TL;DR Fermat's Last Theorem, unsolved for over 350 years, has now been fully formalized into a computer-verified proof by Claude in just 11 days. Dozens of AI agents collaborated to build a massive proof checked by the Lean proof assistant. Title: Formalizing Fermat's Last Theorem URL: Key points 🧮 29,500 intermediate theorems proved (30,300 total) 📄 13 million lines of Lean code generated -- 5x the size of Mathlib 🤝 Dozens of Claude agents collaborated, each taking on a piece of the proof 🧩 The Prove2Me platform managed theorem dependencies and project state ⚙️ Only Lean's three standard axioms were used 💬 Mathematician Kevin Buzzard independently confirmed the proof's validity 🔁 A 3-person team formalized the Three Primes Theorem in just 3 days using the same platform This looks like real evidence that AI-driven formalization can cut down the years-long human review burden that complex proofs usually require. #Lean# #FormalVerification#

Why does bounded model checking of C blow up on loops, and how do function contracts fix it? Title: Function Contracts for Bounded Model Checking of C Programs URL: ❓ Why is BMC so heavy? It unrolls loops N times and inlines every call. A function with an N-iteration loop called from K sites costs roughly N×K. 💡 What changes with contracts? The body is verified once against its contract, and each call is replaced by a stub derived from that contract. No unrolling is needed, so cost no longer scales with call count. ❓ What is new here? The authors add contract support to ESBMC. The assigns clause is checked observationally: snapshot the locations that must not change on entry, compare them at exit. Formula size depends on the number of globals, not the number of writes, unlike CBMC. The algebraic core is machine-checked in Lean 4. ❓ How well does it work? ・N=20,K=10: direct verification times out past 120 s, modular finishes in 12.5 s ・N=10,K=10: 42.0 s down to 1.8 s (23.3x) ・With 500 writes, ESBMC emits 5 VCCs vs. 521 for CBMC ・At the FIPS-203 ML-KEM size, monolithic runs exceed 10 minutes in both tools, but modular completes Note that at K=1 it is slower. #FormalVerification# #ModelChecking#

Formal verification of Aztec’s cryptography is underway. We've completed formal verification of major components of our proving system & our workflow for formally verifying the Aztec stack is quickly accelerating. Stay tuned for more updates with the upcoming Alpha V6 release

Formal verification is just static analysis + unit test using different vocabulary. It helps in the same sense as writing the same program in different programming languages helps to deepen the understanding.

Top 9 Formal Methods/Verification predictions: 1. Formal methods alone will not eliminate all kinds of bugs. What I’m calling “Empirical Verification” via sophisticated simulation testing, CUA, etc. will become more important than ever. 2. Languages won’t matter but barriers to adoption will still be relevant especially for startups with customers that they’d need to migrate codebases for, enterprises, etc. 3. For cost and pricing, the economics are improving but there is still high cost demands for infrastructure that are to be figured out. See more in point 7 below. 4. Models will significantly improve and intent alignment will take center stage. Even the best models today prove the wrong thing many times without sophisticated tooling, etc. The model by itself will not be enough here. 5. Engineering workflows are going to drastically change. Engineers will move into long running tasks in parallel that run for overnight to weeks, meaning we will work faster in higher quantity. But fast, iterative work that you push and get back instant results for will not be the norm anymore. Coding agents have tricked us into thinking we’re getting high quality, verified results instantly but that is not the case. This too will improve over time. 6. Vibe coding, consumer/indie development overall, and gaming will have very interesting windfalls as a result of formal methods scaling (at least in terms of applications end users will notice in their day to day). Not including crypto, finance, cloud, hardware, etc. that are already seeing and have been seeing strong results. 7. Languages are only one piece of this. Hardware, and compute are another but there will be an entire class of infrastructure that we’ll need in addition to great work on languages and across the board software. Honestly this is where one of the biggest risks lies. For this to work at scale, the infrastructure doesn’t exist and will require significant innovations and languages are not even there yet. As an engineering community if we want to win we need diversity of choice and we need to avoid lock in. That means helping contribute to different formal languages and you can start with the ones that are tied to your use case. Here’s a brief selection map I wrote: - Agents writing production code today (especially Rust): Verus - Checking a distributed design: TLA+ - Math: Lean - Bend 2, Vera, Vow and Kōdo: worth watching, still very early though. There’s others so feel free to fill them in, we can have an interesting conversation about them. Just get started for what works for you. Also you help the engineers working on building products around these to accelerate work that comes back for you to use. For example, I’m committing a lot of work to Verus which is OSS to give back. Join me. It’s pretty obvious the big guys are betting on Lean, Verus, TLA+, Dafny. Which, if you think about the unit economics of this and future vision, makes a lot of sense. Also if you read “FV X”, many of the engineers and researchers that are formal methods experts are pushing these too. There’s a reason. Also, there is less risk of having to rip out your work and start over if you want to get started now. And you can benefit from a rich engineering community already contributing to these languages with large amounts of funding. I like spreading out your contributions so no singular method is locked in and also because each is attuned for specific type of work. The most important thing is to have conviction and just contribute. I’m currently bullish on Rust so I’ve been pushing Verus. 8. Hiring will be impacted. As I mentioned this space is ripe for direct innovation and in tangential research areas, such as intent alignment. Understanding Verification Engineering and I mean understanding it for both Formal and Empirical Verification will help you a lot. This is another reason to look into the above languages as ways for working with the frontier AI labs, neo labs, and big tech companies. There’s a very limited number of formal methods experts today and even less that can combine Formal Verification, Empirical Verification, and Agentic Engineering. 9. “Vibe Verification” via just natural language skills or plugins, etc. will take the market by storm because it’s satisfying to have instant feedback. At times they will maybe even prove valuable, meaningful things and perhaps are good enough for some cases. But they are definitely not good enough for actual commercial or enterprise products or real security today. Be wary of and do not pay for Vibe Verification. Just like with all the test bloat that we had to rip out, if you vibe verify your codebase then it will be filled with slop you’ll have to pull out in the future. As model capabilities improve the last thing you want is poor formal spec examples that are incorrect for these models to reference inside of your codebase. Save yourself the trouble. I could be wrong about everything and also right about a thing or two, but I think for collective success and transparency we should share our predictions and work together. Follow me for more on Verification and Agentic Engineering.

while i'm quite bullish on formal methods, i think it's worth tempering expectations and doing your own research on it (disclaimer: i am not an expert in it). it cannot guarantee your code is bug free, only that it matches the spec under certain assumptions, and the specs come from what people want, not math. as long as we build software for humans, nothing can prove that your spec is right, only you can judge. i created the /statechart skill in pstack primarily because it helps make the state machines implicit in your code more obvious and legible to you, so you can shrink the review surface and review the work at a higher level: does it actually match your intent and goal? i used this skill a ton while building my game below you can see the statechart for story mode where i was able to find many bugs with it. in that sense, i think model checking (eg TLA+ with TLC) is quite useful for understanding and checking properties of your system e2e, and you don't have to write tons of new verification code for it. the spec isn't your actual code so there's always a risk of drift, but so far i've had good experiences finding actual bugs with it. i tend to pair it with empirical verification (running the code) also to confirm it's real other types of formal verification like proving theorems (eg Lean, Dafny), bounded model checking (eg CBMC, Kani) etc have their own tradeoffs. proofs cover every possible input, but only for the properties specified, and it takes a lot more code/work. bounded model checking can run on your actual code, which avoids drift, but it only checks up to a certain number of steps, so it's better at finding bugs than proving there aren't any so i think in the near-medium term you'll still need to layer your codebase: constraints and guardrails (types, lint rules, api design, refactoring), empirical verification (tests, evals, real usage), and formal verification for the parts that really need it. none of these catch everything on their own, but layered together, they catch a lot more and shrink what's left for you to review but also maybe in the limit, the bitter lesson will prevail and flawless code will just be printed out perfectly every time with no bugs. even in that scenario, /statechart still seems very helpful in confirming that the agent understood your intent correctly. give it a try if you haven't already!

People assume that in an AI doing formal verification world, they can take their existing codebase, ask AI to prove it correct, and get either a proof or a bug. Sadly reality has a few bones to pick with this, and one of them is the "existing codebase" part. And that's due to the good ol' halting problem. The short of it is that there is no general purpose algorithm that takes any program and input and correctly determines whether it will terminate or run forever. With a few mathematical flourishes we can extend that to "Rice's theorem" and prove this is true for any nontrivial semantic property, meaning we can't automatically prove arbitrary things about arbitrary programs. Now obviously we can prove some things about some programs, or else formal verification wouldn't exist as a field. The trick is that we write the code in a style suitable for verification. One example of this is totality: in Lean, all functions must be guaranteed to return a value for all inputs. If we want some code that runs forever (like f.ex a server), instead of `while true` we do `while (i < 10^60)` so that it's guaranteed to terminate and return a value (after the end of the universe). (Totality is also why, in Lean, `1/0 == 0`. If you convert your code to Lean without accounting for this, you could have correct lean but incorrect code!) Another "style" we use is state machines. Even if your code doesn't quite fit an SM architecture, if you want to prove it at scale, you're probably going to go with a state machine. State machines are the carcinisation of provable code. Hopefully by now the problem is clearer: even if your codebase is objectively correct, it might not be in the right shape to be proven correct! Okay, just have the AI rewrite your codebase into another form, right? Two problems. One: you don't know if you've introduced errors in the rewrite because you can't prove them equivalent (since one of them is not in a provable shape). Two: making code more verifiable can make it worse on other metrics, like modifiability, performance, and complexity. And now you've got the old bugbear of software engineers, the dreaded tradeoff. Now, don't get me wrong, formal verification has a huge role in the future of software, but it's not going to be a breezy "prove my Ruby thx" Claude prompt. It's still going to take work and expertise on our parts to prove our code, and to strike the right balance between formal verification and other forms of correctness. This is one reason I'm so excited to be working at @AntithesisHQ , which tackles a lot of the same properties as proof methods, but verifies them with "deterministic simulation testing" and fuzzing instead of with a proofs. So it's not as thorough and doesn't give you confidence in all inputs, but it automatically works on pretty much any code shape. I've literally grabbed open source projects off Github, told Claude "check properties XYZ in Antithesis thx", and gotten bug reports back. No state machine rewrites needed.

Theorem co-founder @rajashree breaks formal verification into 3 problems and says AI already solved the one everyone thought was hard: "The core challenge is taking these programs and shoving them into a proof assistant, and then being able to phrase these questions. That's the theorem statement generation problem." "The second part is generating all the proofs. That one, the AIs solve fully, because they can reason about these programs perfectly." "The third part is checking this proof, which is where you need to spend your CPU cycles, not GPUs. The proof assistant is asymptotically too slow, so even though you wrote the proof, the checking time is so long that you can't actually get the answer." @theoremlabs

Theorem co-founders @rajashree + @diagram_chaser explain why formal verification could break cybersecurity’s endless whack-a-mole and stop reward hacking during AI training: Rajashree Agrawal: "Formal verification is asymmetric security. Currently you have this whack-a-mole problem. As the attackers get better, the defenders have to catch up. You keep doing this forever." "Once you prove this particular property holds of your program, you don't need to check that again. This feels like the asymmetric approach that you need if you're going to avoid this cyber apocalypse." "If you wanna move beyond one-off interactions, build a very complex world, lots of automations, you're going to have structured things coming out of models which looks like software. Being able to reason about software seems like a good hammer to have." Jason Gross: "If you can verify the RL environments and the graders that you're running, then the models won't have any reward hacks during training, and so you can potentially train them to not be as reward hacky in general." @theoremlabs