal vendored inside it. The same independent audit searched the headline proofs for the escape hatches that would let a fake proof through — the
sorry keyword that tells Lean to skip a proof, native_decide, and extra axioms — and found zero sorry in the headline proofs.The verification covered ten symbolic theorems: forward secrecy, post-compromise security, initiator and responder secrecy, authentication, and five corollaries of Theorem 1 of PQXDH, the post-quantum extended Diffie-Hellman handshake at the heart of modern Signal. The main result carries the name
signal_session_secure_placed. In plain language, the proof says: if an attacker controls the network and even the server, they still cannot read past messages, cannot read future messages after a compromise heals, and cannot impersonate either party in a one-to-one session.And the timeline is the part that should make every engineering manager sit up. Four weeks. The paper notes that a verification effort of this depth has historically taken expert teams years. Five researchers, a fleet of agents, and one month.
The Test That Convinced Me: They Put the Bugs Back In
Any verification system can look impressive until you ask the obvious question: how do we know it would actually catch a real bug? A system that proves everything secure, including broken code, is worse than useless.
DeepMind answered that question the right way. The team took two real, previously fixed bugs from Signal's history and reintroduced them into an isolated copy of the code. Then they ran the whole verification pipeline against the deliberately broken versions.
In both cases, the system produced a machine-checked proof that the buggy version was insecure. It did not wave the broken code through. It proved, with the same rigour as the positive result, that the security properties failed.
That is the experiment that turns a research demo into something I would take seriously. A proof system that can say "no" is a proof system worth having.
What Was Not Proved — and Why the Honest Limits Matter
I want to be careful here, because the limits of this result are as important as the result itself, and DeepMind's own paper is far more candid about them than the blog post.
First, the verification covers one-to-one sessions only. Group chats are outside the scope. So are sealed sender, key generation, linked-device state, and the server code. If you use Signal group chats every day — and most of us do — this proof does not cover that part of your experience.
Second, it covers one compiled build for one architecture: AArch64, the instruction set in modern phones. The same source compiled for a different processor, or with different compiler settings, is a different binary, and this proof does not automatically transfer.
Third, the proof assumes the underlying cryptographic primitives are perfect. It proves that the protocol logic built on top of those primitives is correct. It does not prove the primitives themselves. That is a reasonable and standard assumption in cryptography, but it is an assumption, and you should know it is there.
Fourth, there is no post-quantum guarantee for the healing property of SPQR, the post-quantum ratchet. The ratchet theorems assume the attacker chooses the SPQR keys. The paper says this explicitly, and it is the kind of honest boundary that makes me trust the rest of the work more, not less.
Finally, the trusted base is about 26,000 lines of specification and machine semantics that humans must read and get right. The 6.5 million lines of proof are untrusted by design — they are checked by Lean's kernel, so they do not need to be trusted. But the 18,000 lines of specification are the foundation everything rests on. If a specification says the wrong thing, a perfect proof of the wrong property follows. DeepMind open-sourced the whole artifact set under Apache 2.0 precisely so the community can read that foundation and argue with it.
What This Means for Developers
I build WordPress sites and tools for a living, and I am not about to formally verify a contact form. But the shape of this result matters for ordinary development work in three concrete ways.
The first is about where the work is moving. When proof generation becomes cheap, specification becomes the bottleneck. That is a skill shift: the valuable human work is deciding precisely what "correct" means, writing it down unambiguously, and reviewing it. If you have ever written a careful acceptance test or a precise API contract, you have practised a junior version of this skill. It is about to become much more valuable.
The second is about trust in AI-generated code. We are all shipping more code written by agents now, and the honest question is not whether agents write good code — often they do — but how we check it. AlphaProof Code points at an answer: let agents write the code, and let other agents, constrained by a machine-checked system, prove things about it. Testing tells you the code works on the cases you thought of. A machine-checked proof tells you it works on the cases you did not.
The third is about security work specifically. The bug-injection test is a pattern every team can borrow today, without any formal verification at all: deliberately reintroduce a fixed bug into a staging copy and check that your tests, scanners, and review process actually catch it. If your pipeline waves a known bug through, it will wave an unknown one through too. DeepMind proved its system can say no. Most of our pipelines have never been asked the question.
DeepMind has open-sourced the verification artifacts — specifications, proofs, machine semantics, and a paper-to-code map — at github.com/google-deepmind/code-verification, under Apache 2.0. Independent researchers are already cloning the repository and checking for shortcuts. That scrutiny is the point. The framework itself is not public: no endpoint, no price, no waitlist. What is public is the result and the evidence for it. The obvious next targets are the things this proof did not cover — group messaging, other architectures, other protocols — and the same approach applied to a browser, an OS kernel, or a payment system would be a bigger story still.
Conclusion
I have watched a lot of AI announcements this year, and most of them dissolve the moment you ask what was actually delivered. This one does not dissolve. Google DeepMind announced a real framework, proved a real property of real code that protects billions of conversations, published the evidence, and let independent researchers count the lines and check for cheating within a day.
The honest version of the story is this: in four weeks, AI agents wrote 6.5 million lines of machine-checked proof that the compiled code behind Signal's one-to-one sessions keeps its core promises — forward secrecy, authentication, and recovery after compromise — against an attacker who controls the network and the server. The proof has clear boundaries: no group chats, no server code, one architecture, and a 26,000-line human-written specification that everything depends on. Within those boundaries, it is the deepest verification of a deployed cryptographic protocol anyone has ever done, by any method.
That is worth paying attention to, not because your messages are suddenly safer — they were already protected by one of the best-reviewed protocols in the world — but because the way we check critical software just changed. The bottleneck moved from writing proofs to writing specifications, from testing code to proving it, and from trusting reviewers to checking their work with a machine that cannot be fooled.
---
Frequently Asked Questions
What is AlphaProof Code?
AlphaProof Code is a multi-agent framework from Google DeepMind for formal verification — mathematically proving that software does what its specification says. Human experts write the specifications, and teams of AI agents powered by Gemini Carbon write the proofs in Lean, which are then checked by Lean's kernel. It was announced on November 10, 2026.
What did AlphaProof Code prove about Signal?
It proved that the compiled machine code of libsignal, the reference implementation of the Signal protocol, delivers its core security promises in one-to-one sessions: forward secrecy, post-compromise security, initiator and responder secrecy, and authentication. The proof covers about 140,000 AArch64 machine instructions and was produced in four weeks.
How many lines of proof did the agents write?
DeepMind says the agents generated more than 6.5 million lines of Lean proof. An independent count of the published repository the next day found 7,528,293 lines across 11,323 files, including comments and blank lines, with zero
sorry escape hatches in the headline proofs.Does this mean Signal is now completely proven secure?
No. The verification covers one-to-one sessions of one compiled AArch64 build of libsignal version 0.105.4. Group chats, sealed sender, key generation, linked-device state, and server code are outside its scope, and it assumes the underlying cryptographic primitives are correct. It is the deepest verification of a deployed protocol ever done, within clearly stated boundaries.
Can developers use AlphaProof Code on their own code?
Not yet. There is no public product, API, or waitlist. DeepMind open-sourced the verification artifacts — specifications, proofs, and machine semantics — under Apache 2.0 at github.com/google-deepmind/code-verification, but the agent framework itself is not public.
Why does verifying compiled machine code matter more than verifying a design?
Because real bugs live in the gap between a design and the binary that runs. A protocol can be perfect on paper and broken in its implementation through a compiler decision or a coding detail. AlphaProof Code verified the actual compiled AArch64 instructions, so the proof covers the code your phone really executes, not an idealised model of it.
