---
title: Formal verification just got cheap: six million lines of proof for Signal in four weeks
description: DeepMind's AlphaProof Code generated six million lines of Lean proof for Signal's protocol library in four weeks, flagging 1% for human review. Three preprints show the same pattern spreading to proof repair and project management.
canonical: https://hangingcontext.com/stories/2026-11-11/formal-verification-gets-agentic/
last-updated: 2026-11-11
url: https://hangingcontext.com/stories/2026-11-11/formal-verification-gets-agentic/
published: 2026-11-11T12:39:26Z
edition: 2026-11-11T12
newsroom: artificial-intelligence
beat: research
trust: confirmed
source_count: 4
cited_manifest_ids: ['1794362148640093001', '1794380138610189436', '1794387984085226958', '1794380366335190805']
---

# Formal verification just got cheap: six million lines of proof for Signal in four weeks

*DeepMind's AlphaProof Code generated six million lines of Lean proof for Signal's protocol library in four weeks, flagging 1% for human review. Three preprints show the same pattern spreading to proof repair and project management.*

Confirmed · 4 Manifests · Artificial Intelligence · Published 2026-11-11 12:39 UTC

## Key facts

- Google DeepMind says its AlphaProof Code framework, announced on 10 Nov 2026, generated over six million lines of Lean proof in four weeks and flagged about 1% of Signal's protocol codebase for human review. (self-reported) [cites: 1794362148640093001]
- In a preprint, ProofCoder increases proof success on the AutoRocq benchmark from 47% to 60%, cuts backtracking 4x to 6x, and halves computational cost for proof synthesis. (self-reported) [cites: 1794380138610189436]
- In a preprint, TopoVerus achieves 61.6% Safe-Pass@1 and 72.2% Safe-Pass@3 on Verus benchmarks, outperforms Claude Sonnet 4.5 by 5.7/6.3 points, and learned counterexamples improve proof repair success by 64.3% over chain-of-thought diagnostics. (self-reported) [cites: 1794387984085226958]
- DeepMind's Signal analysis found no new vulnerabilities in the parts of the protocol it checked, and its paper states that formal verification has historically been too expensive for most software. (self-reported) [cites: 1794362148640093001]

## Six million lines of proof

Google DeepMind has introduced AlphaProof Code, a multi-agent framework for formal verification, and its first demonstration is a striking one: the system generated over six million lines of Lean proof in four weeks for Signal's protocol library, with human experts reviewing the specifications and agents flagging only about 1% of the codebase for manual inspection. Formal verification proves with math that code meets a stated property for every input — but DeepMind's paper states it has historically been too expensive for most software. The new framework combines human expertise with AI agents to perform the verification, and the Signal analysis found no new vulnerabilities in the parts of the protocol it checked. [cites: 1794362148640093001]

Two caveats in the same report deserve attention. DeepMind's paper states that a specification cannot be automatically checked — someone still has to write down what the code is supposed to do, and that specification is where the judgment lives. And the review problem is not going away: reviewing and validating AI-generated code is the main delivery constraint for 25.8% of developers. Formal verification does not remove human review. It concentrates it on the 1% of the code that matters most, and on the specification that defines what correct means. [cites: 1794362148640093001]

## The preprints behind the demo

In a preprint posted this week, ProofCoder shows how the agent side of this works. It introduces an agentic approach to formal verification that moves beyond standard tactic-generation loops by enabling continuous reasoning and iterative proof revision, using feedback from the Rocq proof assistant to decide when to gather information, inspect states, or backtrack. It increases proof success on the AutoRocq benchmark from 47% to 60%. Continuous reasoning reduces backtracking frequency by 4x to 6x compared to rigid tactic-generation loops, and feedback-guided revision allows for a 50% reduction in computational cost. The agent does not just generate more proofs. It wastes less effort on the wrong ones. [cites: 1794380138610189436]

> **From Synorb** — Claims with a source link. A Manifest holds a Signal of structured claims and a Brief, plus the source it came from. Your agent can check a sentence against it. [Read the guide](https://synorb.com/connect/start)


In a preprint, TopoVerus attacks the repair side: when a proof fails, what tells the model how to fix it? The framework trains language models to generate actionable counterexamples for Verus proof repair, using a curriculum based on topological invariant dependencies. It achieves 61.6% Safe-Pass@1 and 72.2% Safe-Pass@3, outperforming Claude Sonnet 4.5 by 5.7/6.3 points in proof repair success. Learned counterexamples improve existing language-model-based proof repair success rates by 64.3% compared to chain-of-thought diagnostics. A counterexample is worth more than an explanation, because it shows the model exactly where the proof breaks. [cites: 1794387984085226958]

## Managing the work, not just the proofs

In a preprint, a fourth paper addresses the project management problem that formal verification has always had: nobody can see how far along it is. The authors introduce automated proof dependency analysis that maps proof obligations to their underlying specifications and assumptions, enabling precise progress tracking, implemented in the Viper and Gobra verifiers. Their proposed progress metric accurately reflects the state of a verification project over time, and dependency-based guidance strategies outperform standard bottom-up and top-down verification approaches in real-world benchmarks. Verification stops being a black box and becomes a project with a visible state. [cites: 1794380366335190805]

Taken together, the four pieces describe a field crossing a cost threshold. Six million lines of proof in four weeks, proof success up from 47% to 60% at half the cost, repair success up 64% with counterexamples, and progress you can measure. The constraint that kept formal verification confined to the most critical code — cost — is falling, and the remaining constraint is the specification. Someone still has to say what correct means. That job just became the most valuable one in the pipeline. [cites: 1794362148640093001, 1794380138610189436, 1794387984085226958]

## What is still unresolved

- Whether AlphaProof Code's Signal results generalize to codebases without Signal's mature specification culture.
- Whether the proof-success gains hold outside the AutoRocq and Verus benchmarks.
- How much human expertise the specification-writing step still requires at scale.

## Decision card

- **Useful for:** Developers working on high-assurance software; Security engineers verifying protocol code
- **Not for:** Codebases without a formal specification to check against
- **Compare against:** Manual code review for critical code; LLM-as-a-judge review of pull requests

## Provenance ledger

| Manifest id | Title | Source | Claims used | Published |
|---|---|---|---|---|
| `1794362148640093001` | Google DeepMind Says AI Formally Verified Signal's Protocol Code and Flagged Only 1% for a Human Look. Where Should Human Review Go? | [qodo-publishing](https://qodo.ai/blog/alphaproof-code-signal-formal-verification) | 1794362607209094730, 1794362607214094732, 1794362607217094733, 1794362607224094737, 1794362607220094735, 1794362607226094738, 1794362607212094731, 1794362607227094739 | 11-10 00:00 |
| `1794380138610189436` | ProofCoder: Continuous Reasoning for Automated Software Verification | [arxiv-ai-agents-tool-use](https://arxiv.org/pdf/2611.14106v1) | 1794380388129192475, 1794380388131192478, 1794380388133192479 | 11-11 00:00 |
| `1794387984085226958` | Curriculum proof repair with learned counterexamples | [arxiv-frontier-methods-select](https://arxiv.org/pdf/2611.13627v1) | 1794388301650228829, 1794388301659228830, 1794388301667228832 | 11-11 00:00 |
| `1794380366335190805` | Using Proof Dependencies to Manage Verification Projects | [arxiv-code-devtools-ai](https://arxiv.org/pdf/2611.13250v1) | 1794380711862195088, 1794380711867195089, 1794380711869195090 | 11-11 00:00 |

## Run these Manifests yourself

Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.

1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.
2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief.
3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them.

Cited Manifest ids:

- `1794362148640093001`
- `1794380138610189436`
- `1794387984085226958`
- `1794380366335190805`

```sh
for id in 1794362148640093001 1794380138610189436 1794387984085226958 1794380366335190805; do
  curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id"
done
```

> **From Synorb** — Ask what Synorb covers. The MCP tool synorb-stream-search answers questions like "do you have this publisher?" without using any Manifest allowance. [Connect and ask](https://synorb.com/connect/start)

## Related stories

- [Context is the new compute bill: your tools cost more than your model](https://hangingcontext.com/stories/2026-11-11/context-is-the-new-compute-bill/)
- [Coding agents write twice as fast as humans can review. The bottleneck moved, not away](https://hangingcontext.com/stories/2026-11-11/coding-agents-review-bottleneck/)
- [The attacks moved inside the model: dormant neurons, fragmented prompts, one flipped bit](https://hangingcontext.com/stories/2026-11-11/attacks-move-inside-the-model/)
- [Your agent's settings are code now — and they are leaking your secrets onto GitHub](https://hangingcontext.com/stories/2026-11-11/agent-settings-leak-secrets/)

## Links

- HTML: https://hangingcontext.com/stories/2026-11-11/formal-verification-gets-agentic/
- JSON: https://hangingcontext.com/stories/2026-11-11/formal-verification-gets-agentic/index.json
- Markdown: https://hangingcontext.com/stories/2026-11-11/formal-verification-gets-agentic/index.md

Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.

---
Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-11-11/formal-verification-gets-agentic/. Terms: https://hangingcontext.com/terms/reuse/