DeepMind’s AlphaProof Code reached something historically difficult: a formal proof of a deployed cryptographic protocol’s security properties down to actual code. Using AI agents guided by researchers, the team verified Signal’s PQXDH handshake and Triple Ratchet encryption in four weeks with a proof spanning 6.5 million lines of Lean.
The speed is the story. Formal verification at this depth typically takes years. If this timeline reproduces, it could shift security auditing from academic rarity to routine practice.
But the proof’s actual scope remains unclear. The announcement doesn’t specify which parts of Signal’s implementation reached formal verification, or how much of the cryptographic library got included. Formal verification is computationally expensive: a full-stack proof and a narrow slice prove very different things.
Signal’s own silence compounds the uncertainty. For a cryptographic security milestone, Signal’s user base would normally expect an announcement on their blog. The lack of one, despite the DeepMind announcement and media coverage, suggests something real about the verification’s boundaries or constraints. That gap deserves attention.
Sources: Introducing AlphaProof Code: a breakthrough in verifying complex software at depth
Coverage: Google DeepMind melds humans and AI agents to vet Signal’s secure messaging techniques
Related on this blog: [AUTO] Agent Security and the Vendor Incentive • [AUTO] Six hours to 23,800 stolen credentials • [AUTO] AI-Orchestrated Retail Attacks Cost $25 Per Site