# DeepMind AlphaProof Code: What It Really Proved on Signal

> DeepMind's AlphaProof Code used Gemini-powered agents and 6M lines of Lean to verify Signal's protocol. Here's what was actually proven — and the 'zero bugs' claim it wasn't.

- Canonical: https://www.kunalganglani.com/blog/deepmind-alphaproof-signal-verification
- Author: Kunal Ganglani
- Published: 2026-11-11 · Updated: 2026-11-11
- Category: AI and Machine Learning · Tags: ai-security, formal-verification, deepmind, llm, signal-protocol

## TL;DR

Google DeepMind announced that its AI system, AlphaProof Code, used Gemini-powered agents to write a six-million-line mathematical proof about the encryption behind Signal, WhatsApp, and Google Messages. The impressive part is real: the proof can be independently checked. But the popular framing is misleading. It did not prove Signal has zero bugs. It proved that the known and unknown bugs in one specific library don't break a specific set of security rules humans wrote down first. Crashes, memory leaks, and the entire Signal app itself were never checked. It's a genuine step for AI-assisted security math — and a claim worth verifying, not trusting on sight.

If you use Signal, WhatsApp, or Google Messages RCS, the math behind your encrypted chats just got audited by an AI. And the headline you're going to see about it is wrong. On November 10, 2026, Google DeepMind announced [AlphaProof Code](https://deepmind.google/blog/introducing-alphaproof-code/), a system that used Gemini-powered agents to generate a machine-checked proof about Signal's cryptographic protocol. DeepMind's AlphaProof Code verification of Signal's protocol is real, it is impressive, and it does **not** mean Signal's protocol has zero bugs.

That distinction matters. The announcement dropped in the same week as DeepMind's Gemini 4 Carbon frontier model and its CodeMender security-patching agent, which packages the whole thing as a tidy "AI now does security-critical formal methods" narrative. Within about 18 hours the [Hacker News thread](https://news.ycombinator.com/item?id=50439193) hit 610 points and 182 comments, and the sharpest commenters were already pulling apart the gap between what the proof covers and what the marketing implies. That gap is the most important part of this story. Almost no early coverage states it plainly.

## What is AlphaProof Code

AlphaProof Code is DeepMind's automated theorem-proving system that uses AI agents to generate formal, machine-verified mathematical proofs about real software, rather than just pure-math competition problems. It descends directly from the original AlphaProof, which in 2024 scored at silver-medal standard on the International Mathematical Olympiad. Same proof-search machinery, new target. Instead of aiming the agents at olympiad geometry, DeepMind pointed them at libsignal, the library that implements Signal's encryption.

![Nvidia logo on a green background with abstract spheres](https://cdn.sanity.io/images/vzekdneq/production/d1a3e32bf53789ecb9cef63e5caab3c90a1c48d7-1200x675.webp)

The difference between the two systems is worth being precise about, because people conflate them. The original AlphaProof proved theorems that have a known answer and a bounded problem statement. AlphaProof Code has to do something harder and messier: take a sprawling, real-world codebase, pin down what "secure" even means for it as a formal specification, and then prove the code satisfies that specification. The IMO version plays a game with fixed rules. The Code version first has to write the rulebook, and that step is where the entire claim lives or dies.

Formal verification itself is not new, and it is not AI. It is the practice of mathematically proving that a system meets a precise specification, using the same kind of logical rigor you would use to prove a theorem. The subfield that uses computers to search for those proofs is automated theorem proving. What DeepMind changed is the labor model. Instead of human formal-methods PhDs hand-writing proofs over months, Gemini-powered agents did the bulk of the grinding.

## How DeepMind verified Signal's protocol

The workflow had three distinct stages, and they are easy to collapse into one if you only read the headline.

![Two nvidia titan x graphics cards side by side](https://cdn.sanity.io/images/vzekdneq/production/02c04c13f1903b86e4e7c34b9c526811ba96e2e6-1200x675.webp)

First, translation. DeepMind's researchers used a mix of models to translate Signal's security goals into formal mathematical specifications, the "rulebook" I mentioned above. This is the step humans cannot skip. Per the announcement, **human experts reviewed every single specification** before any proof work began. If the spec is wrong, the proof is worthless no matter how clean it looks, so this is the highest-leverage human-in-the-loop checkpoint in the whole pipeline.

That split, one set of models translating intent into a spec and a different set grinding out proofs, is not an accident. Running this blog's own agent pipeline taught me the same lesson: model-per-job-shape beats one-model-everywhere. I run Sonnet for the tool-heavy loops and Opus for prose because the two job shapes reward different capabilities. DeepMind's spec-then-proof structure is that instinct applied to formal methods.

Second, proof generation. Agents powered by Gemini Carbon then generated the actual proofs, producing **over six million lines of Lean**. Lean is a proof assistant and functional programming language created by [Leonardo de Moura](https://leanprover.github.io/), based on the calculus of constructions with inductive types, the same theoretical family as Coq/Rocq. The choice of Lean is more significant than it sounds. It is open-source, academically serious, and maintained by a nonprofit, which means the six-million-line proof is independently checkable by a standard Lean kernel. Nobody has to trust DeepMind's word that the proof is valid. They have to trust Lean's tiny, battle-tested proof checker. That is the right property for a security claim to have.

Third, verification. The Lean proofs were checked against the formalized goals from stage one. When the checker accepts, you have a mathematical guarantee that the code satisfies the spec, bounded entirely by whether the spec captured what you actually cared about.

### What is Gemini Carbon?

Gemini Carbon is the model family behind the proof-generating agents, released in the same cycle as Gemini 4 Carbon, DeepMind's newest frontier model. Six million lines of valid Lean is a very different workload from a 2,000-token answer. It has to stay globally consistent across the whole proof, and one broken lemma fails the kernel check. Whether Gemini Carbon generalizes beyond libsignal to messier codebases is the open question, and DeepMind has not published throughput, cost, or failure-rate numbers to answer it.

The human spec review, not the agent's cleverness, is the load-bearing part here. The deterministic Lean checker and the human review are the gates. The agent is just a very fast, very expensive proof searcher sitting between them.

## What was actually proven, and what wasn't

Here's the thing nobody in the press-release echo chamber is saying clearly: DeepMind did not prove that libsignal has no bugs.

![Nvidia logo on a green background with abstract 3D elements](https://cdn.sanity.io/images/vzekdneq/production/f40384b138d01ca47aa0d4cddccc3cefafeab306-1200x675.webp)

As the Hacker News commenter *derefr* put it, DeepMind "proved that none of the current bugs ... are security-breaking, per their formalized security model." That is a narrower and more honest claim. The proof establishes that whatever bugs exist in the verified code, known or unknown, do not violate the specific security properties DeepMind formalized. Everything *outside* that security model is explicitly out of scope: memory leaks, crashes, protocol deadlocks, and liveness failures are not covered. A bug that hangs the protocol or leaks memory can still exist. It just cannot break the particular security guarantees that were formalized.

Here is the scope laid out plainly:

| In scope (proven) | Out of scope (not proven) |
| --- | --- |
| libsignal protocol code satisfies the formalized security model | The Signal mobile and desktop apps, clients, and UI |
| Known and unknown bugs don't break the formalized properties | Memory leaks, crashes, deadlocks, liveness failures |
| Confidentiality and integrity properties humans wrote down first | Any security goal nobody formalized into the spec |
| A proof independently re-checkable by a standard Lean kernel | Key storage, OS keystore, backups, push notifications |

Read that right-hand column again. That is most of the real-world attack surface, and none of it was touched.

### libsignal, not the Signal app

The second scoping correction is about attack surface. As commenter *mentalgear* flagged, the verification targets libsignal, the cryptographic protocol library, not the Signal mobile or desktop app, its clients, or the operating system underneath. That matters because the protocol library is the *small* part of the attack surface. The UI, the key-storage code, the OS keystore, the notification system, the backup logic. None of that is touched by this proof. Historically, that surrounding code is exactly where real-world messaging-app compromises live. Verifying the protocol core is genuinely valuable, but it is a bit like certifying the engine block while the doors, wiring, and fuel line remain unexamined.

### Has Signal's protocol been verified before AI?

Yes. And leaving this out is how coverage makes AlphaProof Code sound like the first time anyone checked Signal's math. It wasn't. The Signal Protocol (Double Ratchet plus X3DH, with the PQXDH post-quantum key agreement added in 2023) was developed by Open Whisper Systems in 2013, and academic cryptographers have been analyzing it for the better part of a decade. The 2017 symbolic-model analysis by [Cas Cremers](https://eprint.iacr.org/2016/1013) and colleagues, using tools in the Tamarin and ProVerif tradition, is the canonical example. The difference is level: that prior work verified the protocol *as a model*, while AlphaProof Code ties proofs directly to the implementation code in libsignal. What it adds is scale and that shift from symbolic models toward the actual bytes that ship. It is the next chapter in a long book, not the opening page.

## The future of AI-assisted formal verification

I am genuinely excited about this direction, and I am skeptical of the framing around it. Both can be true.

The excitement is easy to justify. Formal verification has always been bottlenecked by the scarcity and cost of people who can write Lean or Coq proofs. If agents handle the mechanical proof search while humans own the specifications, the economics of verifying security-critical code change in a way that matters for [AI in production](/pillars/ai-engineering-production) systems and the libraries they depend on. Six million lines of auto-generated Lean for one library would have been unthinkable to produce by hand.

The skepticism is about trusting a single vendor's security announcement at face value, and we have a recent cautionary data point. As [Patrick Garrity](https://www.vulncheck.com/blog/anthropic-glasswing-november-update) of VulnCheck documented, seven months into Anthropic's Project Glasswing only 217 of 37,966 reported findings had been marked fixed. About 19.4% were even public, and just two of the 442 CVEs attributed to Anthropic were confirmed exploited in the wild, roughly 0.5% of this year's CVEs. That is exactly why I treat every [AI security](/pillars/ai-security-safety) claim as something to verify, not repost. The distance between an impressive announcement and verifiable impact can be enormous.

AlphaProof Code is actually *more* trustworthy than most AI-security claims precisely because of Lean. A proof you can re-check with an independent, open-source kernel beats a vulnerability count on a vendor blog. It's the same discipline behind the reproducible methodology I publish with every run in [the local LLM benchmark database](/llm-benchmarks) I maintain. The right move for the community is to demand the specifications and proofs be published and independently audited. The spec is where any over-claim would hide.

How does AlphaProof Code relate to CodeMender? They are two halves of the same bet. CodeMender writes and proposes security patches; AlphaProof Code proves properties about code. Pair them and you get a loop where one agent patches a flaw and another proves the patch doesn't break the formalized security model, exactly the pitch DeepMind is making to governments and enterprises in the same window as Gemini 4 Carbon.

If you build security-critical software, treat AlphaProof Code as a powerful new tool for the protocol-core layer, not a seal that makes an app safe. The attack surface that got you breached last year, the clients, the dependencies, the misconfigured keystore, is still unverified, which is why I keep a running [AI security](/pillars/ai-security-safety) guide and a full [AI and LLM security threat breakdown](/blog/ai-security-complete-guide) of where those risks live. The same discipline that catches [prompt injection](/blog/prompt-injection-2026-owasp-llm-vulnerability) in [AI agents](/pillars/ai-agents) applies here: a machine-checkable proof is the gold standard to ask for, and most [vibe coding](/blog/vibe-coding-security-audit-nightmares) output you ship today has nothing close to it.

My prediction: within 18 months, "formally verified by an AI agent" will be a marketing badge slapped on libraries whose specifications nobody published. When that happens, remember libsignal. The proof was only ever as good as the rulebook humans wrote first.

Photo by Patrick Martin on Unsplash.