Google DeepMind says AI agents have produced mathematical proofs that the code behind Signal’s encryption protocol keeps some of its most important promises. The lab published the result on its blog on 10 November, and describes it as the first time anyone has formally verified the working implementation of a widely used protocol like this, by any method. Signal and Google Messages both rely on the protocol, which the post says protects billions of conversations.
“Formal verification” is the phrase that needs unpacking. Ordinary testing runs a program many times and checks that nothing goes wrong. Formal verification writes a promise down in exact mathematical terms, such as the rule that a device compromised for a while still does not expose messages from before or after that window, and then builds a proof that the code keeps the promise for every input, including the ones no tester thought to try. A proof checker then accepts or rejects the argument mechanically. Here the checker is Lean, a language built for exactly that.
Cryptographers have studied protocols like Signal’s for decades, but most of that work examines the design. DeepMind’s post argues that real vulnerabilities tend to hide in the gap between the design and the code that implements it. Its proofs reach the compiled code running on devices, which is why the researchers call the result a milestone.
The system is called AlphaProof Code, and it splits the labor the way a research group would. Human experts and a mix of models converted what Signal is meant to guarantee into formal specifications, and people reviewed every one. Agents running on Gemini Carbon, a Google model, then wrote the proofs, which add up to millions of lines of Lean. The agents also audited their own work and flagged roughly one percent of the codebase for a human to look at again, because Lean checks the rest automatically.
DeepMind says the whole effort took four weeks, against the years it says expert teams have needed for comparable work. As a test, the researchers put two real bugs that Signal had already fixed back into an isolated copy of the code. Each time, the system came back with a proof, checked by machine, that the buggy copy was insecure. Two known bugs is a small sample, but it shows the tool can fail a broken program as well as pass a sound one.
The scope is narrower than the headline suggests. The proofs cover Signal’s core cryptographic code and the security properties that DeepMind’s experts specified. The post does not claim anything about the rest of the app, Signal’s servers, or other messengers, and a proof is only as strong as the list of promises it was asked to prove. A property nobody wrote down gets no guarantee.
Signal’s part is limited, going by DeepMind’s own account. The acknowledgements thank three Signal staff, Ehren Kret, Rolfe Schmidt, and Michael Rosenberg, for feedback on the methodology. They are named separately from the research team, and the post quotes no one from Signal and never says Signal commissioned the work or signed off on the results. Nobody outside DeepMind has yet confirmed the “first” claims or the four-week figure.
DeepMind is open-sourcing the verification artifacts and has published a technical paper, so outsiders can rerun the checks themselves. If the four-week figure holds up under that scrutiny, proof-level assurance stops being a luxury for a handful of projects and becomes a line item a security team can price against an audit.
Reported by the Google DeepMind blog on 10 November 2026.
