Google DeepMind has pulled off something cryptographers have talked about for years. On November 10, the lab said its AI agents mathematically proved that the code behind Signal’s encryption does what it promises, finishing in four weeks. The work covers the protocol guarding private chats in Signal, WhatsApp, and Google Messages, touching billions of conversations a day.
The project is called AlphaProof Code. A five-person team guided Gemini Carbon agents as they generated more than six million lines of proof in Lean, a language built for checking mathematical arguments. Lean’s kernel then checked every line, and a proof that doesn’t hold gets thrown out.
Four weeks. That’s the number to remember.
DeepMind says work of this depth has historically taken expert teams years. Its researchers didn’t verify a paper design. They verified the real implementation, libsignal, the open-source library behind the Signal protocol, exactly as the standard Rust compiler turns it into a program for ARM devices. That’s the code that actually runs on phones.
How DeepMind’s AlphaProof verified Signal’s encryption
Formal verification isn’t a code review. A reviewer reads the design and says it looks sound. A proof is checked by software, line by line, against a written specification, and if the code strays anywhere, the proof fails. That’s why the field has stayed small: writing those proofs by hand eats up years of specialist time.
AlphaProof Code splits the job the way a research team would. Human experts worked with AI models to turn Signal’s security goals into formal specifications, and a person reviewed every one. Then Gemini Carbon agents did the proving, and a final audit flagged about 1% of the proof base for a second look by a human.
There’s a catch, and DeepMind doesn’t hide it. The proof is only as strong as the specification it checks against, and the whole result rests on about 26,000 lines of specifications and machine-code rules that people have to trust. Get the spec wrong and you can prove the wrong thing perfectly.
What the proof covers, and what it doesn’t
The verification covers the two parts of a Signal conversation that matter most: the PQXDH handshake that sets up a chat, including its post-quantum layer, and the Triple Ratchet that changes the key for every message. For one-to-one sessions, it proves four things: messages stay secret, the other side is who it claims to be, old messages stay secret even if a key leaks, and a conversation recovers after a compromise.
It also held up under a hostile test. The team pointed AlphaProof Code at older Signal versions with known, long-fixed bugs, and the system caught both. In the current code, it found no new vulnerabilities in the parts it examined.
The limits are just as specific. The proof applies to libsignal version 0.105.4, compiled for ARM Linux inside a small test harness, not to the Signal app on your phone. Group chats are future work, and key generation, sealed sender, server-side code, and side-channel attacks all sit outside it. The low-level cryptographic building blocks are assumed to be secure, not proven.
Signal’s chief technology officer, Ehren Kret, said the work “gives us even greater confidence in our code’s privacy guarantees.”
Why this matters
Encryption is one of those things everyone relies on and almost nobody can check. You trust that Signal, WhatsApp, and Google Messages keep your chats private because cryptographers reviewed the protocol years ago and no one has broken it since. A machine-checked proof of the actual code is a different kind of assurance: it doesn’t depend on a reviewer’s stamina.
The bigger question is whether the method travels. DeepMind calls this the first time AI has formally verified a widely deployed cryptographic protocol at this depth, and the first time the implementation of such a protocol has been formally verified by any method. If a five-person team plus agents can do in four weeks what used to take years, the same approach could reach software that really can’t afford bugs: operating systems, browsers, and medical devices.
Don’t get carried away. DeepMind research scientist Swarat Chaudhuri told WIRED, “We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that.” Google also declined to say what the project cost, or whether it plans to sell verification as a service. A free research demo is not a product yet.
Still, the direction is hard to miss. AI spent two years writing code faster than humans could review it. Now it’s starting to check code with a rigor humans could never afford at scale. The Signal proof doesn’t make your messages unhackable, and DeepMind never claims it does. It shows the math guarding your chats holds up, checked line by line.
Frequently asked questions
What did Google DeepMind prove about Signal’s encryption?
Its AlphaProof Code framework formally verified key security properties of libsignal, the code behind the Signal protocol, including the PQXDH handshake and the Triple Ratchet, down to compiled machine code.
How long did the Signal verification take?
Four weeks. DeepMind says work of this depth has historically taken expert teams years. A five-person team plus Gemini Carbon agents produced more than six million lines of Lean proof, and humans reviewed every specification.
Does this mean Signal and WhatsApp are unhackable?
No. The proof covers one-to-one sessions in libsignal version 0.105.4, compiled for ARM Linux in a test harness, and it assumes the cryptography is perfect. It does not cover the full Signal app, group chats, servers, key generation, or side-channel attacks.
What is AlphaProof Code?
It is Google DeepMind’s agentic framework for formal verification. Human experts decide what to prove, Gemini Carbon agents write the proofs in Lean, and Lean’s kernel checks every step. DeepMind has open-sourced the specs and proofs and published a technical paper.
Sources: Wired, AI Weekly, Google DeepMind.