Formal methods · Program analysis · Information-flow security

Mahmudul Faisal
Al Ameen

I reason formally about how information flows — inside software, and against AI-scale adversaries.

Independent researcher PhD, Informatics Separation logic · IFC · Side-channels
01

About

I am an independent researcher and formal-methods specialist with over a decade of experience building industry-grade static analysis for memory safety, information-flow security, and constant-time verification of cryptographic code. I now work on my own research and ventures full-time.

Most recently, at CEA-LIST in Saclay, France, I worked on the side-channel security of post-quantum cryptography — including a systematic timing-leakage study of NIST PQDSS candidates and scalable constant-time verification tooling, presented at the NIST PQC Standardization Conference.

Earlier, I built separation-logic verifiers at the National University of Singapore, the National Institute of Informatics (Japan), and the University of Tokyo — tools applied to autonomous-driving software and open-source library security. My doctoral work proved completeness and expressiveness results for pointer-program verification in separation logic.

Today my curiosity points outward: extending the same information-flow mathematics from inside programs to the open world of personal and business data, where large-language-model adversaries change what "leakage" even means.

02

Research interests

Verification

Formal verification & program analysis

Modular static analysis, separation logic, bi-abductive inference, and machine-checked correctness for systems software.

Security

Information-flow control

Non-interference, logic-based IFC, declassification, and a dual notion I call non-conclusivity against inference adversaries.

Crypto

Side-channel & constant-time

Systematic timing-leak analysis of post-quantum primitives; scalable constant-time verification tooling.

Systems

Symbolic execution & LLVM

Scalable symbolic reasoning, function-pointer elimination, and reverse engineering of LLVM back toward analyzable source.

Frontier

Privacy under AI-scale adversaries

Formal and information-theoretic guarantees for privacy defenses when the adversary is an LLM-powered correlation engine.

Logic

Fixpoint logic & transformation

Asynchronous unfold/fold transformation for fixpoint logic and its use in functional-program verification.

03

What I'm building now

shifa.dev
Shifa playground — information-flow analysis of C with verified output

Shifa

Live Symbolic heap-based information-flow analyzer

Shifa proves non-interference for C programs: that a function's public outputs cannot depend on its secret inputs. It combines separation-logic reasoning about the heap with information-flow analysis over a Z3 backend, checking each function against a lightweight stub specification of its security signature (Hi → Lo).

  • In-browser playground — write C, get a verdict
  • Information-flow mode with Hi/Lo security labels
  • Stub specification language for compositional analysis
  • Separation logic + symbolic execution + Z3
  • BinRevZ — reach binaries via LLVM reverse engineering
seenslide.com
SeenSlide — live study and presentation interface

SeenSlide

In development Real-time study & presentation platform

Navigate presentations. Study together. In real-time. SeenSlide captures slides live during lectures and conferences and syncs them to every device in the room — no app, just a link or QR code. Around that live feed it adds a collaborative study layer: shared annotations, slide-linked chat, study groups, and an AI assistant that can explain a selected region, summarize a slide, or translate it on the spot.

  • Live slide capture & WebSocket sync
  • Collaborative annotation & chat
  • AI personas — Strict Professor, Socratic Guide, ELI5…
  • Select-region explain · summarize · translate
  • Study groups with join codes · QR sharing
  • Open-source desktop capture · cloud SaaS
ostudi.com
Ostudi — a full online classroom on an ordinary phone

Ostudi

In development ওস্তাদি · a classroom in your phone

Take live classes. Learn from wherever you are. Ostudi turns an ordinary phone into a complete online classroom — show slides, write on a live board, talk in real time, take attendance, and lean on an AI helper. No laptop, no expensive software, and it holds up on weak connections. Built for teachers and students in exactly the conditions most edtech ignores.

  • Live slides, board & real-time voice
  • Attendance and an in-class AI assistant
  • Designed for low bandwidth & modest phones
  • Android 8.0+ · free · multilingual (বাংলা · EN · FR)
banglarrokto.org
Banglar Rokto — archive of victims of state violence in Bangladesh

Banglar Rokto

Live বাংলার রক্ত · open memorial archive

Blood of Bengal — from '52 to '24. An open, Bengali-language archive of those who gave their lives for the freedom and rights of the people of Bangladesh — spanning from the 1952 Language Movement to the 2024 student uprising. A work of remembrance, built so these names and stories cannot be quietly erased.

  • Decentralised storage on IPFS — censorship-resistant by design
  • Interactive timeline (1952 → 2024) & map of events
  • Narrative chapters & victim profiles in Bangla
  • Open archive · React · D3 · Leaflet
seeksync.app
SeekSync — the 8-layer migrant labour pipeline prototype

SeekSync

In development digital backbone for migrant labour

Not merely sending workers abroad — building a trusted human-excellence export hub. SeekSync is an operational prototype (BGCDP 3.1) for Bangladesh's overseas-labour ecosystem: an 8-layer pipeline that connects workers, training providers, recruiters, foreign employers, returnees, and the ministry around a single, dignified digital identity for every worker.

  • Worker Digital Identity — NID, skills, contracts, wages, grievance & return in one thread
  • AI demand intelligence — corridor-by-corridor labour forecasting
  • Role dashboards: worker, provider, recruiter, employer, returnee, ministry
  • Built around migration corridors: Japan, Saudi Arabia, Italy, Germany, Korea
safeself.fr
SafeSelf Research — the decoy-validation research journal

SafeSelf

In development Privacy research & platform

My most ambitious project: adversary-aware privacy under an explicit LLM-amplified adversary threat model. SafeSelf measures how well intelligent analyzers — cloud LLMs, local LLMs, even humans — can reconstruct a person from their OSINT footprint, and how effectively decoy interventions degrade that reconstruction without making the footprint implausible. Where most tools just hide or delete data, SafeSelf attacks the adversary's confidence itself.

  • seeself — personal data-audit pipeline
  • safesocial — peer-to-peer social network
  • counterself — end-user defensive walker
  • Decoy-validation research: personas, synthetic corpora, cross-analyzer benchmark
spheres.dev
Spheres — a calm, private, peer-to-peer social network

Spheres

In development Your circle. Your peace. Your privacy.

A social network built for calm, meaningful connection — no rage-bait algorithms, no ads mining your attention, no strangers in your feed. Just the people you actually trust. Spheres is peer-to-peer: your data stays on your device, and metadata stays private by construction.

  • Peer-to-peer — your device is the storage, not a company server
  • End-to-end encrypted, no plaintext metadata
  • No phone or email required to join
  • A feed of only the people you chose — no algorithm
04

Selected publications

  1. 2025

    Systematic Timing-Leakage Analysis of NIST PQDSS Candidates: Tooling and Lessons Learned

    S. Bardin, E. Bellini, G. N. Dione, M. F. A. Ameen, et al.

    arXiv preprint · NIST PQC Standardization Conference

  2. 2024

    Asynchronous Unfold/Fold Transformation for Fixpoint Logic

    M. F. Al Ameen, N. Kobayashi, R. Sato

    Science of Computer Programming

  3. 2021

    Function Pointer Eliminator for C Programs

    D. Kimura, M. F. A. Ameen, M. Tatsuta, et al.

    Asian Symposium on Programming Languages and Systems (APLAS)

  4. 2019

    Completeness and Expressiveness of Pointer Program Verification by Separation Logic

    M. Tatsuta, W. N. Chin, M. F. Al Ameen

    Information and Computation

  5. 2017

    A Logical System for Modular Information Flow Verification

    A. Prabawa, M. F. Al Ameen, B. Lee, W. N. Chin

    International Conference on Verification, Model Checking, and Abstract Interpretation (VMCAI)

  6. 2016

    Completeness for Recursive Procedures in Separation Logic

    M. F. Al Ameen, M. Tatsuta

    Theoretical Computer Science

  7. 2009

    Completeness of Pointer Program Verification by Separation Logic

    W. N. Chin, M. F. Al Ameen

    IEEE International Conference on Software Engineering and Formal Methods (SEFM)

Full list on Google Scholar ↗
05

Through a lens

A quieter pursuit. Light, geometry, and the occasional accident — gathered slowly, added when something earns it.

06

Let's talk.

Open to research collaboration, deep-tech ventures, and conversations about formal methods, privacy, and security.