Vero: Can AI Agents Build Formally Verified Software Repositories?

TL;DR

Vero benchmark assesses AI's ability to jointly generate verified multi-module repositories; strongest model solves 27 out of 43 instances.

cs.LG πŸ”΄ Advanced 2026-08-14 89 views
Zhe Ye Hantao Lou Yuechun Sun Peiyang Song Zhengxu Yan Timothe Kasriel Qingyang Zhang Kaiyu Yang Soonho Kong Jingxuan He Dawn Song
formal verification code generation AI agents repository-scale verification Lean 4

Key Findings

Methodology

Vero employs a multi-stage manual curation combined with automated translation to convert real-world software repositories into multi-module Lean 4 projects, covering languages like Python, Dafny, Verus, and Coq. Each instance includes API definitions, formal specifications, and reference implementations, supporting both proof-only and combined code-and-proof tasks. The evaluation uses state-of-the-art large language models (e.g., GPT-5.5, Claude) with toolchain support to assess their capacity for joint implementation and verification. A formal auditing mechanism detects latent errors via proofs of unsatisfiability or incorrectness, ensuring high benchmark reliability. The process involves iterative human-in-the-loop curation, emphasizing diversity and realism, thereby advancing the frontier of automated software verification at the repository scale.

Key Results

  • Among 43 instances, the best model fully solved only 27 in the code+proof mode, with no solutions for the most challenging repositories, indicating substantial gaps in current AI capabilities for large-scale formal verification.
  • Models struggled particularly with specifications involving cross-module invariants, protocol consistency, and advanced mathematical theories, primarily due to limited lemma reuse and insufficient global reasoning abilities.
  • The formal audit mechanism uncovered multiple latent errors in specifications and reference implementations, which were corrected through formal counterexamples and proofs, significantly improving benchmark quality and providing clear directions for future model improvements.

Significance

This work pioneers a systematic evaluation of AI's ability to produce verified software at the repository level, moving beyond isolated function or proof tasks. It addresses a critical gap in formal verification research by integrating multi-language, multi-module, and multi-task scenarios, reflecting real-world software systems. The results highlight the current limitations of state-of-the-art models, but also set a concrete path forward for developing more capable AI tools that can automate large-scale, trustworthy software synthesis. The benchmark and methodology serve as foundational steps toward industrial adoption of automated formal verification, promising enhanced software security, reliability, and maintainability in the future.

Technical Contribution

Vero introduces a novel framework that combines multi-language, multi-module formal verification with a semi-automated curation pipeline and an innovative formal audit mechanism. The framework supports joint implementation and proof synthesis, with a flexible architecture that enables switching between proof-only and combined modes. The audit mechanism leverages formal proofs of unsatisfiability and incorrectness to identify latent errors, thus ensuring high-quality benchmark instances. The evaluation of cutting-edge language models demonstrates their current limitations in cross-module reasoning and lemma reuse, providing critical insights for future algorithmic development. Overall, Vero advances the state of the art in automated software verification by integrating rigorous formal methods with scalable AI-driven synthesis.

Novelty

Vero is the first benchmark to evaluate AI's capacity for joint implementation and verification at the repository scale, supporting multi-language, multi-module projects with formal specifications. Its combination of manual curation, formal auditing, and large-model evaluation distinguishes it from prior function-level or proof-only benchmarks. The formal audit mechanism and the comprehensive, real-world dataset further set Vero apart, establishing a new standard for assessing AI in large-scale formal software synthesis. This innovation bridges a significant gap between theoretical research and practical application, marking a milestone in the field.

Limitations

  • Current models exhibit limited ability to handle cross-module invariants and protocol-level correctness, mainly due to insufficient global reasoning and lemma reuse strategies, restricting their performance on complex repositories.
  • The benchmark instances, while diverse, are still constrained by the expressiveness of Lean 4 and the maturity of its verification ecosystem, which may limit scalability to industrial-scale projects with richer mathematical libraries.
  • Training data for models may contain overlaps with some benchmark instances, raising concerns about potential memorization and overfitting, despite efforts to ensure dataset novelty.
  • Formal auditing, while effective, introduces computational overhead, and scaling it to larger repositories or more complex specifications remains a challenge, necessitating further optimization.

Future Work

Future directions include enhancing models' global reasoning and lemma reuse capabilities, expanding the formal library support, and integrating reinforcement learning techniques to improve synthesis quality. Additionally, extending the benchmark to cover more source languages and complex industrial scenarios will be prioritized. Improving the efficiency of formal auditing and verification tools is also critical for scaling to larger repositories. Ultimately, the goal is to develop fully autonomous, scalable, and trustworthy AI systems capable of producing verified software at the industrial scale, transforming software engineering practices and elevating software safety standards.

AI Executive Summary

In the realm of software engineering, ensuring the correctness and security of complex systems remains a formidable challenge. Traditional verification methods rely heavily on manual proofs and testing, which are labor-intensive and prone to oversight. As artificial intelligence increasingly automates code generation, the question arises: can AI not only produce functional code but also guarantee its correctness through formal verification?

Existing benchmarks in formal verification have primarily focused on isolated functions or proof tasks, leaving a significant gap in evaluating AI's ability to handle large, interconnected software repositories. Recognizing this, Zhe Ye and colleagues introduced Vero, a pioneering benchmark designed to assess AI agents' capacity for joint implementation and proof synthesis at the repository level. This framework bridges the gap between theoretical research and practical application, addressing the complexities inherent in real-world software systems.

Vero's core innovation lies in its comprehensive pipeline that transforms real-world repositories into formalized, multi-module Lean 4 projects. These instances include diverse source languages such as Python, Dafny, Verus, and Coq, covering domains from cryptographic protocols to distributed systems. Each instance comprises API definitions, formal specifications, and reference implementations, meticulously curated through manual review and automated translation. The benchmark supports two modes: proof-only, where agents verify existing implementations, and code-and-proof, where agents generate both implementations and proofs, reflecting real-world development workflows.

A key feature of Vero is its formal audit mechanism, which employs proofs of unsatisfiability and implementation incorrectness to detect latent errors in specifications and reference code. This mechanism enhances the reliability of the benchmark, ensuring that evaluation results genuinely reflect an agent’s capabilities rather than artifacts of flawed data. The evaluation of state-of-the-art models like GPT-5.5 and Claude reveals that, even under optimal conditions, the best models fully solve only 27 out of 43 instances, with significant difficulty in handling cross-module invariants and protocol consistency.

These findings underscore the substantial challenges ahead in scaling AI-assisted formal verification. The results highlight the need for improved global reasoning, lemma reuse, and more expressive verification libraries. Despite current limitations, Vero provides a vital foundation for future research, offering a realistic, high-quality platform to benchmark progress. Its comprehensive dataset, rigorous evaluation protocols, and innovative error detection mechanisms set a new standard for AI-driven software verification, promising a future where automated, trustworthy software synthesis becomes a practical reality.

Deep Dive

Abstract

AI agents are increasingly used for programming, but do not provide any guarantee on the correctness of generated code. Verified code generation, in which an agent produces both an implementation and a machine-checked proof of its specification, offers a stronger path toward trustworthy AI-generated software. Existing benchmarks in this direction either focus on individual functions or only evaluate proof generation with provided implementations. It is still an open question whether agents can make coherent implementation and proof choices across real multi-module codebases. To bridge this gap, we introduce Vero, the first benchmark to evaluate joint implementation and proof synthesis at the repository level. Vero contains 43 multi-module instances sourced from real-world repositories spanning Python, Dafny, Verus, and Coq, and covering diverse domains from cryptographic protocols to distributed systems. Each instance consists of a multi-module Lean 4 repository with predetermined API interfaces, manually curated formal specifications, and reference implementations, supporting both proof-only and code-and-proof evaluation modes. To improve benchmark reliability, Vero also includes an audit mechanism where agents are allowed to formally prove unsatisfiability of provided specification or incorrectness of reference code, which surfaces and corrects latent code and specification errors during curation. We evaluate frontier coding-agent configurations with Lean toolchain access. The strongest agent fully solves only 27 of 43 instances and closes no specifications on the hardest repositories. Vero provides a concrete testbed for measuring progress toward repository-scale verified software synthesis, where current agents still fall short. We release the benchmark, curation pipeline, and evaluation harness at https://github.com/sunblaze-ucb/vero.

cs.LG cs.AI cs.LO cs.PL cs.SE

References (20)

LeanAgent: Lifelong Learning for Formal Theorem Proving

Adarsh Kumarappan, Mo Tiwari, Peiyang Song et al.

2024 31 citations View Analysis β†’

SWE-bench: Can Language Models Resolve Real-World GitHub Issues?

Carlos E. Jimenez, John Yang, Alexander Wettig et al.

2023 3354 citations View Analysis β†’

The lean mathematical library

The mathlib Community

2019 407 citations View Analysis β†’

Program Synthesis with Large Language Models

Jacob Austin, Augustus Odena, Maxwell Nye et al.

2021 4277 citations View Analysis β†’

DafnyBench: A Benchmark for Formal Software Verification

Chloe Loughridge, Qinyi Sun, Seth Ahrenbach et al.

2024 69 citations View Analysis β†’

Evaluating Large Language Models Trained on Code

Mark Chen, Jerry Tworek, Heewoo Jun et al.

2021 11045 citations View Analysis β†’

LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Code

Naman Jain, King Han, Alex Gu et al.

2024 1982 citations View Analysis β†’

This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Certikos: an Extensible Architecture for Building Certified Concurrent Os Kernels Certikos: an Extensible Architecture for Building Certified Concurrent Os Kernels

Ronghui Gu, Zhong Shao, Hao Chen et al.

363 citations

VeriSoftBench: Repository-Scale Formal Verification Benchmarks for Lean

Yutong Xin, Qiaochu Chen, Greg Durrett et al.

2026 3 citations View Analysis β†’

AutoVerus: Automated Proof Generation for Rust Code

Chenyuan Yang, Xuheng Li, Md Rakib Hossain Misu et al.

2024 65 citations View Analysis β†’

A benchmark for vericoding: formally verified program synthesis

Sergiu Bursuc, Theodore Ehrenborg, Shaowei Lin et al.

2025 22 citations View Analysis β†’

Clover: Closed-Loop Verifiable Code Generation

Chuyue Sun, Ying Sheng, Oded Padon et al.

2023 85 citations View Analysis β†’

Simple High-Level Code for Cryptographic Arithmetic - With Proofs, Without Compromises

Andres Erbsen, Jade Philipoom, Jason Gross et al.

2019 154 citations

Certified Program Synthesis with a Multi-Modal Verifier

Yue Feng, Dipesh Kafle, V. Gladshtein et al.

2026 3 citations View Analysis β†’

Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification

Kyle Thompson, Nuno Saavedra, Pedro Carrott et al.

2024 46 citations View Analysis β†’

AlgoVeri: An Aligned Benchmark for Verified Code Generation on Classical Algorithms

Haoyu Zhao, Ziran Yang, Jiawei Li et al.

2026 8 citations View Analysis β†’

The Coq proof assistant : reference manual, version 6.1

Bruno Barras, S. Boutin, C. Cornes et al.

1997 1227 citations

miniCodeProps: a Minimal Benchmark for Proving Code Properties

Evan Lohn, S. Welleck

2024 24 citations View Analysis β†’

The Lean Theorem Prover (System Description)

L. D. Moura, Soonho Kong, J. Avigad et al.

2015 751 citations

VeruSAGE: A Study of Agent-Based Verification for Rust Systems

Chenyuan Yang, Natalie Neamtu, Chris Hawblitzel et al.

2025 10 citations View Analysis β†’