Google DeepMind's AlphaProof Code Proves Signal's Encryption Secure at the Machine-Code Level

Posted on 12th Nov 2026 11:04:16 in Artificial Intelligence, Machine Learning

Tagged as: Google DeepMind, Signal, Cryptography, Formal Verification, AI Agents, Cybersecurity

Google DeepMind has done something cryptographers have chased for two decades: it produced a mathematical proof that a widely deployed encrypted messaging protocol actually delivers the security it claims — and it proved it against the compiled machine code running on real devices, not a cleaned-up model of the design.

The work, published on November 10, 2026, used a new agentic framework called AlphaProof Code to verify libsignal, the reference implementation of the Signal protocol that protects conversations in the Signal app, Google Messages and WhatsApp. DeepMind says this is the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth, and the first time any method — AI or human — has formally verified the implementation of such a protocol rather than only its blueprint.

The scale is the story. The agents generated roughly 6.5 million lines of machine-checked Lean proof code, resting on about 26,000 lines of trusted specifications and a formal model of AArch64 machine code. The entire project took four weeks.

What DeepMind Actually Proved

Formal verification is the highest standard of software assurance. Instead of testing a system and hoping the tests caught the worst cases, you write down — in mathematics — exactly what the software must guarantee, then prove that the code satisfies those guarantees in every possible execution. A successful proof rules out entire classes of bugs and attacks, not just the ones someone thought to try.

Applied to Signal, the team targeted the parts of the protocol that matter most in the real world:

• Forward secrecy — a stolen key cannot be used to decrypt earlier messages.
• Post-compromise security — protection is restored after a device is temporarily compromised, so an attacker who gets in does not stay in.
• Handshake secrecy and authentication — the initial key exchange really does establish a private channel between the two parties and nobody else.

Crucially, the proofs cover Signal's post-quantum PQXDH handshake and the Triple Ratchet, the machinery that keeps keys rotating. And they were produced against an unmodified Rust build of libsignal, compiled normally, with the proofs reasoning about the actual AArch64 instructions the devices execute. Standard practice in the field has been to verify a hand-written model of a protocol and hope the shipped code matches it. Real vulnerabilities tend to live in exactly that gap between design and implementation — buffer handling, compiler behaviour, a stray optimisation. DeepMind closed the gap instead of stepping over it.

Signal's chief technology officer Ehren Kret called it a significant expansion of what formal verification can cover, noting that as AI-driven security threats grow, rigorously verifying the protocol implementation gives the foundation greater confidence in its privacy guarantees.

How the Agent Framework Works

AlphaProof Code is not a single model asked to “check the code”. It is a pipeline designed so that no AI output is trusted on its own:

• A specification-writer agent works with human researchers to turn the protocol's published security goals into a Lean specification. Reviewer agents critique each draft, and a human approves the final version.
• A team of autonomous prover agents, built on Google's Gemini Carbon models, then attempts the proofs. A gatekeeper step accepts a proof only if Lean's kernel verifies it against the approved specification.
• The system audits its own work and flags the areas that need human eyes — about one percent of the codebase, according to DeepMind.

That last number is the economic argument. Human experts still decide what to prove, which is the part that requires judgment about threat models. The mechanical, years-long labour of constructing proofs is handed to agents, and the Lean kernel — not the agents — decides whether the result stands.

The comparison to earlier milestones is stark. The formally verified seL4 microkernel, long considered the field's biggest success, took roughly twenty person-years of expert effort. The CompCert verified C compiler took six. Both were written with verification in mind. Signal's code was not, and the proof took weeks.

The Bug Test That Makes It Credible

A verification system that says “all good” is worthless unless it can also say “broken”. So the researchers ran a control experiment: they reintroduced two real, previously fixed bugs into an isolated copy of Signal's code. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure. The tool detects what it is supposed to detect.

On the live code, the analysis found no new vulnerabilities in the portions it covered. That is the expected result for a protocol that has been attacked by serious cryptographers for a decade — but it is now an independently proven result rather than an informed bet.

What the Proof Does Not Cover

It is worth being precise about the boundaries, because the headline invites overreach.

• Not the whole app. The verification covers Signal's core cryptographic protocol and implementation, not the entire Signal mobile app, its UI, its backup systems or every library it links against.
• Not from scratch. The team built on earlier formal verification work done by the Signal Foundation, which gave the agents a head start.
• Not cheap — or at least not disclosed. DeepMind ran the Signal analysis as an unfunded research project and declined to share what it cost. Google also declined to say whether a commercial verification product is planned.
• Not yet general. DeepMind research scientist Swarat Chaudhuri told WIRED there is “a long distance to go” before this scales to all the world's software.

Chaudhuri also drew a line the industry should pay attention to: the goal is human-AI collaboration, not a “vibe world” where AI writes the goals and AI writes the proofs and effectively grades its own exam. The specification is approved by people. That is what keeps the result meaningful.

Why It Matters Beyond Messaging

The Signal protocol is not a niche project. It secures a very large share of the world's private conversations, so an independent proof of its core has immediate value for anyone who relies on encrypted messaging — which is most businesses.

The bigger prize is the template. DeepMind frames the same approach as a route to verifying medical device firmware, power grid software and other critical infrastructure, and positions it as a counterpart to CodeMender, its AI agent for finding and fixing security bugs. One system finds flaws at machine speed; the other proves the absence of whole classes of flaws. In a threat landscape where attackers are already using AI agents, matching their speed with manual audits is not a strategy.

DeepMind has open-sourced the Lean development and formal verification artifacts from the project, so other teams can inspect the specification, reuse the AArch64 semantics and build on the proof rather than starting from an empty file. Pushmeet Kohli, DeepMind's vice president of research, framed the commercial upside simply: if you can verify the correctness of these implementations, you can rest easy — and banks and other bug-wary organisations could one day say “I can prove these properties” instead of “we tested it”.

The India Angle

For Indian businesses, the practical link is WhatsApp. It is the default channel for customer support, order confirmations, catalogues and payments follow-ups for a huge number of small and mid-sized firms, and every one of those conversations rides on the Signal protocol. A verified core does not make a business compliant or secure by itself, but it strengthens the bottom layer of the stack that Indian commerce already depends on.

Three things are worth watching:

• Procurement questions will change. Once “we formally verified the core” becomes a credible vendor claim, security questionnaires will start asking for it — the way they now ask for SOC 2 or penetration-test reports. Indian SaaS and fintech vendors selling into regulated buyers should expect the question within a couple of years.
• Audit and compliance narratives get sharper. With the Digital Personal Data Protection Act in force, data-security obligations are no longer theoretical for Indian firms. Mathematical assurance of a component is a far stronger statement in a breach post-mortem than a checklist.
• Skill demand shifts. Lean, formal methods and proof engineering have been academic specialities. If AI agents do the proof construction, the scarce skill becomes specification writing — deciding precisely what a system must guarantee. That is a skill Indian engineering teams can build deliberately, and the open-sourced Signal artifacts are a free place to start.

The honest caveat for smaller firms: this is not a service you can buy today at a small-business price. Google has not announced a commercial offering, and the compute cost of a proof at this depth is unknown. What changed this week is that the technique moved from “theoretically possible for giants” to “demonstrated on production code in four weeks”. The pricing question usually follows the demonstration.

Sources

• Google DeepMind — Introducing AlphaProof Code: a breakthrough in verifying complex software at depth
• Google DeepMind — AlphaProof Code: Verifying Signal's Security at the Machine-Code Level (technical paper)
• WIRED — A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure
• Ars Technica — Google DeepMind just mathematically verified key parts of Signal
• 9to5Mac — Google DeepMind analysis proves Signal and WhatsApp encryption is secure