Google DeepMind’s AI Proves Signal’s Encryption Is Secure — In Just Four Weeks
Google DeepMind has used teams of AI agents to mathematically prove that the encryption behind Signal — one of the world’s most trusted private messaging apps — really does what it promises. The work, announced on 10 November 2026, took just four weeks. DeepMind says the same job would historically have taken expert teams years.
The project used a new system called AlphaProof Code. It produced around 6.5 million lines of machine-checked proof showing that key security guarantees of the Signal protocol hold in the actual code that runs on people’s phones — not just in the design documents. It is the first time, DeepMind says, that a widely used cryptographic protocol has been formally verified at this depth by AI, and the first time the real implementation of such a protocol has been verified by any method at all.
Signal’s encryption does not only protect the Signal app. The same protocol, in modified form, protects messages in Google Messages and WhatsApp. That is why the result matters to billions of people, even if most of them have never heard of Signal.
This article explains what DeepMind actually proved, what it did not prove, and why it matters for the future of software security.
What happened
On 10 November 2026, Google DeepMind published a blog post and a technical paper introducing AlphaProof Code, a new framework for formal verification — the process of using mathematics to prove that software behaves as it should.
DeepMind’s researchers set the system a hard test: formally verify the cryptographic core of the Signal protocol. The Signal protocol is the set of rules that keeps messages private. When two people chat, it agrees the secret keys, changes them as the conversation goes on, and makes sure that even if someone steals a phone or a key, past messages stay secret.
The team verified the protocol’s reference code, known as libsignal, version 0.105.4, together with its post-quantum component, SPQR version 1.6.0. Crucially, they did not check an idealised model of the protocol. They compiled the real code with the standard Rust compiler and proved the properties against the resulting machine code for 64-bit Arm (AArch64) processors — the kind of chip inside most modern smartphones.
The agents generated about 6.5 million lines of proof in the Lean proof language, resting on roughly 26,000 lines of trusted specifications and machine-code rules. The whole job took four weeks. DeepMind says a task of this complexity would historically have taken expert teams years.
The researchers also ran a control test. They put two real bugs that had been found and fixed in Signal years ago back into an isolated copy of the code. In both cases, AlphaProof Code produced a machine-checked proof that the buggy version was insecure. The system can tell good code from bad code — which is exactly what a verification tool must be able to do.
No new vulnerabilities were found in the parts of the code that were examined.
What is formal verification?
Most software is tested, not proved. Engineers write tests, run the program, and check that it gives the right answer for the cases they thought of. That is useful, but it can never cover every possible case. A bug can hide in a situation nobody tested.
Formal verification is different. It turns the question “does this code do what it should?” into a mathematical statement, and then proves that statement with the same rigour as a theorem in geometry. A computer program called a proof checker — in this case, Lean — checks every step of the proof. If any step is wrong, the proof is rejected.
The catch is that writing these proofs is slow, difficult work. It needs rare experts, and it can take years even for a small piece of software. That is why formal verification has mostly been used for the most safety-critical systems, such as aircraft controls and the tiny seL4 microkernel, rather than for everyday apps.
DeepMind’s idea is to let AI agents do the heavy lifting. Human experts decide what needs to be proved and write the specification — the precise mathematical description of what “secure” means. Then teams of agents, powered by Google’s Gemini Carbon model, write the proofs, while other models — including Claude Opus 5.5 — help draft and review the specifications. Lean checks every proof the agents produce, so the agents cannot cheat: a proof is either right or it is rejected.
Only about 1% of the work was flagged for a second look by a human, according to reports on the project.
What exactly did DeepMind prove?
The verification covered the parts of the Signal protocol that handle one-to-one conversations — chats between two people. Specifically, it covered:
- The PQXDH handshake. This is how two phones first agree on secret keys when a conversation starts. PQXDH is Signal’s post-quantum handshake, designed to stay safe even against future quantum computers.
- The Triple Ratchet. This is the mechanism that keeps changing the encryption keys as messages are sent back and forth, so that each message uses fresh keys.
The proofs confirmed several key security properties:
- Message confidentiality. Only the two people in the conversation can read the messages.
- Authentication. Each person can be sure they are really talking to the other person, not an impostor.
- Forward secrecy. If someone steals a phone or a key today, they cannot use it to read messages sent in the past.
- Post-compromise security. If an attacker briefly takes over a device, the conversation can heal itself — new keys are agreed and the attacker is locked out again.
- Handshake secrecy. The keys agreed when a conversation starts stay secret.
The main result is a theorem the researchers call signal_session_secure_placed. It ties all of these properties together for the compiled code, not just for a paper design.
DeepMind and Signal both stressed that the work builds on earlier verification efforts. Signal has been working with the firm Cryspen to machine-check its protocols, and the DeepMind team says that earlier work gave them a head start.
Signal’s chief technology officer, Ehren Kret, said the work “gives us even greater confidence in our code’s privacy guarantees.”
Why checking the real code matters
Most earlier verification of the Signal protocol stopped at the design level. Researchers proved that the protocol, as described on paper, was secure. That is valuable, but it leaves a gap: the code that actually runs on a phone is not the paper design. A programmer could make a mistake when turning the design into code, or a compiler could introduce a subtle error.
DeepMind’s work closes that gap for the parts it examined. By proving properties of the compiled machine code itself, the team did not need to trust either the source code or the Rust compiler. The proof covers about 560 kilobytes of libsignal source, roughly 140,000 machine instructions, modelled in Lean down to the level of individual processor instructions and system calls.
That is why DeepMind calls it the first formal verification of a widely deployed protocol’s implementation, with or without AI.
What the proof does not cover
The result is real, but it is not a certificate that Signal — or WhatsApp, or Google Messages — can never be hacked. DeepMind and the independent coverage of the work are clear about the limits:
- It is not the whole app. The verification covers the core cryptographic protocol code, not the full Signal mobile app. The app’s user interface, its servers, and the operating system on your phone were not part of the proof.
- Group chats were not covered. Only one-to-one conversations were verified. Group messaging is planned for future work.
- Key generation was not verified. The process by which a phone creates its keys was outside the scope.
- The building blocks were assumed, not proved. The low-level cryptographic routines — such as AES-256, X25519 and the post-quantum algorithms Kyber1024 and ML-KEM-768 — were treated as secure contracts rather than proved from scratch. The proof shows that if those building blocks are secure, then the protocol built on top of them is secure.
- It covers one platform. The proof targets one compiled build: AArch64 Linux, running as a fresh process. Other chips and operating systems were not covered.
- It does not prove post-quantum healing. The paper is open that neither of its two arguments proves the post-quantum healing property that SPQR is designed to add. The computational argument covers classical attackers, while the symbolic argument lets the attacker choose the SPQR keys.
- Side channels and multi-device use are outside the scope. Attacks that measure how long a computation takes, or that exploit a second linked device, were not part of the proof.
For ordinary Signal users, there is nothing to do. This is not an app update and it does not fix a security problem. No emergency patch or account change is needed. It is extra assurance about code that was already considered strong.
Why this matters beyond Signal
The bigger story is not really about Signal. It is about whether AI can make formal verification cheap and fast enough to use widely.
Today, most of the software the world depends on — banking systems, hospital equipment, power grids, messaging apps — is tested, not proved. Bugs still slip through, and some of them become security disasters. Formal verification could catch whole classes of bugs before software ever ships, but it has been too slow and too expensive for most uses.
If AI agents can do in four weeks what used to take years, that calculation changes. DeepMind says it is open-sourcing the verification artifacts — the specifications and the proofs — so that other researchers can build on them. The researchers’ stated next steps are to strengthen the theorems, verify more of the code, and expand coverage to group messaging, sealed sender and server-side protocols.
But the researchers themselves urge caution. Swarat Chaudhuri, a DeepMind research scientist who led the work, told WIRED that scaling this approach to all software is still a long way off. The proof also depends on the specifications humans wrote: if a specification misses something, the proof will not catch it. As one analysis put it, a theorem is only as good as the assumptions behind it.
There is also the question of cost. DeepMind did the Signal work free of charge, as a research project. Google declined to say what it cost, and would not say whether it plans to sell formal verification as a product or service.
What happens next
DeepMind’s stated goal is to verify new releases of libsignal before they ship, turning formal verification from a one-off research project into a routine part of how the code is built. Whether that happens will depend on cost, speed and how much of the app can be covered.
For the wider industry, the Signal result is a proof of concept — in both senses of the phrase. It shows that AI agents can produce machine-checked proofs about real, widely used code, at a scale that was not practical before. Other teams are already working on similar goals: the Beneficial AI Foundation, for example, is running a project called Signal Shot to formally verify the Signal protocol and app with Lean.
If the approach scales, the software we all rely on could become measurably more trustworthy — not because AI wrote the code, but because AI checked it, and the checking was done by mathematics rather than by opinion.
Frequently asked questions
Does this mean Signal is now unhackable?
No. The proof covers specific security properties of the core protocol code for one-to-one chats, on one platform. It does not cover the whole app, group chats, key generation, servers, or the phone’s operating system. Signal was already considered very secure; this is extra, independent confirmation of its core cryptography.
Do I need to update Signal or change anything?
No. Nothing in this announcement requires any action from users. It is research, not a security fix. Keep updating your apps as normal, and keep your phone’s software up to date.
Does this cover WhatsApp and Google Messages too?
Partly. Both use the Signal protocol, in modified form, for their end-to-end encryption. The proof was done on libsignal, Signal’s reference implementation, not on WhatsApp’s or Google’s own code. So the result supports the design they share, but it is not a proof about those apps themselves.
What is Lean?
Lean is a programming language and proof checker. Mathematicians and computer scientists use it to write proofs that a computer can check step by step. If Lean accepts a proof, the proof is correct according to the rules of logic — no human judgement is involved.
How long did the work take, and how big was the proof?
Four weeks, by a team of DeepMind researchers working with AI agents. The agents produced about 6.5 million lines of machine-checked Lean proof, based on roughly 26,000 lines of trusted specifications and machine-code rules. (DeepMind’s own blog gives a lower figure — “over three million lines” — in one summary; the technical paper’s figure of about 6.5 million lines is used here.)
What is AlphaProof Code?
It is Google DeepMind’s new framework for formal verification. Human experts decide what must be proved and write the specification. Teams of AI agents, powered by Gemini Carbon, then write the proofs, and Lean checks them. DeepMind says it is a research framework, not a product, and there is no public access to it yet.
Conclusion
Google DeepMind’s verification of Signal’s encryption is a genuine milestone: AI agents produced a machine-checked mathematical proof, in four weeks, that the code protecting billions of private conversations does what it claims to do. The control test — catching two old bugs that had been deliberately reintroduced — shows the system can tell secure code from insecure code.
But the honest reading is narrower than the headline. The proof covers the cryptographic core, not the whole app; one-to-one chats, not groups; one chip architecture, not all of them. It assumes the underlying cryptography is sound, and it says nothing about the phone in your pocket or the servers in between.
What it does show is that formal verification — long too slow and costly for everyday software — may finally be getting fast enough to matter. If that promise holds, the next decade of software could be checked by mathematics, not just tested by hand. For now, Signal users can take quiet reassurance from the result, and the rest of the industry can watch closely to see whether it scales.
Sources
This article is for general information and education only. It is not legal or financial advice.
