A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure

Google DeepMind researchers used a new AI framework called AlphaProof Code to mathematically prove, or formally verify, key cryptographic guarantees of the Signal protocol, the encryption system used by Signal, WhatsApp, Google Messages, and Meta's Messenger. The project, conducted as a proof-of-concept over four weeks by a team of five researchers, generated approximately 6.5 million lines of machine-checked Lean proof code establishing that the compiled AArch64 binary of libsignal version 0.105.4 satisfies ten security theorems covering forward secrecy, authentication, post-compromise security, and handshake secrecy for the PQXDH handshake and Triple Ratchet. The proofs were checked by Lean's kernel, meaning they cannot be wrong without the kernel rejecting them. DeepMind researchers Swarat Chaudhuri and Pushmeet Kohli emphasized this is a milestone toward scaling formal verification, though significant structural exclusions remain: no post-quantum guarantee for SPQR's healing property, no payload privacy, no responder authentication for the first handshake message, one session per promotion, fixed message lengths, no multi-device state, trust-on-first-use identity keys, an 8-byte MAC forgery term that becomes vacuous at roughly 25,000 messages per session, and 37 routines including AES-256-CBC, X25519, Kyber1024, and ML-KEM-768 were contracted rather than verified. The analysis covered the team's build of libsignal-cli as a fresh process, not the Signal mobile app. To test the specifications, researchers reintroduced two known, long-fixed vulnerabilities—a weak-state bug and a small-subgroup bug—and AlphaProof Code correctly proved the resulting binaries violated the security theorems. The specifications, about 26,000 lines of trusted Lean statements and AArch64 semantics, were drafted with agents powered by Gemini 4 Carbon and Claude Opus 5.5, while the proofs were produced entirely by agent teams powered by Gemini 4 Carbon. DeepMind is open-sourcing the formal verification artifacts at github.com/google-deepmind/code-verification. Signal CTO Ehren Kret said the approach enables significant expansion beyond prior formal verification work focused on smaller scopes. The paper contrasts the 20 person-weeks for this effort with the 20 person-years cited for the seL4 microkernel verification, though the systems differ in size and scope. DeepMind declined to share the compute cost and has no commercial product or service announced.