On November 10 Google DeepMind introduced AlphaProof Code, a multi-LLM agentic framework for formal verification: human experts and models turn security goals into formal specifications, then agents powered by Gemini 4 Carbon carry out the proofs. The team used it to prove key security properties of the core Signal protocol implementation, such as forward secrecy and post-compromise security, all the way down to the AArch64 machine code running on devices. DeepMind says this is the first time the implementation of a widely deployed protocol has been formally verified at this depth by any method, with or without AI: more than 6 million lines of Lean proofs in four weeks, with only about 1% needing human review. Specs and proofs are open source on GitHub, and Signal CTO Ehren Kret endorsed the result.
Key Takeaways
- ✓Scale: agents produced 6M+ lines of Lean proofs in 4 weeks during October 2026, all machine-checked by Lean (vendor figure)
- ✓Human share: after agent self-audit only about 1% of the proofs were flagged for human review; every specification was reviewed by human experts
- ✓Depth: proofs reach the AArch64 machine code, covering the protocol core including the PQXDH handshake and Triple Ratchet, without trusting the Rust compiler
- ✓Negative test: the team reintroduced 2 real, previously fixed bugs into an isolated build, and the system produced machine-checked proofs that those versions were insecure
- ✓Open source: paper, Lean specs and proofs are published at google-deepmind/code-verification, with a public endorsement from Signal's CTO
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and Industry Pain Points
Formal verification proves mathematically that code is free of certain classes of flaws, the highest standard of security assurance, but it is very expensive: most work stops at the protocol design level or covers a small slice of code, and fully verifying an implementation can take expert teams years. Meanwhile attackers are already using agents to find bugs at scale, so defenders need faster tools. Google DeepMind picked the Signal protocol, which protects billions of private conversations in Signal and Google Messages.
Architecture Highlights and Mechanism
AlphaProof Code splits work like a research team: human experts collaborate with several models to translate Signal's security goals into formal specifications and review each one; then a group of agents powered by Gemini 4 Carbon writes the proofs, and agents audit them and flag what a human should check. Every proof is checked by the Lean theorem prover, so an agent mistake is simply rejected. The target is the compiled AArch64 machine code, closing the gap between design and implementation where real bugs tend to hide.
Benchmarks and Measured Results
This is not a leaderboard result; there is no public general benchmark, and DeepMind has not published direct comparisons with other tools. The verifiable figures, all vendor-reported: four weeks, 6M+ lines of Lean, about 1% human review, and two reintroduced known bugs both proven insecure. DeepMind says comparable efforts could take teams decades of combined work. Some developers note that millions of lines of proof are hard for humans to read and that reusable spec libraries are the long-term payoff.
Developer Guide and Getting Started
Read the DeepMind technical paper and the Lean specs and proofs on GitHub, and re-check them locally with Lean 4. Teams building critical infrastructure, crypto libraries or firmware can start by writing security requirements as checkable specifications. AlphaProof Code itself is not yet available as a product or API; DeepMind invites teams building critical software to get in touch and plans to improve the specs with the open-source community.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.