# AlphaProof Code: DeepMind's AI Proves Signal's Code

> DeepMind's AlphaProof Code had AI agents write 6.5 million lines of Lean proof for Signal's code in four weeks. What it proved and what it left out.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-11-10
- Canonical (HTML): https://cellcog.ai/blog/alphaproof-code-signal/
- Section: Insights / Multi-agent & AI organizations
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Google DeepMind announced AlphaProof Code on November 10, 2026: AI agents proved key security properties of the compiled code behind the Signal protocol.
- The agents wrote about 6.5 million lines of Lean proof, per the paper. No author wrote any proof code. The proofs came from agent teams on Gemini 4 Carbon.
- People still chose what to prove. Humans approved every specification, and the agents flagged one percent of the codebase for a second human look.
- A team of five did the proof work in four weeks. DeepMind says a task like this has taken expert teams years.
- Limits: the proofs cover one-to-one sessions in one version of Signal's library. Key generation, side channels and the full Signal app are outside them.

## At a glance

- **What is AlphaProof Code?** A Google DeepMind system in which people write a specification with AI help and teams of AI agents prove that code meets it. Announced November 10, 2026.
- **What did it prove?** Key security properties of the compiled code of Signal's library for one-to-one sessions, in about 6.5 million lines of machine-checked Lean proof.
- **Did it find new bugs in Signal?** No. WIRED reports no new vulnerabilities in the parts examined. Two old, fixed bugs that the team put back were both caught.

Google DeepMind announced AlphaProof Code on November 10, 2026. It is a system of AI agents that writes mathematical proofs about software. In its first project, the agents proved key security properties of the code behind the Signal protocol. That is the encryption used by the Signal app and, in variants, by WhatsApp and Google Messages.

DeepMind says the work took four weeks. The [technical paper](https://deepmind.google/documents/36/Formal_Verification_of_Signal_4.pdf) counts about 6.5 million lines of proof, all written by agents and all checked by a machine. The project found no new flaw in Signal. This page sets out what was proved, how it was done, and what the proofs leave out.

## What DeepMind announced

![Animated diagram of how Google DeepMind's AlphaProof Code verified Signal's code, per DeepMind on November 10 2026. Four steps: people and AI models write the specification and human experts review every one; AI agents on Gemini Carbon write the proofs, over 6 million lines of Lean; Lean checks every proof by machine; the agents flag 1 percent of the code for a second look by a human. The work took 4 weeks. Two old, fixed bugs were put back in as a test and both were caught. Scope: Signal's core cryptographic code, not the entire Signal app.](https://cellcog.ai/blog/media/alphaproof-code-signal/proof-pipeline.svg)
*The four steps of AlphaProof Code, and the test with two old bugs.*

[DeepMind's post](https://deepmind.google/blog/introducing-alphaproof-code/) says its researchers "guided AI agents to mathematically prove key security properties of the actual code underlying the Signal protocol". The method is called formal verification. A test checks some inputs. A formal proof shows that code meets a written specification for every input.

The post makes a wide claim: "It's also the first time the implementation of a widely deployed protocol like this has been formally verified by any method, with or without AI." That claim is DeepMind's own. [WIRED](https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/) reported the project earlier the same day. Pushmeet Kohli, whose team did the work, [posted it on X](https://x.com/pushmeet/status/2120127611137634376) at 12:13 UTC.

*Table: AlphaProof Code on Signal, by the numbers*

| Item | Figure | Source |
|---|---|---|
| Time taken | Four weeks, by a team of five | Paper |
| Proof written by agents | About 6.5 million lines of Lean (the post says over six million) | Paper, post |
| Text a reader has to trust | About 26,000 lines of specifications and machine-code rules | Paper |
| Code verified | About 560 KB, about 140,000 machine instructions | Paper |
| Library version | libsignal v0.105.4 | Paper |
| Flagged for a second human look | One percent of the codebase | Post |
| Old bugs put back as a test | 2, both caught | Post, paper |
| New vulnerabilities found | None in the parts examined | WIRED |
| Cost | Not disclosed | WIRED |

## How it works

The post and the paper describe four steps.

- **People decide what to prove.** Researchers and AI models turn Signal's security goals into formal statements, "with human experts reviewing every one".
- **Agents write the proofs.** The paper says "none of the authors wrote any proof code". The proofs came from teams of agents running on Gemini 4 Carbon.
- **A machine checks them.** Lean is a language for proofs that a computer can check. Proofs are "accepted only if Lean's kernel checks them against the approved specification".
- **Agents flag what needs a person.** They marked "just one percent of the codebase" for a second look by a human.

Two details in the paper stand out.

- **The proofs are about the compiled program.** The team proved statements about the machine code that a standard compiler produced from Signal's library. The paper says the proofs need no trust in the source code or the compiler. It calls them "the first proofs connecting protocol-level security guarantees to the unmodified code of a widely used cryptographic protocol implementation".
- **Two model families worked on the specifications.** They were "developed through an intense back-and-forth between humans and agents powered by Gemini 4 Carbon and Claude Opus 5.5". One model drafted each statement. "An agent from a different model family" then reviewed the draft.

The paper also says where the human time went: "The majority of our effort went not into proofs but into specifications."

## The test: two old bugs

A proof system is only useful if it rejects bad code. To check that, the team took two bugs that Signal had already fixed and put them back. The post says "we reintroduced two real, previously fixed bugs into an isolated version of Signal's code". The result: "In both cases, the system produced a machine-checked proof that the buggy version was insecure."

The paper names the two bugs, Weak state and Small subgroup, and credits their discovery to earlier research by Cheval and co-authors. On the current code, WIRED reports that the analysis "did not find any new vulnerabilities in the portions of the Signal protocol it looked at".

## What the proofs cover, and what they leave out

*Table: What the proofs cover and leave out, per the paper and WIRED*

| Part | Status |
|---|---|
| Starting a one-to-one session (the PQXDH handshake) | Proved |
| Encrypting and decrypting messages (the Triple Ratchet) | Proved |
| Key generation | Not verified |
| Side channels and other secrets in memory | Out of scope |
| Quantum attackers | Partly. One proof covers handshake secrecy; the other gives no guarantee |
| Low-level cryptographic routines | Assumed to meet written contracts |
| The full Signal mobile app | Not verified |

The paper states the limits plainly: "keygen is not verified". It also says that "side channels and other secrets in memory are out of scope". On quantum attackers it says "Our bounds give no guarantee against a quantum adversary." WIRED adds that the project "did not, for example, formally verify the entire Signal mobile app".

DeepMind's researchers say the same about scale. "We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that," Swarat Chaudhuri, a DeepMind research scientist, told WIRED.

## How long would people have taken?

Three DeepMind sources give three estimates.

- **The post:** "a task that historically takes expert teams years".
- **The paper:** the results "would have required years of expert labor with earlier tools".
- **Kohli on X:** "Similar efforts could take teams decades of combined effort." His post then adds: "We did it in a month's time."

Kohli's figure counts combined effort. The paper uses the same unit for an older project: it says the seL4 operating system kernel took twenty person-years to verify. None of these is a measured comparison. No human team did this same job by hand.

## What Signal said

Signal's chief technology officer, Ehren Kret, is quoted in the post: "As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code's privacy guarantees."

The paper places the work inside a larger effort. It calls the result "a significant milestone towards a grand challenge launched in April 2026". Its reference list names that challenge as Signal Shot, from the Beneficial AI Foundation, Signal and the Lean FRO.

## What is not known

- **The cost.** WIRED reports that "Google declined to share the cost of the analysis".
- **A product.** WIRED says the company also declined to say whether it plans a commercial verification product.
- **Outside review.** The paper is hours old. The proofs are checked by machine, so an error would most likely sit in the specifications, and outside experts have not had time to read them.
- **How far it scales.** The post says "Scaling these techniques requires continued research."

## What to watch

- Reviews of the specifications by cryptographers outside Google.
- Whether DeepMind applies the method to a second system. The post names medical device firmware and power grid software as targets.
- The public files. DeepMind says "We are open-sourcing our formal verification artifacts for community use." They are on [the project site](https://google-deepmind.github.io/code-verification).

Related on this blog: [Anthropic Formal Verification: Claude Proved 123 Libraries](https://cellcog.ai/blog/anthropic-formal-verification/) and [Gemini 4 Carbon: Benchmarks, Price and Access](https://cellcog.ai/blog/gemini-4-carbon/).

## Where CellCog sits

CellCog runs its AI employees on Anthropic's Claude Opus 5.5. The paper names that model, with Gemini 4 Carbon, as one of the two that worked on the specifications. CellCog had no part in this research.

## Sources

- Google DeepMind, [Introducing AlphaProof Code: a breakthrough in verifying complex software at depth](https://deepmind.google/blog/introducing-alphaproof-code/), Pushmeet Kohli and Swarat Chaudhuri, November 10, 2026
- Chaudhuri and others, [AlphaProof Code: Verifying Signal's Security at the Machine-Code Level](https://deepmind.google/documents/36/Formal_Verification_of_Signal_4.pdf), Google DeepMind, November 10, 2026
- WIRED, [A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure](https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/), Lily Hay Newman, November 10, 2026
- [Pushmeet Kohli on X](https://x.com/pushmeet/status/2120127611137634376) (12:13 UTC, November 10, 2026)
- Google DeepMind, [code-verification project site](https://google-deepmind.github.io/code-verification)

## FAQ

**What is AlphaProof Code?**

AlphaProof Code is a Google DeepMind system for formal verification. People and AI models write a specification, human experts approve it, and teams of AI agents write proofs that the code meets it. A proof checker called Lean checks every proof.

**What did AlphaProof Code prove about Signal?**

It proved key security properties of the compiled code of Signal's library for one-to-one sessions: starting a session and encrypting and decrypting messages. The paper counts about 6.5 million lines of Lean proof.

**Did DeepMind find new vulnerabilities in Signal?**

No. WIRED reports that the analysis did not find any new vulnerabilities in the portions of the protocol it looked at. As a test, the team put two old, fixed bugs back, and the system proved both versions insecure.

**Which AI models did AlphaProof Code use?**

The paper says the proofs were produced by agent teams powered by Gemini 4 Carbon. The specifications were developed by humans and agents powered by Gemini 4 Carbon and Claude Opus 5.5.

**Is the whole Signal app now proven secure?**

No. The proofs cover one-to-one session code in one version of Signal's library. Key generation is not verified, side channels are out of scope, and the full mobile app was not verified.

**Can I use AlphaProof Code?**

DeepMind says it is open-sourcing its specifications and proofs. It has not announced a product. WIRED reports that Google declined to comment on commercial plans or on the cost of the project.

## Related

- [Anthropic Formal Verification: Claude Proved 123 Libraries](https://cellcog.ai/blog/anthropic-formal-verification/index.md)
- [Gemini 4 Carbon: Benchmarks, Price and Access](https://cellcog.ai/blog/gemini-4-carbon/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/alphaproof-code-signal/. Try CellCog free, no credit card needed: https://cellcog.ai/signup