The team compiled unmodified libsignal v0.105.4 and the spqr v1.6.0 crate with the standard Rust compiler into AArch64 Linux machine code, linked into a small command-line harness, and loaded the executable into Lean alongside a formal model of AArch64 [2]. Specification-writing agents, working with humans, adapted published security models of Signal into Lean; agents powered by Gemini 4 Carbon and Claude Opus 5.5 drafted and reviewed them, and people approved each one [2]. Teams of prover agents powered by Gemini 4 Carbon then wrote the proofs, which a gatekeeper accepts only if Lean's kernel checks them against a held-out copy of the approved specification [2].
The output is about 6.5 million lines of Lean proof covering roughly 140,000 AArch64 instructions; a reader has to trust about 18,000 lines of specifications plus about 8,000 lines of the AArch64 semantics [2]. A team of five did the proof work over four weeks, and none of the authors wrote proof code [2]. DeepMind's blog says the agents flagged about one percent of the codebase for human review [1]. For comparison, the paper notes that verifying the seL4 microkernel took twenty person-years [2]. DeepMind did not disclose the compute cost.
To test whether the specifications would catch real flaws, the researchers reintroduced two previously fixed libsignal bugs, a weak-state bug and a small-subgroup check missing from the PQXDH responder, and proved in Lean that the resulting binaries violate the security theorem [2]. Writing the specifications also turned up errors in the published analyses they were based on, including 15 gaps or bugs in a computational analysis of the Double Ratchet [2]. The paper does not report new vulnerabilities in libsignal.
The guarantees are bounded. They cover one-to-one sessions; group messaging is left for later, key generation is not verified, and side channels are out of scope [2]. The symbolic proofs assume perfect cryptography, the computational bounds give no guarantee against a quantum adversary, and the ratchet theorems show the Triple Ratchet is no weaker than the Double Ratchet but do not prove the post-quantum healing that SPQR adds [2]. The results also trust Lean's kernel, the cryptographic primitives and the contracts of some routines the executable calls [2].
"Using AI agents to translate live code into valid Lean theorems is a major breakthrough," said Ehren Kret, Signal's chief technology officer, adding that earlier formal verification covered smaller portions of the code [1]. Academic researchers previously verified the PQXDH protocol design with automated tools in 2024 [3]. DeepMind has published the full Lean development, specifications and proofs at google-deepmind.github.io/code-verification [2]. The project follows other DeepMind work applying AI agents and Lean to security and science, including cheaper attacks on legacy 1024-bit RSA (MLQ.ai coverage) and Lean-checked savings in quantum algorithms (MLQ.ai coverage).
