Google DeepMind announced on 10 November that it had done something cryptographers have chased for years: produced a machine-checked mathematical proof that the code behind Signal’s encryption actually does what it promises. Not a code review. Not an audit. A proof — checked by a machine, covering the compiled code that runs on real phones.
So what exactly was proved?
The target was libsignal, the open-source library that implements the Signal protocol — the same protocol that protects chats in Signal itself and, in variants, WhatsApp, Messenger and Google Messages. DeepMind’s system, called AlphaProof Code, verified two things that matter most in a messenger: the PQXDH handshake, the post-quantum key agreement that starts a conversation, and the Triple Ratchet, the mechanism that keeps rotating the key as messages flow.
The proofs cover four properties of one-to-one sessions: messages stay secret, the other side is who they claim to be, past messages stay secret even if a key leaks later, and a conversation recovers its security after a compromise. Crucially, the team did not verify a paper model of the protocol. They verified the unmodified Rust code, compiled with the stock Rust compiler into AArch64 machine code — about 140,000 instructions — exactly as it runs on ARM devices.
How did AI do it?
A team of five researchers spent four weeks with AlphaProof Code. AI agents working under human supervision generated about 6.5 million lines of Lean proof code. None of the authors wrote any proof code themselves. People wrote the formal specification — deciding what “secure” should mean — reviewed the definitions and kept final approval. The design rests on one principle: specifications are trusted, proofs are not. Every line of proof was checked by Lean’s kernel, a small, independent checker.
To test whether the system could actually catch flaws, the team rebuilt libsignal with two bugs that had already been found and fixed in older versions — known as “weak state” and “small subgroup” — and ran the tool on the altered code. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure. It found no new vulnerabilities in the code it examined.
Does this mean Signal is unbreakable?
No — and DeepMind is explicit about that. The proof covers one-to-one sessions of one release of the library, running as a fresh process in a test harness. Group chats, key generation, sealed sender, server-side code and side-channel attacks all sit outside it. The low-level cryptographic building blocks are assumed secure, not proven. And neither proof establishes the post-quantum healing that the SPQR upgrade was designed to add. Signal’s chief technology officer, Ehren Kret, said the work “gives us even greater confidence in our code’s privacy guarantees” — confidence, not a certificate.
Why this matters
Formal verification used to take years. Verifying the seL4 microkernel took 20 person-years; the verified CompCert C compiler took six. DeepMind’s team did a comparable job on a widely deployed cryptographic protocol in four weeks, with five people and a team of AI agents. It is, by DeepMind’s own account, the first time the implementation of a widely deployed protocol has been formally verified at this depth, by any method.
The work is a step toward a grand challenge launched in April 2026 by the Beneficial AI Foundation to formally verify the Signal protocol and app, and the full set of verification artifacts has been open-sourced by DeepMind at github.com/google-deepmind/code-verification. If AI can prove that the code guarding billions of conversations does what it claims, the next question is what else it can prove — and how soon. Gemini 4 Carbon, Google’s newest AI model, powered the agents that wrote the proofs, and the result lands weeks after Google’s recent quantum computing breakthrough — a reminder that the company is stacking up firsts in 2026 at a pace its rivals are struggling to match.
