AlphaProof Code vs TwIL-LM3-Pro: A Framework You Cannot Buy Against a Model You Can Barely Download

The most useful thing to know about comparing AlphaProof Code and TwIL-LM3-Pro is that neither one is a product. AlphaProof Code is G​oogle DeepMind's agentic formal-verification framework, published on 10 November 2026 with the Lean artifacts of a four-week verification of Signal's compiled libsignal binary and no endpoint behind it. TwIL-LM3-Pro is webAI's 3.66-billion-parameter formal-logic reasoning model, on Hugging Face since 3 September 2026, whose weights sit behind an email-request form and a licence that forbids commercial use. One asks "can I get this at all"; the other asks "can I run this cheaply enough to matter." For anyone who works in formal methods, both questions are the live ones, and neither answer is a yes.

What TwIL-LM3-Pro is, mechanically

Strip the marketing and TwIL-LM3-Pro is a dense Granite decoder: forty layers, hidden size 2,560, forty attention heads against eight key-value heads, derived from IBM's granite-4.2-3b. The real parameter total is 3,659,737,600, and the 131,072-token context is the base model's, carried through unchanged. It emits a <think>…</think> block before answering and was evaluated with greedy decoding at a 2,048-token budget.

The training stack is unusually well documented for a model this size: a rank-64 LoRA supervised fine-tune on a synthetic formal-logic corpus, multipath distillation for several reasoning traces per prompt, parameter-space checkpoint fusion rather than taking the final checkpoint, a WiSE-FT interpolation at α = 0.15 merged back toward the base with TIES and DARE-SLERP, and an entropy-weighted GRPO stage webAI calls MGPO against a programmatic verifier, run to step 2580. The published artifact is the merged policy, which is the practical detail: you can run it in bf16 at 6.82 GiB, or as a Q4_K_M GGUF at 2.09 GiB on a CPU or 4 GB of VRAM.

That last sentence is the entire value proposition. A 3.66B model that runs on a laptop and answers formal-logic questions is a different kind of object from a verification framework that needed five researchers, four weeks and teams of 40 to 80 agents. TwIL-LM3-Pro is the cheap end of formal reasoning; AlphaProof Code is the expensive end of formal assurance. They are not substitutes and the comparison is only worth making because people keep filing both under "AI for formal methods."

What the benchmarks on each side actually establish

TwIL-LM3-Pro's card reports four summary rows on its own Track A: a macro gate of 0.5539, strict-7 of 0.2879, a six-lane average of 0.5389 and macro_primary of 0.5875. Against Qwen3-8B the macro gate is 0.5539 versus 0.5336, and the card writes the sentence a marketing page would have deleted: the gate lead of 0.020 is smaller than the sampling noise at n = 200 per lane, so that row is parity, not a win. Where it is not a tie:

• Strict-7 — 0.2879 vs Qwen3-8B at 0.2093, and this row uses no loose-match credit anywhere, so formatting luck cannot produce it.

• Strict MCQ — 0.4100 vs 0.0000, the widest lane gap in the eleven reported rows.

• Rule induction — 0.4195 vs 0.3680.

• Corpus fit — the lowest lm_corpus perplexity of any arm at 2.3130, against 2.5478.

• Held-out suite — the card is blunt: "TwIL-LM3-Pro does not lead it." The 10-dataset macro is 0.7901, statistically level with its own base at 0.7942 and well behind Qwen3-8B at 0.8493 and gpt-oss-120b at 0.8689.

Two more caveats the card states itself: Track A generations average 1,902 tokens against 564 for the predecessor, with 24.2% hitting the length cap, which the card calls "indicative rather than exact"; and the throughput figures were measured on a newer vLLM than the comparison columns.

AlphaProof Code has no such table, because it is not answering a question a table can answer. The claim is that a specific binary — libsignal v0.105.4 with spqr v1.6.0, built by rustc 1.98.1, statically linked, one AArch64 executable — satisfies ten symbolic theorems and a computational track with a concrete bound, proved by roughly 6.5 million lines of Lean and checked by the kernel. The comparable validation is the negative test: two real, previously fixed bugs were reintroduced into an isolated copy, and both produced machine-checked proofs of insecurity. That is not a score. It is a demonstration that the system can tell correct code from broken code, which is a stronger statement than TwIL's 0.2879 on strict-7 and a much narrower one — one binary, one specification, one week of five people's time.

The licence, which is the actual decision point

TwIL-LM3-Pro ships under a licence that forbids commercial use, distributed through three channels that are not equivalent. The weights are on Hugging Face. The checkpoint is revised periodically — the current one landed on 30 September 2026. And on 1 October 2026 webAI published a LiteRT-LM build for on-device Android and iOS inference, which is the channel that makes the 2.09 GiB GGUF figure meaningful for a phone application. One of the three channels is a form, and if your use is commercial you should read the licence before you read the benchmark table.

AlphaProof Code's distribution question is different and arguably worse. The artifacts are published at github.com/google-deepmind/code-verification — the Lean development, the 7,578-line AArch64 semantics covering 467 instructions and 31 system calls, the libsignal binding, the symbolic and computational specifications — and the landing page states no licence at all. That is not "permissive"; it is unresolved. The blog post says only that DeepMind is open-sourcing the verification artifacts for community use. Before you build a pipeline on top of a Lean development with no licence, ask someone.

So: one artifact is a model you may not use commercially; the other is a codebase whose terms are unstated. For a hobbyist the first is workable. For a company, neither is a green light.

Where each one would actually sit in a pipeline

TwIL-LM3-Pro does reasoning over formal logic as text. Give it a proof obligation, a rule system, a set of premises; it produces a derivation in prose-and-symbol form that a human reads. It is a reasoning aid, and the card's own benchmark suite — rule induction, strict multiple choice, corpus fit — is built around that job.

AlphaProof Code does not reason over logic in text. Its agents write Lean, and the Lean is checked. The two stages are complementary in principle: a small model that proposes the shape of a specification, a strong general model that reviews it, and a proof-agent harness that closes it against a kernel. What is missing between them is a bridge — TwIL-LM3-Pro has not been evaluated on Lean statement generation, and nothing in its card suggests it was trained for it. Its natural neighbour in that stack is MathForm-8B, OpenBMB's Lean 4 autoformalizer, not a verification framework.

DeepMind's own account of the human bottleneck is the interesting part here. Before any proof work began, researchers translated Signal's security goals into formal specifications with a mixture of models, and an expert reviewed every specification. A small, fast, local model that could draft those statements plausibly and cheaply would be genuinely useful at that stage — and would still need the expert review, because a wrong specification produces a proof of the wrong theorem, verified perfectly.

What you can run today, and what it costs

• TwIL-LM3-Pro — weights by request from Hugging Face under a non-commercial licence; a LiteRT-LM on-device build since 1 October 2026; no hosted API from webAI that I can verify. Self-host on 6.82 GiB of bf16 weights or 2.09 GiB at Q4_K_M.

• AlphaProof Code — not runnable. Artifacts published, no endpoint, no weights, no price, no waitlist, no licence stated.

• The models inside AlphaProof Code — the proof agents ran on G​emini 4 Carbon, which we do not serve; Claude Opus 5.5 was used among the models drafting and reviewing specifications and is on OrcaRouter's catalogue at $4 per million input and $20 per million output tokens, provider list price passed through at 0% markup.

• The models TwIL-LM3-Pro is measured against — Qwen3-8B-class models are the ordinary comparison set for a 3.66B formal-logic checkpoint, and the point of putting them behind one key is that a spec-drafting loop can send the same obligation to a small specialist and a general model and diff the results without a second contract. Model fusion does the same thing in one call: a panel answering together, which is roughly what the DeepMind team did with a mixture of models on the specification stage.

The honest verdict, which is that you probably need neither

If you want formal verification of production code, AlphaProof Code is a paper and a Lean development. Read it, cite it, and do not plan a sprint around it — DeepMind's own framing is that scaling the technique "requires continued research," and the paper says the process has substantial room for optimization. The median time to a clean build is hours, and a one-line source change can trigger large proof repairs.

If you want a small model that reasons about formal logic on a laptop, TwIL-LM3-Pro is real, runs at 2.09 GiB quantised, and its own card tells you where it ties rather than wins. Check the licence before you check the benchmarks, because the licence is the shorter read and the more decisive one.

What both releases share is a shape worth noticing: the frontier of formal methods is being pushed at the very expensive end by a lab with hundreds of agent-hours to spend, while the affordable end produces small models with narrow competence and non-commercial terms. The middle — a commercial tool that takes a specification and returns a checked proof for code you own, at a price a team can budget — is still empty. That gap, not the gap between these two artifacts, is the one worth watching.