# AI helps check the code that keeps private messages private

Agent contract: 1.2.0

Google DeepMind’s AlphaProof Code produced machine-checked proofs for parts of Signal’s cryptographic implementation. The promising step is making rigorous software checks easier to do, with people still deciding what must be proved.

Canonical: https://brightaifuture.com/discoveries/alphaproof-code-private-messages
Format: discovery
Source publication: 2026-11-10
Bright publication: 2026-11-11
Substantive update: 2026-11-11
Evidence and review: Emerging; confidence: unassessed; approved; ai-assisted. AI-assisted source report comparing the November 10 announcement with the public technical report, including stated proof scope and limitations, Signal design documentation and reporting about costs. No Bright proof rerun, independent security audit, interview or human editorial review is claimed. Original explanatory visual is a simplified workflow, not a performance result. An additional AI-assisted source and visual review was completed; scope and quantum-limit precision edits adopted.

## Editorial image

Original Bright explanatory diagram of the AlphaProof Code workflow: people define and review the requirement and assumptions, AI agents write proofs about specified properties of compiled libsignal, and Lean checks that the proof satisfies the approved statement. The diagram states the boundary: specified code and assumptions, not the entire Signal app.: https://brightaifuture.com/media/content/8259b6afaf1f23cff985aa193c5e8982ab3e27f30c76092ed567ba1662a463ca.png

Credit: Original Bright explanatory diagram, based on Google DeepMind’s November 10, 2026 technical report. License: Original Bright visualization; all rights reserved.

Source: https://google-deepmind.github.io/code-verification/

explanatory; not a screenshot, a performance chart, verification of the entire Signal app, or an independent proof audit.

## The story

A private message can hold something ordinary and irreplaceable: a family conversation, a plan with a friend, a difficult question. Most of us cannot inspect the code carrying it. We depend on other people finding ways to check that the protection works.

On November 10, Google DeepMind announced AlphaProof Code, a system that combines researchers’ judgment with AI agents to verify security properties of Signal’s core cryptographic code. The company says the work took four weeks. Its announcement includes support from Signal’s chief technology officer, Ehren Kret, who describes the approach as an expansion of earlier verification work. [DeepMind’s announcement](https://deepmind.google/blog/introducing-alphaproof-code/)

## Checking the promise against the implementation

Signal’s published design explains why messaging security involves more than encrypting a single note. Its Double Ratchet changes the keys used as a conversation proceeds, aiming to protect earlier messages if current keys are stolen and to regain protection after a compromise under the required conditions. Handling delayed messages adds another practical complication. [Signal’s specification](https://signal.org/docs/specifications/doubleratchet/)

A sound design still has to survive implementation. An analogy is a building plan and the building itself: checking the plan does not settle whether the finished structure follows it. Software verification asks a similarly concrete question, though its answers are mathematical and depend on precisely stated assumptions.

DeepMind’s researchers worked with AI to define the requirements; agents then wrote proofs that the Lean proof checker had to accept. The technical report describes about 6.5 million lines of proof and roughly 26,000 lines of trusted specifications and processor semantics. The target was libsignal v0.105.4’s one-to-one session code, run in a small command-line harness compiled for AArch64 processors. [Technical report](https://google-deepmind.github.io/code-verification/)

## What the result covers

The report establishes specified confidentiality, authentication and compromise-recovery properties under its models. Reintroducing two previously fixed bugs produced proofs that the altered code violated the symbolic security theorem. The scope excludes the complete Signal applications, group messaging, multi-device state and side channels. Cryptographic and execution-environment assumptions remain. The computational proof offers no quantum-adversary guarantee. A separate symbolic proof covers handshake secrecy if an attacker later breaks Diffie–Hellman key exchange, but not the added post-quantum ratchet’s recovery after compromise. [Results and limitations](https://google-deepmind.github.io/code-verification/)

For someone reading the headline, those boundaries are part of the result. A proof about one component cannot promise that a stolen unlocked phone, a deceptive message or every other part of an application is safe. This is a reason to understand the work, not a reason to change everyday security habits.

## The opportunity is broader access to careful checking

The practical question is whether more software teams could afford this depth of scrutiny. WIRED reports that Google did not disclose the project’s cost or plans for a commercial verification service. A fast research demonstration alone cannot settle the economics of routine use. [WIRED’s reporting](https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/)

The released specifications and proofs give specialists something concrete to examine. Bright has reviewed the sources, not rerun the proofs or independently audited their assumptions. [Public research artifacts](https://google-deepmind.github.io/code-verification/)

Bright’s reading is that the most useful possibility lies in changing who can obtain rigorous assurance. If the approach becomes affordable and repeatable, maintainers of everyday software could spend more effort deciding what people need protected, then test whether the implementation meets that requirement. Independent scrutiny, broader coverage and maintainable proofs will determine how far that opportunity travels.

## The human problem

A private message can hold something ordinary and irreplaceable: a family conversation, a plan with a friend, a difficult question. Most of us cannot inspect the code carrying it. We depend on other people finding ways to check that the protection works.

## The prior constraint

Rigorous verification of real software has required substantial specialist work, limiting where it can be applied.

## AI’s actual role

AI agents draft specifications under human review and generate proofs checked by Lean against approved statements.

## The documented result

DeepMind reports machine-checked proofs of specified security properties for a compiled build using libsignal, with about 6.5 million lines of proof and roughly 26,000 lines of trusted specifications and processor semantics.

## Why it may matter

If this approach becomes affordable and repeatable, more software maintainers could check whether important protections hold in the implemented code. That wider benefit remains to be demonstrated.

## Limitations

The result concerns specified properties of a particular AArch64 command-line build of libsignal v0.105.4’s one-to-one session code, not the complete Signal applications. Group messaging, multi-device state and side channels are outside its scope.

The proofs depend on trusted specifications, processor and environment models, and cryptographic assumptions. The computational proof offers no quantum-adversary guarantee. A separate symbolic proof covers handshake secrecy if an attacker later breaks Diffie–Hellman key exchange, but not the added post-quantum ratchet’s recovery after compromise.

Bright has not rerun the proofs or independently audited their assumptions. Public artifacts are available for scrutiny; affordability, broader coverage and routine commercial use are not established.

## Unresolved questions

Can independent specialists reproduce the checks and validate the specifications and assumptions?

Can coverage expand to more application behavior and realistic deployment conditions?

What does verification cost, and how readily can proofs be maintained as software changes?

## Provenance and history

{
  "dates": {
    "captureDate": "2026-11-11T12:03:56Z",
    "eventDate": "2026-11-10",
    "lastReviewedDate": "2026-11-11T12:07:18.168Z",
    "publicationDate": "2026-11-10"
  },
  "provenance": {
    "origin": "editorial",
    "externalId": null
  },
  "revisions": [
    {
      "id": "alphaproof-code-private-messages-initial-2026-11-11",
      "recordedAt": "2026-11-11",
      "sourceIds": [
        "source:alphaproof-code-private-messages:paper",
        "source:alphaproof-code-private-messages:announcement",
        "source:alphaproof-code-private-messages:signal",
        "source:alphaproof-code-private-messages:reporting"
      ],
      "summary": "Initial source report on AI-assisted verification of messaging protocol code, with exact implementation and proof-assumption limits."
    },
    {
      "id": "alphaproof-code-private-messages-review-method-2026-11-11",
      "recordedAt": "2026-11-11",
      "sourceIds": [
        "source:alphaproof-code-private-messages:paper",
        "source:alphaproof-code-private-messages:announcement",
        "source:alphaproof-code-private-messages:signal",
        "source:alphaproof-code-private-messages:reporting"
      ],
      "summary": "Clarified that the additional source and visual review was AI-assisted; article, evidence scope, limitations and image are unchanged."
    }
  ],
  "corrections": []
}

## Original sources

- [Google DeepMind · November 10, 2026 · primary technical report and public proof artifacts; scope and limitations in sections 5.1.6 and 5.2.5](https://google-deepmind.github.io/code-verification/)
- [Google DeepMind · November 10, 2026 · institutional announcement](https://deepmind.google/blog/introducing-alphaproof-code/)
- [Signal · Double Ratchet specification · background on messaging security design](https://signal.org/docs/specifications/doubleratchet/)
- [WIRED · November 10, 2026 · reporting on undisclosed costs and commercial plans, not independent proof replication](https://www.wired.com/story/a-new-ai-tool-from-google-deepmind-formally-verified-the-signal-protocol/)

## Continue exploring