Wouldn't it be more productive spending the tokens on adding ACSL annotations to verify CPython with Frama-C? You'd verify the actual runtime instead of an AI translation of it, and fixes could be contributed upstream directly.
The way I understand it, the two implementations can only differ in the result if the lean translation was done incorrectly; that's the point, you don't want to use those to prove invariants in the next step.
For the next step, I have the same question. It's the crux of the approach and the article is surprisingly light on detail:
> The hardest part wasn't getting AI agents to write proofs. It was getting proofs that actually mean something
So it was done by AI but they don't make entirely clear how the interesting proof statements were chosen.
yes, one can say it is "guessing" but taking in these into account:
> Source, in order of preference: (a) the implementation disagreeing with itself (C vs Python twin, fast vs slow path, method vs equivalent method, round-trips, str vs bytes); (b) undisputed invariants (no crash, no internal error leaking, results in range, no hang); (c) explicit doc sentences read in context.[...]
I think this approach to bug hunting is super promising (obviously - it finds a ton of bugs). The long-term problem is how this kind of bug-hunting can be done routinely, e.g. as part of a test suite. The approach taken by these people, the same approach as when the Julia folks did it, isn't really automatable, because it requires a lot of both human and AI agent work.
I guess longer term it needs to be built into the language, to prevent code and lean proofs from drifting. I.e. it could be opt-in properties that are written along the code, and which is then checked in the test suite. So very similar to ordinary compiler checks, except more expressive and expensive, and done only at test time.
I am not a lean expert, but I imagine that python primitives like dicts, ints, functions, etc., have been defined in lean. So if you add a way to annotate python code with a proof, you should as well be able to automatically translate it to Lean completely.
it's a matter of how much of a modeling gap do you choose to accept.
for full, honest to god, end to end verification this would be insufficient. but you don't need that in order to reap benefits.
just gotta make sure you actually bound the triage process with some sort of automated verification process. like comparative test cases or similar. otherwise it's just a particularly expensive way of agentic hallucination.
Because in order for the proof to succeed, Lean needs "strange" assumptions about the code. This rare assumptions are the conditions to trigger the bug.
Imagine a proof that needs the axiom that all numbers are below 2^32. What happens if my system is expected to handle numbers greater than 2^32?? There you have the bug... Also it could mean that the system is not validating the boundness of the input, and 2^32 is the maximum that allows for coherent execution downstream of the execution. In both cases, it needs to be checked :)
Wouldn't it be more productive spending the tokens on adding ACSL annotations to verify CPython with Frama-C? You'd verify the actual runtime instead of an AI translation of it, and fixes could be contributed upstream directly.
Same approach for Julias stdlib: https://discourse.julialang.org/t/formalizing-julia-in-lean-...
Interesting also the prompt of the python formalization (and the blog post) mentions the julia-in-lean:
https://github.com/Broyojo/python-formalization/blob/main/AG...
I'm confused about a few points, would love it if someone could help clear it up!
- if the rewrite in Lean happens line-by-line, how can the two implementations differ in their result (Step 2)?
- how does this approach know "something that should always be true" in Step 3 (is it the intelligence of the LLM "guessing"?).
The way I understand it, the two implementations can only differ in the result if the lean translation was done incorrectly; that's the point, you don't want to use those to prove invariants in the next step.
For the next step, I have the same question. It's the crux of the approach and the article is surprisingly light on detail:
> The hardest part wasn't getting AI agents to write proofs. It was getting proofs that actually mean something
So it was done by AI but they don't make entirely clear how the interesting proof statements were chosen.
yes, one can say it is "guessing" but taking in these into account:
> Source, in order of preference: (a) the implementation disagreeing with itself (C vs Python twin, fast vs slow path, method vs equivalent method, round-trips, str vs bytes); (b) undisputed invariants (no crash, no internal error leaking, results in range, no hang); (c) explicit doc sentences read in context.[...]
https://github.com/Broyojo/python-formalization/blob/main/AG...
I think this approach to bug hunting is super promising (obviously - it finds a ton of bugs). The long-term problem is how this kind of bug-hunting can be done routinely, e.g. as part of a test suite. The approach taken by these people, the same approach as when the Julia folks did it, isn't really automatable, because it requires a lot of both human and AI agent work.
I guess longer term it needs to be built into the language, to prevent code and lean proofs from drifting. I.e. it could be opt-in properties that are written along the code, and which is then checked in the test suite. So very similar to ordinary compiler checks, except more expressive and expensive, and done only at test time.
At that point you might as well use Lean?
It would solve the two language problem :-)
yep
Interesting. Now I have an idea to extend my tooling flow, thanks.
bend programming language already solved this problem: https://bend-lang.com/
Does anyone read articles written by AI? This is a serious question.
I think AI output is like your own farts. We all smell our own but others don't want to be subject to it.
Is there a way to avoid the translation or replace it with normal parsing?
In principle, yes.
I am not a lean expert, but I imagine that python primitives like dicts, ints, functions, etc., have been defined in lean. So if you add a way to annotate python code with a proof, you should as well be able to automatically translate it to Lean completely.
it's a matter of how much of a modeling gap do you choose to accept.
for full, honest to god, end to end verification this would be insufficient. but you don't need that in order to reap benefits.
just gotta make sure you actually bound the triage process with some sort of automated verification process. like comparative test cases or similar. otherwise it's just a particularly expensive way of agentic hallucination.
Only 418?
I would have expected around 10k.
Edit: Professional python programmer.
they don't have full coverage yet
Stupid question: if the lean4 code is a copy of the C code, how does "it" know which code is a bug and which code is working as intended?
Because in order for the proof to succeed, Lean needs "strange" assumptions about the code. This rare assumptions are the conditions to trigger the bug.
Imagine a proof that needs the axiom that all numbers are below 2^32. What happens if my system is expected to handle numbers greater than 2^32?? There you have the bug... Also it could mean that the system is not validating the boundness of the input, and 2^32 is the maximum that allows for coherent execution downstream of the execution. In both cases, it needs to be checked :)
Cite an AI-written document? Hell no.
Can we just develop in Lean and compile to something else for speed?
Lean is actually pretty speedy as is, and it enables much harder optimizations[1]
[1] https://github.com/kim-em/lean-zip#verification-enables-perf...
Of course.