The Signal — November 12, 2026

Google DeepMind has published machine-checked proofs that the compiled code behind Signal's encryption meets a written set of security specifications. AI agents wrote the proofs, with a team of five working on the project for four weeks. New York opened a state center to test frontier AI systems and a portal where the largest developers must register under its RAISE Act.

Google DeepMind's AI agents proved security properties of Signal's compiled code, and the proofs are public

On November 10, Google DeepMind introduced AlphaProof Code, a system in which people and AI models write a formal specification of what software must guarantee, and a team of AI agents then proves in the Lean proof language that the software meets it. DeepMind applied it to libsignal, the reference implementation of the Signal protocol, which in variant forms also protects messages in WhatsApp, Messenger and Google Messages. According to the technical paper, the agents generated about 6.5 million lines of Lean proof covering Signal's post-quantum PQXDH handshake and its Triple Ratchet. The theorems establish forward secrecy, authentication, handshake secrecy and post-compromise security, which keeps messages protected after a device has been temporarily compromised. A team of five did the proof work over four weeks. For comparison, the paper notes that verifying the seL4 microkernel, often cited as the field's biggest success, took twenty person-years.

The theorems are stated about the compiled program itself. The researchers linked unmodified libsignal into a small command-line harness, compiled it with the standard Rust compiler into AArch64 Linux machine code, and proved their results against a formal model of that processor. DeepMind says these are the first proofs connecting protocol-level security guarantees to the unmodified code of a widely used cryptographic implementation. To test whether the specifications would catch real flaws, the team reintroduced two previously fixed libsignal bugs and proved that the resulting programs violate the security theorems. The analysis found no new vulnerabilities in the parts of the protocol it examined, WIRED reports. Ehren Kret, Signal's chief technology officer, said in a statement quoted by DeepMind that "prior formal verification focused on smaller portions of the code." The specifications and proofs are posted at DeepMind's verification site.

Because Lean checks every step mechanically, readers don't have to trust the agents that wrote the proofs, though they do rely on Lean's own checker. What they have to trust is the specification, about 18,000 lines of statements and definitions that people approved after AI reviewer agents critiqued the drafts, along with about 8,000 lines describing how the processor behaves. The paper says a flaw in the specification "could weaken the guarantee," and that human review "is not expected to detect all bugs in a large codebase." The work covers one-to-one sessions in libsignal v0.105.4 and leaves group messaging for later. Side channels are out of scope, and the cryptographic building blocks are assumed to be secure. The computational proofs give no guarantee against a quantum attacker, although the symbolic proof shows handshake secrecy against one, and neither proves the post-quantum recovery that SPQR, Signal's post-quantum ratchet, is designed to provide. WIRED adds that the project did not verify the whole Signal app, and that Google declined to share what the analysis cost. The proofs can now be checked by anyone; no outside group has reported doing so yet.

Sources: Google DeepMind · Google DeepMind (technical paper) · Google DeepMind (Lean development) · WIRED

New York opened a center to test frontier AI and a registration portal for the RAISE Act

Governor Kathy Hochul launched the New York Center for AI Responsibility and Research on November 10. Based at SUNY's Binghamton University, it is meant to "independently test advanced AI systems for safety and security," according to the governor's office. "The stakes are too high to simply take AI companies at their word," Hochul said. Greg Morrisett of Cornell Tech and Jeannette Wing of Columbia University will lead it as interim co-directors, drawing on more than 80 researchers who will keep working at their home institutions. The center will use computing resources from Empire AI, the state's $500 million public-private research initiative. As Newsday noted, Hochul first announced the center in January with a $30 million gift from donors led by Bloomberg co-founder Tom Secunda; SUNY added an initial $25 million research investment. The center's first recruiting push covers areas including formal methods and verification, interpretability and alignment, and biosecurity.

The same announcement opened a portal where large frontier AI developers must register with the state by January 1, 2027, under the RAISE Act. From January, those developers must publish safety frameworks on their websites, and all frontier developers must report critical safety incidents and publish model transparency reports. The release cites a 72-hour deadline for incident reports. The center will coordinate with DIGIT, the state office set up to implement the act, to begin reviewing the published safety frameworks and recommend ways to strengthen the requirements. POLITICO describes the effort as a response to President Donald Trump's decision not to pursue federal safeguards for AI.

The release gives the center an advisory role, providing assessments and evidence "at the State's request." It doesn't say whether developers will have to give the center access to their models, or what follows if its researchers find a problem, and the center has not published any evaluations yet. The governor's office calls the effort "first-of-its-kind," a description we haven't checked against programs elsewhere.

Sources: Office of the Governor of New York · POLITICO · Newsday

On the Editor's Desk

A shorter Signal today. We held the DeepMind story on November 10, when WIRED's report was all we had, and ran it once the paper and proofs were posted. A Google engineering post on how stale TODO comments send coding agents into work nobody asked for was useful but dates to November 6, so it's too old for this edition. We again held a preprint testing AI-text detectors on German students' English essays because it still hasn't had an outside read. Meta's Muse Ember model is also on hold until someone other than Meta tests it.