AlphaProof Code vs AesCode 32B: One Proves Code Correct, the Other Draws It

Put AlphaProof Code and AesCode 32B in the same sentence and the only thing they share is the word "code." AlphaProof Code is a G​oogle DeepMind agentic framework announced on 10 November 2026 that produced roughly 6.5 million lines of machine-checked Lean proving the compiled libsignal binary behaves as specified. AesCode 32B is a 33-billion-parameter vision-language checkpoint that Microsoft uploaded to Hugging Face in early October 2026 with no announcement, and it writes a prompt into a single self-contained HTML document — a slide, a poster, a dashboard — that a human then looks at. Neither one is a service you can call. One of them is not even a model. If you arrived here looking for a drop-in replacement decision, the honest answer is that no such decision exists, and the rest of this piece explains why the comparison is still worth making.

The category error, stated properly

AesCode 32B is a generator. You give it a description; it returns an artifact whose quality is judged aesthetically and by whether the numbers on the page happen to be the numbers you asked for. The model card's own framing is that image generators compose a handsome page and misrender the figures on it, while code models get the figures right and cannot see how the page looks — AesCode pairs your prompt with an image generated from that same prompt and uses the image as an aesthetic reference while following the text for content.

AlphaProof Code is a verifier. You give it a specification — a statement of what must be true — and it returns a proof, checked by Lean's kernel, that a particular compiled binary satisfies that specification. There is no aesthetic judgment anywhere in the loop. A proof is either accepted or it is not, and the acceptance criterion is a few thousand lines of kernel code rather than a reviewer's taste.

That distinction decides what each is for. AesCode 32B answers "make me a thing." AlphaProof Code answers "is this thing what it claims to be." You would use the first on a Tuesday afternoon for a deck and the second, if you were Signal, over four weeks with five researchers and teams of 40 to 80 agents.

What each one actually ships

• Parameters — AesCode 32B: about 33.4 billion in BF16 across fourteen safetensors shards totalling 66,714,912,704 bytes. AlphaProof Code: none. It is a framework plus an artifact repository, and there are no weights to download.

• Base — AesCode 32B: a fine-tune of Qwen3-VL-32B-Instruct, architecture declared as Qwen3VLForConditionalGeneration, so it loads with transformers 4.57 and later. AlphaProof Code: model-agnostic by construction; the DeepMind paper names G​emini 4 Carbon for the proof agents and says Claude Opus 5.5 was used among the models drafting and reviewing specifications.

• Licence — AesCode 32B: Apache 2.0, on Hugging Face today. AlphaProof Code: the Lean development, AArch64 semantics and libsignal binding are published at github.com/google-deepmind/code-verification, and the landing page states no licence, which you should resolve before building anything on it.

• Availability — AesCode 32B: self-host only. Roughly 65 GB of accelerator memory for the weights, a vLLM command on four tensor-parallel ranks, no hosted endpoint and no inference-provider mapping behind the repo page. AlphaProof Code: research artifact, no endpoint, no waitlist, no pricing.

• Output — AesCode 32B: one HTML document, checkable by opening it. AlphaProof Code: a Lean proof term, checkable by Lean.

• What "correct" means — AesCode 32B: the page looks right and the figures match the prompt, judged by a person. AlphaProof Code: the theorem holds for all inputs in the model, judged by a kernel.

The one genuinely interesting overlap: both outputs are artifacts

Here is the comparison worth having. Both systems produce a file that outlives the model that made it. AesCode 32B's HTML is a finished document; you can ship it, edit it, diff it, and nobody needs the model again. AlphaProof Code's Lean proof is a finished derivation; you can re-check it on a laptop in a few minutes of compute, and if the specification has not changed, the result still stands in five years.

That is a rarer property than it sounds in a market full of chat endpoints. Most model output is disposable text whose value depends on the model remaining available. Both of these produce something you can keep. The difference is what "keep" buys you: with AesCode you keep a deck, with AlphaProof Code you keep a guarantee.

Where the analogy breaks is auditability. Anyone can open the HTML and see whether the title is wrong. Almost nobody can open 6.5 million lines of Lean and see whether the theorem says what the press release says it says — which is precisely why DeepMind's paper spends pages enumerating its trusted base, its 37 contracted primitives and the properties it does not prove. The artifact is checkable; the reading of it is not free.

What the numbers on each side are worth

AesCode 32B's headline is an overall score of 85.89 against GPT-5.5 at 81.28 — Microsoft's measurement of a competitor's model, on a rubric Microsoft wrote, on a harness Microsoft built. Boundary sits at 97.27 with severe overflow on 4.3% of samples, and style at 55.99, a row where no model in the table clears 60. As of the repo's own counters, nobody outside Microsoft had published a number for the model. Every figure above is vendor-reported and unreproduced.

AlphaProof Code has no benchmark table at all, and that is not a gap in the reporting — it is a different kind of claim. The result is that a specific binary satisfies ten symbolic theorems and a computational track with a concrete bound. You can disagree with the specification, but you cannot argue with the kernel's verdict on the proof. The comparable caveats are structural rather than statistical: no post-quantum guarantee for SPQR healing, no payload privacy, no responder authentication on unpromoted first messages, one session per promotion, fixed message lengths, no multi-device state. And a MAC forgery bound that goes vacuous around 25,000 messages in a single session.

One number does cross over usefully. AlphaProof Code's verification took four weeks where comparable work has historically taken expert teams years, against the paper's own cited baselines of roughly 20 person-years for seL4 and about 6 for CompCert. That ratio is the claim to hold onto, and it is a claim about workflow, not about model quality.

Which one you can actually run this week

AesCode 32B: yes, if you have the hardware. Download the shards, serve with vLLM on four ranks, keep prompts under the card's 24,576-token ceiling, and accept that your review step is a human squinting at rendered HTML. It will not tell you whether the page is right; it will tell you whether the page looks right.

AlphaProof Code: no. The published artifacts are a Lean development, not a pipeline you invoke. Even the models inside it are not the deliverable — the framework is a research construct, and DeepMind's own framing is that scaling it "requires continued research." CodeMender is the sibling project for automated repair; verification and remediation are two different products in that lab's roadmap.

If what you want is a model to draft the specifications — the step where human experts translated Signal's security goals into Lean, reviewed one by one — that is ordinary model work, and Claude Opus 5.5 is on OrcaRouter's catalogue at $4 per million input and $20 per million output tokens with provider list price passed through at 0% markup. Routing a spec-drafting loop across two or three models and comparing their Lean output is a routing-DSL call, not a research project. What none of that gives you is a proof; the proof step is where the six million lines came from.

Why the pairing is worth publishing anyway

Because "code model" has become a category with no floor. A model that writes slides and a framework that proves a messaging protocol both get filed under it, and buyers comparing them on a leaderboard learn nothing. The useful question is not which is better — it is what evidence you get for the output. AesCode 32B gives you a rendered page and a vendor rubric. AlphaProof Code gives you a kernel-checked derivation and an unusually explicit list of what it assumes. One of those scales to code you would rather not get wrong, and it is not the one with the bigger parameter count.

If you are evaluating AesCode 32B for a design pipeline, the thing to test is not its overall score but its boundary behaviour — the 4.3% severe overflow rate is where a deck silently becomes wrong rather than ugly. If you are evaluating AlphaProof Code, the thing to read is the spec-deviation catalogue in the artifact repository: over 200 computational entries and about 35 symbolic ones, fifteen of which are gaps or bugs in the Double Ratchet analysis. That catalogue is the most honest document in the release, because it is a list of everything the proofs did not close.