Google DeepMind has introduced AlphaProof Code, an AI agent framework for formal verification that mathematically proved key security properties of the real code behind the Signal protocol. DeepMind says it is the first time AI has formally verified a widely deployed cryptographic protocol this deeply. The work took about four weeks, a job that the company says historically takes expert teams years.
What AlphaProof Code Actually Did
The Signal protocol protects private chats for billions of people, both in the Signal app and in Google Messages. DeepMind’s team set out to prove that the compiled code running on devices really delivers the protections the protocol promises. That includes keeping messages safe before and after a phone is temporarily compromised.
Most past work on protocols like this checked the design on paper. AlphaProof Code went further and checked the actual implementation, which is where many real-world bugs hide. DeepMind also says this is the first time a widely deployed protocol’s implementation has been formally verified by any method, with or without AI.
A Quick Look at Formal Verification
Formal verification means writing a mathematical proof that code behaves exactly as specified, with no gaps. It is considered the gold standard of security assurance. The catch is that it has always been slow, expensive and dependent on rare specialists.
How the AlphaProof Code Agents Split the Work
DeepMind describes AlphaProof Code as a multi-model agent system that divides work the way a research team would. Humans decide what needs proving, and AI agents do the heavy lifting of proving it. Every proof is then checked automatically by Lean, a programming language built for machine-checked math.
- Researchers worked with several AI models to turn Signal’s security goals into formal specifications, and human experts reviewed every one.
- Agents powered by a Gemini model DeepMind calls Gemini Carbon wrote the proofs, producing more than six million lines of Lean.
- The agents then audited their own proof and flagged about one percent of the codebase for a closer human look.
- Lean checked everything else automatically, so experts could focus only where judgment mattered most.
To test whether the system could tell good code from bad, the team reinserted two real Signal bugs that had already been fixed. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure. That matters, because a verifier that approves everything would be useless.
| Detail | What DeepMind Reports |
|---|---|
| Target | Compiled code of Signal’s core cryptographic protocol |
| Proof size | More than 6 million lines of Lean |
| Time taken | About 4 weeks |
| Human review needed | Roughly 1 percent of the codebase |
| Bug test | 2 previously fixed bugs caught and proven insecure |
| Availability | Verification artifacts being open-sourced, with a technical paper |
What Signal Says About the Result
Signal’s chief technology officer, Ehren Kret, welcomed the work and called the use of AI agents to turn live code into valid Lean theorems “a major breakthrough.” He said rigorous verification gives the team even more confidence in the app’s privacy guarantees as AI-driven threats grow. Signal engineers also gave feedback on DeepMind’s method, according to the announcement.
DeepMind frames this as a defensive tool for a world where attackers increasingly use AI too. It pairs the idea with CodeMender, its earlier agent for finding and fixing security flaws. Together, the company argues, they could help produce software that comes with mathematical proof that its protections work.
Why AI Code Verification Matters Beyond Signal
Encryption protocols sit under online banking, web browsing and messaging, so one flaw can expose millions of people at once. DeepMind says the same approach could later help secure medical device firmware and power grid software. It also notes that scaling these techniques will take more research, so this is not a push-button product yet.
The project also shows a pattern you are seeing across the industry: AI handling grinding, high-volume work while humans keep control of the decisions. We saw a similar theme when Anthropic used Claude to examine NIST curve seeds for hidden weaknesses. Security research is quickly becoming one of the most practical uses of frontier models.
What This Means for You
You do not need to change anything in Signal or Google Messages today. The proof confirms that the core encryption code already does what it promises. Still, there are a few useful takeaways.
- If you rely on encrypted messaging, this is extra evidence that Signal’s core design and code hold up under very strict scrutiny.
- If you build software, expect AI-assisted verification to show up in security tooling over the next few years, especially for crypto and safety-critical code.
- If you lead a security team, the open-source artifacts and paper are worth a look as a model for mixing human review with agent work.
- For everyday protection, basic habits still matter most, as covered in our guide to AI threat detection.
A proof only covers what it was told to prove. The real advance here is making deep, implementation-level proofs fast enough to be practical.
Google has been shipping a steady run of Gemini-powered security features, from scam detection in Android Messages to its latest Gemini model launch. You can follow more stories like this on our AI news page.
Sources
Primary source: Google DeepMind’s AlphaProof Code announcement.
Conclusion
AlphaProof Code shows AI agents can do something security experts have long treated as a grand challenge: prove that real, deployed encryption code is secure, not just its design. DeepMind finished the Signal proof in about four weeks, with humans reviewing roughly one percent of the work and Lean checking the rest. The system also caught deliberately reinserted bugs, which builds trust in its results. More research is needed before this scales to every critical system. But it is a strong sign that AI may soon make the highest level of software assurance far more common.
