Foundational Constraint Solving for Expressive Refinement Typing
This paper introduces FLEX, a foundational Constrained Horn Clause solver implemented in the verified Lean theorem prover, which reduces the trusted computing base to the kernel and leverages Lean's proof ecosystem to overcome SMT expressiveness limitations while automatically verifying low-level systems code with high success rates.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to prove a complex video game character can't glitch through the floor. Usually, you ask a super-smart, but slightly mysterious, robot judge (called an SMT solver) to check your math. The problem? This robot has two big flaws. First, it only understands a limited set of rules; if your game logic gets too creative or weird, the robot gets confused and gives up. Second, the robot is a giant, unverified black box built by humans who might have made mistakes. If the robot is wrong, your whole game is unsafe, and you have no idea why.
Enter Flex, a new way to do this checking that swaps the mysterious robot for a transparent, step-by-step proof builder built inside a trusted math engine called Lean.
The Big Idea: From Black Box to Transparent Blueprint
Instead of asking a black box to guess if your code is safe, Flex breaks the problem down into a puzzle of "Horn Clauses." Think of these as a set of logical rules with missing pieces (unknown invariants) that need to be filled in to make the whole picture true.
The paper shows that Flex can solve these puzzles in two distinct ways, depending on the shape of the problem:
- The "Straight-Line" Puzzle (Acyclic Variables): Sometimes the missing pieces are in a straight line with no loops. Flex has a tactic called Zap that acts like a master detective. It looks at the clues, figures out the exact missing piece mathematically, and writes down a proof that says, "I know this piece fits because here is the math." It doesn't guess; it calculates.
- The "Looping" Puzzle (Cyclic Variables): Sometimes the missing pieces are part of a loop (like a character running in circles). You can't just calculate the answer in one go. Here, Flex uses a tactic called Fix. It starts with a big list of possible guesses (called qualifiers) and slowly whittles them down. It asks, "Is this guess true?" If the answer is no, it throws the guess away. It keeps doing this until only the correct, safe guesses remain.
Why This is a Game Changer
The authors argue that the old way (using SMT solvers) is like playing a game where the rules are hidden and the referee might be asleep. Flex changes the game entirely. Because Flex is built inside Lean, every single step of the solution is a proof that can be checked by a tiny, trusted "kernel" (the core of the math engine). If Flex says the code is safe, it's not because a big program guessed right; it's because it built a certificate that proves it.
What They Actually Proved (and What They Didn't)
The paper doesn't just suggest this is a good idea; they built it and tested it.
- They built two new "generators": One that turns simple imperative code (like a loop counting numbers) into these logic puzzles, and another that turns a functional math language into puzzles.
- They proved the generators are sound: They mathematically showed that if the puzzle is solved, the original code is safe.
- They tested it on real Rust code: They used Flex to verify complex low-level systems code, like a ring buffer (a type of memory queue) and sorting algorithms.
The Results: Speed vs. Trust
Here is the catch, and the paper is very honest about it. Flex is trustworthy, but it is slower.
- When they ran Flex on a suite of 880 logic puzzles from their existing benchmarks, it automatically solved 95.7% of them. That's a huge win for automation.
- However, the paper explicitly states that Flex is about 100 times slower (two orders of magnitude) than the current SMT-based tools.
- For the remaining 4.3% of puzzles that Flex couldn't solve automatically, the system doesn't just crash and say "Error." Instead, it hands the problem to a human programmer inside Lean, who can use interactive tools to finish the proof. This is a massive improvement over the old way, where a failure was just a confusing "timeout" with no explanation.
The Bottom Line
The paper demonstrates that you can trade raw speed for absolute trust. Flex proves that you can verify complex, expressive code (like Rust libraries with loops and memory safety) without relying on the "black box" of traditional solvers. It successfully discharges the vast majority of constraints automatically, and for the tricky ones, it offers a clear path for humans to step in and finish the job, rather than leaving them staring at a wall of unexplained errors.
In short: Flex is a new, transparent engine that builds its own proof certificates. It's not the fastest car on the track, but it's the only one with a driver who can show you exactly how they won, every single time.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.