Formal verification just got cheap: six million lines of proof for Signal in four weeks

Six million lines of proof

Google DeepMind has introduced AlphaProof Code, a multi-agent framework for formal verification, and its first demonstration is a striking one: the system generated over six million lines of Lean proof in four weeks for Signal's protocol library, with human experts reviewing the specifications and agents flagging only about 1% of the codebase for manual inspection. Formal verification proves with math that code meets a stated property for every input — but DeepMind's paper states it has historically been too expensive for most software. The new framework combines human expertise with AI agents to perform the verification, and the Signal analysis found no new vulnerabilities in the parts of the protocol it checked. m:…3001

Two caveats in the same report deserve attention. DeepMind's paper states that a specification cannot be automatically checked — someone still has to write down what the code is supposed to do, and that specification is where the judgment lives. And the review problem is not going away: reviewing and validating AI-generated code is the main delivery constraint for 25.8% of developers. Formal verification does not remove human review. It concentrates it on the 1% of the code that matters most, and on the specification that defines what correct means. m:…3001

The preprints behind the demo

In a preprint posted this week, ProofCoder shows how the agent side of this works. It introduces an agentic approach to formal verification that moves beyond standard tactic-generation loops by enabling continuous reasoning and iterative proof revision, using feedback from the Rocq proof assistant to decide when to gather information, inspect states, or backtrack. It increases proof success on the AutoRocq benchmark from 47% to 60%. Continuous reasoning reduces backtracking frequency by 4x to 6x compared to rigid tactic-generation loops, and feedback-guided revision allows for a 50% reduction in computational cost. The agent does not just generate more proofs. It wastes less effort on the wrong ones. m:…9436

In a preprint, TopoVerus attacks the repair side: when a proof fails, what tells the model how to fix it? The framework trains language models to generate actionable counterexamples for Verus proof repair, using a curriculum based on topological invariant dependencies. It achieves 61.6% Safe-Pass@1 and 72.2% Safe-Pass@3, outperforming Claude Sonnet 4.5 by 5.7/6.3 points in proof repair success. Learned counterexamples improve existing language-model-based proof repair success rates by 64.3% compared to chain-of-thought diagnostics. A counterexample is worth more than an explanation, because it shows the model exactly where the proof breaks. m:…6958

Managing the work, not just the proofs

In a preprint, a fourth paper addresses the project management problem that formal verification has always had: nobody can see how far along it is. The authors introduce automated proof dependency analysis that maps proof obligations to their underlying specifications and assumptions, enabling precise progress tracking, implemented in the Viper and Gobra verifiers. Their proposed progress metric accurately reflects the state of a verification project over time, and dependency-based guidance strategies outperform standard bottom-up and top-down verification approaches in real-world benchmarks. Verification stops being a black box and becomes a project with a visible state. m:…0805

Taken together, the four pieces describe a field crossing a cost threshold. Six million lines of proof in four weeks, proof success up from 47% to 60% at half the cost, repair success up 64% with counterexamples, and progress you can measure. The constraint that kept formal verification confined to the most critical code — cost — is falling, and the remaining constraint is the specification. Someone still has to say what correct means. That job just became the most valuable one in the pipeline. m:…3001 m:…9436 m:…6958