Google DeepMind built an AI proof agent called AlphaProof Code and proved key math rules inside the Signal encryption protocol. Five staff finished the test in four weeks. They checked real compiled `libsignal` v0.105.4 and `spqr` binaries, not just rough pseudocode.
Shared on DeepMind’s proof site on Nov. 10, 2026, the system wrote 6.5 million lines of Lean proofs. Those proofs cover 140,000 AArch64 Linux machine steps across Signal’s post-quantum PQXDH handshake and Triple Ratchet.
Executive Summary
- Machine-Code Proofs: AlphaProof Code proved properties of compiled libsignal v0.105.4 binaries (~140,000 AArch64 steps), leaving zero compiler gap.
- 6.5M Lines of Lean: Agents driven by Gemini 4 Carbon and Claude Opus 5.5 wrote 6.5 million lines of checked Lean code in four weeks.
- Security Guarantees: Proofs verified forward secrecy, identity checks, handshake secrecy, and post-compromise safety.
- Caught Real Bugs: When tested on old Signal builds with two past bugs put back in, proofs failed and flagged both flaws.
- Small Human Core: Experts only need to inspect ~26,000 lines of specs and chip rules because Lean’s kernel checks the rest.
Why Proving Compiled Binaries Beats Abstract Paper Math
Teams usually prove crypto designs on whiteboards, yet real bugs sneak in when programmers write Rust or C and compile it down. Checking raw CPU bytes by hand used to take experts years.
DeepMind sped up that slog by pairing AI search agents with Lean’s strict checker. Every step the AI guessed had to pass Lean’s math kernel. That stops fake proofs cold. Humans only audited ~26,000 lines of target rules and CPU specs.
Signal CTO Ehren Kret welcomed the test, saying binary proofs boost trust as AI cyber threats grow. DeepMind VP Pushmeet Kohli named banks and core software as next targets, linking closely to Google’s Gemini 4 Carbon security launch.
Stopping Self-Graded AI Proofs With Human Checks
Formal proofs still carry one sly trap. If an AI writes both the test goals and the proofs, it can invent easy rules that always pass. DeepMind scientist Swarat Chaudhuri warned humans kept tight control over all specs.
“We don’t want this sort of vibe world where AI is generating the goals and AI is generating the proofs and basically taking tests that are self-written.”
To test real rigor, staff ran AlphaProof Code on older Signal versions holding two old patched bugs. Both builds failed the proofs right away. That bug-catching power pairs well with automated audits in GPT-5.6 PHP flaw hunting.
Open Questions: Compute Bills and Full-App Scope
Even this Signal milestone has real bounds. DeepMind proved core crypto code, not the whole Signal phone app UI, storage, or server stack. Google also wouldn’t share what compute cost to write 6.5 million Lean lines or name commercial launch plans.
Still, sharing the Lean proofs openly hands security teams a clear map. Pairing AI search with strict proof kernels could shift high-stakes code from guesswork tests to solid math.
Technical Specs: AlphaProof Code Signal Audit
Scope, models, and proof counts from DeepMind’s Nov. 10, 2026 release:
| Audit Factor | Verified Detail | Security Value |
|---|---|---|
| Code Audited | libsignal v0.105.4 + spqr crate | Unmodified Rust compiled to AArch64 Linux |
| Machine Steps | ~140,000 AArch64 instructions | Covers PQXDH handshake and Triple Ratchet |
| Lean Output | ~6.5M lines of Lean proof code | Checked strictly by Lean math kernel |
| Human Trust Core | ~26,000 lines (specs + CPU rules) | Cuts manual audit work dramatically |
| AI Models Used | Gemini 4 Carbon & Claude Opus 5.5 | Five researchers finished work in four weeks |
| Bug Check | Two old Signal bugs re-tested | Proofs failed and caught both flaws |
Frequently Asked Questions
Did Google DeepMind verify the entire Signal messaging app?
No. AlphaProof Code verified core crypto code inside compiled libsignal v0.105.4 and spqr binaries, not the mobile app UI or servers.
What security traits did AlphaProof Code prove?
It proved forward secrecy, authentication, handshake secrecy, and post-compromise safety for Signal’s PQXDH and Triple Ratchet.
Could the AI have faked the Signal security proof?
No. Lean’s deterministic kernel checked every step, and re-adding two old bugs caused the proofs to fail.
Are DeepMind’s Signal proof files public?
Yes. DeepMind published the Lean proofs, specs, and paper openly on GitHub Pages.
