On November 10, 2026 Google DeepMind's AlphaProof Code proved key security properties of Signal's compiled libsignal code with 6.5 million lines of Lean. What it covers and what it doesn't.
On November 10, 2026, Google DeepMind introduced AlphaProof Code ↗, an agent framework for formal software verification, in a post by Pushmeet Kohli and Swarat Chaudhuri. Its first target was libsignal, the reference implementation of the Signal protocol that protects chats in Signal and Google Messages.
The headline claim: agents proved key security properties of Signal's compiled machine code, not just its design. DeepMind calls it the first time the implementation of a widely deployed protocol like this "has been formally verified by any method, with or without AI." Sundar Pichai posted ↗ that the teams "put Gemini 4 Carbon to work" on it. The Register ↗ covered it the same day with an interview with Chaudhuri.
From the blog and the technical paper ↗:
Humans decide what to prove. Researchers worked with a mix of models to turn Signal's security goals into formal specifications in Lean, a proof language, and human experts reviewed every one.
Agents do the proofs. Prover agents powered by Gemini Carbon generated about 6.5 million lines of Lean proof code. A proof counts only if Lean's kernel checks it against the approved specification.
The trusted base is small. The proofs rest on about 26,000 lines of trusted specifications and a formal model of AArch64 (64-bit ARM) machine code. They do not need to trust the Rust source or the compiler.
Agents flag their own weak spots. An audit pass marked about 1% of the code for a human second look.
Time: four weeks. The Register adds that this took a team of five people and "quite a few tokens." For comparison, it notes the seL4 microkernel verification took 20 person-years.
A bug test. DeepMind put two real, previously fixed bugs back into an isolated copy of the code. In both cases the system produced a machine-checked proof that the buggy version was insecure.
The proofs cover Signal's post-quantum PQXDH handshake and the Triple Ratchet, and establish forward secrecy, authentication, post-compromise security and handshake secrecy. Signal CTO Ehren Kret, quoted in the blog, called the use of agents "to translate live code into valid Lean theorems" "a major breakthrough."
The paper is precise about scope, and several readers flagged it:
| Covered | Not covered |
|---|---|
| libsignal v0.105.4 session code | The whole Signal app |
| Compiled AArch64 CLI binary | Key generation (keygen) |
| PQXDH setup, send, receive | Crypto primitives (assumed) |
The verified target is libsignal-cli, a small command-line harness DeepMind built around the unmodified libsignal crates. Cryptographic primitives are specified by contracts, not proved. The Register says the result "assumes perfect cryptography." The open-source repository ↗ (Apache 2.0) contains two independent proofs, one in a symbolic model and one in a computational model. Rebuilding and checking everything takes "several hours" and 15 to 34 GiB of RAM, per its README.
"Important scope: this isn't a proof that the entire Signal app is bug-free." — @tisoftwar ↗
"This does not verify every Signal app. The specification and assumptions still need scrutiny." — @AIDeveloperCode ↗
"a real-world crypto protocol, not a benchmark. If it holds up under audit, that's a strong case for long-horizon agents doing proof work humans can't scale." — @knightleijun ↗
Chaudhuri to The Register: "We really believe that the next frontier is not going to be proof but specification."
Reddit was not reachable for this story, so there are no Reddit quotes.
This is research, not a product you can sign up for. DeepMind has open-sourced the proof artifacts, not a hosted AlphaProof Code service, and gives no availability date. You can read and re-check the Signal proofs today. You cannot point AlphaProof Code at your own repository.
The useful lesson for teams using AI coding tools is the split of work. Humans wrote and reviewed the specification; agents wrote millions of lines nobody reads line by line; a strict checker decided what counts. AWS used the same pattern this week with AWS Emulator, swapping Lean for tests against real AWS. If you already rely on AI review, our AI code review tools guide covers the products you can use now.
Signal users do not need to do anything. DeepMind reported no flaw in the verified code. The result raises confidence in the code paths it covers, within the assumptions above.
It is the second DeepMind security result in a week. On November 6 its agents found two weaknesses in legacy 1024-bit RSA. That was offense; this is defense. For how Gemini compares with other assistants day to day, see ChatGPT vs Claude vs Gemini, and for the model that did the proofs, our Gemini 4 Carbon launch post.