Professor UIUC @siebelschool @UofIllinois | Creator K Framework | Founder @fastxyz @rv_inc | Formerly @NASA. Logic, semantics, verification.
Champaign, IL
Joined June 2017
- Tweets2.3K
- Following498
- Followers14.5K
- Likes6K
Pinned Tweet
The reason I've been quiet recently.
Over the last two months I worked hard, using AI, on solving two open problems that my UIUC research lab was not able to solve over the last 7 years.
Finally, we proved them. Viva @AnthropicAI and @OpenAI!
Grigore Rosu retweeted
The earliest version of KEQ can be traced to the work that underpinned our ASPLOS 2021 paper, titled "Language-Parametric Compiler Validation with Application to LLVM".
If you're also working on solving global-scale challenges using formal methods, we'd love to hear about it!
1/3 🧵
@rv_inc makes automated proving of program equivalence scale with real languages like C and Rust!
AI is particularly good at translating programs from one language to another. But how do we know the two programs are equivalent?
Unlike in formal verification, you need *two* formal language semantics! And more.
Grigore Rosu retweeted
We're ready to share our next verification pipeline!
Meet KEQ, a semantic equivalence prover based on the K Framework.
AI is getting good at rewriting legacy code, but the new version has to behave exactly like the old one (bugs included).
Tests can only show the presence of bugs, but not their absence. KEQ proves that two programs written in different languages match on every input, or it gives you a concrete counterexample.
Our first real-world trial has been proving equivalence between SHA 256 Rust and C implementations.
For more on how KEQ works, what's next, and how we're thinking of solving large-impact verification challenges, check out our latest blog post below.
A special thanks to the @Code_Metal_AI formal methods team, which inspired this work.
runtimeverification.com/blog…
1/3 🧵
@rv_inc makes automated proving of program equivalence scale with real languages like C and Rust!
AI is particularly good at translating programs from one language to another. But how do we know the two programs are equivalent?
Unlike in formal verification, you need *two* formal language semantics! And more.
2/3 🧵
Supposing that you already have formal semantics of languages L1 and L2, how can you prove that program P1 in L1 is equivalent to its translation P2 in L2?
We laid down the semantic foundations in a ASPLOS'21 paper, and used the resulting keq tool to turn the LLVM backend (300k LOC in C++) into a certifying compiler. There, L1 is LLVM and L2 is x86. Yes, full semantics of these languages (in K) were defined as part of the project. (side fact: the klean tool translates K artifacts to Lean)
Surprisingly, it turned out that none of the existing notions of program equivalence (aka bisimulation relations) were adequate when dealing with real-world languages like LLVM and x86. We proposed a variant that worked, called *cut bisimulation*.
3/3 🧵
@rv_inc advanced and improved the keq tool to work with C and Rust. So if you have any adhoc translator between C and Rust, you can now turn it into a certifying translator. Or ask your AI to do it:
runtimeverification.com/blog…
ASPLOS'21 paper: dl.acm.org/doi/epdf/10.1145/…
If you are attending DevCon and interested in formal verification, strongly encourage you to attend Natalia's talk tomorrow.
If somebody can formally verify anything, that is Natalia. No system is too big or too complex for her.
I wonder if people use @OpenAI, @AnthropicAI and @GeminiApp at the same time in the loop, as a research team, to solve hard math or coding challenges. And if yes, what is your experience, which model is better and for what?
I have mixed results. I spent 4 months working on a few conjectures, including the one below with Michael Beeson, and found that:
* ~25% of the claims "I proved ABC!" made by Fable or Argon were found to be wrong by Astra. Almost no proof made by Astra was found wrong by the other models, but Astra takes its time, sometimes 10h or more. Fable and Argon are fast, but unreliable.
* In a few cases, Fable and Codex spent 10x or more sessions to solve a problem over a week's time, and they failed, but then Argon came and solved it in 1 hour. Same with any two of them, but Argon solving may surprise many who have not tried it.
* Argon is particularly good at constructions. Both Fable and Codex agents in my AI research team salute it and assign it all the tricky constructions.
Still, if I were forced to only keep one AI model, at this moment in time I would choose Astra. But Argon is coming fast and furious from behind. Fable is just way too expensive. If it were cheaper I would probably be more excited about it. I solve more tasks with 2 codex accounts than I solve with 4 Claude ones (thanks @OpenAI for the free resets, too!).
teapaw.org/RosuGrigore/status/211…
Wouldn't it be nice to have a silver-bullet programming language, for the AI era, with the following properties:
1. Only allows provably correct programs, formally verified by construction, so AI cannot hack-reward them.
2. Each program is a mathematical theory, i.e., a specification, so we and our AI can reason about it as is, without any additional language formal semantics.
3. Each program/specification is efficiently executable, preferably faster than many conventional programming languages.
4. Intuitive for humans, allowing us the same level of assurance and formal verification capabilities with existing languages like C, Python, Rust, Java, etc., once those have a formal semantics.
The good news is that such a language already exists.
It is called K: kframework.org.
Grigore Rosu retweeted
Devcon 8 starts today!
On Thursday, Natalia Klaus will show how we take production Rust to Lean 4 proofs.
You'll leave with a realistic picture of what Rust-to-Lean verification delivers, what it costs, and where AI provers help.
🗓️ Thu, Nov 5 | 16:00 - 16:25
📍 Lotus Stage 2
Wouldn't it be nice to have a silver-bullet programming language, for the AI era, with the following properties:
1. Only allows provably correct programs, formally verified by construction, so AI cannot hack-reward them.
2. Each program is a mathematical theory, i.e., a specification, so we and our AI can reason about it as is, without any additional language formal semantics.
3. Each program/specification is efficiently executable, preferably faster than many conventional programming languages.
4. Intuitive for humans, allowing us the same level of assurance and formal verification capabilities with existing languages like C, Python, Rust, Java, etc., once those have a formal semantics.
The good news is that such a language already exists.
It is called K: kframework.org.
Had a lot of fun recently with Michael Beeson and our AI agents on solving the following problem:
A triangle is cut into a prime number P of congruent triangles iff P = 2, P = 3, or P ≡ 1 (mod 4).
By Fermat's Christmas Theorem, primes P ≡ 1 (mod 4) can be written as sums of two squares, e.g., 13 = 9 + 4.
Tiling a triangle into a prime number of congruent triangles paper: arxiv.org/pdf/2607.23453
1/6 @sgl_project is one of the most widely used LLM inference servers. We wrote 200+ properties it must always satisfy, from its docs, comments and code. Then searched for runs that break them.
Found 10 issues; several under private disclosure, the public ones below. 🧵
5/6 The higher-severity ones, including one-request "whole server goes down" crashes, are under coordinated disclosure with the maintainers via private advisories.
We'll post specifics as the fixes land. 🔒
6/6 Each issue is a counterexample to one of those properties, reproduced on a real SGLang server.
Prove code and find bugs yourself with
intentcomputing.org/