On November 10, 2026, Google DeepMind announced AlphaProof Code, an agentic framework for formal verification. Its first public target was libsignal, the implementation behind Signal's encryption protocol, which also protects Google Messages. Most earlier work verified protocol designs. This work proves security properties of the compiled AArch64 machine code, so the trust base includes neither the Rust source nor the compiler.
This matters to builders for two reasons. It is the largest public example so far of LLM agents producing machine-checked proofs about production code. And it moves the bottleneck from writing proofs to writing and reviewing specifications. A wrong spec makes even a perfect proof meaningless.
What we checked
- What concrete evidence would resolve the remaining editorial uncertainty for this item? confirmed. DeepMind published a blog post, a long technical paper with a reviewer site, and an Apache-2.0 repository with build instructions. The Register reported the work independently. Together these settle what was proved, under which assumptions, and what was excluded. [3][1][4][2]
- Does the result show that the Signal app as a whole is secure? refuted. The proofs cover one-to-one PQXDH and Triple Ratchet sessions in a CLI harness. Quantum attackers, multi-device state and group messaging are excluded. Cryptographic primitives are replaced by contracts, and replay-based loss of forward secrecy is not ruled out. [1]
- Can outside builders use AlphaProof Code itself? unresolved. DeepMind is open-sourcing the verification artifacts (specifications and proofs). Neither the blog nor the repository offers the agent framework as a product or API, and The Register does not say whether outsiders can use it. [3][4]
What we found
- The paper puts the proofs at about 6.5 million lines of Lean. The blog says 'over six million'. The target is libsignal v0.105.4 with SPQR v1.6.0, compiled with stock rustc and restricted to one-to-one sessions. The properties proved are forward secrecy, post-compromise security, authentication and handshake secrecy, in both a symbolic model and a computational model. [1]
- The trusted base and the assumptions matter. The paper says 37 hooked routines, mostly cryptographic primitives such as SHA-256, X25519 and Kyber/ML-KEM, are replaced by contracts. That means the primitives are assumed correct, not verified. The paper also says its theorems do not rule out replay-based loss of forward secrecy. The Register describes the symbolic result as theoretical because it assumes perfect cryptography. [1][2]
- The system found no new bugs. As a validation step, the team reintroduced two real bugs that had already been fixed into an isolated copy of the code. In both cases the system produced a machine-checked proof that the modified version was insecure. That is evidence the specifications can tell secure code from insecure code, not just a smoke test. [3]
- DeepMind calls this the first formal verification, by any method, of a widely deployed protocol's implementation at this level. Builders can check the proofs themselves: the repository is licensed under Apache 2.0, pins its Lean toolchain, and reports a full build of several hours with tens of GiB of RAM. The 'first' claim has not been independently assessed against earlier partial verifications. Signal's CTO, as quoted in coverage, said earlier efforts covered smaller portions of the code. [3][4]
- The Register reports the effort took five people four weeks plus 'quite a few tokens'. The cost in compute is undisclosed. Chaudhuri, the lead author, told The Register that specification, not proof, is now the frontier. [2]
What it means
For teams building security-critical software, the takeaway is that agent-written, kernel-checked proofs about compiled binaries are now feasible at the scale of millions of lines. Human effort goes into specifications and the trusted base, not into writing proofs. If you adopt this approach, budget review time for specs, contracts and machine semantics. In this work those trusted pieces came to roughly 26,000 lines, and they are where errors would hide. Read any 'verified' claim alongside its exclusions list: group messaging, quantum attackers, multi-device state, the primitives, and replay attacks are all outside this proof.
Practically, there is nothing to integrate today. DeepMind released proofs and specifications, not the agent framework, and the compute cost is undisclosed. The released repository is still useful as a reference for how to structure binary-level specifications and contracts, and as a benchmark for anyone building their own Lean proof agents.
Competing readings
- This is a real milestone in scoped, binary-level verification: agents make the proving cheap, and specification becomes the bottleneck (likely, about 65%). What would tell it apart: Kernel-checked proofs of about 6.5M lines against compiled code, done in four weeks with about 1% human review [3][1]; Reintroduced bugs were proven insecure [3]; The lead author names specification as the frontier [2].
- This is mainly a showcase for Gemini Carbon and an internal capability, with little that builders can use in the near term (unlikely, about 25%). What would tell it apart: Only the artifacts are released, not the agent framework [3][4].
- The headline overstates the result: the assumptions and trusted base are large enough that 'verified Signal' misleads (very unlikely, about 10%). What would tell it apart: 37 contract-replaced routines, perfect-crypto assumptions, and replay attacks left open [1][2].
Base rate
Of 16 earlier research stories about models, organisations or projects in the New Runtime archive over the last 12 months that are at least 3 months old, 9 (56%) were followed within 3 months by a release story on the same company or product line. In 9 of 16 earlier research stories in New Runtime's archive, a release story about the same entity followed within 3 months. That makes a follow-on release from DeepMind, such as wider access to AlphaProof Code or a Gemini Carbon release, slightly more likely than not.
What would change this view
- Independent cryptographers find that a trusted specification or contract in the repository is wrong, making a headline theorem vacuous (signal): The 'overstated' reading would gain weight, and spec review would turn out to be the weak link.
- DeepMind offers AlphaProof Code as an API or open-source agent, with published pricing (pricing signal): The 'internal showcase' reading would weaken, and builders could adopt the method directly.
- Outside teams reproduce comparable agent-written binary proofs on other codebases (open-source signal): The method generalizes beyond a single, heavily staffed case study.
Still open
- Will AlphaProof Code, or Gemini Carbon proof tooling, be offered to outside developers, and at what cost?
- How many tokens and how much compute did the four-week effort use?
- Will Signal keep the proofs in sync as libsignal moves past v0.105.4?
- Can the approach extend to group messaging, multi-device state, and the cryptographic primitives that are currently handled by contracts?