DeepMind Agents Formally Verify Signal Encryption Code

Google DeepMind has unveiled AlphaProof Code, a framework that combines human expertise with AI agents to formally verify the actual production code of the Signal encryption protocol. This marks the first time AI agents have completed mathematical proofs of key security properties for real-world cryptographic code, advancing agent capabilities from code generation to deep formal verification—a major breakthrough in software security.

Technically, AlphaProof Code uses a cluster of Gemini Carbon agents to generate approximately 6.5 million lines of Lean proofs for Signal's compiled machine code, verifying message confidentiality at the processor instruction level. The proofs are independently checked by the Lean checker, eliminating trust in the AI or the Rust compiler. The project took about four weeks with 40 to 80 agents collaborating, while humans only set security goals and reviewed about 1% of flagged content. The method also successfully identified an older implementation with known vulnerabilities, demonstrating practical discriminative power.

This is the first end-to-end formal verification of a widely used protocol at the machine-code level, closing the gap between design and implementation. Although computationally intensive and not immediately scalable, it highlights the potential of AI agents in software security verification, providing mathematical guarantees for billions of private communications and paving the way for formal verification to become standard for critical infrastructure.