DeepMind’s AlphaProof Code verifies part of Signal’s code
Google DeepMind used AI to prove specific security claims about a compiled Signal component. The research shows why the software build and the claim both matter.
Google DeepMind introduced AlphaProof Code on November 10. Researchers used AI agents to generate mathematical proofs for specific security properties of the code behind Signal’s one-to-one messaging protocol. One proof reached down to a compiled program, the instructions a processor runs.
That closes a gap between a protocol’s design and one implementation of it. The team studied a command-line build of Signal’s core library. The scope is narrower than the Signal app on someone’s phone.
What the proof covers
A formal proof starts with an explicit claim and a set of assumptions. The researchers set the scope, guided the wording and reviewed the specifications. Agents generated proofs and Lean, a mathematical proof checker, checked the reasoning.
The technical report describes two kinds of assurance. One connects behavior of the compiled program to a model of the messaging protocol. Another puts a mathematical bound on an adversary’s chances under stated assumptions in a separate model. The analysis covers selected behavior in one-to-one conversations. Group messaging and the full Android and iOS apps fall outside the project’s scope.
What a software buyer can ask for
The report says five researchers worked on the proofs over four weeks. They spent most of their effort on specifications. Automating the proofs still leaves people to decide which promises matter and describe them precisely enough for a checker.
For a software buyer, the practical question is whether the proof applies to the release being purchased. A vendor can make that answer concrete by identifying the build, naming the property it verified and explaining the assumptions. The next test for a team using this approach comes with a software update: can it show that the same assurance still applies to the version customers receive?