ResearchPapers, evidence & method
DeepMind's AlphaProof Code agents produce machine-checked Lean proofs of security properties in Signal's compiled cryptographic code
Google DeepMind's AlphaProof Code used AI agents to write about 6.5 million lines of Lean proof. The proof shows that Signal's compiled libsignal binary meets key security properties for one-to-one sessions. Lean's kernel checked the proofs, and humans reviewed the specifications.
From the Google DeepMind article of November 10, 2026 and cited sources: The proofs cover the AArch64 binary that a standard Rust compiler produces from unmodified libsignal code. [5] [1]
SOURCES[5] AlphaProof Code Signal verification site google-deepmind.github.io[1] DeepMind blog: Introducing AlphaProof Code deepmind.google
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- The proofs cover the AArch64 binary that a standard Rust compiler produces from unmodified libsignal code. [5] [1]
- Original source
- Google DeepMind article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 10, 2026 article published
- Covered
- Nov 10 edition
- Evidence
- 10 sources across 9 sites
- 1DeepMind blog: Introducing AlphaProof Codedeepmind.google
- 2Cryspen: Helping Secure Signal's Post-Quantum Transitioncryspen.com
- 3arXiv 2605.30106: Rust-to-Lean Verification Pipeline with…arxiv.org
- 4arXiv 2607.26306: Foundational Refinement Proofs for EVM…arxiv.org
- 5AlphaProof Code Signal verification sitegoogle-deepmind.github.io
- 6RuntimeWire coverageruntimewire.com
StrongHow it’s measured
Hacker News · 140 likes · 63 comments
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
The proofs cover the AArch64 binary that a standard Rust compiler produces from unmodified libsignal code. The verified parts are the PQXDH handshake, the Triple Ratchet, session management, out-of-order messages and serialization. A symbolic model with 10 theorems covers forward secrecy, post-compromise security, authentication and resistance to key-compromise impersonation. A second, computational model gives concrete security bounds. As a test, two previously fixed bugs were put back into the code, and the system proved that the altered binaries break the security theorems. [5] [1]
Trust now rests on the specifications and assumptions rather than on the AI. The trusted base is about 26,000 lines, including a hand-written model of how AArch64 instructions behave. Thirty-seven cryptographic primitives, such as SHA-2, AES and ML-KEM, are assumed correct through contracts instead of being proved. Code that has been proved correct can still have bugs in parts that sit outside the proof. [5] [10]
DeepMind reports that the work took four weeks and that humans reviewed about 1% of the code, which the agents flagged. Both figures come only from DeepMind. Google reportedly would not share the cost or say whether a product will follow. [1] [9]
The work follows a wider pattern: AI agents write the proofs and the Lean kernel checks them, so the AI does not have to be trusted for correctness. The claim to be first should be read narrowly. Cryspen had already verified parts of Signal's Rust code, but for narrower goals such as panic-freedom rather than end-to-end protocol security. [2] [3] [4]
an open, machine-checked proof against a pinned libsignal version that others can re-run or extend. Implication: if agents make proofs cheap, the hard part becomes writing correct specifications and auditing assumptions.
Read the full assessment
Unknown costs still make budgeting speculative.
Executive brief
Google DeepMind says AI agents produced a machine-checked proof that Signal's real, compiled cryptographic code keeps its main security promises. The work took four weeks, a job that DeepMind says has historically taken expert teams years. The agents wrote about 6.5 million lines of Lean proof. Lean's checker verified the proof automatically, and humans reviewed the specifications plus about 1% of the code that the agents flagged. The scope is limited to one-to-one sessions in libsignal. Group messaging, multi-device state and the rest of the app are not covered. No independent group has reproduced the result yet. DeepMind has open-sourced the artifacts and has not disclosed what the project cost.
What changed and event timeline
Cryspen verifies Signal's SPQR
Cryspen checked the design of SPQR, Signal's new post-quantum ratchet, with ProVerif. It also checked the core Rust code with hax/F* for panic-freedom and some correctness goals, and noted that verifying the full codebase was "still some distance away" ().
Independent Rust-to-Lean pipeline
Klaus, Conejero and Tolmach used Harmonic's Aristotle and Logical Intelligence's Aleph provers to close Lean proofs for Plonky3 and RISC Zero cryptography ().
EquiVM
Lazaropoulos and Paraskevopoulou used LLM agents to generate Lean refinement proofs for 35 production EVM contracts, mostly with little human intervention ().
AlphaProof Code announced
DeepMind reports agent-generated Lean proofs of security properties for Signal's protocol implementation. Signal CTO Ehren Kret calls it "a major breakthrough" ().
Capabilities and access
- Target: libsignal v0.105.4 with SPQR v1.6.0. It covers the PQXDH handshake, the Triple Ratchet, session management, out-of-order messages and protobuf serialization (project site).
- Not covered: key generation, groups and multi-device state (project site).
- Models: the proof agents run on "Gemini Carbon." The other models in the multi-LLM setup are not named (DeepMind blog).
Read the full section
- Target: libsignal v0.105.4 with SPQR v1.6.0. It covers the PQXDH handshake, the Triple Ratchet, session management, out-of-order messages and protobuf serialization (project site).
- Not covered: key generation, groups and multi-device state (project site).
- Models: the proof agents run on "Gemini Carbon." The other models in the multi-LLM setup are not named (DeepMind blog).
- Access: the Lean development, the specifications and the build scripts are on GitHub. AlphaProof Code itself has no announced product or API.
Technical analysis for researchers and developers
- What is proved: the proofs target the compiled AArch64 binary that stock rustc 1.98.1 produces from unmodified Rust.
- Two proof layers: a symbolic model with 10 theorems (forward secrecy, post-compromise security, authentication, resistance to key-compromise impersonation) and a computational model with concrete security bounds.
- Trusted base: about 26,000 lines, including roughly 7,578 lines of AArch64 semantics.
Read the full section
- What is proved: the proofs target the compiled AArch64 binary that stock rustc 1.98.1 produces from unmodified Rust. Nothing is translated from Rust source with tools like Aeneas or hax (project site).
- Two proof layers: a symbolic model with 10 theorems (forward secrecy, post-compromise security, authentication, resistance to key-compromise impersonation) and a computational model with concrete security bounds.
- Trusted base: about 26,000 lines, including roughly 7,578 lines of AArch64 semantics. Thirty-seven cryptographic primitives (SHA-2, AES-CBC, curve operations, ML-KEM) are replaced by contracts, so their correctness is assumed rather than proved.
- Agent safeguard: a "gatekeeper" agent compares the proofs against held-out copies of the specifications.
- Execution model: single-threaded, statically linked, with a fixed clock and file-supplied randomness.
Claims and evidence
- "First" claim: DeepMind calls this the first verification of a widely deployed protocol implementation "by any method" (blog). Read it narrowly.
- Bug detection: two previously fixed bugs were reintroduced: decrypting a prekey message under an archived session, and skipping MAC verification.
- Self-reported figures: the four-week duration and the 1% human-review figure come only from DeepMind (blog). Coverage so far quotes no independent experts (RuntimeWire).
Read the full section
- "First" claim: DeepMind calls this the first verification of a widely deployed protocol implementation "by any method" (blog). Read it narrowly. Cryspen had already verified parts of Signal's Rust code, though for panic-freedom and selected correctness rather than end-to-end protocol security (Cryspen).
- Bug detection: two previously fixed bugs were reintroduced: decrypting a prekey message under an archived session, and skipping MAC verification. In both cases the system produced Lean proofs that the mutated binaries violate the security theorems (project site).
- Self-reported figures: the four-week duration and the 1% human-review figure come only from DeepMind (blog). Coverage so far quotes no independent experts (RuntimeWire).
Context and prior work
- Signal's Double Ratchet was earlier analyzed with automated symbolic tools (Oxford MRG), and PQXDH was analyzed at USENIX Security 2024 (Cryspen).
- Recent independent work uses the same pattern: AI agents generate proofs and the Lean kernel checks them, so the AI is not trusted for soundness (arXiv 2605.30106, arXiv 2607.26306).
- AlphaProof Code follows DeepMind's October 2025 CodeMender security agent (DeepMind blog).
Read the full section
- Signal's Double Ratchet was earlier analyzed with automated symbolic tools (Oxford MRG), and PQXDH was analyzed at USENIX Security 2024 (Cryspen).
- Recent independent work uses the same pattern: AI agents generate proofs and the Lean kernel checks them, so the AI is not trusted for soundness (arXiv 2605.30106, arXiv 2607.26306).
- AlphaProof Code follows DeepMind's October 2025 CodeMender security agent (DeepMind blog).
Limitations, safety and contested findings
- What the guarantees rest on: idealized or assumed primitives (Gap-DH, XEdDSA unforgeability, HKDF/HMAC as PRFs) and a hand-written AArch64 semantics (project site).
- Scope: "selected" properties of the crypto layer, not the whole app (RuntimeWire; StartupHub).
- No new vulnerabilities: none were found in the covered code.
Read the full section
- What the guarantees rest on: idealized or assumed primitives (Gap-DH, XEdDSA unforgeability, HKDF/HMAC as PRFs) and a hand-written AArch64 semantics (project site).
- Scope: "selected" properties of the crypto layer, not the whole app (RuntimeWire; StartupHub).
- No new vulnerabilities: none were found in the covered code. Google reportedly declined to share the cost or say whether a commercial product will follow (Dealroom feed).
- Trusted base caveat: a Hacker News discussion of a separate Lean project shows that "proved correct" code can still have bugs in its unverified trusted base (HN).
Business and practitioner implications
- Where the effort moves: if writing proofs gets cheap, the bottleneck becomes writing correct specifications and auditing assumptions (RuntimeWire).
- For security teams: an open Lean artifact against a pinned libsignal version gives a concrete baseline to re-check, extend or challenge.
- Planning: cost per verified line is unknown, so budgets can't be built on this yet.
Read the full section
- Where the effort moves: if writing proofs gets cheap, the bottleneck becomes writing correct specifications and auditing assumptions (RuntimeWire).
- For security teams: an open Lean artifact against a pinned libsignal version gives a concrete baseline to re-check, extend or challenge.
- Planning: cost per verified line is unknown, so budgets can't be built on this yet. DeepMind names medical-device firmware and power-grid software as possible next targets (StartupHub).