Google DeepMind announced on Nov 10, 2026 that its new AI framework, AlphaProof Code, was used to formally verify the actual code of the Signal protocol. Formal verification means mathematically proving that software behaves exactly as intended, without hidden bugs. The team guided AI agents to generate and check a proof that the compiled Signal code enforces key security guarantees, such as keeping messages safe even if a device is temporarily compromised. The entire effort took four weeks, a task that would normally require expert teams years of work.
What AlphaProof Code does
AlphaProof Code is a multi‑LLM (large language model) agentic system. Human researchers first translate Signal’s security goals into formal specifications, reviewing each step. Then a group of agents, powered by DeepMind’s Gemini Carbon model, writes the proof in Lean, a language that checks mathematical theorems. The agents produced over six million lines of Lean code and flagged only about one percent of the codebase for human review. The system also correctly identified two previously fixed bugs when they were re‑introduced, showing it can tell secure code from buggy code.
Why this matters
The verification covers the compiled implementation, not just the design, closing a gap where many real‑world vulnerabilities hide. Signal’s chief technology officer, Ehren Kret, said the result gives “greater confidence in our code’s privacy guarantees.” Experts see this as a step toward using AI to provide elite security assurance for banks, medical devices, power‑grid software and other critical systems.
Why it matters
For everyday users, the work means the encryption that protects billions of messages in Signal and Google Messages has been mathematically checked at the implementation level, reducing the risk of hidden flaws. For developers, it shows a practical path to use AI‑assisted formal verification to speed up security reviews, though broader scaling and cost details remain unclear.
