DeepMind Uses AI to Verify Signal Code: What It Proved

Key takeaways

• Google DeepMind says its new AlphaProof Code framework helped formally verify key security properties in the compiled code of Signal's reference protocol implementation.

• The November 10, 2026 research paper reports about 6.5 million lines of machine-checked Lean proofs, produced by a five-person team over four weeks.

• The result is significant but limited: it covers one-to-one sessions in a specific code build, not the full Signal apps, group messaging or every possible attack.

Google DeepMind announced AlphaProof Code on November 10, 2026, alongside a technical paper describing how the system helped prove security properties of libsignal, the reference implementation of the Signal protocol. The work connects mathematical security claims to compiled software code, but it does not mean every part of Signal or every messaging scenario has now been proven secure.

What did Google DeepMind verify?

The work focuses on libsignal version 0.105.4 and the SPQR post-quantum ratchet library version 1.6.0. The researchers compiled the unmodified Rust libraries into an AArch64 Linux executable and used a small command-line harness to test one-to-one messaging sessions at the machine-code level.

That distinction matters. Security research often proves that a protocol design should protect messages under a defined mathematical model. DeepMind's paper says its team went further by proving selected properties of the compiled implementation: the code that carries out the protocol's operations after compilation.

The proofs cover Signal's PQXDH handshake and Triple Ratchet messaging. The paper says the results establish properties including forward secrecy, authentication and post-compromise security. In plain English, these are protections intended to keep earlier messages safe if a key is later exposed, confirm who is participating in a session, and help restore message security after a device or session state has been compromised.

DeepMind says AI agents generated about 6.5 million lines of Lean proof code. Lean is a proof assistant: its small trusted kernel checks whether a mathematical proof follows from the specification. The framework used human-guided agents to draft and review the specifications, then prover agents to produce proofs that Lean could check.

The paper says five researchers completed the work in four weeks. The team also reintroduced two previously fixed bugs into an isolated copy of the code; the framework produced machine-checked results showing that the modified versions violated the specified security properties.

The primary sources are Google DeepMind's November 10 announcement and the technical paper and verification artifacts. Independent coverage from The Register also describes the research and its limits.

Why does this matter for messaging and software security?

Analysis: The important development is not simply that AI wrote millions of lines of proof code. The bigger step is that the researchers used machine-checked proofs to connect security properties to an unmodified, compiled implementation of a widely used cryptographic protocol.

Software can fail in the gap between a sound design and the code that implements it. A protocol may be carefully specified, yet a programming error, state-management mistake or unexpected interaction can undermine the intended protection. Formal verification aims to rule out classes of failures by proving that a specific implementation satisfies explicit properties.

That could matter well beyond messaging. The same general approach could eventually help teams examine software that controls financial systems, medical devices, cloud infrastructure or industrial equipment. These are areas where a flaw can have consequences far beyond a single app.

The result is also a useful example of human-and-AI collaboration rather than fully autonomous security engineering. People still decide which properties to prove, define the assumptions and review the specification. AI agents help produce the proof work, while Lean checks whether the proof is valid under those approved definitions.

Big Zero has previously covered how AI can assist defensive security work, including OpenAI's Linux vulnerability research and a Justice Department case involving alleged AI-assisted impersonation fraud. AlphaProof Code points toward a different defensive use: proving that selected security properties hold in code, rather than only searching for defects or responding after an attack.

What does this mean for Signal users and developers?

For everyday users, there is no new setting to turn on and no special update announced as part of this research. DeepMind described a research result, not a new Signal feature or a security advisory asking users to change how they communicate.

The practical takeaway is that formal verification may become a stronger part of how critical software is built and reviewed. Developers and security teams should watch for tools that make it easier to prove specific guarantees about real code, while continuing to use code review, testing, vulnerability reporting and timely updates.

For teams evaluating the research, the best starting point is the technical paper rather than the headline. Check which code version was analyzed, which properties were proved, which assumptions were trusted and which operating conditions were excluded. A proof is meaningful only within the scope of its specification.

What is still unknown and what should we watch next?

The paper is explicit that this is not a proof of every Signal feature. The work is restricted to one-to-one sessions; group messaging is left for future work. It verifies a command-line build of libsignal, not Signal's complete consumer applications.

The research also has assumptions and exclusions. The proofs rely on specifications and models that must be trusted, including assumptions about cryptographic primitives and the modeled machine environment. The paper's computational security result does not cover quantum attackers; a future-quantum guarantee appears only in the symbolic model, which idealizes cryptographic primitives. The study also does not establish the security of multi-device state or side-channel behavior.

Those limits do not erase the achievement. They define what the result actually supports and where additional work is needed. The next milestones to watch are independent scrutiny of the published specifications and proof artifacts, expansion to group messaging and other protocol components, and demonstrations on software outside this research example.

FAQ

Does this mean Signal is now impossible to hack?

No. The research proves selected properties of a particular build under defined assumptions. It does not rule out every possible vulnerability in Signal's apps, devices, operating systems, user accounts or surrounding infrastructure.

Did AI verify the entire Signal app?

No. The work examined a compiled command-line build of the libsignal reference implementation for one-to-one sessions. The paper says group messaging is future work and does not claim to have verified the full Signal applications.

What is formal verification?

Formal verification uses mathematical specifications and proofs to show that software satisfies defined properties. In this project, Lean checked the proof code produced by AI agents against specifications that human researchers helped create and review.

Does the research protect messages from future quantum computers?

The paper reports a quantum-resistance result for handshake secrecy in its symbolic model, which treats cryptographic primitives as idealized. Its computational proof covers classical attackers, so it would be inaccurate to say the study proves complete quantum security for all Signal communications.

Do Signal users need to do anything?

The announcement does not ask users to change settings or install a special update. Keep using the app's normal update channel and follow any future security guidance issued by Signal itself.

Bottom line

AlphaProof Code is a meaningful step toward using AI to make rigorous software verification more practical. Its Signal result is substantial but carefully scoped: one-to-one protocol code, selected guarantees and explicit assumptions. The next thing to watch is whether independent researchers and future projects can extend the method to more of the software people rely on every day.