DeepMind Says Its AI Agents Verified Core Signal Encryption Code in Four Weeks, With Asterisks

Google DeepMind says a team of AI agents just did something security researchers have chased for decades. According to a DeepMind blog post published Nov 10 by Pushmeet Kohli and Swarat Chaudhuri, a new framework called AlphaProof Code mathematically proved key security properties of the actual compiled code behind the Signal protocol, the encryption that DeepMind says protects billions of private conversations in apps like Signal and Google Messages.

That is a big claim, and it deserves a careful read. This is not a proof that Signal is unbreakable, and it is not a proof that the whole Signal app is flawless. It is a proof that specific, human-approved security properties hold in the core cryptographic code. That distinction is the whole story.

DeepMind calls it the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth, and the first time the implementation of a protocol like this has been formally verified by any method, with or without AI. Those are DeepMind's claims.

The workflow, as DeepMind describes it, splits the job in two. Researchers worked with a mix of models to turn Signal's security goals into formal mathematical specifications, and human experts reviewed every one. Then agents powered by Gemini Carbon wrote the proofs, generating over six million lines of Lean, a language whose checker automatically verifies each step. The agents audited their own output and flagged about one percent of the codebase for a second human look. The Register puts the total at 6.5 million lines and reports that the work covered Signal's post-quantum PQXDH handshake and Triple Ratchet, along with libsignal's forward secrecy, authentication, post-compromise security and handshake secrecy.

The selling point is the level. Most protocol verification, DeepMind notes, stops at the design. Its agents went down to the compiled code running on devices, proving properties such as keeping messages protected before and after a device is temporarily compromised. DeepMind argues that real vulnerabilities often hide in that gap.

"Using AI agents to translate live code into valid Lean theorems is a major breakthrough." Ehren Kret, Chief Technology Officer of Signal

Four weeks, five people and a lot of tokens

DeepMind says the verification took four weeks, a task it says historically takes expert teams years. The Register adds the less glamorous part. Chaudhuri's team still needed five people and "quite a few tokens" to get there. The Register also points out that the result is theoretical in one important way, because it assumes perfect cryptography and does not guarantee the computational secrecy of bytes.

The cost question is the one to watch. WIRED reports that DeepMind did the Signal analysis free of charge as a research project, that Google declined to share what it cost, and that the company would not say whether a commercial verification product is coming. A method only a frontier lab can afford is a demo, not a shift.

There is a sanity check in the work, at least. DeepMind says researchers reintroduced two real, previously fixed bugs into an isolated copy of Signal's code, and in both cases the system produced a machine checked proof that the buggy version was insecure. WIRED reports the analysis found no new vulnerabilities in the parts of the protocol it examined. DeepMind is also open sourcing its verification artifacts.

That is where the real scrutiny belongs. A proof is only as strong as the statement it proves, and Chaudhuri seems to know it.

"We really believe that the next frontier is not going to be proof but specification in this kind of research." Swarat Chaudhuri, Google DeepMind, to The Register

AI plus Lean is having a moment. Just yesterday we covered a startup that says an unreleased Anthropic model cracked a long open quantum conjecture with a proof checked in Lean. The Signal work points the same tools at shipping code. DeepMind pitches the approach as a defense against agent driven cyber threats. If the specifications survive outside review, the proof bottleneck may really be breaking. If they do not, six million lines of perfect proof will have verified the wrong thing.