Google DeepMind generated more than six million lines of Lean to prove Signal's shipping crypto code keeps its promises, the lab said.
AlphaProof Code splits the job like a research team, with humans and models writing formal specs and agents powered by Gemini Carbon proving them. Ehren Kret, Signal's chief technology officer, called translating live code into valid Lean theorems "a major breakthrough" that expands checks beyond smaller prior scopes.
The tell is the audit burden: agents flagged just one percent of the codebase for human re-review, the lab said.
Researchers collaborated with models to turn Signal's goals into math, and human experts reviewed every specification before any proof ran, per Google DeepMind. Lean then machine-checks each proof, so reviewers can trust the checked bulk and spend time where agents were unsure.
The proofs target compiled code, including protection before and after temporary device compromise, not just the protocol design.
That implementation gap is where deployment bugs live, and bridging it took four weeks versus years for manual expert efforts, the lab said. As a control, the team reintroduced two previously fixed bugs in isolation and Lean proved the buggy code insecure, confirming the checks can fail.
The same cryptography protects WhatsApp in addition to Signal and Google Messages, reported by WIRED, which widens the impact beyond the lab's examples.
Google DeepMind said it will open-source the verification artifacts for community use, while noting the guarantee covers core crypto and specified properties, not the whole chat app. Paired with defense agents like CodeMender, the lab points to firmware for medical devices and power-grid software as next targets.
If you ship protocol code, budget for spec writing because the prover is fast and the spec is now the security decision.
