Google DeepMind says it used a new framework, AlphaProof Code, to prove key security properties of the code behind the Signal messaging protocol. The November 10, 2026 post is signed by Pushmeet Kohli and Swarat Chaudhuri. The proofs cover only named properties of a specific build of libsignal, Signal's official Rust implementation. They do not show that the Signal apps are free of every bug or every kind of attack.
What AlphaProof Code is
Formal verification means writing down what a program must do as a mathematical statement, then proving the program meets it. DeepMind describes AlphaProof Code as a framework that pairs human experts with AI agents for that work. Researchers turned Signal's security goals into formal specifications, DeepMind says, and human experts reviewed every specification. Agents then wrote the proofs in Lean, a language that checks mathematical arguments. Lean was also used for Axiom's proof of the finite simple groups theorem. DeepMind says the agents were "powered by Gemini Carbon." We described the release of Gemini 4 Carbon in Gemini 4 Carbon Now Available: Price and Access.
What was verified
The technical paper, dated November 10, 2026, says the proofs cover the one-to-one session code of libsignal-protocol version 0.105.4, with spqr version 1.6.0: Signal's post-quantum PQXDH handshake and Triple Ratchet messaging. The named properties are forward secrecy, authentication, post-compromise security, and handshake secrecy. DeepMind describes one goal as "keeping messages protected before and after a device is temporarily compromised."
The team wrapped the unmodified libsignal crates in a command-line tool, libsignal-cli, compiled them with stock rustc 1.98.1, and proved claims about the compiled AArch64 Linux executable. The theorems cover init, send, and recv, the paper says, but not key generation (keygen). The GitHub repository describes the same target: libsignal's compiled AArch64 machine code "in a CLI harness (with hooked cryptographic primitives)."
Time and scale
DeepMind's blog says the verification process "took just four weeks," a task that "historically takes expert teams years." The paper says a team of five did the proof work over four weeks, on two independent proofs, one symbolic and one computational. The blog says the Carbon-powered agents generated "over six million lines of Lean." The paper says the repository contains nearly 7 million lines of Lean, about 6.5 million of them proofs, resting on "about 26,000 lines of trusted specifications and AArch64 semantics." DeepMind says the agents flagged "just one percent of the codebase" for human review.
What was not verified
The results concern this libsignal-cli build, not Signal's own applications. The theorems carry over to the Android and iOS apps only "as long as we trust that they preserve the behavior of the protocol code as exercised by the libsignal-cli binary," the paper says. The paper says 37 routines were hooked and replaced by trusted contracts. They include the low-level cryptographic routines (such as SHA-256 compression, AES-256-CBC, X25519, Kyber1024, and ML-KEM-768), error-message formatting, and a few memory, string, and output routines. The guarantees do not verify that hooked code. Side channels, other in-memory secrets, one-time Kyber prekeys, and the trust-on-first-use path are out of scope.
The symbolic proof assumes perfect cryptography and says nothing about the computational secrecy of bytes. The computational proof covers only classical adversaries and gives no guarantee against a quantum adversary, the paper says, though the symbolic proof shows handshake secrecy even if a future quantum attacker later breaks Diffie-Hellman, with further limits in the paper. The paper notes that variants of the protocol run in WhatsApp, Meta's Messenger, and Google Messages. This work did not verify those variants. DeepMind is open-sourcing the artifacts. The repository README, as read on November 11, 2026, says this is not an official Google product.
A check against known bugs
DeepMind says the team reintroduced two previously fixed bugs into an isolated version of Signal's code, and in both cases produced a machine-checked proof that the buggy version was insecure. The paper says Cheval et al. found both bugs in libsignal, and both are now fixed. It names them "Weak state" and "Small subgroup" and reintroduced each one by reverse-applying its fix to the libsignal v0.105.4 source. In Weak state, a prekey message that failed to decrypt on its new session was retried against older sessions. If that worked, the new session's unconfirmed state, which holds a copy of the signed prekey secret, was stored. In Small subgroup, the PQXDH responder did not check that the initiator's X25519 base key was torsion-free and in range, so a replayed handshake with a mangled base key could create a second session with the same shared secret. The paper says the symbolic security theorem does not hold of either bug-injected binary.
Signal's comment
Signal has not published its own blog post on this work. Its comment appears in DeepMind's announcement.
"While prior formal verification focused on smaller portions of the code, Google DeepMind's approach enables significant expansion," said Ehren Kret, Chief Technology Officer of Signal. "Using AI agents to translate live code into valid Lean theorems is a major breakthrough. As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code's privacy guarantees."
Why it matters
DeepMind claims this is "the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth," and the first time such an implementation "has been formally verified by any method, with or without AI." The paper calls these "the first proofs connecting protocol-level security guarantees to the unmodified code of a widely used cryptographic protocol implementation." Those are the authors' claims, not a certificate for the Signal app or for attacks the theorems leave out.
DeepMind also used AI agents in work that reported two weaknesses in 1024-bit RSA. Its claim that the work "lays the groundwork to secure other vital systems, from medical device firmware to power grid software" is future-looking, not a result already shown.
