DeepMind's AlphaProof Code formally verifies Signal protocol code

Google DeepMind has announced AlphaProof Code, a multi-LLM agentic framework for formal verification, and says it used the framework to mathematically prove key security properties of the actual code underlying the Signal protocol. That protocol, DeepMind notes, protects billions of private conversations in apps like Signal and Google Messages. Formal verification means mathematically proving that code runs correctly without flaws. DeepMind calls it the highest standard of security assurance, but difficult and often labor-intensive.

DeepMind claims two firsts. It says this is the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth, and also the first time the implementation of such a protocol has been formally verified by any method, with or without AI. Most protocol verification, the post says, stops at the design level. Its agents went further and proved that the compiled code meets the key security properties, down to the exact code running on devices. One example property is keeping messages protected before and after a device is temporarily compromised. DeepMind argues that real-world vulnerabilities often hide in the gap between design and implementation, which is why closing that gap makes the proofs far more complex.

The framework splits the work the way a research team would: human experts work with AI to decide what to prove, and a group of AI agents does the proving. The process had three steps. First, researchers worked with a mix of models to translate Signal's security goals into formal mathematical specifications, and human experts reviewed every one. Second, agents powered by Gemini Carbon did the proofs, generating over six million lines of Lean, a language used to mathematically prove that code is correct. Third, the agents audited the proof and flagged the parts that needed a second look from a human. That was just one percent of the codebase. Because Lean checks the rest automatically, the experts could focus their review where human judgment matters most.

DeepMind says the verification of Signal's core cryptographic code took four weeks, for a task that historically takes expert teams years. The result is a proof that the code delivers the security protections the experts specified.

As a check that the system can tell correct code from buggy code, the team reintroduced two real, previously fixed bugs into an isolated version of Signal's code. In both cases the system produced a machine-checked proof that the buggy version was insecure.

Looking ahead, DeepMind says verifying Signal's core cryptography lays the groundwork to secure other vital systems, from medical device firmware to power grid software, and that the approach could bring elite security assurance to businesses, governments and critical infrastructure. It adds that scaling these techniques requires continued research, and that paired with automated defense agents like CodeMender, formal verification can help counter the speed and scale of modern cyber threats. DeepMind is open-sourcing its formal verification artifacts for community use. The post lists Swarat Chaudhuri, Andrew Ferraiuolo, Anton Kovsharov, Tej Chajed, Sam Schlesinger, Karn Seth, Jonathan Katz, Charles Sutton and Pushmeet Kohli as the people who developed the research, and thanks Signal's Rolfe Schmidt, Michael Rosenberg and Ehren Kret for feedback on the methodology.

Key facts

DeepMind says AlphaProof Code, a multi-LLM agentic framework, produced machine-checked proofs of key security properties of the actual code underlying the Signal protocol, down to the exact code running on devices.
Agents powered by Gemini Carbon generated over six million lines of Lean; the agents flagged just one percent of the codebase for a second look by a human, and human experts reviewed every formal specification.
DeepMind says the verification of Signal's core cryptographic code took four weeks, a task that historically takes expert teams years.
As a test, two real, previously fixed bugs were reintroduced into an isolated version of Signal's code; in both cases the system produced a machine-checked proof that the buggy version was insecure.
DeepMind claims this is the first time AI has formally verified a widely deployed cryptographic protocol at this depth, says scaling needs continued research, and is open-sourcing the verification artifacts.

Why it matters

Cryptographic protocols underpin nearly all digital communication, from online banking to web browsing, and DeepMind notes that a single flaw can expose millions of people at once. Experts have spent decades formally analyzing such protocols, but most of that work stops at the design level, while real vulnerabilities often hide in the gap between design and implementation. DeepMind says its agents proved properties of the compiled code itself, and claims this is the first formal verification of the implementation of a widely deployed protocol like this by any method, with or without AI. It also reports that a job that historically takes expert teams years took four weeks.

Who it affects

The Signal protocol protects billions of private conversations in apps like Signal and Google Messages, so the proofs concern the code those users rely on. Security engineers and formal-methods researchers are the direct audience, since the verification artifacts are being open-sourced for community use. DeepMind also says the approach could bring elite security assurance to businesses, governments and critical infrastructure, and names medical device firmware and power grid software as later targets, as groundwork rather than as something already done.

How to use it

The post gives no product, pricing or access terms for AlphaProof Code itself. What it offers is the open-sourced formal verification artifacts, released for community use, and a technical paper that the post points readers to. Practitioners can study the approach: humans decide what to prove and review every specification, agents write the Lean proofs, and agents audit the result so that people only look closely at the flagged one percent. DeepMind also suggests pairing formal verification with automated defense agents such as CodeMender.

How solid is it

This is DeepMind's own announcement, and the claims, including both "firsts", are its own. The main evidence in the post is the machine-checked Lean proofs, which Lean checks automatically, and a sanity test in which two reintroduced, previously fixed bugs were each shown insecure by a machine-checked proof. Signal's Rolfe Schmidt, Michael Rosenberg and Ehren Kret are thanked for feedback on the methodology. The text does not say that Signal itself conducted or endorsed the verification beyond that thanks.

Risks and caveats

The proofs show that the code delivers the security properties the experts specified, so their value depends on those specifications, which is why human experts reviewed every one. The post reports no vulnerability found in Signal's actual current code; the only bugs it mentions are two previously fixed ones deliberately reintroduced for testing, and it does not say which they were. It also does not give the size of the verified codebase, the size of the human team or the compute cost of the four-week run, and the "years" for historical effort is not quantified. DeepMind itself says scaling these techniques requires continued research, and the extension to firmware and power grids is stated as groundwork only.

“Our work marks the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth.”

— Google DeepMind, AlphaProof Code announcement