Google DeepMind announced November 10 that AlphaProof Code formally verified key security properties of compiled libsignal code. According to its paper, AI agents generated about 6.5 million lines of machine-checked Lean proofs covering Signal’s PQXDH handshake and Triple Ratchet.
The distinction is what those proofs establish, not their size. For small B2B software vendors answering enterprise security reviews, the research suggests a possible path toward stronger evidence for specific claims, not whole-product security certification.
What the proofs cover
DeepMind’s paper describes compiling unmodified Rust with the stock rustc compiler into AArch64 Linux machine code. The proofs establish specified protections, including forward secrecy, authentication and post-compromise security, about that executable under stated assumptions. Earlier work generally examined abstract models, modified implementations or narrower properties.
The paper combines symbolic proofs, which treat cryptographic primitives as abstract black boxes, with computational proofs, which bound attackers’ success using assumptions about those primitives. Message-security guarantees address classical attackers; handshake secrecy against a future quantum attacker is established in the symbolic model.
Humans guide and approve the mathematical specifications defining what must hold. Gemini Carbon agents construct proofs that Lean’s kernel checks. A gatekeeper uses a Lean comparator to check each proof against a held-out copy of the approved specification, with its git commit establishing the baseline. DeepMind says an agent audit flagged one percent of the codebase for human review.
The proofs rest on about 26,000 lines of trusted specifications and machine-code semantics: roughly 18,000 lines of statements and definitions, plus 8,000 describing AArch64 execution. An incorrect specification can weaken even a valid proof’s guarantee. Results also depend on Lean’s kernel, cryptographic assumptions and contracts for routines outside scope.
Testing the boundaries
Researchers tested instruction execution against two independent references, the Unicorn emulator and the Sail model of Armv9.4-A, and tested the loader and system-call model against qemu-aarch64.
Agents introduced faults, including skipping ciphertext message-authentication-code verification, then proved the altered binary violated the security theorem. Researchers also reintroduced two previously fixed libsignal bugs and produced machine-checked proofs that the altered binaries violated security guarantees. These were historical flaws, not newly discovered vulnerabilities.
The paper describes a command-line harness around libsignal, not verification of Signal’s applications. Its machine model covers 467 instructions and 31 system calls but excludes threads, signals and dynamic linking. Low-level cryptographic primitives use trusted contracts rather than verification through executing their code. SecurityWeek reports that side channels were excluded from parts of the analysis.
DeepMind says verification took four weeks; The Register reports five people did the work. DeepMind is publicly releasing the specifications and proofs, but says scaling requires continued research.
WIRED reports that DeepMind conducted the analysis free of charge as a research project. Google declined to disclose its cost or comment on commercial product plans. Those details don’t establish affordability or deployability for small teams.
For an owner preparing an assurance answer, the practical inference is four questions: Which property is supported? Which code or build was examined? Under what assumptions? What remains outside scope? That distinction also frames the security evidence software buyers may expect: a checked property isn’t a guarantee that an entire product is secure.
Sources
- https://deepmind.google/blog/introducing-alphaproof-code/
- https://google-deepmind.github.io/code-verification/
- https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/
- https://www.theregister.com/ai-and-ml/2026/11/10/google-deepmind-melds-humans-and-ai-agents-to-vet-signals-secure-messaging-techniques/5308625
- https://www.securityweek.com/google-widens-gemini-4-carbon-access-after-ai-agents-verify-signal-code/