DeepMind’s AlphaProof Code verifies selected Signal…

The agent framework demonstrated machine-checked proofs of core cryptographic properties—not whole-app security or a verification service software vendors can buy.

Google DeepMind introduced AlphaProof Code on November 10, 2026, describing a human-guided, multi-agent framework used to mathematically prove selected security properties of Signal’s cryptographic implementation.

The technical paper, “AlphaProof Code: Verifying Signal’s Security at the Machine-Code Level,” identifies the targets as libsignal, the protocol’s reference implementation, including its PQXDH handshake and Triple Ratchet. It reports machine-code-level verification of four selected properties: forward secrecy, authentication, post-compromise security and handshake secrecy. These are specified guarantees about particular code, not a blanket finding that surrounding systems are secure.

According to The Register, five people completed the verification in four weeks, generating 6.5 million lines of Lean proof code.

DeepMind described a division of labor: researchers and models translated security goals into mathematical specifications, humans reviewed each specification, and Gemini Carbon agents generated proofs. Lean checked those proofs. An agent auditing pass flagged one percent of the codebase for further human review, the company said.

“We don’t want this sort of vibe world where AI is generating the goals and AI is generating the proofs and basically taking tests that are self-written,” Swarat Chaudhuri, DeepMind research scientist, told WIRED.

DeepMind also reintroduced two previously fixed bugs into an isolated version of Signal’s code. The system produced machine-checked proofs that both buggy versions were insecure, the company said. WIRED reported that the analysis found no new vulnerabilities in the portions examined. DeepMind said it was open-sourcing the formal-verification artifacts.

The limits matter. WIRED reported that the project didn’t verify the entire Signal mobile app and benefited from earlier formal-verification work. The Register described the result as relying on an assumption of perfect cryptography, rather than guaranteeing the computational secrecy of bytes.

Axios described the work as research, not a currently available commercial cybersecurity product. DeepMind conducted the analysis free of charge, WIRED reported; Google declined to disclose its cost or comment on plans for a commercial verification service.

For owners of small B2B software businesses, the practical implication is sales-evidence discipline, not an immediate tool recommendation. Alongside the November 5 coverage of agent monitoring and small-business security, this research suggests a distinction for businesses deploying agents to find or serve customers: answering customer-data security objections requires naming the property tested, implementation covered and assumptions behind the result. AlphaProof Code’s demonstration doesn’t verify a reader’s product or establish a customer-growth outcome.

DeepMind’s AlphaProof Code verifies selected Signal security guarantees

Sources