Google DeepMind says its new AlphaProof Code system has formally verified selected security guarantees in the compiled implementation of Signal’s cryptographic protocol. The result links mathematical claims to executable code, a step that could make rigorous checks less expensive for software teams. It does not certify the Signal app as a whole or prove that every possible flaw is gone.
In a November 10 announcement, DeepMind said researchers used AI agents to prove properties of libsignal, the reference implementation used by Signal’s protocol. The work covers the PQXDH handshake and Triple Ratchet, including forward secrecy, authentication, post-compromise security and handshake secrecy. Those are mechanisms intended to keep messages confidential and participants authenticated even as keys or devices are compromised.
The technical paper and released proof artifacts describe roughly 6.5 million lines of Lean proof checked by Lean’s kernel, built on about 26,000 lines of trusted specifications and machine-code semantics. The AI did not choose the security goals on its own: researchers and models drafted specifications, humans reviewed them, and prover agents attempted to establish that the compiled AArch64 binary met those approved statements. DeepMind says the project took four weeks.
What the proof covers
Formal verification is different from testing. A test samples executions; a proof can show that, under stated assumptions, every modeled execution satisfies a property. Here, the team connected protocol-level guarantees to a compiled command-line harness for libsignal instead of checking only an abstract design. The researchers also put two previously fixed bugs back into an isolated version. The framework then proved that the altered versions violated the security properties.
That scope matters. The result concerns selected properties of the protocol implementation, not Signal’s entire mobile app, servers, operating systems, device security or every interaction around a conversation. The paper also states assumptions: some cryptographic primitives are treated through contracts, and the proofs rely on Lean’s kernel and on the accuracy of the human-approved specification. The work therefore says “this code meets these defined guarantees under these conditions,” not “this software cannot be hacked.”
Independent reporting by WIRED describes the study as a four-week proof of concept, not a commercially available security product. The outlet also notes that the team did not formally verify the whole Signal app. DeepMind says it is releasing its specifications and artifacts so others can inspect the work.
The specification is still the hard question
The eye-catching number is millions of proof lines; the more consequential change may be that agents can help produce them while a small trusted checker validates each result. That reduces reliance on whether a language model sounds convincing. It does not remove the human work of deciding what should be proved, defining assumptions, and checking that the chosen properties match real threats.
That distinction could matter beyond messaging. If the approach works on more codebases, teams might apply formal checks to critical libraries that have historically been too costly to verify. But each deployment will need scrutiny of its trusted components, scope, and specification. A correct proof of an incomplete or poorly chosen claim is still an incomplete security guarantee.
TINA’s view: This is more substantial than an AI system finding another bug: the machine-checked proof makes the output auditable, while humans still own the security claims. The next test is independent reproduction and extension beyond one carefully bounded implementation. Broader adoption would be persuasive if outside teams can verify the artifacts, identify the assumptions clearly, and apply the method to other critical software without the review effort swallowing the savings.
Watch for independent checks of the released proof and evidence that the workflow scales to code beyond a cryptographic protocol. Until then, the result is a promising verification method—not a new warranty for every Signal conversation.
This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration. Read our AI and editorial standards.
