AlphaProof Code, Google DeepMind’s new AI system, has produced machine-checked proofs that key security properties of Signal’s encryption code hold, and it did the job in about four weeks. That kind of work normally takes expert teams years. The catch: the proofs cover a specific test build of the code, not every Signal app on your phone.
Here are the facts worth knowing before you read the details.
- DeepMind announced AlphaProof Code on November 10, 2026.
- It targets Signal’s cryptographic protocol code, checked down to compiled instructions rather than just the design on paper.
- The proofs are written in Lean, a language a computer can check mechanically.
- Agents flagged about 1% of the work for human review.
- You don’t need to do anything. This is research, not a patch or a new Signal feature.
Think of the list as the whole story in ten seconds. The rest of this post covers what happened, where the limits are, and why security people are paying attention.
What AlphaProof Code Actually Did to Signal’s Code
According to DeepMind’s announcement, the team used agents to prove security properties of the code behind Signal’s protocol. That includes protection for your messages before and after a device is briefly compromised, a property cryptographers call forward secrecy and post-compromise security.
Most earlier verification work stopped at the protocol design. This one went further. The Decoder reports that the agents, built on Gemini Carbon, wrote more than six million lines of Lean proof code and checked that the real program met requirements that human experts defined first.
One wrinkle: DeepMind’s own page says “over six million lines” in the body but “over three million” in its summary text. Either way it’s a volume no human team would write by hand.
To test the system, researchers reintroduced two previously fixed bugs into an isolated copy of the code. The system produced proofs that the buggy versions were insecure. Signal CTO Ehren Kret called translating live code into valid Lean theorems with AI agents “a major breakthrough.”
Why Four Weeks Is the Real Headline
Formal verification means proving, with math a computer can check, that code does what its specification says. It’s the gold standard for security software, and it’s rarely done because it’s slow and expensive.
XenoSpectrum’s breakdown of the technical material says five researchers worked full time alongside the agents. The trusted base that humans still had to audit was about 26,000 lines, against roughly 6.5 million lines of generated proof. Humans checked the small, critical layer, and the machine checked the rest.
That ratio is the point. If AI can generate proofs and a proof checker can reject any wrong ones, trust moves from “did the AI get it right?” to “is the specification right?” The second question is much easier to audit.
It also fits a broader pattern on this blog. Earlier we looked at Claude’s formal verification libraries, and the Gemini model behind this work is the one we covered in Gemini 4 Carbon’s restricted access.
What the Proofs Cover and What They Leave Out
The fine print matters here, because “Signal is proven secure” is not what DeepMind claimed. The table below uses the scope described in XenoSpectrum’s breakdown, so check it against the project’s technical paper before quoting it elsewhere.
| Area | Covered? | What it means |
|---|---|---|
| Session setup and ratcheting | Yes | Proofs target the one-to-one handshake and the ratchet that rotates keys as you chat. |
| Compiled code | Yes | The proofs cover a compiled test binary of roughly 140,000 instructions, not just the Rust source. |
| Group chats and multi-device sync | No | Not part of this scope, so don’t read it as proof for those features. |
| Side-channel and memory attacks | No | Timing leaks and memory corruption sit outside the model. |
| Your Signal app | Not directly | The result covers a specific Linux test build, not the official Android or iPhone apps. |
The same breakdown notes that the strongest guarantees weaken in very long sessions, past roughly 25,000 messages with frequent key updates. That’s well beyond normal chatting, but it shows these proofs come with stated assumptions.
Do Signal Users Need to Change Anything?
No. Nothing in the announcement is a vulnerability disclosure or an update you need to install. Keep Signal updated like any other app, which is the same advice as always.
What you gain is indirect. When a protocol has been checked at this depth, the odds of a subtle flaw hiding in the core key-exchange logic drop. The risks that remain are the ones nobody proved anything about: a compromised phone, a malicious app, or someone looking over your shoulder.
DeepMind says it is open-sourcing its verification artifacts on the project page, so independent researchers can examine the work. The announcement doesn’t say AlphaProof Code itself is publicly available.
Where This Goes Next
The Decoder reports that DeepMind wants to extend the approach to critical infrastructure such as power grids and medical devices, including through its CodeMender work. That’s a plan, not a shipped product.
The open question is whether the method works on messier code. Signal’s protocol is small, heavily studied, and written with security in mind. A sprawling legacy codebase is a much harder test, and so far no one has shown results there.
Frequently Asked Questions
What is AlphaProof Code?
It’s a Google DeepMind framework that uses AI agents to write machine-checkable proofs that software meets a security specification. Signal’s encryption code was its first public showcase.
Does this mean Signal is unhackable?
No. The proofs cover specific properties of specific code under stated assumptions. Attacks on your device, side channels and features outside the scope aren’t covered.
How long did the Signal verification take?
About four weeks, according to DeepMind. The company says comparable work has historically taken expert teams years.
Can I use AlphaProof Code myself?
Not as far as the announcement says. DeepMind is releasing the verification artifacts, but it hasn’t said the system itself is open to the public.
Our Take
This is the most interesting AI-for-security result of the month because it’s checkable: the proofs are public and a machine verifies them, so you don’t have to trust anyone’s press release. Treat it as strong evidence about one build of Signal’s core, not a seal of approval on every messaging app. If independent teams reproduce it and the method reaches messier code, it will matter far more than any single product launch.
Leave a Reply