Google DeepMind's Agents Verify Signal's Core Encryption Code in Four Weeks

Google DeepMind's AI agents wrote about 6.5 million lines of proof, and a person needs to read only about 26,000 of them to trust the result. The work, announced on Tuesday, is a machine-checked guarantee that the compiled code at the heart of the Signal protocol delivers the security properties experts specified. The protocol protects billions of private conversations, in Signal itself and, in variants, in WhatsApp and Google Messages. DeepMind says it is the first time the implementation of a widely deployed protocol like this has been formally verified by any method, with or without AI, and it took four weeks.

Proving Code the Way Mathematicians Prove Theorems

Formal verification means proving, with the rigor of a math theorem, that a program does what its specification says for every possible input, not just the ones a tester thought to try. It is the highest standard of software assurance and one of the slowest to reach. Most work on cryptographic protocols stops at the design on paper, DeepMind notes, while real-world vulnerabilities often hide in the gap between that design and the code that actually runs.

AlphaProof Code went all the way down that gap. The team took version 0.105.4 of libsignal, the open-source library at the core of Signal, compiled it for 64-bit ARM processors and proved properties of the resulting machine code itself. The proofs cover the PQXDH handshake, in which two people agree on a shared secret, and the Triple Ratchet, which keeps changing the keys as messages flow.

What those lines establish has abstract names and concrete stakes. Forward secrecy means a key stolen today cannot unlock yesterday's messages. Post-compromise security means a conversation becomes private again after a phone has been temporarily hacked. The proofs also cover authentication and, in a symbolic model, the secrecy of the handshake against a future quantum computer.

A proof that long raises an obvious question: who checks it?

The 26,000 Lines a Human Has to Trust

Lean does. Lean is a programming language built for mathematical proof, and its small kernel checks every step, so the agents writing the proofs never have to be trusted. Humans decide what to prove. Researchers worked with a mix of models, Gemini 4 Carbon and Claude Opus 5.5 among them, to turn Signal's security goals into formal specifications, “with human experts reviewing every one,” DeepMind wrote. Agents powered by Gemini Carbon then did the proving.

The agents work like a research group. In a typical proof campaign, 40 to 80 of them ran on a single machine for 24 to 72 hours, with an architect designing the overall plan and an integrator merging finished proofs into a shared library. Afterwards they audited the result and flagged about 1% of the codebase for a second look by a person.

What a reader has to trust comes to about 18,000 lines of definitions plus about 8,000 lines describing how the ARM processor executes instructions. Printed at 50 lines a page, the full proof would fill some 130,000 pages, while the part a human must read would fit in about 520.

“Using AI agents to translate live code into valid Lean theorems is a major breakthrough. — Ehren Kret, Chief Technology Officer of Signal”

To check that the system could tell good code from bad, the researchers slipped two real, previously fixed bugs back into an isolated copy of Signal's code. In both cases AlphaProof Code produced a machine-checked proof that the buggy version was insecure. In the code it covered, it found no new vulnerabilities, which leaves a bigger question: what else could get the same treatment?

Next on the List: Medical Devices and Power Grids

The paper is precise about where the proof ends. It covers one build of libsignal and one-to-one conversations; group chats are listed as future work. The theorems rest on the compiled program rather than the Signal mobile apps, a few cryptographic routines are assumed to behave as specified, and the computational security proof considers classical attackers only.

DeepMind's announcement does not say what the four weeks cost. The team has published its specification and proofs on GitHub, so other researchers can check the work line by line and reuse it.

The lab's ambitions reach well beyond messaging. Verifying Signal's core cryptography, it says, lays the groundwork to secure other vital systems, “from medical device firmware to power grid software.” Cryptographic protocols already sit under online banking and web browsing, where one flaw can expose millions of people at once.

For decades, a proof that real software keeps its promises was something only small, critical pieces of code could get, after years of expert work. Signal's core now has one, and it took a month.