🤖 AI Summary
This work addresses the challenge of ensuring determinism and trustworthiness in structured computations surrounding large language models (LLMs) without directly verifying the LLMs themselves. It proposes a trust-boundary architecture grounded in Lean 4, leveraging formally verifiable certificates to rigorously certify structured components within LLM pipelines. The core innovation comprises three families of local certificates and two composition operators, enabling hierarchical assumption management, extraction of maximal certifiable residuals, and closed-form computation of end-to-end perturbation budgets. The approach integrates Lean 4 kernel type checking, axiom-free auditing (with 17 out of 46 assertions proven without axioms), dual-lattice grounding, sensitivity analysis, and Hoare-style action logic, formally covering 22 certificate types. Empirical validation is demonstrated across four scenarios: HotpotQA reasoning, embedding stability, file system agents, and related structured tasks.
📝 Abstract
We present a framework for verifying the deterministic structured computations surrounding a large language model rather than the model itself, extending a Lean 4 trust-boundary architecture to the generic interfaces of modern LLM pipelines. Certificate validity is a Lean 4 kernel type-check plus a sorry-free transitive axiom audit against the trusted set {propext, Classical.choice, Quot.sound}; other assumptions are declared and partitioned by tier (mathematical placeholders, cryptographic assumptions, ML/human oracles).
The technical contribution comprises three local certificate families and two operators. The families are conflict-aware bilattice grounding (with an emission-gate soundness lemma), embedding sensitivity and paraphrase stability, and Hoare-style agent action. The operators are a Maximal Certifiable Residue, which turns abstention into the maximum-weight certifiable residue with audit-logged dropped claims, and a Compositional Stability theorem, which yields a closed-form pipeline-wide perturbation budget from per-layer gains and margins. The three families plus a Universal Assurance Card consolidator form the per-call deliverable for high-stakes deployments: patent and legal retrieval, regulated finance, clinical decision support, and agentic systems with irreversible side effects.
A compiled Lean 4 reference artifact (Lean v4.30.0-rc2, Mathlib) covers all 22 certificate types, with 17 of 46 kernel-audited declarations axiom-free, the rest depending only on the trusted set and declared assumptions, and zero uses of sorryAx or Lean.ofReduceBool. The three families are empirically tested through four registered pilots: bilattice grounding on adversarially perturbed HotpotQA, embedding sensitivity in short- and long-form settings, and Hoare-style agent action on a filesystem sandbox with adversarial prompt injection.