AlphaProof Code Proved Correctness of Signal's Encryption Core in 4 Weeks Instead of Years

Tests show that code works on the inputs you thought to check. For encryption that is not enough: a bug that went unnoticed for five years is still a bug. That is why the most critical systems use formal verification, that is, a mathematical proof of correctness. It works, but it is expensive: it requires rare specialists and years of effort. DeepMind says it has found a way to shorten that timeline dramatically.

What DeepMind Showed

The team presented AlphaProof Code, a system that proves a program conforms to its security specification without errors. The demonstration was carried out on the core of Signal's encryption protocol. According to researchers Pushmeet Kohli and Swarat Chaudhuri in the DeepMind blog, this kind of work usually takes years, while here four weeks were enough.

There is a second difference. Earlier attempts to verify Signal stopped at the level of theoretical design: they proved that the protocol itself was built correctly. AlphaProof Code verified the actual cryptographic code that runs on users' devices. The nastiest bugs often hide between an elegant design and its implementation, and that is the gap that was closed here.

How It Works, with a Simple Example

Imagine a function that adds two numbers. A test will check a couple dozen combinations. A proof in Lean works differently: it shows that the result is correct for any input values, and Lean mechanically checks every step. If the reasoning has holes, it simply won't pass verification.

The process is split into two stages:

• First, human experts formulate formal security requirements: what exactly the code must guarantee.
• Then AI agents based on Gemini Carbon help formalize the specifications and independently prove that the program satisfies them.

In total, the agents wrote more than six million lines of Lean. The system flagged about 1% of the codebase for manual review by humans. As a control, the researchers planted two errors in the code, and both were caught immediately. Signal CTO Eren Kret says this approach strengthens trust in data privacy amid growing AI-related threats.

What to Keep in Mind

First: a proof is only as correct as the specification. If the experts made a mistake in the requirements or forgot about a class of attacks, the system will faithfully prove conformance to the wrong goal. The bottleneck shifts from writing proofs to formulating requirements, and humans are not made redundant.

Second: this is still a demonstration on a single project, and it was reported by the developer itself. The article does not say how much the computation cost or how easily the method can be transferred to another language and architecture. We have not seen an independent evaluation of the result.

Third: 1% of code going to human review looks modest, but this is cryptography, where one unverified fragment can undermine the rest. Flagging such sections is part of the method, not a weakness.

What This Means in Practice

For developers, the main signal is this: the most expensive part of verification, writing the proofs, is starting to be automated. The skill of formulating precise requirements for code, such as invariants and bounds of acceptable behavior, will be more valuable than the ability to write proofs by hand. If you work with cryptography, payments, or protocols, it is worth looking at Lean and similar tools now.

For product managers and founders, this is a new trust argument. "The code is mathematically proven" is stronger than "we passed an audit." If the cost of verification really drops from years to weeks, that argument will become available to more than just Signal.

DeepMind plans to extend the method to power grids and medical devices through systems like CodeMender. There the cost of an error is no less than in a messenger, and the requirements are often stricter. It remains to be seen whether the result will be repeated on other projects and whether outside specialists will confirm it.