Formal verification is becoming the trust layer for AI-generated code

Proofs, not vibes

Three new preprints apply formal methods to three different AI pipelines — and they converge on the same idea: machine-checked proof is becoming the trust layer for code that AI systems generate. ForTress brings Lean formal verification to LLM-driven Fortran-to-Python migration. Veri-Sure applies slicing and design contracts to multi-agent RTL code generation. Neuton builds tensor-level executables for neural-network certifiers. Three domains, one pattern: the generated artifact is no longer trusted on its own. m:…0318 m:…9621 m:…7214

The throughline is economic, not just academic. Each of these systems treats the proof as part of the generated artifact rather than an after-the-fact check — bitwise-identical migration results that arrive with their own soundness proofs, RTL that carries its design contracts, certifier executables compiled from their own specifications. Verification is not a separate audit step here; it is the output. That changes who pays for trust: instead of paying reviewers to read generated code, teams invest in the proof machinery once and reuse it, the way ForTress reuses verified rules across software packages. m:…0318 m:…9621 m:…7214

Fortran migration, checked in Lean

ForTress tackles the oldest codebase problem in science: migrating Fortran to Python. In a preprint, the authors report bitwise-identical results with native Fortran on all 17 evaluated scientific software benchmarks, at 44.2% lower LLM usage cost than direct LLM translation. The assurance comes from 121 checked soundness proofs in Lean, 31 of them established via counterexample-guided refinement — and the work compounds: cross-software rule reuse exceeds 90% for 14 of the 15 evaluated packages, so verifying one migration makes the next ones cheaper. m:…0318

The economics are as interesting as the proofs. The 44.2% cost reduction is measured against direct LLM translation, the naive approach of asking a model to convert the code. ForTress shows that adding formal verification to the pipeline does not just buy safety — it cuts the LLM bill, because verified rules get reused instead of re-translated. m:…0318

RTL you can verify

Veri-Sure takes on chip design, where a wrong wire costs a respin. The system uses static dependency slicing to perform precise, localized repairs in RTL code generation, paired with design contracts and formal verification. The authors report state-of-the-art verified-correct RTL generation performance, surpassing standalone LLMs and prior agentic systems. And they extend the evaluation itself: VerilogEval-v2-EXT adds 53 industrial-grade design tasks, because the old benchmarks were too easy to take seriously. m:…9621

Certified neural networks

Neuton closes the loop on the networks themselves. It translates neuron-level certifier specifications into tensor-level executables using a stack-based IR and shape analysis — automating the step that usually keeps neural-network certifiers slow and hand-tuned. Its SkipPoly variant matches DeepPoly's precision on 32 DNN benchmarks while running faster on 50% of them. Verification, in other words, is getting a compiler. Neuton also introduces gBCSR, a sparse tensor format that uses variable-sized, layer-aligned blocks over a non-zero default value to improve how certifiers handle sparsity. m:…7214

Step back and the trend is clear. A year ago, AI-generated code was checked the way human code is checked — by reading it, testing it, and hoping. These three preprints point to a different default: generated artifacts that ship with their own proofs. That is a meaningful shift for anyone deploying AI-written code where failure is expensive, whether that means scientific software, silicon, or the certifiers that judge neural networks. m:…0318 m:…9621 m:…7214