On November 10, 2026, Google DeepMind published Introducing AlphaProof Code, describing what it calls the first use of AI to formally verify a widely deployed cryptographic protocol at this depth. The target was the code behind the Signal protocol, which protects private conversations in Signal and Google Messages. Over roughly four weeks, DeepMind says its agents generated more than six million lines of Lean, a language used to mathematically prove that code is correct, and that human experts reviewed every formal specification.
Most AI security news is about finding flaws. This is about the opposite direction: proving that specific properties hold. The distinction matters for how to read the result, and this post sets out what DeepMind claims, how the pipeline divides work between people and models, and where the claim stops.
What DeepMind says it did
DeepMind describes AlphaProof Code as a multi-LLM agentic framework in which human experts decide what to prove and AI agents carry out the proofs. The workflow, as described on the page, has four steps:
- Specification. A mix of models translated Signal's security goals into formal mathematical specifications. Human experts reviewed every specification.
- Proof. Agents powered by Gemini Carbon wrote the proofs in Lean.
- Audit. Agents audited the proofs and flagged about one percent of the codebase for human review.
- Checking. Lean automatically checks the rest.
The proofs are about the implementation, not only the design. DeepMind says they show the compiled code achieves key properties, such as keeping messages protected before and after a device is temporarily compromised. It notes that real-world vulnerabilities often hide in the gap between a protocol's design and its implementation, which is why implementation-level proofs are considerably harder than design-level analysis.
GoogleThe part that carries the weight: the checker, not the model
A reader's first question about AI-written proofs is whether the model could be wrong. The answer is architectural. In a proof assistant such as Lean, a proof is accepted only if a small, trusted checker verifies each step. The model is therefore a proposer, not a judge: a flawed proof is rejected, however confident the model was.
That shifts where trust sits. The two places that still need people are the ones DeepMind highlights. The first is the specification, because a proof shows that code meets a statement, and the statement must express what the designers actually care about. This is why human experts reviewed every specification. The second is the roughly one percent flagged for human attention.
Where the Signal proofs were checked
Approximate shares of the verified codebase, from Google DeepMind's description, per Google DeepMind.
DeepMind says agents audited the proofs and flagged about one percent of the codebase for human review, with Lean checking the rest automatically. Shares are approximate.
A machine-checked proof is only as meaningful as the statement it proves. The work of deciding what to prove stays with people.
Analysis of the AlphaProof Code division of labor
The bug-injection test
To test whether the system can tell correct code from buggy code, DeepMind reintroduced two real, previously fixed bugs into an isolated version of Signal's code. In both cases the system produced a machine-checked proof that the buggy version was insecure.
This is a useful check because a verifier that can only confirm good code is less informative than one that also refutes bad code. It is still a small sample: two bugs, both previously known and fixed. The page does not claim the system would find unknown flaws, and the result should not be read as a measure of discovery rate.
How it fits with other recent AI security work
In recent weeks AI security stories have mostly concerned discovery. A DeepMind result on 1024-bit RSA and Google's Gemini 4 Carbon security model both sit on the offensive or analytical side. AlphaProof Code is the defensive counterpart, and DeepMind links it with CodeMender, its AI agent for automated code defense.
The two approaches answer different questions:
| Approach | Question answered | Failure mode |
|---|---|---|
| Vulnerability discovery | Is there a flaw we have not found? | Misses flaws; produces false positives that people must triage |
| Formal verification | Does this code provably meet this stated property? | Property is too narrow or mis-stated; scope is limited to what was specified |
Discovery can never show absence, and verification can only show absence of what was specified. They are complements, not substitutes.
Limits of the claim
- Scope. DeepMind says the proofs cover key security properties, not every property of every component. A verified protocol implementation does not mean the surrounding application, operating system or hardware is verified.
- Self-reported. The result comes from DeepMind's own publication. An accompanying technical paper, "Formal Verification of Signal", and open-sourced artifacts are available for outside scrutiny, which is the route by which independent experts can test the claims.
- Superlatives. The page calls this the first time the implementation of a widely deployed protocol like this has been formally verified by any method. That is DeepMind's characterization, not an independently confirmed ranking.
- Generalization. DeepMind says the work lays groundwork for systems such as medical device firmware and power grid software, and also says scaling these techniques needs further research.
Signal's chief technology officer, Ehren Kret, is quoted on the page calling the use of AI agents to translate live code into valid Lean theorems "a major breakthrough". That is a statement from a collaborator and should be read as such.
What to watch
The cost curve is the practical story. If proofs that took expert teams years can be produced in weeks, the economics of verifying high-assurance code change, and the binding constraint becomes writing correct specifications and reviewing flagged items. Teams evaluating AI for security work may find it useful to compare several models on the same verification and review tasks, and tools such as Metir, which put multiple models in one workspace, make that comparison straightforward.
Sources:
Image credits
Header and in-body image: Google-Deep Mind headquarters in London, 6 Pancras Square, by Gciriani, via Wikimedia Commons, licensed CC BY-SA 4.0.