Vibitely Daily

Thursday, 12 November 2026, story 3 of 7

DeepMind's AlphaProof Code formally verifies key parts of Signal

Google says the Lean proofs took four weeks; Wired reports the scope was limited and no new vulnerabilities were found.

Illustration: A small steel vault door fitted with a precisely cut brass key, with a ruler laid across it and a handful of tiny flagged pins marking a few spots on the door's surface.

What happened

Google DeepMind says its new AlphaProof Code system formally verified key parts of the Signal protocol's cryptographic core in four weeks. The Decoder, summarising a DeepMind blog post, says comparable work typically takes years. After experts defined the security requirements, agents built on Gemini Carbon wrote over six million lines of Lean proof and flagged roughly one percent of the codebase for human review. Two bugs planted for testing were caught.

Wired reports the scope was limited: the whole Signal mobile app was not verified, and no new vulnerabilities turned up. DeepMind is releasing the specification and proof. Whether others can use AlphaProof Code is not stated.

What it means

This is a proof of concept, and Wired describes it that way. The four-week figure comes with caveats: DeepMind had a head start from earlier Signal Foundation verification work, and the cost is undisclosed. Google ran the analysis free as research and declined to say whether a commercial service is planned. A team cannot yet budget for this.

What carries over is the process. Experts wrote the requirements, agents wrote the proofs, and humans reviewed the flagged one percent. A proof is only as good as its specification, so the human steps likely matter most. Teams with security-critical code may find the released specification and proof a useful template. Watch for cost figures, any product, and the planned extension to power grids and medical devices, which so far is only a stated plan.

What to do: If you ship security-critical code, read the released Signal specification and proof to see what a verifiable requirement looks like; do not plan around a product yet.

Sources

Filed under Research. Published .

"What it means" is analysis, not reporting. Found an error? Write to hello@vibitely.com.