# Formal Verification

ProofCoder, a proof-synthesis system for Rocq software verification, stops letting an external controller dictate when to retrieve premises, backtrack or repair; instead the model writes down its reading of the proof state before each tool call and decides whether to continue, query or roll back to a given line. On 280 verification lemmas from the AutoRocq benchmark, its best configuration raises proof success from AutoRocq's 47% to 60% at roughly half the inference cost, and removing continuous reasoning leaves the agent solving fewer lemmas at higher cost with four to six times more backtracking.

ProofCoder, a proof-synthesis system for Rocq software verification, stops letting an external controller dictate when to retrieve premises, backtrack or repair; instead the model writes down its reading of the proof state before each tool call and decides whether to continue, query or roll back to a given line. On 280 verification lemmas from the AutoRocq benchmark, its best configuration raises proof success from AutoRocq's 47% to 60% at roughly half the inference cost, and removing continuous reasoning leaves the agent solving fewer lemmas at higher cost with four to six times more backtracking.

A team at Eindhoven University of Technology organized LLM-assisted Dafny verification into a ten-step workflow in which Claude Code acts as a verification construction agent, producing specifications, implementations, invariants and proofs under human supervision. The workflow yielded machine-checked Dafny implementations for 37 algorithms from graph theory, labelled transition systems and computational geometry, including the Hopcroft–Tarjan triconnectivity test; the authors report many verifications within hours to a few days, but ran no controlled comparison against human-led verification.

A team at Eindhoven University of Technology organized LLM-assisted Dafny verification into a ten-step workflow in which Claude Code acts as a verification construction agent, producing specifications, implementations, invariants and proofs under human supervision. The workflow yielded machine-checked Dafny implementations for 37 algorithms from graph theory, labelled transition systems and computational geometry, including the Hopcroft–Tarjan triconnectivity test; the authors report many verifications within hours to a few days, but ran no controlled comparison against human-led verification.

State-inferer recovers a protocol implementation's state machine by program slicing: from each state-variable assignment it runs depth-bounded forward and backward searches on the system dependence graph, hands the LLM one compact fragment per transition, then specializes RFC security properties into linear temporal logic formulas over that model and checks them with nuXmv. On seven open-source TLS, IKEv2 and SSH implementations it reaches a macro-average strict transition-level F-score of 95.2 against 78.9 for the strongest baseline, Codex, and uncovers four previously unknown vulnerabilities, all assigned CVE or CNVD identifiers.

State-inferer recovers a protocol implementation's state machine by program slicing: from each state-variable assignment it runs depth-bounded forward and backward searches on the system dependence graph, hands the LLM one compact fragment per transition, then specializes RFC security properties into linear temporal logic formulas over that model and checks them with nuXmv. On seven open-source TLS, IKEv2 and SSH implementations it reaches a macro-average strict transition-level F-score of 95.2 against 78.9 for the strongest baseline, Codex, and uncovers four previously unknown vulnerabilities, all assigned CVE or CNVD identifiers.

Tool-using language-model agents often execute actions their domain policies forbid, and LeanGuard places policies written in Lean 4 between the model and its tools so that only admitted calls execute. On τ 2-bench, unguarded runs of five Qwen models executed at least 33 calls the Lean policy forbids, while LeanGuard executed none; on DTap, direct prompt-injection success fell from 57.9% to 5.9% and indirect success from 22.3% to 3.8%. Denials with feedback did not significantly change task success, and the read-only deployment blocks many benign writes.

Tool-using language-model agents often execute actions their domain policies forbid, and LeanGuard places policies written in Lean 4 between the model and its tools so that only admitted calls execute. On τ 2-bench, unguarded runs of five Qwen models executed at least 33 calls the Lean policy forbids, while LeanGuard executed none; on DTap, direct prompt-injection success fell from 57.9% to 5.9% and indirect success from 22.3% to 3.8%. Denials with feedback did not significantly change task success, and the read-only deployment blocks many benign writes.

Axiom released a Lean formalization of the Stacks Project, turning the roughly 7,500-page open reference that lays the foundations of modern algebraic geometry into a single machine-checked library of about 16 million lines of code. Algebraic geometry had lacked matching Lean infrastructure: a contemporary proof may invoke a long chain of theorems across commutative algebra, schemes, sheaves, cohomology and algebraic stacks before its core argument begins. The library keeps the original permanent tags so researchers and AI agents can import definitions and theorems directly, and the formalization surfaced dozens of statements needing local refinement.

Axiom released a Lean formalization of the Stacks Project, turning the roughly 7,500-page open reference that lays the foundations of modern algebraic geometry into a single machine-checked library of about 16 million lines of code. Algebraic geometry had lacked matching Lean infrastructure: a contemporary proof may invoke a long chain of theorems across commutative algebra, schemes, sheaves, cohomology and algebraic stacks before its core argument begins. The library keeps the original permanent tags so researchers and AI agents can import definitions and theorems directly, and the formalization surfaced dozens of statements needing local refinement.

Harmonic has extended Aristotle, previously applied to research mathematics, to formal verification of software and hardware, starting with C and Verilog. Unlike code review and testing, which examine only a portion of possible behaviors, it uses machine-checked proofs to determine whether specified properties hold across all possible inputs within a defined system, proposing properties from code and reporting which were proved and what assumptions each proof rests on. In the block Tensordyne's team considered hardest to verify, it found bugs up to 110,000 cycles deep; on LibTomMath it fixed three bugs and made modular exponentiation 31–38% faster in Harmonic's benchmarks, with the faster code proved against the same spec.

Harmonic has extended Aristotle, previously applied to research mathematics, to formal verification of software and hardware, starting with C and Verilog. Unlike code review and testing, which examine only a portion of possible behaviors, it uses machine-checked proofs to determine whether specified properties hold across all possible inputs within a defined system, proposing properties from code and reporting which were proved and what assumptions each proof rests on. In the block Tensordyne's team considered hardest to verify, it found bugs up to 110,000 cycles deep; on LibTomMath it fixed three bugs and made modular exponentiation 31–38% faster in Harmonic's benchmarks, with the faster code proved against the same spec.

Formal verification once took years of expert effort and was reserved for code such as avionics. In a collaboration with Theorem, Claude turned existing fuzz tests in open-source libraries into specifications and then produced proofs over compiled RISC-V assembly for 239 entry points across 123 OSS-Fuzz libraries, patching the bugs it found along the way. The proofs assume a single-threaded, statically linked RISC-V binary on Linux with a fixed memory budget and inputs up to 64 MB.

Formal verification once took years of expert effort and was reserved for code such as avionics. In a collaboration with Theorem, Claude turned existing fuzz tests in open-source libraries into specifications and then produced proofs over compiled RISC-V assembly for 239 entry points across 123 OSS-Fuzz libraries, patching the bugs it found along the way. The proofs assume a single-threaded, statically linked RISC-V binary on Linux with a fixed memory budget and inputs up to 64 MB.