The Library Media — Science, Technology & Health · AI News & Intelligence Desk
AI Agents Just Proved Signal’s Encryption Code Correct — Six Million Lines of Proof in Four Weeks
By Catalina Clarke
Follow The Library Media
There is a difference between testing software and proving it. Testing samples what a program does; a proof establishes what it cannot do — in this case, that the code protecting the world’s most trusted encrypted messenger cannot quietly fail at the properties it promises. On Tuesday, Google DeepMind announced that a system it calls AlphaProof Code has done exactly that for Signal: mathematically verified key security properties of the actual code underlying the Signal protocol, the technology that also protects conversations in Google Messages.
DeepMind describes it, in its own words, as “the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth.” That is the company’s claim, and it is a large one. What sits underneath it is concrete enough to examine.
How the proof was built
Formal verification begins with a specification: a precise mathematical statement of what the code must guarantee. Human experts worked with models to translate Signal’s security goals into formal specifications, and humans reviewed every one of them — a detail that matters, because a proof is only ever as meaningful as the statement it proves.
Then the machines went to work. Agents powered by DeepMind’s Gemini Carbon models generated more than six million lines of Lean — the proof assistant whose kernel machine-checks every step, so a finished proof is not an argument a reviewer found persuasive but one a computer has verified line by line. The technical paper puts the total at roughly 6.5 million lines. When the proving was done, the agents turned auditor and flagged about 1% of the codebase for a human second look.
What was actually verified
The scope was the core of the protocol: Signal’s post-quantum PQXDH handshake and its Triple Ratchet, in the libsignal library, version 0.105.4, unmodified. The properties proved include forward secrecy, authentication, post-compromise security and handshake secrecy — and the verification ran down to the machine-code level, the instructions the processor actually executes, not just the source code programmers read. The whole exercise took four weeks. DeepMind notes that verification at this depth has historically taken expert teams years.
The most persuasive part of the announcement is the negative control. The researchers took an isolated copy of the code and deliberately reintroduced two real bugs that libsignal had previously shipped and fixed — known in the paper as “weak state” and “small subgroup.” In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure. A verification system that blesses everything proves nothing; this one demonstrably tells correct code from broken code.
What the proof does not cover
The limits deserve the same prominence as the result, and to its credit the work states them. The proofs assume perfect cryptography — they verify that the protocol’s logic uses its cryptographic building blocks correctly, not that the blocks themselves are unbreakable. They cover the one-to-one session code in the researchers’ libsignal build, not the full Signal applications. Key generation was not verified. Group messaging, side channels and multi-device state are out of scope. A proof covers only what it was told to prove, and everything outside the specification remains exactly as trustworthy — or as unexamined — as it was on Monday.
Why it matters
Signal’s chief technology officer, Ehren Kret, welcomed the work, saying it “gives us even greater confidence in our code’s privacy guarantees.” DeepMind is open-sourcing the formal verification artifacts, so other teams can inspect, reuse and extend them. The project also answers a challenge issued in April 2026 by the Beneficial AI Foundation, which asked whether Signal could be formally verified with Lean. It could — with AI agents doing the proving and humans holding the specification.
The deeper story is the division of labor. The scarce resource in formal verification was never intelligence; it was stamina — the millions of lines of meticulous proof that human experts could not produce at the speed software now ships. Agents have that stamina. What they do not supply is judgment about what is worth proving, and in this project that judgment stayed exactly where it belongs: with the humans who wrote and reviewed every specification. Six million lines of proof in four weeks is the headline. The arrangement that produced it — machines that prove, people who decide what proof means — is the precedent.
Reporting based on Google DeepMind’s announcement and technical paper, with cross-checks from The Register.
— Catalina Clarke, AI News & Intelligence Desk
Catalina Clarke is The Library Media’s editor-in-chief.
From The Library — the estate of our family.