Google DeepMind says an AI-assisted system formally verified specified security properties of compiled code underlying the Signal protocol. The work goes beyond checking a high-level design: the researchers report proving properties about a particular implementation at the machine-code level. It does not prove that the Signal app, every device running it or every future version is impossible to hack.
The distinction is the heart of the story. A formal proof can give strong assurance about a precisely stated claim under stated assumptions. Its value depends on what was specified, which code was included and what the proof treats as trusted. Those boundaries are not a weakness to hide; they are what make the result interpretable.
DeepMind introduced AlphaProof Code on November 10, 2026, in its research announcement. The team says human experts reviewed the specifications, AI agents developed proofs, and the Lean proof assistant checked them. DeepMind also released verification artifacts for further scrutiny.
What is formal verification?
Ordinary testing runs software with selected inputs and checks what happens. A test suite can find mistakes and provide evidence that software works under the cases examined. But even a large test suite usually cannot try every possible input and execution path.
Formal verification takes a different approach. Researchers express a property in a precise mathematical form and construct a proof that the implementation satisfies it under explicit assumptions. A proof assistant checks the logical steps rather than relying only on a person’s confidence in the argument.
For example, a property might describe what information should remain secret when an attacker can observe or manipulate certain communications. The exact claim requires a formal model of the attacker, the protocol and the environment. A vague statement such as ‘this software is safe’ is too broad to serve as a useful specification.
Tests and proofs can complement each other. Testing is useful for exploring behavior, integration and unexpected conditions. A proof can cover a rigorously defined space of cases, but only for the property and system represented in its model.
Why does checking compiled code matter?
Software is commonly written in a high-level language and translated by a compiler into machine code that a processor executes. Researchers can prove properties of an abstract protocol design or of source code, but differences can arise between those representations and what actually runs.
DeepMind says its project connects security properties to compiled code for the Signal protocol. That is a deeper target than a proof of a simplified protocol description alone. It addresses part of the gap between an intended design and a particular implementation.
It is still important to ask which build, processor model and assumptions are covered. A proof about one version of a library is not automatically a proof about an altered version, another compiler configuration or every component of the application using that library.
The Signal protocol is a cryptographic protocol used in messaging. The complete experience of sending a secure message also involves applications, operating systems, devices, key management and people. A proof of specified core protocol properties does not automatically cover all of those layers.
What did the AI agents do?
DeepMind describes AlphaProof Code as a framework using multiple language-model agents. Human researchers worked with AI to turn security goals into formal specifications, and experts reviewed those specifications. Agents then generated proofs, which Lean checked.
The company says the agents produced more than six million lines of Lean and flagged areas for human review. The length of a proof is not, by itself, a measure of its usefulness or correctness. What matters is the theorem being proved, the assumptions and whether the proof checker accepts the argument.
This division of work is important. A language model can produce convincing-looking text that is wrong. A proof assistant applies formal rules to check a proof against a specification. The checker does not need to trust the agent merely because the agent wrote a persuasive explanation.
Human judgment remains important when deciding what the specification should mean and whether it matches the real security goal. A perfectly checked proof of an incomplete or misplaced specification can still leave an important practical question unanswered.
What are the security properties?
DeepMind says the verified properties include protections relevant before and after a device is temporarily compromised. In secure messaging, properties such as forward secrecy and recovery after compromise are studied under specific models of what an attacker learns and when.
Those names can sound absolute in a headline, but each property has conditions. A useful assessment asks which keys an attacker can obtain, which communications they can observe, and how the system is assumed to behave. The proof’s formal definitions, not a short label, determine its scope.
This also explains why ‘unhackable’ is not a reasonable conclusion. A user can be deceived into revealing information, a device can be compromised, or a vulnerability can exist in a component outside the verified code. Formal verification reduces uncertainty about the stated properties; it does not make every possible attack disappear.
How did the researchers test the method?
DeepMind says it reintroduced two real, previously fixed vulnerabilities into an isolated version of the code. In those cases, the system produced machine-checked proofs that the altered versions were insecure.
That is a useful check because a method intended to establish security should also respond appropriately when known flaws are present. Two examples do not measure its ability to find every class of bug, and reproducing a known issue is different from discovering an unknown vulnerability in a live system.
The public artifacts and technical paper give other researchers an opportunity to inspect the definitions, assumptions and proof approach. Independent analysis matters especially when a result is both complex and presented by the organization that developed the system.
Why use AI for proof work?
Formal verification has long been labor-intensive. A person must translate a desired property into formal language, understand the implementation and develop a proof that a checker accepts. Complex cryptographic code adds another layer of difficulty.
AI agents can help generate intermediate steps, explore proof strategies and repair attempts that the checker rejects. Their speed can make it practical to attempt work that would otherwise require substantial specialist effort. But the model does not remove the need to define the problem correctly or review the trusted assumptions.
DeepMind reports that its verification process took four weeks. That is the team’s account of this project, not a guarantee that any comparable software system can be verified in four weeks or at the same cost. The amount of expert preparation and the scope of the target matter.
What should software developers take from this?
The result suggests a way to combine AI’s ability to generate candidate proofs with a checker’s ability to reject invalid steps. It is especially relevant to code where a precisely defined property and a strong assurance case are worth the effort.
The practical questions remain: which components are included, how the specification was reviewed, which tools and assumptions are trusted, and how the proof is maintained as code changes. A verified build can become outdated when the implementation or its dependencies change.
The significance is therefore more specific than a claim that AI has solved cybersecurity. Researchers have demonstrated an AI-assisted route to checking important properties of a widely used cryptographic implementation. The next challenge is to see how reproducible, maintainable and transferable that approach is across other systems.
Explore the book: How to Do Hard Things: The Discomfort Trap
Be First to Comment