Google DeepMind AI Agents Produce Machine-Checked Proofs of Signal Protocol Security Properties in Four Weeks

Google DeepMind announced AlphaProof Code on Tuesday, Nov. 10, a system of AI agents that writes mathematical proofs about software. Its first project: proving key security properties of the code behind the Signal protocol, the encryption design used by the Signal app and, in variants, by WhatsApp and Google Messages.

Five researchers spent four weeks on it. The team found no new vulnerabilities in the portions of the protocol it examined.

What was proved

The target was libsignal v0.105.4 and SPQR v1.6.0, built unmodified into a statically linked AArch64 Linux executable with the stock Rust compiler. Earlier work checked abstract models of the design. This one checked the compiled implementation.

The proofs cover one-to-one session code: the PQXDH handshake and the Triple Ratchet messaging scheme. The properties include forward secrecy, authentication, post-compromise security and handshake secrecy.

The paper offers two independent arguments. One is ten symbolic theorems under idealized cryptographic assumptions. The other is a computational proof bounding an attacker's advantage.

The agents generated about 6.5 million lines of Lean proof code. That rests on roughly 26,000 lines of trusted specifications and AArch64 semantics.

How the humans and agents split the work

People chose the properties, settled ambiguities and security trade-offs, and kept final approval of the specifications. According to the paper, agents powered by Gemini 4 Carbon and Claude Opus 5.5 drafted and reviewed those specifications. Gemini 4 Carbon agent teams then generated all the proof code. None of the authors wrote any.

Typical runs used 40 to 80 agents on one machine for 24 to 72 hours. A gatekeeper accepted a proof only after Lean's kernel checked it and a comparator confirmed it matched the human-approved specification. That guards against a known failure in agent-written proofs, where a spec gets quietly weakened through one of its definitions.

Does the checker catch bad code?

The team reintroduced two real, previously fixed bugs, called Weak state and Small subgroup, into an isolated version of Signal's code. In both cases the system produced a machine-checked proof that the buggy version was insecure.

Wired reported that the analysis on current code turned up nothing new.

The limits

The paper is plain about what it leaves out. Key generation is not verified. Side channels and other secrets in memory are out of scope. And in the paper's words, "Our bounds give no guarantee against a quantum adversary." The researchers did not verify the entire Signal mobile app.

"Signal is proven secure" is shorthand for something narrower: these stated properties hold under these stated assumptions. A proof is only as good as the specification it is checked against. Startup Fortune made that point directly to its readers, warning companies to read the scope before repeating the claim in marketing.

DeepMind's post also says this is the first time the implementation of a widely deployed protocol has been formally verified by any method, with or without AI. That claim is DeepMind's own. The Beneficial AI Foundation, co-founded by Max Tegmark, is running a separate Lean-based effort called Signal Shot with Signal and the Lean FRO to verify the protocol and its Rust implementation.

Speed, head start and cost

Swarat Chaudhuri, a DeepMind research scientist, told Axios the tools did in four weeks what would likely have taken humans alone years. No human team has done this same job by hand, so that comparison is an estimate, not a measurement.

The team also had a head start. Signal's chief technology officer, Ehren Kret, said in a statement that earlier formal verification by the Signal Foundation covered smaller portions of the code, and that DeepMind's approach "enables significant expansion."

The cost is undisclosed. Wired reported that Google declined to say what the work cost or whether it plans a commercial formal-verification product. DeepMind conducted the analysis free of charge as a research project and is releasing its specification and proof so others can check and build on them.

What comes next

Chaudhuri was bullish in the Axios interview: "You can finally get to this world of unhackable software." To Wired he was more careful: "We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that."

DeepMind told Axios it is looking at building this verification into AI coding agents and development workflows. The aim would be for developers to prove security protections as they write and update code.

The open question is whether the method works on far larger codebases at a price anyone but Google can pay. Four weeks and five researchers on one protocol's core is a data point. It is not yet a business model, and the published specifications and proofs are what outside researchers can now test.