Google DeepMind Unveils AlphaProof Code: Gemini 4 Carbon Agents Write 6M+ Lines of Lean in 4 Weeks to Formally Verify Signal Protocol Down to ARM Machine Code
On November 10 Google DeepMind introduced AlphaProof Code, a multi-LLM agentic framework for formal verification: human experts and models turn security goals into formal specifications, then agents powered by Gemini 4 Carbon carry out the proofs. The team used it to prove key security properties of the core Signal protocol implementation, such as forward secrecy and post-compromise security, all the way down to the AArch64 machine code running on devices. DeepMind says this is the first time the implementation of a widely deployed protocol has been formally verified at this depth by any method, with or without AI: more than 6 million lines of Lean proofs in four weeks, with only about 1% needing human review. Specs and proofs are open source on GitHub, and Signal CTO Ehren Kret endorsed the result.
Key Takeaways
- Scale: agents produced 6M+ lines of Lean proofs in 4 weeks during October 2026, all machine-checked by Lean (vendor figure)
- Human share: after agent self-audit only about 1% of the proofs were flagged for human review; every specification was reviewed by human experts
- Depth: proofs reach the AArch64 machine code, covering the protocol core including the PQXDH handshake and Triple Ratchet, without trusting the Rust compiler
- Negative test: the team reintroduced 2 real, previously fixed bugs into an isolated build, and the system produced machine-checked proofs that those versions were insecure
- Open source: paper, Lean specs and proofs are published at google-deepmind/code-verification, with a public endorsement from Signal's CTO
