Google DeepMind AI agents formally verify Signal's encryption code

Google DeepMind on 10 November 2026 introduced AlphaProof Code, a system of AI agents that it says mathematically proved key security properties of the actual code behind the Signal protocol, the encryption used by apps such as Signal and Google Messages. The agents, powered by a model DeepMind calls Gemini Carbon, generated over six million lines of proofs in Lean, a language for machine-checked mathematical proof, and the whole verification took four weeks, according to the company.

DeepMind describes the result as the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth, and the first time the implementation of a widely deployed protocol like this has been formally verified by any method, with or without AI. Those are the company’s own claims; no independent review of the work appears in the available sources.

What AlphaProof Code verified in Signal

Formal verification means mathematically proving that code behaves as intended, rather than testing it on examples. DeepMind calls it “the highest standard of security assurance” but notes that it is difficult and often labour-intensive.

The key detail is where the proofs stop. According to DeepMind, most protocol verification stops at the design level: it proves that the protocol as written on paper is secure. AlphaProof Code went further, proving that the compiled code fulfils the key security properties “down to the exact code running on devices”. One example property DeepMind gives is keeping messages protected before and after a device is temporarily compromised.

DeepMind’s reasoning is that real-world vulnerabilities often hide in the gap between a protocol’s design and its implementation, and that bridging this gap makes the proofs far more complex. The company says the four-week process proved “that Signal’s core cryptographic code delivers the security protections our experts specified”, a task it says has historically taken expert teams years.

How the agents split the work

DeepMind describes AlphaProof Code as a multi-LLM agentic framework, meaning several large language models acting as agents, that divides formal verification the way a research team would: humans and AI decide what to prove, and a group of AI agents does the proving. The process, as DeepMind lays it out, has three steps:

1. Specification. Researchers worked with a mix of models to translate Signal’s security goals into formal mathematical specifications, precise statements of what the code must guarantee. Human experts reviewed every one.
2. Proof. Agents powered by Gemini Carbon wrote the proofs, generating over six million lines of Lean.
3. Audit. The agents audited the proof and flagged areas that needed a second look from a human. DeepMind says that came to just one percent of the codebase.

Lean automatically checks every proof, so the human reviewers could concentrate on the flagged portion rather than reading millions of lines. That checking step matters: an AI agent can write a wrong proof, but Lean will reject it. ZME Science, describing DeepMind’s earlier AlphaProof work, compared Lean to “an infallible referee” that checks each logical move and only accepts a theorem as proven when no goals remain.

Testing whether it catches real bugs

A verifier that proves everything secure would be useless. To check that AlphaProof Code can tell correct code from buggy code, DeepMind reintroduced two real, previously fixed bugs into an isolated version of Signal’s code. In both cases, the company says, the system produced a machine-checked proof that the buggy version was insecure.

What is new compared with DeepMind’s earlier AlphaProof

The AlphaProof name has so far been tied to mathematics. AlphaProof entered the International Mathematical Olympiad in 2024, and a paper in Nature later described how it worked, ZME Science reported. That system was pre-trained on 300 billion tokens of code and mathematical text, fine-tuned on 300,000 human-written proofs from Lean’s Mathlib library, and then trained through reinforcement learning, according to the same report. It also relied heavily on compute: each hard Olympiad problem took two to three days and hundreds of TPU-days, ZME Science said.

A later DeepMind system, AlphaProof Nexus, was described in a May 2026 LinkedIn post as having solved 9 open Erdős mathematics problems, with Gemini writing proofs in Lean, Lean checking them and errors fed back to the AI to self-correct. That is a third-party social media summary, not a DeepMind statement in the sources here.

AlphaProof Code applies the same core idea, AI writes proofs and Lean checks them, to production software instead of mathematical theorems. The differences, based on the sources:

	AlphaProof (2024–2025)	AlphaProof Code (2026)
Target	Competition and research mathematics	Implementation code of the Signal protocol
Proof language	Lean	Lean
Structure	Single agent trained with reinforcement learning	Multi-LLM team of agents plus human experts
Model named	Gemini-based auto-formalisation system for training data	Gemini Carbon agents write the proofs
Output size	Not stated in sources	Over six million lines of Lean
Human role	Not stated in sources	Review every specification; check the 1% flagged by agents

What Signal says, and what is being released

Signal’s chief technology officer, Ehren Kret, is quoted in DeepMind’s announcement. He says prior formal verification focused on smaller portions of the code, and that DeepMind’s approach enables significant expansion.

“Using AI agents to translate live code into valid Lean theorems is a major breakthrough. As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code’s privacy guarantees.”

DeepMind also thanks Signal’s Rolfe Schmidt, Michael Rosenberg and Kret for feedback on the methodology. The announcement is written by Pushmeet Kohli and Swarat Chaudhuri, and the research team listed includes Andrew Ferraiuolo, Anton Kovsharov, Tej Chajed, Sam Schlesinger, Karn Seth, Jonathan Katz and Charles Sutton.

On access, DeepMind says it is open-sourcing its formal verification artifacts for community use and has published a technical paper. The announcement does not say that AlphaProof Code itself, or the Gemini Carbon model used for the proofs, is available as a product, app or API. Developers can expect to inspect the proofs; the sources do not say they can run the system on their own code.

What it means for people building software

For most developers, formal verification has been something reserved for a few teams with specialist staff and long timelines. DeepMind’s pitch is that AI agents can now do most of the proof-writing, leaving humans to define what “correct” means and to review a small flagged fraction. If that holds up, the cost of strong guarantees for critical code could fall sharply.

DeepMind frames the work as defensive. It says the result shows how AI can bring high-assurance security to businesses, governments and critical infrastructure, and help defend against agent-driven cyber threats. It names medical device firmware and power grid software as examples of systems the approach could later be applied to, and says formal verification could be paired with automated defence agents such as its CodeMender tool.

The pattern also matters for anyone building AI agents more generally. The design rests on a checker that cannot be argued with: agents can generate millions of lines, but Lean decides what counts as proven. The same loop of AI generating and Lean checking underpins DeepMind’s mathematics systems. It is a model for using unreliable generators safely when a strict verifier exists.

Limits and open questions

• The proof is only as good as the specification. DeepMind says the code delivers “the security protections our experts specified”. Properties no one wrote down are not covered. Humans reviewed every specification, which is where the judgement sits.
• Scope is the core cryptography. The announcement refers to Signal’s “core cryptographic code” and “key security properties”, not the whole Signal app.
• Evidence is self-reported. The “first time” claims, the four-week timeline and the one percent figure all come from DeepMind’s own post. The open-sourced artifacts and paper should allow outside experts to check them, but no independent assessment is in the sources yet.
• Compute and cost are not disclosed. The announcement does not say how much compute six million lines of proof required. DeepMind’s earlier AlphaProof needed hundreds of TPU-days per hard problem, according to ZME Science.
• Generality is unproven. DeepMind itself says scaling these techniques requires continued research.

What to watch next

The first test is outside scrutiny of the released artifacts and technical paper: whether cryptographers and formal methods researchers confirm that the specifications capture the properties that matter and that the proofs connect to the code Signal actually ships. The second is whether DeepMind applies AlphaProof Code beyond Signal, to the kinds of firmware and infrastructure software it names. The third is access: whether the framework, or the Gemini Carbon model behind it, becomes something other teams can run on their own code, which the announcement does not address.