DeepMind’s AlphaProof Code Verifies Signal Protocol Encryption Guarantees
Google DeepMind researchers used a new AI framework, AlphaProof Code, to mathematically verify key guarantees of the Signal encryption protocol in four weeks. The work found no new flaws, but it points to faster software security checks.
Google DeepMind researchers used a new AI tool called AlphaProof Code to mathematically prove several key cryptographic guarantees of the Signal protocol, the encryption system behind Signal, Google Messages and WhatsApp, according to a report published November 10, 2026. The proof work took four weeks.
Researchers call this kind of math-based checking "formal verification." It confirms that software behaves as intended and has no critical vulnerabilities.
What DeepMind found
The team found no new vulnerabilities in the parts of the Signal protocol it examined. That counts as further independent validation of the cryptography that protects a huge volume of the world's messages.
The researchers also ran AlphaProof Code on older Signal versions that contain known, long-fixed flaws. The tool correctly flagged them and showed those versions could not be formally verified.
DeepMind is releasing the specification and proof it built for the Signal analysis, in the hope of helping other formal verification projects.
Why AI changes the workload
Before AI, formal verification was slow. People had to describe the properties they wanted to prove, turn those descriptions into formulas, and then write the proof.
Agentic AI, meaning software that carries out multistep tasks with some autonomy, can cut the time needed for the proof stage. That made the four-week Signal analysis possible.
The project had a head start, though. The Signal Foundation had already done some formal verification work, which the DeepMind researchers say helped them move quickly.
Limits of the project
The analysis did not formally verify the entire Signal mobile app. DeepMind researchers describe their findings as one milestone in a larger process.
Cost is another open question. DeepMind ran the analysis free of charge as a research project, and Google declined to share what it cost. The company also declined to say whether it plans a commercial formal verification product or service.
The researchers say a core advance is a "human-AI collaboration process" in which AI agents contribute to the proofs and correct their own work.
What the people involved said
Ehren Kret, Signal's chief technology officer, said in a statement: “While prior formal verification focused on smaller portions of the code, Google DeepMind's approach enables significant expansion.” He added that “As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code's privacy guarantees.”
Pushmeet Kohli, chief scientist at Google Cloud and DeepMind's vice president of research, pointed to wider uses. “If you can now verify the correctness of these implementations, then you can rest easy,” he said, suggesting banks and other companies could one day prove properties of their own software.
Swarat Chaudhuri, a DeepMind research scientist, was more cautious. “We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that,” he said.
