Google DeepMind's AI Agents Prove Signal's Core Code in Four Weeks

Google DeepMind researchers used teams of AI agents to produce roughly 6.5 million lines of machine-checked Lean proof code verifying security properties of Signal's compiled libsignal implementation — work that five humans completed in four weeks without writing any proof code themselves.

The team introduced AlphaProof Code on November 10, 2026, and published its technical paper alongside specifications and verification artifacts for outside review. The paper describes the result as the first protocol-level security proofs for the unmodified code of a widely deployed cryptographic protocol implementation.

Unlike earlier academic work that modeled Signal's protocol design in the abstract, the DeepMind team verified the actual compiled binary. Researchers wrapped the unmodified libsignal v0.105.4 and SPQR v1.6.0 crates in a small command-line harness, then used stock rustc to build a statically linked AArch64 Linux executable.

How did the agents divide the work?

The five-person team ran agents continuously on their workstations while pursuing symbolic and computational proofs in parallel, according to the paper. Agents powered by Gemini 4 Carbon and Claude Opus 5.5 drafted and reviewed the trusted specifications — roughly 26,000 lines including AArch64 semantics — with review from a different model family as a check.

Gemini 4 Carbon agent teams then generated all of the proof code. Typical campaigns deployed 40 to 80 agents on a single machine for 24 to 72 hours, with an orchestrator and team leads coordinating proof workers while architect and integrator roles maintained the shared proof base.

Humans kept control at the points that matter. The researchers selected the properties, resolved ambiguities and security trade-offs, reviewed specifications and retained final approval.

A gatekeeper accepted a proof only after Lean's kernel checked it and a comparator confirmed it matched the human-approved specification, including every transitive definition, using only Lean's standard axioms. Agents could propose small amendments when proofs exposed specification problems, but changes to trusted assumptions required human approval or a user-set policy and were logged with justifications. The control targets a documented risk in agent-generated proofs: a specification can be weakened indirectly through one of its definitions.

What security properties were verified?

The target was one-to-one session code covering the PQXDH handshake and Triple Ratchet messaging. The team reports two independent arguments:

• Ten symbolic theorems under idealized cryptographic assumptions
• A computational proof bounding an attacker's advantage through cryptographic assumptions and statistical terms

The verified properties include forward secrecy, which protects earlier messages after current state is stolen; authentication; post-compromise security, covering recovery after a compromise; and handshake secrecy. The symbolic argument additionally covers handshake secrecy after a later Diffie–Hellman break.

To test whether the specifications catch real errors, the team reverse-applied the fixes for two previously repaired libsignal bugs, known as weak state and small subgroup, and recompiled the altered binaries. In both cases, agents produced Lean proofs that the symbolic security theorem failed.

The public verification repository separates the computational, symbolic, shared binary and AArch64-semantics material and documents how to rebuild and independently check the proofs.

Signal chief technology officer Ehren Kret said the work "gives us even greater confidence in our code's privacy guarantees."

What the proofs do not cover

The guarantees stop well short of certifying Signal's complete applications. They concern the researchers' libsignal-cli build running as a fresh process. Key generation was not verified, group messaging was left for future work, and side channels and multi-device state fall outside the scenario. Low-level cryptographic primitives and selected output and library routines are represented by trusted contracts, so the result also depends on those contracts, the approved specifications, Lean's kernel, the AArch64 semantics and assumptions about the primitives.

The paper states that neither argument proves the post-quantum healing that SPQR is designed to add: the computational theorem covers classical attackers, while the symbolic ratchet theorems let the attacker choose SPQR keys. The computational model also restricts several attacker actions and becomes vacuous at sufficiently large message and session scales. These boundaries define what an outside reviewer must trust before treating the machine-checked proofs as a security guarantee for a particular deployment.

The researchers' stated next steps are to strengthen the theorems, reduce the trusted base by verifying more hooked routines and connecting cryptographic contracts to verified implementations, and expand coverage to group messaging, sealed sender and server-side protocols. Their objective of verifying new libsignal releases before shipment is a research goal, not an announced deployment.

The immediate significance is the division of labor the result demonstrates: agents handled the proof construction, while assurance still rests on human-reviewed specifications and explicit assumptions. Releasing the proofs and checking procedures gives outside reviewers a way to test that foundation as the researchers work to carry the workflow into continuing libsignal development.