Google DeepMind Verifies Signal Encryption With AI Agents

Google DeepMind verifies Signal encryption with AI agents

Google DeepMind dropped the news on November 10, 2026: their researchers hit a major milestone in software security. They used AI to formally verify the core encryption code powering the Signal protocol. This is the first time AI has mathematically proven the security properties of a widely deployed cryptographic protocol at this depth, and the first time the actual implementation-not just the design-has been formally verified by any method.

AlphaProof Code framework blends human expertise with Gemini Carbon agents

The breakthrough runs on AlphaProof Code, a new agentic framework blending human expertise with multiple AI agents powered by Gemini Carbon. Formal verification-mathematically proving code runs correctly without flaws-has long been the gold standard for security assurance. The problem? It’s brutal. Typically, it takes expert teams years to finish even modest scopes. Most earlier efforts stopped at the design level, leaving a dangerous gap between the math spec and the compiled code running on your phone. Real-world vulnerabilities love hiding in that gap.

AlphaProof Code tackles it like a research team would. Human experts first worked with AI models to translate Signal’s security goals into formal mathematical specs, reviewing every single one themselves. Then the AI agents took over the heavy lifting, generating over six million lines of Lean-a language built to mathematically verify code accuracy. The agents audited their own proofs and flagged only the spots needing a second human look: roughly one percent of the codebase. Since Lean auto-checks the rest, experts could focus their judgment where it actually matters.

The whole verification process took just four weeks. To prove the system could tell correct code from buggy code, researchers slipped two real, previously fixed bugs into an isolated version of Signal’s code. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure.

Verified Signal encryption guarantees protect messages before and after compromise

The verified properties include critical guarantees-like keeping messages protected before and after a device is temporarily compromised. These protections apply down to the exact code running on devices, finally bridging that design-to-implementation gap that’s historically left room for exploits. Cryptographic protocols underpin nearly all digital communication, from banking to browsing; a single flaw can expose millions at once.

Ehren Kret, Signal’s CTO, said the approach enables a massive expansion beyond the smaller scopes prior formal verification work has necessarily focused on. He called the use of AI agents to automatically translate live code into valid Lean theorems a major breakthrough, adding that as AI-driven security threats grow, having the core Signal protocol rigorously verified with automated theorem proving gives even greater confidence in the code’s privacy guarantees.

For developers and security teams, this signals a shift in what’s practical. Formal verification has long been reserved for the most critical, well-funded projects because of the cost and time. An agentic framework that shrinks a years-long effort to weeks-while keeping mathematical rigor-changes the economics of high-assurance software. The technique isn’t limited to crypto, either; any codebase where correctness matters, from OS kernels to safety-critical embedded systems, could benefit from similar tooling.

AI agents generate proofs and self-audit while humans steer specifications

The research also demos a workflow where AI agents do the heavy lifting of proof generation and self-audit, while humans steer the spec and review the tiny fraction of cases needing judgment. That division of labor could become a template for other verification tasks. Teams adopting this will need to invest in Lean expertise and the tooling connecting their codebases to formal specs, but the payoff is a level of assurance testing alone can’t touch.

Google DeepMind has published a technical paper detailing the framework and the Signal verification. Engineers interested in the approach should study that paper and the Lean artifacts to understand the spec patterns and agent interactions that made the proof tractable. The broader lesson? Agentic AI can now handle formal reasoning at a scale that was previously impractical, opening the door to routine mathematical verification of production code.

Frequently asked questions

What did Google DeepMind achieve with AI and the Signal protocol?

Google DeepMind researchers used AI agents to formally verify the core encryption implementation of the Signal protocol, mathematically proving its security properties. This is the first time AI has achieved this depth of verification for a widely deployed cryptographic protocol, and the first time the actual running code-not just the design-has been formally verified by any method.

How does AlphaProof Code work to verify software?

Human experts first translate security goals into formal mathematical specifications. AI agents then generate over six million lines of Lean code to prove correctness, self-audit those proofs, and flag only about one percent for human review. Lean automatically checks the rest, letting experts focus judgment where needed.

How long did the Signal verification take compared to traditional methods?

The full verification process took just four weeks. Traditional formal verification typically requires expert teams years to complete even modest scopes, making this a dramatic reduction in time while maintaining mathematical rigor.

What specific security properties were verified in Signal's code?

The verified properties include critical guarantees like forward and backward secrecy-keeping messages protected before and after a device is temporarily compromised. These protections apply down to the exact code running on devices, closing the historic gap between design specifications and implementation.

How did researchers test that AlphaProof Code could detect real vulnerabilities?

Researchers inserted two real, previously fixed bugs into an isolated version of Signal's code. In both cases, AlphaProof Code produced machine-checked proofs that the buggy versions were insecure, demonstrating the system can distinguish correct from vulnerable code.

Source: Google DeepMind