Google DeepMind said on November 10 that AI agents have mathematically proved key security properties of the actual code behind the Signal protocol. The work used a new framework called AlphaProof Code. DeepMind says it is the first time AI has formally verified a widely deployed cryptographic protocol at this depth, and the first time such an implementation has been verified by any method.
Formal verification means proving with mathematics that code meets a stated property, rather than testing sample cases and hoping the rest behave. Lean is the proof language used here. Its kernel checks each proof, so a claim either passes that check or it does not count.
The Announcement
AlphaProof Code splits the work the way a research team would. People decide what must be proved. A mix of models helps turn those goals into formal specifications, and human experts review every specification. Agents then do the proving work, and Lean checks the result.
That division matters. The agents did not choose the definition of secure. They worked to a definition that people had read and approved, and the auditing pass flagged about one percent of the material for a closer human look.
The target was serious code, not a toy model. Detailed coverage of the technical paper names libsignal v0.105.4 with spqr v1.6.0, built with stock Rust tooling into AArch64 machine code. That is roughly 560 KB of source and about 140,000 machine instructions, covering the PQXDH handshake that starts a conversation and the Triple Ratchet that keeps rotating keys as messages flow.
Important Details
| Item | What was verified |
|---|---|
| Code | libsignal v0.105.4 with spqr v1.6.0, compiled to AArch64 |
| Scope | PQXDH handshake and Triple Ratchet, one to one sessions |
| Properties | Forward secrecy, post compromise security, authentication, handshake secrecy |
| Proof size | Over six million lines of Lean; the paper count reported in coverage is about 6.5 million |
| Time taken | Four weeks |
| Control test | Two real bugs, fixed in the past, were put back in; the system proved the altered code insecure in both cases |
Forward secrecy limits what a stolen current key can expose from older messages. Post compromise security lets later messages become secure again after a temporary compromise, once the ratchet has moved on. Those are the promises users think Signal makes. This work checked them against code, not just against a paper design.
The limits deserve the same size type as the headline number. Coverage of the paper is clear that key generation was not verified, and group chats, sealed sender and server code sit outside the result. The cryptographic building blocks were assumed, not proved. Neither proof track established the post quantum healing that SPQR was built to add. Signal is not now proved unbreakable, and DeepMind has not claimed that it is.
Readers who follow agent coding tools on this site will recognise the pattern from Use Microsoft PDD Kit To Verify Agent Rust: the value is not that agents wrote a lot of code. The value is that a strict checker decided whether the work counted.
What’s Next
Confirmed next steps are modest. DeepMind says it is open sourcing the formal verification artifacts for community use, alongside the technical paper. That lets outside experts inspect the specifications themselves, which is where trust in this kind of result has to start. A proof is only as good as the statement it proves.
Open questions are larger. AlphaProof Code has not been released as a general tool that other teams can run on their own code. No price, no public endpoint and no timetable for wider use were given in the announcement. Whether the same approach scales to group messaging, to other protocols, or to ordinary production software is unproved.
DeepMind points to wider targets in its post, from medical device firmware to power grid software. That is ambition, stated as direction, not a delivered product. The solid result is narrower and still remarkable: in four weeks, agents did verification work that expert teams have historically measured in years, and a machine checked every line of it.
Facts checked November 11, 2026, against the DeepMind announcement dated November 10, 2026, and detailed coverage of its technical paper.
Sources
- Google DeepMind, Formal Verification of Signal’s Protocol with Gemini, November 10, 2026: https://deepmind.google/blog/introducing-alphaproof-code/
- The Register, Google DeepMind melds humans and AI agents to vet Signal’s secure messaging techniques, November 10, 2026: https://assets.theregister.com/2026/11/10/20266/
- OrcaRouter, AlphaProof Code: Signal Verified at the Machine Level, November 2026: https://www.orcarouter.ai/blog/alphaproof-code-signal-formal-verification
- Body image: Dirty Static illustration
END OF TRANSMISSION
Stay curious. Question everything.
