Google DeepMind Releases AlphaProof Code: AI Agents Prove Security of Signal's Compiled Code in Lean
On November 10, Google DeepMind detailed AlphaProof Code, an agentic system that produced approximately 6.5 million lines of Lean proofs on the machine code of libsignal, the reference library for the Signal protocol. The proofs cover the PQXDH post-quantum handshake and the Triple Ratchet, with assumptions and limitations detailed in the technical report.
The demonstration was briefly hinted at in a single line during the launch of Gemini 4 Carbon; it is now documented. On November 10, Google DeepMind published a blog post and a technical report on AlphaProof Code, an agentic system that mathematically proved security properties of the libsignal codebase, the reference library for the Signal protocol. In various forms, this protocol also encrypts WhatsApp, Messenger, and Google Messages.
What was proved
The novelty lies in the level of the proof. Most protocol verifications stop at their design. Here, researchers compiled libsignal using the standard Rust compiler for AArch64 (64-bit Arm) processors running Linux, and then proved that this machine code satisfies the expected properties. These proofs cover the PQXDH post-quantum handshake and the Triple Ratchet: forward secrecy, authentication, post-compromise security after a temporary device compromise, and handshake secrecy.
The numbers illustrate the scale: roughly 6.5 million lines of proofs written in Lean, a proof language whose kernel checks every step. They rest on approximately 26,000 lines of specifications and processor semantics that must themselves be trusted. The work took a five-person team four weeks. The report notes that verifying the seL4 microkernel required twenty person-years, and six for the CompCert compiler.
How the agents work
AlphaProof Code divides labor much like a research team. Humans decide what to prove and review every specification, which is drafted with the help of several models. Autonomous agents powered by Gemini Carbon then write the proofs. A “gatekeeper” agent accepts a proof only if Lean validates it against a copy of the approved specification: the reliability of the result therefore does not depend on the reliability of the agents. According to Google DeepMind, the agents then audited their own work and flagged only about 1% of the proof code for human review.
To ensure the system distinguishes secure code from faulty code, the team reintroduced two real bugs, long since patched, into an isolated copy of libsignal. In both cases, the system produced a verified proof that the buggy version was insecure. Signal Chief Technology Officer Ehren Kret, quoted in the post, called it a “major leap forward.” The verification artifacts have been released as open source.
The limits, written in black and white
The technical report is explicit about what it does not guarantee. Symbolic proofs assume perfect cryptography and say nothing about the computational secrecy of the raw bytes. Computational bounds do not hold against a quantum adversary. Key generation is not verified. The processor description covers 467 instructions and 31 system calls, but models neither threads, signals, nor dynamic linking. Finally, the outcome relies on trust in the Lean kernel, cryptographic primitives, and the contracts of certain routines invoked by the program.
Our take
Formal verification has always suffered from one fatal flaw: it is too expensive for almost all software. AlphaProof Code demonstrates that agents can generate the vast majority of the proofs, as long as humans define what needs to be proved and Lean mechanically verifies everything else. This is a shift in methodology rather than an isolated feat: trust is transferred from fallible agents to a mechanical checker. Yet the result covers a strictly defined scope: a small command-line test harness, a single architecture, and deliberate cryptographic assumptions. The claimed priority and the real compute costs have yet to be evaluated by outside teams, especially since Google DeepMind has not stated whether the tool itself will be made available to others. For developers of critical software, the practical question now arises: who will write and review the specifications, which now represent the core human effort?
Sources
- Google DeepMind — Introducing AlphaProof Code: a breakthrough in verifying complex software at depth (November 10, 2026) Primary source
- Google DeepMind — AlphaProof Code: Verifying Signal's Security at the Machine-Code Level (technical report and Lean development) Primary source
- The Register — Google DeepMind melds humans and AI agents to vet Signal's secure messaging techniques Secondary source
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
