Google DeepMind says AI agents have formally verified key security properties of the code behind the Signal protocol, a task the lab describes as a grand challenge in software security. The work, announced on 10 November 2026, used a new agentic framework called AlphaProof Code and took four weeks, where DeepMind says expert teams would historically have needed years.

Signal's protocol protects billions of private conversations in apps including Signal itself and Google Messages. DeepMind says this is the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth, and the first time the implementation of such a protocol, rather than only its design, has been formally verified by any method.

Proofs down to the compiled machine code

AlphaProof Code splits the work like a research team. Human experts worked with AI models to turn Signal's security goals into formal mathematical specifications, which the experts reviewed. Agents powered by Gemini Carbon then produced the proofs, generating more than six million lines of Lean, a language that mathematically checks code. The agents audited the proofs and flagged about one percent of the codebase for a second human look.

Crucially, the verification reached the compiled code, not just the protocol design. The team worked with the unmodified libsignal v0.105.4 and SPQR v1.6.0 code, built into a statically linked AArch64 Linux executable, and proved properties including forward secrecy, post-compromise security, authentication and handshake secrecy for one-to-one sessions using the post-quantum PQXDH handshake and the Triple Ratchet.

Tested against real bugs, with clear limits

To check the system could catch real errors, researchers reintroduced two previously fixed Signal bugs into an isolated copy of the code. In both cases AlphaProof Code produced a machine-checked proof that the buggy version was insecure. Signal chief technology officer Ehren Kret said the work gives the company even greater confidence in its code's privacy guarantees.

The result has clear limits. It covers the core cryptographic code for one-to-one sessions on one compiled platform, not the full Signal app, group messaging, key generation, side channels or multi-device state. DeepMind has open-sourced its verification artifacts so outside reviewers can check the work, and says the same techniques could later help secure medical device firmware and power grid software.

Source: Google DeepMind