Picture the moment you tap send on a private message. The words leave your phone, cross the internet, and land on a friend’s screen half a world away. You never see the mathematics that guards them. You simply trust that nobody in between can read them.
That trust rests on the Signal protocol, the encryption engine behind the Signal app and Google Messages. Billions of private conversations depend on it every single day. And until now, nobody had ever proved — mathematically, down to the actual code — that it does what it promises.
On November 10, Google DeepMind changed that. Its researchers announced AlphaProof Code, a new agentic framework that formally verified key security properties of Signal’s real cryptographic code. The work took four weeks. Historically, a task like this takes expert teams years.
What AlphaProof Code Actually Proved
Formal verification is not the same as testing. Testing tries a bunch of cases and hopes nothing was missed. A formal proof covers every case by construction, checked by a machine that does not get tired or distracted.
AlphaProof Code verified the code that runs Signal’s one-to-one conversations: the post-quantum PQXDH handshake and the Triple Ratchet, the two mechanisms that set up a secure session and keep it secure as messages flow. The proof covers forward secrecy, post-compromise security, authentication and handshake secrecy.
Forward secrecy means that even if a key leaks later, old messages stay unreadable. Post-compromise security means a conversation can heal itself after an attacker briefly gets in. These are the promises Signal users rely on without ever naming them.
What makes this result different is the depth. DeepMind did not verify a design document or a simplified model. It verified the compiled code itself — libsignal version 0.105.4, built into an AArch64 Linux binary of roughly 140,000 machine instructions. That is the level where real-world bugs actually live.
According to Google DeepMind, this is the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth. The team also says it is the first time any method, with or without AI, has verified such a protocol’s implementation at the machine-code level.
How AlphaProof Code Works
AlphaProof Code splits the job the way a research team would. Human experts decide what must be proved. Then teams of AI agents do the proving, and every proof is checked by Lean, a programming language built for machine-checked mathematics.
First, researchers worked with a mix of models to translate Signal’s security goals into formal mathematical specifications. Human experts reviewed every one of those specifications before the agents were allowed to proceed.
Then agents powered by Gemini Carbon — the model family behind DeepMind’s Gemini 4 Carbon release — got to work writing proofs. They produced more than six million lines of Lean code, an almost absurd volume of formal mathematics, in about four weeks.
The agents then audited their own proof and flagged roughly one percent of the codebase for a closer human look. The rest passed Lean’s checks untouched. Humans stayed in charge of the goals; machines did the heavy lifting in between.
The framework also includes a separate computational track with a concrete security bound, alongside the symbolic track that even models a quantum attacker breaking Diffie-Hellman after the handshake. The two tracks use different adversary models, and together they give a fuller picture than either could alone.
The Bug Test That Proved It Works
A proof system is only useful if it can tell good code from bad code. DeepMind put that to the test in the most direct way possible.
The team reintroduced two real Signal bugs that had already been fixed, dropping them into an isolated copy of the code. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure.
That matters more than the headline numbers. A system that rubber-stamps everything would be worthless. This one caught real flaws, proved they were flaws, and did it without a human pointing at them first.
The work also answers a challenge issued in April by the Beneficial AI Foundation, which asked researchers to formally verify the Signal protocol and the Signal app using Lean. DeepMind’s team took up that challenge and delivered on the protocol’s core.
What the Proof Does Not Cover
Honesty demands the limits be stated plainly. This proof does not mean Signal is unhackable, and DeepMind does not claim that it does.
The verification covers one-to-one sessions using the PQXDH handshake and Triple Ratchet. It does not cover group chats, linked-device behaviour, or the full Signal app on your phone. It applies to one specific build of libsignal, not every architecture or every future version.
The proof also assumes the underlying cryptography itself is sound. It does not guarantee the computational secrecy of every byte, and it cannot protect a phone that is already compromised. For Signal users, there is no emergency patch or account change tied to this announcement.
None of that diminishes the result. A proof is only as strong as what it was asked to prove, and here the team was explicit about exactly what that was. The artifacts are being open-sourced, so independent researchers can inspect, reproduce and extend the work.
Why This Matters Beyond Signal
Software security has always had a scaling problem. The systems we trust most — messaging apps, payment networks, operating systems — are too large and too complex for humans to verify by hand in reasonable time.
That is why this result reaches beyond one protocol. If AI agents can formally verify a deployed cryptographic implementation in weeks instead of years, the same approach could be aimed at the code running hospitals, power grids and financial systems.
The timing is telling. The same week saw Fireworks AI disclose a widening breach of customer datasets and model weights, a reminder that the AI industry’s own infrastructure is under attack. Verification and breach response are two sides of the same coin: one proves code is correct, the other cleans up when it is not.
Signal’s chief technology officer, Ehren Kret, welcomed the work. For a project whose entire reputation rests on a promise of privacy, an independent mathematical proof of that promise is worth more than any marketing claim.
What Happens Next
DeepMind has published a technical paper, “AlphaProof Code: Verifying Signal’s Security at the Machine-Code Level,” alongside the open-sourced verification artifacts. Other research groups can now test the framework on their own code, and rival labs can try to break the proof.
Watch for two things. First, whether AlphaProof Code moves from research showcase to routine tool — the point at which a development team runs formal verification the way it runs unit tests today. Second, which codebase gets verified next.
The Signal protocol was chosen because it is both widely used and famously hard to verify. Now that the hardest case has a proof, the question is no longer whether AI can do this kind of verification. It is how quickly the rest of the software world catches up.
Four weeks. Six million lines of proof. One protocol that billions of people trust every day, now with mathematics to back the promise. The next time you tap send, that is what is standing between your words and everyone else.
