--- title: "Google DeepMind's AlphaProof Code verifies Signal protocol's real implementation with AI agents" url: https://llmreport.gr/news/google-deepmind-s-alphaproof-code-verifies-signal-protocol-s-real/ language: en published: 2026-11-10T13:11:20.114Z updated: 2026-11-10T13:11:20.119Z site: "LLM Report" section: "Models" --- # Google DeepMind's AlphaProof Code verifies Signal protocol's real implementation with AI agents Google DeepMind says AI agents proved security properties of the code behind the Signal protocol in four weeks, using a new framework called AlphaProof Code. The company is open-sourcing the verification artifacts. > Written with AI from the sources listed below. Editorial responsibility: Konstantinos Perros. How we write: https://llmreport.gr/how-we-write/ ## Key facts - Google DeepMind announced on 10 November 2026 that AlphaProof Code, a multi-LLM agentic framework, was used to formally verify core code of the Signal protocol. [1] - The company says this is the first time a widely deployed cryptographic protocol has been formally verified at this depth with AI, and the first verification of such an implementation by any method. [1] - Agents running on Gemini Carbon produced more than six million lines of Lean, and humans were asked to re-examine about one percent of the codebase. [1] - DeepMind reports the process took four weeks, against years for expert teams in the past, and it is releasing its verification artifacts as open source. [1] ## What Google DeepMind announced On 10 November 2026 Google DeepMind described a result it calls a milestone in software security. Its researchers directed AI agents to prove mathematically that the real code behind the Signal protocol meets key security properties. The protocol protects private conversations for billions of people in apps such as Signal and Google Messages, according to the company. The work used AlphaProof Code, which DeepMind presents as a new agentic framework for formal verification that pairs human expertise with AI agents. Formal verification means proving mathematically that code behaves correctly, which the company calls the highest standard of security assurance, though slow and labour-intensive. DeepMind claims two firsts: AI had not previously verified a widely used cryptographic protocol to this depth, and no method, AI-assisted or not, had verified the implementation of such a protocol before. ## How the verification worked DeepMind says AlphaProof Code splits the job much as a research team would. Human experts and AI decide what needs proving, and a group of agents then carries out the proofs. Researchers worked with several models to turn Signal's security goals into formal mathematical specifications, and human experts reviewed each specification. Agents powered by Gemini Carbon then wrote the proofs, producing over six million lines of Lean. Lean is a language whose checker confirms that proofs are valid. The agents audited their own output and flagged the parts needing a closer human look, which DeepMind puts at one percent of the codebase. Lean verified the rest automatically, so reviewers could concentrate where judgment matters. DeepMind stresses that the proofs go beyond the protocol's design. They address the compiled code that runs on devices, including guarantees such as keeping messages protected before and after a device is briefly compromised. The company argues that flaws often sit between design and implementation, which makes proofs at this level far more complex. It reports the verification took four weeks, a task it says has historically taken expert teams years. ## Testing, limits and next steps To check that the system distinguishes sound code from faulty code, DeepMind reinserted two genuine bugs, both fixed earlier, into an isolated copy of Signal's code. According to the company, the system returned a machine-checked proof of insecurity for the buggy version in both cases. DeepMind says the result lays groundwork for securing other critical systems, naming medical device firmware and power grid software, and that it could help defend against agent-driven cyber threats. It adds that scaling the techniques needs further research, and that pairing formal verification with automated defence agents such as CodeMender could help counter the speed and scale of modern attacks. The company is open-sourcing its verification artifacts and has published a technical paper. It credits Signal staff with feedback on the methodology. All claims in this report come from DeepMind's own announcement. ## Questions and answers **What did Google DeepMind verify?** It says AI agents proved key security properties of the actual code underlying the Signal protocol, not only of its design. **How long did the verification take?** DeepMind says four weeks, compared with years historically for expert teams. **Are the results available to others?** Yes. DeepMind says it is open-sourcing its formal verification artifacts for community use and has published a technical paper. ## Sources 1. Google DeepMind: [Introducing AlphaProof Code: a breakthrough in verifying complex software at depth](https://deepmind.google/blog/introducing-alphaproof-code)