🤖 machine learning

Evidence-Grounded Verified Agentic Reasoning: A Path Toward Eliminating LLM Hallucination in Empirical Inference via Tool-Attested Kernel Proofs

The paper introduces EG-VAR, a Lean 4-based agentic reasoning architecture that eliminates LLM hallucinations in empirical inference by ensuring all verified outputs are structurally derived from attested tool calls and kernel-checked proofs, while explicitly auditing or abstaining from any unsupported claims.

Original authors: Junyu Ren

Published 2026-07-15

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Junyu Ren

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart, chatty robot assistant (an LLM) who loves to tell stories about the world. The problem? Sometimes, this robot gets so confident in its own memories that it makes up facts or ignores the actual evidence right in front of it. It's like a student who, when asked to check a math problem against the textbook, just writes down the answer they think is right because they remember it from a dream, even if the textbook says something different.

For a long time, people tried to fix this by giving the robot a "toolbox" of external sources, like a calculator or a database. But the paper argues that just handing the robot a toolbox isn't enough. The robot might still ignore the toolbox, or it might use the numbers from the toolbox but then twist the logic to fit its own story. It's like giving a chef a fresh, verified ingredient but letting them cook it however they want; the final dish might still be a disaster.

The Big Idea: The "Verified Claim" Factory

The authors, led by Junyu Ren, built a new system called EG-VAR (Evidence-Grounded Verified Agentic Reasoning). Think of this not as a robot that just answers questions, but as a high-security factory with a very strict, unblinking inspector.

Here is how the factory works, step-by-step:

The Tool Layer (The Trusted Courier): First, a trusted, boring, deterministic machine (not the chatty robot) goes to the source—like a spreadsheet or a database—and fetches the raw numbers. It stamps these numbers with a "Verified" seal. This is the only way to get real data into the factory.
The Formalizer (The Translator): The chatty robot (the LLM) is then asked to translate the human question into a strict, mathematical language called Lean 4. It's like asking the robot to write a legal contract or a math proof instead of a paragraph.
The Kernel (The Unblinking Inspector): This is the most important part. A tiny, super-strict computer program (the Lean kernel) acts as the inspector. It checks the robot's "contract" line by line.
- The Golden Rule: The inspector has a rule that says, "You cannot claim a fact is VERIFIED unless you can point to a stamped, sealed number from the Trusted Courier."
- If the robot tries to make up a number, or if it tries to use a number but connects the logic wrong, the inspector rejects the whole thing.
The Result:
- If the proof passes, the factory prints a VERIFIED answer. This answer comes with a "replayable audit trail," meaning anyone can re-run the math later and see exactly how the answer was built from the original data.
- If the proof fails, the factory doesn't guess. It says ABSTAIN (which means "I don't know" or "I can't prove this"). It's an honest "I give up" rather than a confident lie.

What the Paper Actually Found

The authors tested this system on a specific set of 120 questions about tables (spreadsheets).

The "Perfect" Score: When the questions were clear and the robot was given the right tools, EG-VAR got 120 out of 120 questions right. It was 100% accurate.
The Competition: Other systems that used the same tools but didn't have the strict inspector only got 114 out of 120 right (95%). They were still making mistakes.
The "Counterfactual" Test: This was the real stress test. The authors took tables and secretly changed the numbers to contradict what the robot "knew" from its training (like changing a country's population to a tiny number).
- Without the strict inspector, the robot ignored the new numbers and stuck to its old memories 80% to 90% of the time.
- With EG-VAR, the system stayed 100% faithful to the new, changed numbers. It didn't matter how strong the robot's old memory was; the inspector forced it to use the new data.

What the Paper Rules Out (The "No-Go" Zones)

The paper is very clear about what this system is not and what it cannot do:

It is not a magic cure for all hallucinations. The paper explicitly states that the robot can still make mistakes in translating the human question into the math language. If the robot misunderstands the question and writes the wrong math problem, the inspector will check that math problem perfectly, but the answer will still be wrong for the original question.
- In their tests, this "translation error" happened about 3.3% of the time with one model and 1.7% with a stronger model.
It does not fix bad data. If the original spreadsheet has a lie in it, the system will faithfully verify that lie. The system guarantees that the answer comes from the source, not that the source is true.
It is not a "maybe" system. The paper argues against systems that give a "confidence score" (like "I'm 80% sure"). Instead, EG-VAR uses a strict "Yes/No" gate. You either have a verified proof, or you have an honest "I abstain."

How Sure Are They?

The authors are very confident about the structural safety of their system. They have mathematically proven (Theorems 3.1 and 3.2) that:

No VERIFIED answer can ever appear without a stamped tool call backing it up.
Every step of the logic in a VERIFIED answer has been checked by the kernel and is mathematically valid.

However, regarding the accuracy of the robot's translation of human language, they are more cautious. They measured the error rates (3.3% and 1.7%) in their specific tests and suggest that these numbers could get better if they train the robot more on how to translate questions correctly. But the "safety floor"—the guarantee that the system won't silently lie—is built into the architecture, not just the robot's brain.

The Bottom Line

EG-VAR is like a factory that refuses to ship a product unless it can show a receipt for every single part used. If the robot tries to sneak in a fake part, the factory stops the line and says, "Nope, we can't ship this." It turns the problem of "lying robots" into a problem of "missing receipts," which is much easier to catch and fix. While it doesn't solve every problem (the robot can still misunderstand the order), it ensures that when the factory says "Verified," it really means "Verified."

Technical Summary: Evidence-Grounded Verified Agentic Reasoning (EG-VAR)

Problem Statement

Large Language Models (LLMs) frequently hallucinate empirical facts during inference, either fabricating data or relying on outdated parametric priors that conflict with retrieved evidence. While tool-augmented reasoning (RAG) allows models to consult external sources, it fails to guarantee verifiable empirical claims. Current approaches suffer from two structural failures:

Unattested Outputs: Accepted outputs do not necessarily descend from attested evidence; models may dismiss retrieved data that conflicts with their internal priors (confirmation bias).
Unverified Deductions: Accepted deductions do not necessarily hold up under formal scrutiny; models may perform invalid logical steps or misinterpret tool outputs.

Existing solutions, such as symbolic fact verifiers or LLM-driven theorem provers, either lack external grounding (math-only provers) or rely on learned components that cannot structurally guarantee the absence of unsupported claims.

Methodology: EG-VAR Architecture

The paper presents EG-VAR (Evidence-Grounded Verified Agentic Reasoning), a four-layer architecture designed to make empirical reasoning governable by integrating a proof assistant (Lean 4) with tool-attestation. The system treats the LLM as an untrusted component within a strictly defined trust ledger.

The Four-Layer Stack

L1: Tool Layer (Trusted, Deterministic): A deterministic runtime executes queries against external sources (e.g., table cell lookups, aggregates). It produces an Attested T payload—a runtime witness recording the query, source identity, and result. Only the runtime can generate these witnesses.
L2: Per-Source Formalization (Audited Offline): A "curator" defines a lift catalog for each data source. This maps L1 storage facts (e.g., "cell at row $r$ , column $c$ has value $v$ ") to L2 world ontology facts (e.g., HasProperty, ArgmaxWhere). These lifts are audited once and imported as axioms.
L3: Lean 4 Kernel (Trusted, Formal): The kernel is the sole authority to mint Evidence Verified claims. It enforces a single minting rule, mkVerified, which requires an Attested T hypothesis from the runtime. The kernel type-checks every proof step; if a step fails, the claim is rejected.
L4: Solver LLM (Untrusted, Stochastic): The LLM receives a typed goal and proposes proof tactics. It can consume Attested T terms introduced by the runtime but cannot synthesize them. If the kernel rejects the tactic, the system iterates or abstains.

Core Mechanisms

The mkVerified Rule: The only constructor for Evidence Verified requires an Attested T witness. This ensures that no verified output can exist without a corresponding tool call (Theorem 3.1).
Dependent Sum Witnesses: Claims are framed as dependent sums ( $\Sigma$ ). For a question "Which entity has property $P$ ?", the goal is $\Sigma (e : \text{String}) (v : \text{Value}), \text{Evidence Verified}(\dots)$ . The surface answer is the witness extracted from the kernel-checked proof.
Honest Abstention: If the kernel rejects the proof (due to missing lifts, invalid tactics, or lack of attestation), the system outputs an ABSTAIN with a replayable audit trail, rather than guessing.
Grade Discipline: Evidence carries explicit grades (VERIFIED, SUPPORTED, PLAUSIBLE, SPECULATIVE). The system enforces a "no-upcast" rule: conclusions cannot outrank their weakest premise.

Key Contributions

Structural Guarantee of Grounding: EG-VAR is the first architecture to combine a proof-assistant kernel with tool-attestation as a typed axiom. It provides a structural guarantee (Theorem 3.1) that every VERIFIED output descends from an attested tool call, eliminating unsupported hallucinations regardless of the LLM's strength.
Formal Safety vs. Semantic Faithfulness: The paper distinguishes between formal safety (the proof is kernel-accepted) and semantic faithfulness (the formalized goal matches the natural language claim). EG-VAR guarantees the former structurally; the latter is treated as an accuracy target addressable via formalizer fine-tuning.
Replayable Audit Trails: Every verified claim is accompanied by a self-contained Lean proof file. Third parties can re-typecheck the claim offline without re-running the LLM, using the kernel, the per-source lifts, and the tool adapter.
Per-Source Formalization Protocol: The paper introduces a method for treating data sources as co-equal trust artifacts, requiring formalization (lift catalogs) that separates source-side curation from claim-side reasoning.

Empirical Results

The evaluation focuses on TableBench (numerical reasoning on tables) across three tiers:

Tier 1 (Gold-Goal Benchmark, $n=120$ ):
- EG-VAR achieved 120/120 (100%) on unambiguous claims, matching the gold answer with a kernel-checked proof.
- Baselines (same model with tools but no kernel) plateaued at 95.0% (114/120).
- EG-VAR closed the gap to zero, demonstrating that the kernel discipline enforces correct composition of tool outputs.
Tier 1.5 (Counterfactual Stress Tests, 5 domains $\times$ 2 models):
- Synthetic tables were created where cell values contradicted the model's world-knowledge prior (e.g., changing a country's population to a low value).
- EG-VAR remained 100% source-faithful across all domains and flip magnitudes.
- Baselines (same-tool) dropped to 80–90% (Sonnet) and 50–80% (no-tool), showing that EG-VAR structurally prevents the "prior-override" failure mode where models ignore retrieved evidence.
Tier 2 (End-to-End with LLM Formalizer, $n=120$ ):
- In a fully automated setting where the LLM proposes the formal goal (removing the gold-fixture bypass), the pure formalizer error rate was 3.3% (Sonnet) and 1.7% (Opus).
- Remaining disagreements were categorized as logged ambiguities (4.2%) or surfaced benchmark-artifact issues (1.7%), all of which are explicit and auditable rather than silent hallucinations.

Significance and Claims

The paper positions EG-VAR as a technical-governance interface for high-stakes empirical claims. Its significance lies in shifting the burden of safety from statistical learning to architectural enforcement:

Elimination of Unsupported Outputs: The structural guarantee ensures that "verified hallucinations" (outputs labeled VERIFIED without evidence) are impossible under the system's threat model.
Measurable Uncertainty: By making abstention a structural outcome of kernel rejection rather than a learned behavior, the system provides a measurable "refusal rate" and typed uncertainty.
Formalization Flywheel: The authors argue that as data sources evolve toward typed interfaces (SQL, APIs, Knowledge Graphs), the formalization burden will amortize into reusable infrastructure, reducing the per-query cost of verification.
Governance Properties: The system enables three enforceable properties: (i) independent audit of every verified output via replayable proofs; (ii) typed uncertainty via grade discipline; and (iii) honest abstention as a measurable system property.

The paper concludes that while semantic-formalization errors remain (addressable via fine-tuning on the released curator corpus), the structural safety floor is established today, offering a path toward eliminating LLM hallucination in empirical inference.