Vero: Can AI Agents Build Formally Verified Software Repositories?
Vero benchmark assesses AI's ability to jointly generate verified multi-module repositories; strongest model solves 27 out of 43 instances.
Key Findings
Methodology
Vero employs a multi-stage manual curation combined with automated translation to convert real-world software repositories into multi-module Lean 4 projects, covering languages like Python, Dafny, Verus, and Coq. Each instance includes API definitions, formal specifications, and reference implementations, supporting both proof-only and combined code-and-proof tasks. The evaluation uses state-of-the-art large language models (e.g., GPT-5.5, Claude) with toolchain support to assess their capacity for joint implementation and verification. A formal auditing mechanism detects latent errors via proofs of unsatisfiability or incorrectness, ensuring high benchmark reliability. The process involves iterative human-in-the-loop curation, emphasizing diversity and realism, thereby advancing the frontier of automated software verification at the repository scale.
Key Results
- Among 43 instances, the best model fully solved only 27 in the code+proof mode, with no solutions for the most challenging repositories, indicating substantial gaps in current AI capabilities for large-scale formal verification.
- Models struggled particularly with specifications involving cross-module invariants, protocol consistency, and advanced mathematical theories, primarily due to limited lemma reuse and insufficient global reasoning abilities.
- The formal audit mechanism uncovered multiple latent errors in specifications and reference implementations, which were corrected through formal counterexamples and proofs, significantly improving benchmark quality and providing clear directions for future model improvements.
Significance
This work pioneers a systematic evaluation of AI's ability to produce verified software at the repository level, moving beyond isolated function or proof tasks. It addresses a critical gap in formal verification research by integrating multi-language, multi-module, and multi-task scenarios, reflecting real-world software systems. The results highlight the current limitations of state-of-the-art models, but also set a concrete path forward for developing more capable AI tools that can automate large-scale, trustworthy software synthesis. The benchmark and methodology serve as foundational steps toward industrial adoption of automated formal verification, promising enhanced software security, reliability, and maintainability in the future.
Technical Contribution
Vero introduces a novel framework that combines multi-language, multi-module formal verification with a semi-automated curation pipeline and an innovative formal audit mechanism. The framework supports joint implementation and proof synthesis, with a flexible architecture that enables switching between proof-only and combined modes. The audit mechanism leverages formal proofs of unsatisfiability and incorrectness to identify latent errors, thus ensuring high-quality benchmark instances. The evaluation of cutting-edge language models demonstrates their current limitations in cross-module reasoning and lemma reuse, providing critical insights for future algorithmic development. Overall, Vero advances the state of the art in automated software verification by integrating rigorous formal methods with scalable AI-driven synthesis.
Novelty
Vero is the first benchmark to evaluate AI's capacity for joint implementation and verification at the repository scale, supporting multi-language, multi-module projects with formal specifications. Its combination of manual curation, formal auditing, and large-model evaluation distinguishes it from prior function-level or proof-only benchmarks. The formal audit mechanism and the comprehensive, real-world dataset further set Vero apart, establishing a new standard for assessing AI in large-scale formal software synthesis. This innovation bridges a significant gap between theoretical research and practical application, marking a milestone in the field.
Limitations
- Current models exhibit limited ability to handle cross-module invariants and protocol-level correctness, mainly due to insufficient global reasoning and lemma reuse strategies, restricting their performance on complex repositories.
- The benchmark instances, while diverse, are still constrained by the expressiveness of Lean 4 and the maturity of its verification ecosystem, which may limit scalability to industrial-scale projects with richer mathematical libraries.
- Training data for models may contain overlaps with some benchmark instances, raising concerns about potential memorization and overfitting, despite efforts to ensure dataset novelty.
- Formal auditing, while effective, introduces computational overhead, and scaling it to larger repositories or more complex specifications remains a challenge, necessitating further optimization.
Future Work
Future directions include enhancing models' global reasoning and lemma reuse capabilities, expanding the formal library support, and integrating reinforcement learning techniques to improve synthesis quality. Additionally, extending the benchmark to cover more source languages and complex industrial scenarios will be prioritized. Improving the efficiency of formal auditing and verification tools is also critical for scaling to larger repositories. Ultimately, the goal is to develop fully autonomous, scalable, and trustworthy AI systems capable of producing verified software at the industrial scale, transforming software engineering practices and elevating software safety standards.
AI Executive Summary
In the realm of software engineering, ensuring the correctness and security of complex systems remains a formidable challenge. Traditional verification methods rely heavily on manual proofs and testing, which are labor-intensive and prone to oversight. As artificial intelligence increasingly automates code generation, the question arises: can AI not only produce functional code but also guarantee its correctness through formal verification?
Existing benchmarks in formal verification have primarily focused on isolated functions or proof tasks, leaving a significant gap in evaluating AI's ability to handle large, interconnected software repositories. Recognizing this, Zhe Ye and colleagues introduced Vero, a pioneering benchmark designed to assess AI agents' capacity for joint implementation and proof synthesis at the repository level. This framework bridges the gap between theoretical research and practical application, addressing the complexities inherent in real-world software systems.
Vero's core innovation lies in its comprehensive pipeline that transforms real-world repositories into formalized, multi-module Lean 4 projects. These instances include diverse source languages such as Python, Dafny, Verus, and Coq, covering domains from cryptographic protocols to distributed systems. Each instance comprises API definitions, formal specifications, and reference implementations, meticulously curated through manual review and automated translation. The benchmark supports two modes: proof-only, where agents verify existing implementations, and code-and-proof, where agents generate both implementations and proofs, reflecting real-world development workflows.
A key feature of Vero is its formal audit mechanism, which employs proofs of unsatisfiability and implementation incorrectness to detect latent errors in specifications and reference code. This mechanism enhances the reliability of the benchmark, ensuring that evaluation results genuinely reflect an agentβs capabilities rather than artifacts of flawed data. The evaluation of state-of-the-art models like GPT-5.5 and Claude reveals that, even under optimal conditions, the best models fully solve only 27 out of 43 instances, with significant difficulty in handling cross-module invariants and protocol consistency.
These findings underscore the substantial challenges ahead in scaling AI-assisted formal verification. The results highlight the need for improved global reasoning, lemma reuse, and more expressive verification libraries. Despite current limitations, Vero provides a vital foundation for future research, offering a realistic, high-quality platform to benchmark progress. Its comprehensive dataset, rigorous evaluation protocols, and innovative error detection mechanisms set a new standard for AI-driven software verification, promising a future where automated, trustworthy software synthesis becomes a practical reality.
Deep Dive
Abstract
AI agents are increasingly used for programming, but do not provide any guarantee on the correctness of generated code. Verified code generation, in which an agent produces both an implementation and a machine-checked proof of its specification, offers a stronger path toward trustworthy AI-generated software. Existing benchmarks in this direction either focus on individual functions or only evaluate proof generation with provided implementations. It is still an open question whether agents can make coherent implementation and proof choices across real multi-module codebases. To bridge this gap, we introduce Vero, the first benchmark to evaluate joint implementation and proof synthesis at the repository level. Vero contains 43 multi-module instances sourced from real-world repositories spanning Python, Dafny, Verus, and Coq, and covering diverse domains from cryptographic protocols to distributed systems. Each instance consists of a multi-module Lean 4 repository with predetermined API interfaces, manually curated formal specifications, and reference implementations, supporting both proof-only and code-and-proof evaluation modes. To improve benchmark reliability, Vero also includes an audit mechanism where agents are allowed to formally prove unsatisfiability of provided specification or incorrectness of reference code, which surfaces and corrects latent code and specification errors during curation. We evaluate frontier coding-agent configurations with Lean toolchain access. The strongest agent fully solves only 27 of 43 instances and closes no specifications on the hardest repositories. Vero provides a concrete testbed for measuring progress toward repository-scale verified software synthesis, where current agents still fall short. We release the benchmark, curation pipeline, and evaluation harness at https://github.com/sunblaze-ucb/vero.
References (20)
LeanAgent: Lifelong Learning for Formal Theorem Proving
Adarsh Kumarappan, Mo Tiwari, Peiyang Song et al.
SWE-bench: Can Language Models Resolve Real-World GitHub Issues?
Carlos E. Jimenez, John Yang, Alexander Wettig et al.
Program Synthesis with Large Language Models
Jacob Austin, Augustus Odena, Maxwell Nye et al.
DafnyBench: A Benchmark for Formal Software Verification
Chloe Loughridge, Qinyi Sun, Seth Ahrenbach et al.
Evaluating Large Language Models Trained on Code
Mark Chen, Jerry Tworek, Heewoo Jun et al.
LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Code
Naman Jain, King Han, Alex Gu et al.
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Certikos: an Extensible Architecture for Building Certified Concurrent Os Kernels Certikos: an Extensible Architecture for Building Certified Concurrent Os Kernels
Ronghui Gu, Zhong Shao, Hao Chen et al.
VeriSoftBench: Repository-Scale Formal Verification Benchmarks for Lean
Yutong Xin, Qiaochu Chen, Greg Durrett et al.
AutoVerus: Automated Proof Generation for Rust Code
Chenyuan Yang, Xuheng Li, Md Rakib Hossain Misu et al.
A benchmark for vericoding: formally verified program synthesis
Sergiu Bursuc, Theodore Ehrenborg, Shaowei Lin et al.
Clover: Closed-Loop Verifiable Code Generation
Chuyue Sun, Ying Sheng, Oded Padon et al.
Simple High-Level Code for Cryptographic Arithmetic - With Proofs, Without Compromises
Andres Erbsen, Jade Philipoom, Jason Gross et al.
Certified Program Synthesis with a Multi-Modal Verifier
Yue Feng, Dipesh Kafle, V. Gladshtein et al.
Rango: Adaptive Retrieval-Augmented Proving for Automated Software Verification
Kyle Thompson, Nuno Saavedra, Pedro Carrott et al.
AlgoVeri: An Aligned Benchmark for Verified Code Generation on Classical Algorithms
Haoyu Zhao, Ziran Yang, Jiawei Li et al.
The Coq proof assistant : reference manual, version 6.1
Bruno Barras, S. Boutin, C. Cornes et al.
miniCodeProps: a Minimal Benchmark for Proving Code Properties
Evan Lohn, S. Welleck
The Lean Theorem Prover (System Description)
L. D. Moura, Soonho Kong, J. Avigad et al.
VeruSAGE: A Study of Agent-Based Verification for Rust Systems
Chenyuan Yang, Natalie Neamtu, Chris Hawblitzel et al.