Google DeepMind announced on November 10, 2026 that its agentic framework, AlphaProof Code, has produced the first machine-checked mathematical proofs connecting high-level security guarantees to the unmodified, compiled code of a widely used cryptographic protocol implementation: Signal's libsignal. A five-person research team, working with teams of autonomous AI agents, completed the proof work in roughly four weeks — a task the researchers say historically would have demanded decades of manual effort.
Understanding Formal Verification and AlphaProof Code
Formal verification is the practice of proving, mathematically, that a piece of software satisfies specified properties — not merely testing it against anticipated inputs, but establishing a logical guarantee that holds for all cases. As DeepMind's researchers Pushmeet Kohli and Swarat Chaudhuri note, today's assurance comes primarily from testing, bug finding, and code review, and real bugs often sit in the gap between a protocol's cryptographic design and the code that actually runs on phones.
That gap is precisely what AlphaProof Code targets. It is an agentic framework, powered by Gemini, that "combines human expertise with AI agents" to produce machine-checked proofs in the Lean proof assistant. Prior formal verification of Signal targeted abstract protocol models, verification-friendly reimplementations, or code modified to make verification easier. This work instead verified the actual compiled AArch64 machine code — the deepest level at which a guarantee can be anchored.
Signal Protocol's Proven Security Guarantees
The proofs cover Signal's post-quantum PQXDH handshake and its Triple Ratchet message protocol — components designed to keep messages secure even when some keys are compromised, including against future adversaries with access to a quantum computer. Verified against unmodified libsignal v0.105.4 and SPQR v1.6.0 crates, built into a statically linked AArch64 Linux executable, the established properties are:
- Forward secrecy — compromising current keys does not expose past messages.
- Authentication — participants can establish each other's identities.
- Post-compromise security — the protocol can recover protection after a compromise.
- Handshake secrecy — the initial key agreement resists eavesdropping.
Importantly, the scope is the core protocol library, not the entire Signal application. Signal's chief technology officer, Ehren Kret, called the rigorously verified implementation a source of "even greater confidence in our code's privacy guarantees."
AlphaProof Code: A Step-by-Step Verification Workflow
The framework's distinctive design is its division of labor: humans define what must be proven, AI agents do the proof generation, and an independent kernel checks the result. The technical paper describes three interacting components. Use this workflow to see how each stage constrains the next.
| Stage | Who or What Acts | What Happens | Outcome |
|---|---|---|---|
| 1. Specification | Human expert, guided by an AI agent | Translate Signal's security goals into formal Lean specifications of the code | An approved specification defining what counts as correct |
| 2. Semantics | Trusted foundation | A formal semantics of AArch64 machine code gives the proofs their ground truth | About 26,000 lines of trusted specification and semantics |
| 3. Proof generation | Autonomous prover agents (Gemini) | Agents attempt to prove that the compiled libsignal code satisfies each specification | About 6.5 million lines of machine-checked Lean proof code |
| 4. Validation | Lean's kernel | Every AI-generated proof is accepted only if the kernel checks it against the approved specification | A proof is trustworthy regardless of any AI error along the way |
The critical design point is that nothing the agents produce is taken on faith. A flawed AI proof is simply rejected by Lean's kernel. The humans' role concentrates where judgment matters most — writing specifications — while the mechanized checker guarantees the final result, making this collaboration the first to connect protocol-level guarantees to unmodified, deployed code.
Gemini Carbon's Role in AI-Assisted Proving
The prover agents rely on Gemini 4 Carbon, Google's frontier model introduced in October 2026. Why does the model choice matter for theorem proving? Two capabilities are decisive. First, Carbon supports a high thinking level — Google's documentation recommends that tier for complex reasoning, hard math and science, and "the most difficult code or agent tasks," pairing with long decode for extended outputs. Generating millions of lines of Lean proof is exactly such a task: a sustained, long-output reasoning effort where quality cannot be allowed to drop.
Second, agentic proving demands disciplined output. The model must emit code and proof steps that conform to strict schemas and the kernel's exacting syntax; a single malformed step fails the check. Google describes Carbon's design as combining training, real-time misuse defenses, and alignment work for complex, high-pressure tasks. Without reliable instruction-following at that level, the autonomous loop of attempt, check, and revise that generated the Signal proofs would not function.
Broader Implications for Software Security
The historical obstacle to formal verification has been cost. DeepMind's own paper describes the technique as historically too expensive for most software, and Dana Fine, writing at Qodo, notes the paper's benchmark: verifying the seL4 microkernel took twenty person-years. The Signal effort — a five-person team, four weeks of proof work, with specifications and verification artifacts publicly released at DeepMind's code-verification repository for outside review — suggests AI agents can cut that cost by orders of magnitude.
The significance is not that Signal was found vulnerable; it is that a guarantee previously available only for small, hand-crafted systems is now reachable for production cryptographic code used daily across the Signal app, Google Messages, and other platforms. As AI-driven security threats grow, the ability to mathematically verify deployed code — rather than merely test it — becomes a genuine defensive capability, and a plausible one for safety-critical systems like medical devices and power infrastructure that have long been priced out of rigorous verification.
The Future of Secure Software Development
Software developers and security teams should explore integrating AI-assisted formal verification tools into their development pipelines for critical components, starting with well-specified cryptographic or safety-critical modules where a formal specification is tractable.
The measurable indicator to watch is the increasing availability and adoption of AI-assisted formal verification tools in open-source projects or commercial software development. DeepMind's public release of its Lean development for independent scrutiny is the first test of that trajectory: the next milestone is whether other teams reproduce, extend, or commercialize this pipeline — and whether a second widely deployed protocol receives the same machine-checked treatment Signal just did.
Sources
- Formal Verification of Signal’s Protocol with Gemini — Google DeepMind
- Deepmind
- Google DeepMind Uses AI Agents to Verify Signal’s Core Machine Code — Unite.AI
- Gemini 4 Carbon: our next frontier model — Google
- Google AI Studio — Aistudio
- Google DeepMind Says AI Formally Verified Signal's Protocol Code and Flagged Only… — Qodo
