Google DeepMind's AI Agents Wrote 6.5 Million Lines of Proof to Show Signal's Encryption Code Holds Up

The encryption behind billions of private chats in apps like Signal and Google Messages now has something it never had before: a mathematical proof that its compiled code actually delivers the protections the protocol promises. Google DeepMind announced on Tuesday that AI agents wrote that proof, and that the job took four weeks.

The tool is called AlphaProof Code. People decide what needs proving, and a team of agents running on Gemini Carbon does the proving. Google says it is the first time the implementation of a widely deployed cryptographic protocol has been formally verified by any method, with or without AI.

Proof at the machine-code level

Most protocol proofs stop at the design. Real bugs tend to live in the gap between the design on paper and the code that ships, so DeepMind went all the way down. It compiled libsignal, Signal's official Rust library, with the stock compiler for ARM chips, and proved theorems about the resulting machine code.

According to the research paper, the agents produced about 6.5 million lines of Lean proof, a language whose checker rejects any step that does not hold. That rests on roughly 26,000 lines of specifications and chip semantics that people have to trust. The proofs cover Signal's post-quantum PQXDH handshake and its Triple Ratchet, and establish forward secrecy, authentication, post-compromise security and handshake secrecy.

Five people, four weeks

The scale of the shortcut is the real story. The paper notes that verifying the seL4 microkernel, the field's best known success, took twenty person-years. Here a team of five ran agents nonstop on their workstations for four weeks. The researchers say they chose what to prove and approved every trusted statement, but did not write proofs themselves. The agents also flagged the parts that needed a human look, which Google puts at about 1% of the codebase.

To check the system could tell good code from bad, the team put two real, already fixed Signal bugs back into an isolated copy of the code. Both times, AlphaProof Code produced a machine-checked proof that the buggy version was insecure.

What the proof does not cover

The result has clear limits, and the paper spells them out. It assumes the underlying cryptographic building blocks are sound, it leaves side channels out of scope, and its bounds give no guarantee against a quantum attacker. It also verifies the protocol library, not the full Signal app, as The Register points out.

Even so, formal verification has always been too slow and too expensive for nearly all software. Carbon, which Google opened to paying developers the same day, just turned a multi-year expert project into a month of agent time. DeepMind has published the full Lean development on GitHub for anyone to check.

Some offers on this page may be paid placements or contain affiliate links.