On November 10, 2026, Google DeepMind published AlphaProof Code, a multi-agent framework for formal verification, and used it on libsignal, the reference implementation of the Signal protocol. The technical paper says the agents "generated about 6.5 million lines of machine-checked Lean proof code, resting on about 26,000 lines of trusted specifications and AArch64 semantics." The proofs cover Signal's post-quantum PQXDH handshake and its Triple Ratchet, and establish "forward secrecy, authentication, post-compromise security, and handshake secrecy."
What separates this from earlier Signal analysis is the target. Most protocol proofs check the design. Here the team compiled the unmodified Rust crates with stock rustc 1.98.1 into one AArch64 Linux executable and proved properties of that binary, instruction by instruction, from its entry point to its exit. The paper explains why: source-level Rust verifiers "trust rustc, LLVM and a model of Rust's semantics, so we verify the compiler's output directly."
How the work was split
- People own the specification. A specification-writer agent drafts Lean statements of what must hold, reviewer agents critique them, and a human approves the result. The paper says "the majority of human effort in software verification now lies in engineering the specification".
- Agents own the proof. Teams "typically had 40 to 80 agents and ran on a single machine for 24 to 72 hours" per campaign. DeepMind's post says the provers were "powered by Gemini Carbon" and the whole effort took four weeks.
- Lean is the gatekeeper. Proofs are accepted only if Lean's kernel checks them against the approved specification, so a wrong proof cannot slip through, however long it is.
- A bug test. DeepMind says it "reintroduced two real, previously fixed bugs into an isolated version of Signal's code" and in both cases got a machine-checked proof that the buggy version was insecure.
Where the guarantee stops
The paper is unusually direct about its limits. Key generation "is not verified", so the theorems take the parties' keys as given. Side channels "are out of scope". The symbolic proof assumes perfect cryptography, and the computational bounds "give no guarantee against a quantum adversary". One-time Kyber prekeys are not modeled, only one-to-one sessions in libsignal v0.105.4 are covered, and group messaging is left as future work. The results also trust Lean's kernel and the contracts of some routines the executable calls.
What remains uncertain. DeepMind's claim that this is the first such verification of a widely deployed protocol implementation "by any method" is its own, and outside experts have only just received the artifacts. A proof about one compiled build says nothing directly about other versions, compilers or the Signal apps built on the library.
Analysis: The labour of proof is getting cheap, and the specification is becoming the expensive, reviewable part. That changes what a team should ask for. If Jenya's team at Belgavi's Book Store were offered an AI-generated proof that its payment-token code is safe, the first review should be of the short specification and the list of trusted assumptions, not the millions of proof lines. A strong-sounding theorem that leaves key generation or side channels out is still useful, provided everyone knows which risks remain for testing and review.
Sources and evidence
DeepMind's AlphaProof Code produced about 6.5 million lines of kernel-checked Lean proof that libsignal's compiled AArch64 binary meets PQXDH and Triple Ratchet security properties, resting on 26,000 trusted lines. Key generation, side channels, quantum adversaries for the computational bounds and group messaging are outside the result. Review the specification and assumptions, not the proof bulk.