YHK - yet another hacker news clone

Formalizing CPython

90 points carnevalem 10 hours ago 38 comments

anewhnaccount2 7 hours ago | parent

Same approach for Julias stdlib: https://discourse.julialang.org/t/formalizing-julia-in-lean-...

Alexander-Barth 3 hours ago | parent

Interesting also the prompt of the python formalization (and the blog post) mentions the julia-in-lean:

https://github.com/Broyojo/python-formalization/blob/main/AG...

jakobnissen 6 hours ago | parent

I think this approach to bug hunting is super promising (obviously - it finds a ton of bugs). The long-term problem is how this kind of bug-hunting can be done routinely, e.g. as part of a test suite. The approach taken by these people, the same approach as when the Julia folks did it, isn't really automatable, because it requires a lot of both human and AI agent work.

I guess longer term it needs to be built into the language, to prevent code and lean proofs from drifting. I.e. it could be opt-in properties that are written along the code, and which is then checked in the test suite. So very similar to ordinary compiler checks, except more expressive and expensive, and done only at test time.

stabbles 4 hours ago | parent

At that point you might as well use Lean?

It would solve the two language problem :-)

araquesebastian 4 hours ago | parent

yep

skeledrew 4 hours ago | parent

Interesting. Now I have an idea to extend my tooling flow, thanks.

abhiram-ar 4 hours ago | parent

bend programming language already solved this problem: https://bend-lang.com/

tclancy 1 hour ago | parent

You can writer solvers for bits of code and make them part of your test runs, I do that for gnarly bits, especially gnarly bits written by AI where the drift would not be obvious to me.

bb88 6 hours ago | parent

Only 418?

I would have expected around 10k.

Edit: Professional python programmer.

perching_aix 5 hours ago | parent

they don't have full coverage yet

eternauta3k 6 hours ago | parent

Is there a way to avoid the translation or replace it with normal parsing?

choeger 6 hours ago | parent

In principle, yes.

I am not a lean expert, but I imagine that python primitives like dicts, ints, functions, etc., have been defined in lean. So if you add a way to annotate python code with a proof, you should as well be able to automatically translate it to Lean completely.

perching_aix 5 hours ago | parent

it's a matter of how much of a modeling gap do you choose to accept.

for full, honest to god, end to end verification this would be insufficient. but you don't need that in order to reap benefits.

just gotta make sure you actually bound the triage process with some sort of automated verification process. like comparative test cases or similar. otherwise it's just a particularly expensive way of agentic hallucination.

senderista 6 hours ago | parent

Cite an AI-written document? Hell no.

woggy 6 hours ago | parent

Can we just develop in Lean and compile to something else for speed?

iib 5 hours ago | parent

Lean is actually pretty speedy as is, and it enables much harder optimizations[1]

[1] https://github.com/kim-em/lean-zip#verification-enables-perf...

pjmlp 5 hours ago | parent

Of course.

erfgh 4 hours ago | parent

Does anyone read articles written by AI? This is a serious question.

LtWorf 4 hours ago | parent

I think AI output is like your own farts. We all smell our own but others don't want to be subject to it.

xmcqdpt2 24 minutes ago | parent

I often “oh, this is going to be an interesting article written by someone about how they use an LLM to do X” and then start and discover that the person wrote the article via prompting. I guess if you think LLMs are amazing and that you’ve gotten into a rhythm of offloading all the labour to them, you see writing your own posts as a waste of time. I just wish those posts came with disclaimers telling the reader that reading it is a waste of time too and the reader should just point an agent at it or whatever.

actionfromafar 3 hours ago | parent

Stupid question: if the lean4 code is a copy of the C code, how does "it" know which code is a bug and which code is working as intended?

davidricodias 2 hours ago | parent

Because in order for the proof to succeed, Lean needs "strange" assumptions about the code. This rare assumptions are the conditions to trigger the bug.

Imagine a proof that needs the axiom that all numbers are below 2^32. What happens if my system is expected to handle numbers greater than 2^32?? There you have the bug... Also it could mean that the system is not validating the boundness of the input, and 2^32 is the maximum that allows for coherent execution downstream of the execution. In both cases, it needs to be checked :)

debugnik 2 hours ago | parent

Wouldn't it be more productive spending the tokens on adding ACSL annotations to verify CPython with Frama-C? You'd verify the actual runtime instead of an AI translation of it, and fixes could be contributed upstream directly.

tomtom1337 2 hours ago | parent

I'm confused about a few points, would love it if someone could help clear it up!

- if the rewrite in Lean happens line-by-line, how can the two implementations differ in their result (Step 2)?

- how does this approach know "something that should always be true" in Step 3 (is it the intelligence of the LLM "guessing"?).

Alexander-Barth 2 hours ago | parent

yes, one can say it is "guessing" but taking in these into account:

> Source, in order of preference: (a) the implementation disagreeing with itself (C vs Python twin, fast vs slow path, method vs equivalent method, round-trips, str vs bytes); (b) undisputed invariants (no crash, no internal error leaking, results in range, no hang); (c) explicit doc sentences read in context.[...]

https://github.com/Broyojo/python-formalization/blob/main/AG...

svara 2 hours ago | parent

The way I understand it, the two implementations can only differ in the result if the lean translation was done incorrectly; that's the point, you don't want to use those to prove invariants in the next step.

For the next step, I have the same question. It's the crux of the approach and the article is surprisingly light on detail:

> The hardest part wasn't getting AI agents to write proofs. It was getting proofs that actually mean something

So it was done by AI but they don't make entirely clear how the interesting proof statements were chosen.

auggierose 6 minutes ago | parent

They describe it later. Essentially, they are asking the AI for each function to give them a property that basically means "this function is correct", and then they let it prove that property.