Top
Best
New

Posted by johnbender 11 hours ago

LLMs are making formal software verification feasible at a much larger scale(www.anthropic.com)
344 points | 201 commentspage 4
PandaRider 8 hours ago|
I'm curious if increased adoption of formal verifications would increase migration of legacy COBOL to modern systems.
y1n0 6 hours ago||
It seems like it’s a good fit. Proving equivalence is much easier than writing a spec without a golden reference.
js8 4 hours ago||
Except COBOL systems are often easier to formally verify than modern systems.

They're often simpler, and whole classes of security vulnerabilities are mitigated by design. My favorite example is SQL injection mitigated by having proper access controls in the DB. Why prove about every SQL statement that it cannot be nefarious, when we can just prove it about the connecting user? The user access carries the intent of what the application program wants to do with the database, in a separate channel, independently of the complexity of the application.

UncleEntity 9 hours ago||
I took a different approach with this JavaCard VM I've been working on, first I had Claude implement the VM from the spec and then I had it implement a proof generator (also from the spec) so an identical bug would have to exist in both of them to make it through. Worked pretty well, the JCVM and bytecode verifier are both statically verified using ESBMC (which found a few bugs in that project so, win, win).

Now I have it working on a verifier for the bytecode transformations the optimizer uses, also using the static verification approach, to discover them all and ensure they are all valid. This one is seeming to be on track to making it fast enough to work on a real grammar as opposed to the 'academic grammars' the literature typically uses to prove the lemmas. Claude seems to be fighting this and has been working on the same refactor for over a week now so, we'll see...

y1n0 6 hours ago||
I think you still run the risk of common-mode failure. It might be more robust to pick a different model altogether to do either the VM or the spec.
dolmen 6 hours ago||
ESBMC: https://esbmc.github.io/
thinkindie 1 hour ago||
is it just me, or is Anthropic posting more articles like this (and similar other topics) in the past few days than before? And more of them are ending up in HN front page?

If I recall correctly the only news they used to post were new models updates, while now they have expanded their topics, or so I feel.

lenerdenator 9 hours ago||
Strange to see Anthropic making this point. When I use Claude in my daily development and ticketing workflows, it doesn't seem to want to do formal verification of anything without me telling it to. It makes a lot of assumptions about the state of systems when it could very quickly write scripts to formally validate those states.
dvt 9 hours ago||
It's why unit tests are worthless when humans write them, and less than worthless when AI writes them. Same concept: you're testing yourself, of course you're going to pass with flying colors.
y1n0 6 hours ago||
I wouldn’t call them worthless. I guess it depends on the unit. But also having someone or something independently write tests is generally better than testing your own code.
vikramkr 5 hours ago||
If you want it to do that consistently why can't you put it in your Claude.md?
fathermarz 9 hours ago||
I would disagree that this is not “formal verification” as that discounts the entire software supply chain and how attacks actually show up.

Is this end to end verification? Cause this sounds closer to validation than verification.

paxy 9 hours ago||
All this is going to do is move the problem up one layer. Sofware is fundamentally a representation of human expectations for the computer. How do you formally verify that?
perching_aix 9 hours ago||
Nohow, because the real world is informal. This is as far as coding can and will ever go, basically.

And like yes, it does just launder defects to a layer higher, but another way to phrase that in this case (and in many other cases) is that it raises the bar.

Instead of defects being mostly about nonsense minutia (relative to business logic), they are about actual design decisions and their correspondence to reality, i.e. the actual original goal and point of this god forsaken, navel-gazing field.

y1n0 6 hours ago||
You do it by comparing to something that is “known” to be good.

I didn’t read the whole article, just the appendix. There they talked about having Claude write a python interpreter. Then they had it write a set of properties to test and they vetted the properties against accepted existing python interpreters.

Proving two things are equivalent is a major component of formal.

For everything else, formal is only as good as the properties you specify. A long standing problem. But it’s a problem for all verification. If you write a shitty tests, you get shitty verification.

A key difference I think is that the same skills used for evaluating and reviewing application code apply to reviewing test code. That’s not really true for formal.

whateveracct 4 hours ago||
in heavy air quotes, yeah
anonymous908213 7 hours ago||
Talk is cheap, show me the code. Claude generated a formally verified Python interpreter in Rust? Bullshit. Anthropic would have published it if they did, like that dogshit C compiler publicity stunt. That they won't even show it indicates that this is so misleading as to be a lie. They generously give themselves the grace of describing it as a "subset" of Python interpreter, and I believe them -- I can formally verify a "subset" of Python quite easily, but nobody will be impressed when they look at what that really means. Why was it tested with "1.7 million randomly generated" Python programs and not any real-world Python programs that already exist? Because the subset doesn't cover what anybody would consider to actually be Python.
giancarlostoro 7 hours ago|
Hmm? I had Claude Opus 4.6 implement a .NET compiled language that is Python-like (we already have IronPython, I wanted something Python-like that treated .NET as its entire runtime) language in about two (maybe three sessions tops?) of 1M token context windows, and the first two times I only used roughly 400 to 600k tokens? When Anthropic dropped the 1M context window update, I put it to the test.

See for yourself:

https://github.com/Giancarlos/Culebral

Anyway, my custom (currently paused because I'm taking on a much more ambitious compiler project with Claude... just to push the limits) language can build ASP .NET applications, and a bunch other things. I also took the Rust approach to types, all method signatures must have types defined, type hints are inferred when declaring new values from the value on the right.

I've also had Claude rewrite legacy C# projects with 100k+ lines of code, fully in Rust, long before Opus 5.0. I've spent the last year pushing the limits with Claude, including reimplementing existing software, which people are catching on to now, and I've managed to get rather far in some cases.

So I wouldn't be surprised if yes, Claude can implement Python, mind you, there's Python interpreter coded in Python in what was it? 500 lines of Python? You can build a Python stack machine bytecode interpreter in like 60 ~ 80 lines of Python code.

Would not surprise me if you can trim a C programming language interpreter down in terms of lines of code when you rewrite it in Rust especially when you have access to a much more functional language, not to mention Rust took the best bits out of OCaml it could to make itself very efficient at writing compilers / languages (so they could write their own compiler in Rust...).

I am also having Claude building me a much smaller compiler, which started out in under 500 lines of Python, but as I got more ambitious it had to write more code for my language, it was meant to be a slightly less restrictive Go, the Python basically converts the syntax to C which then compiles anywhere. Havent put that one on GitHub since I'm still tinkering with it.

anonymous908213 7 hours ago||
I notice you haven't touched that repo once since the month you prompted for it. I don't doubt that you generated some cute little prototype that compiles something. I do doubt that it's something actually suitable for anybody to use for programming. My own experiments with having frontier models attempt to implement my own language have all been dire. Even with a rigorous specification and a set of hand-written programs showing both the input of my language and the asm it should output, it managed to create something that compiles exactly those programs and completely fails in real-world use beyond that. So too with Claude's own C compiler experiment; even with C's unbelievably rigorous test suites that give it a deterministic guideline and actionable feedback every time it fucks up, it was still shit. If they merely gave it a C specification, without the decades of human-written tests, there is a snowball's chance in hell it would produce anything worth using.
giancarlostoro 6 hours ago||
I think you answered your own problem: telling it what assembly you're expecting, get it to build the foundation before you start asking it how the tiles should look.

Right now I'm working on a compiler / runtime for a more complicated language than Python or C and while its "slower" I know that once it's done through this run I'll be able to have it focus on optimizations, especially with rigorous tests that some languages have to test their compilers. I have plans to run back to Culebral, but I have to scratch a bigger itch I've had, people like you who've told me repeatedly that an LLM cannot be used to build a compiler. So here I am, slowly chugging at it, getting decades of developer effort worked through every week.

If I'm wrong, so be it, if I'm right, it'll be fun to release. :)

anonymous908213 6 hours ago||
It doesn't take a decade to write a compiler for a language. If you're putting months of your own effort into it, it's not clear that the LLM is even increasing your productivity.
waffletower 7 hours ago||
I think these developments should be done with care and cognizance of the user. I worry that formalism may have trouble scaling and interacting with user intent. LLMs will (and already do in my experience) construct a formalism for your application that may be provable to some archetype -- but separate from reality and separate from your conception. The Claude user experience of rulings is already at a cultural limit among users -- the excitement over the linguistic 'improvements' of the Opus 5.5 release are a case in point. Formalism is only one axis here and usability is another. This could be a problematic development if done lopsidedly.
m3kw9 7 hours ago|
code changes 1000 times a day, and you want to "formally" verify it?
More comments...