AlphaProof Code: AI Agents Formally Verified Signal's Code

Google DeepMind published AlphaProof Code on November 10, 2026, and the headline is easy to over-read: AI agents formally verified Signal. The claim is narrower and more interesting. If you searched for "AI formal verification" this week, the useful question is what was proved, what a human still had to sign off on, and what you can copy when an agent writes your code.

Last updated: November 11, 2026

What DeepMind says it did#

Everything here is from DeepMind's announcement and its technical paper site, and the results are DeepMind-reported, not independently reproduced.

• Target. libsignal, the Signal protocol reference implementation. The paper reports proofs for the post-quantum PQXDH handshake and the Triple Ratchet, covering forward secrecy, authentication, post-compromise security and handshake secrecy.
• Machine-code level. The proofs are about compiled AArch64 code, not a model of the design. The paper argues this matters because source-level Rust verifiers trust rustc, LLVM and a model of Rust semantics, while real vulnerabilities often sit in the gap between design and implementation.
• Scale. The paper reports about 6.5 million lines of machine-checked Lean proof resting on about 26,000 lines of trusted specifications and AArch64 semantics. A team of five worked for four weeks. (The announcement page text says "over six million" while its page metadata says "three million"; the paper's 6.5 million is the figure to cite.)
• Division of labor. Humans and models draft the formal specifications, and humans review every one. Agents powered by Gemini Carbon write the proofs. Agents then audit the result and flag the roughly one percent of the work that deserves human attention.
• A sanity check. The team reintroduced two real, previously fixed bugs into an isolated copy of the code, and the system produced machine-checked proofs that the buggy versions were insecure.

The part that makes it trustworthy: the checker, not the model#

The design choice worth stealing is that no model output is trusted. Provers are described as untrusted, and a gatekeeper accepts a proof only if Lean's kernel checks it against the approved specification. The paper notes that Lean replays every proof in a fresh environment and rejects sorry and native_decide, the two obvious ways to fake a proof.

That is the same pattern as a test suite you do not let the agent edit. Agent output is cheap and noisy, so acceptance must live in something the agent cannot argue with. The related result from Anthropic in October, covered in Claude's formal verification of 123 libraries, reaches the same conclusion with a Rocq checker instead of Lean. The two efforts differ in what the spec is: Anthropic started from existing fuzz tests and a no-crash property, DeepMind wrote protocol-level security specifications and proved them down to the instructions.

What you still have to trust#

The paper is explicit about what a reader must trust. In practice that list is:

1. The specifications. A correct proof of the wrong statement is worthless. This is why humans reviewed every spec.
2. The AArch64 semantics. The formal model of how the processor executes instructions.
3. Lean's kernel. The small checker that accepts or rejects proofs.
4. The cryptographic primitives. Stated as assumptions in the computational proof and idealized in the symbolic proof, along with contracts for some routines the executable calls.

Also note scope. The proofs target one architecture build of one library, and the result says nothing about the Signal servers, clients or your phone. Formal verification removes a class of bugs under assumptions; it is not a certificate that a product is secure.

What a builder does Monday#

You will not be running AlphaProof Code, but the pattern transfers to agent-written code in three steps:

1. Write acceptance before generation. Property tests, type constraints or a spec file the agent cannot modify. The agent proposes, the checker disposes.
2. Make the escape hatches loud. Lean rejecting sorry is the proof-world version of banning skipped tests and any casts in CI. List the cheats for your stack and fail the build on them.
3. Spend human review where the checker is blind. DeepMind's one percent figure is the model: automate what is mechanically checkable, then point scarce reviewers at the specs and the assumptions. For the economics of review at scale, see the argument in does code cleanliness affect AI coding agents.

If you want the math-side lineage, Anthropic's Lean formalization of Fermat's Last Theorem and Leanstral's theorem-proving model show the same Lean toolchain applied to pure mathematics.

What people are actually saying#

The Hacker News thread passed 650 points. Paraphrasing:

• Optimism about the trend. Several commenters expect verified software to become a baseline expectation, comparing running unverified code to using Telnet or plaintext HTTP. One says AI makes the economics of verification work for the first time.
• The spec question. The most common objection is the old one: how do you know the Lean statement matches what you meant? Commenters note the agents here did not challenge the spec, only the implementation, which is consistent with humans owning that step.
• Cheating risk. A practitioner who works with AI-written Lean warns that models can cheat when they write the proof, so you need an adversarial reviewer on top of the kernel. That is a self-reported single account, but it matches why the paper bans sorry and native_decide.
• Skeptics on framing. One commenter questions whether "multi-LLM" is the precise term for what is a multi-agent system, and another asks what the project cost, which DeepMind does not state in the announcement.
• Counter-case. A few ask whether proofs help for software outside cryptography, where specs are fuzzy. Nothing in the release answers that; the authors only say scaling requires continued research.

Continue Reading#

• Claude formally verified 123 open-source libraries - Anthropic's fuzz-test-as-spec approach with Rocq
• Gemini 4 Carbon developer guide - the model that powered the provers
• Anthropic's Lean autoformalization of Fermat - AI Lean proofs in mathematics
• Leanstral theorem-proving model - an open model aimed at Lean
• Does code cleanliness affect AI coding agents - how structure changes agent results

Sources#

• Introducing AlphaProof Code - Google DeepMind
• AlphaProof Code: Verifying Signal's Security at the Machine-Code Level (paper site)
• google-deepmind/code-verification on GitHub
• Hacker News discussion