Five researchers. Four weeks. 6.5 million lines of machine-checked mathematical proof. That’s what it took for Google DeepMind’s AlphaProof Code to formally verify Signal’s cryptographic core — libsignal v0.105.4, all 140,000 compiled AArch64 instructions. No new vulnerabilities were found. That’s actually the point: this is a correctness proof, not a bug hunt. And it’s the first time any widely deployed cryptographic protocol has been verified at the machine-code level by any method, AI-assisted or otherwise.
What Was Actually Verified
AlphaProof Code covered Signal’s one-to-one session code: the PQXDH post-quantum handshake and the Triple Ratchet messaging protocol. For both, it proved four properties: forward secrecy (past messages stay encrypted even if keys are stolen), authentication (you’re talking to who you think), post-compromise security (the protocol recovers after a breach), and handshake secrecy (the key exchange itself is private).
These aren’t abstract academic properties. Forward secrecy is why Signal messages from two years ago stay safe if your phone is seized today. Post-compromise security is why the app “heals” — once a compromised session ratchets forward, an attacker with yesterday’s key can’t read tomorrow’s messages. These are the properties that separate a properly designed encrypted messenger from one that just looks encrypted.
Previous formal verification work covered individual primitives — SHA-256, AES, Poly1305, the HACL* library. That work is valuable and hard. But libsignal is a full protocol stack running in production on hundreds of millions of devices, and nobody had verified it end-to-end at the binary level. Until now.
How the System Works
AlphaProof Code is a three-stage pipeline. First, a spec-writing agent works with researchers to translate Signal’s cryptographic properties from academic literature into Lean — a proof assistant with a small, auditable kernel. This produces about 26,000 lines of human-reviewed, human-approved specifications that define what “correct” means.
Second, the compiled AArch64 binary runs against a formal model of the AArch64 processor built into Lean. The machine code and the mathematical model of the hardware are expressed in the same language, so the proof can reason about what the CPU actually executes.
Third, teams of Gemini 4 Carbon agents generate Lean proofs — 6.5 million lines of them. A gatekeeper agent submits each proof to Lean’s kernel for checking. Lean’s kernel is deterministic and small. It doesn’t “think” a proof looks right; it either accepts or rejects. Every accepted proof is machine-checked against the approved specification.
This distinction matters. AI generates the proofs. A classical, auditable kernel verifies them. The trust doesn’t rest on the AI being correct — it rests on the mathematical kernel, which has been verified independently. That’s what makes the result meaningful rather than just impressive-sounding.
What This Means for Developers
The cost of formal verification just dropped. Historically, proof-to-code ratios ran 3:1 to 10:1, large projects took years, and you needed a dedicated formal methods team with deep cryptography expertise. A five-person research group just did Signal’s cryptographic core in a month. If that trend continues, crypto libraries, firmware, and hypervisors become tractable targets — not just kernels and aircraft control systems.
But the limits are worth being clear about. Side channels — timing attacks, power analysis, cache behavior — are explicitly out of scope. Key generation isn’t verified. Only one-to-one sessions are covered; group messaging, sealed sender, and server-side protocols aren’t. AArch64 only. The full Signal app wasn’t touched. And critically: AlphaProof Code is not a service you can call. This is a research demonstration, not an API endpoint you can point at your codebase today.
Why You Can Trust the Result
DeepMind ran a validation test: they reintroduced two previously fixed bugs into an isolated copy of libsignal. AlphaProof Code produced machine-checked findings showing the buggy versions violated the specified security properties. Signal CTO Ehren Kret acknowledged the work, noting it “expands the scope of earlier verification efforts.” The full Lean artifacts are published on GitHub and independently checkable by anyone with Lean installed — trusting the result requires only trusting Lean’s kernel, not DeepMind’s claim.
The Bigger Picture
The formal verification community has been trying to make this economically practical for decades. The numbers never worked: too expensive, too slow, too specialized. AI agents changed those numbers. Whether AlphaProof Code scales into a general-purpose tool or stays in the hands of large research teams is still open. But the first has happened. The bar for what counts as “verified” just got raised, and the cost to meet it just dropped. Crypto libraries, firmware, and hypervisors are next on the list.
