💻 computer science

CircuitProver: Agentic Lean 4 Theorem Proving with Reusable Circuit Proof Library for Hardware Verification

CircuitProver is an agentic Lean 4 framework that automates hardware verification by translating parameterized designs and specifications into executable models, iteratively constructing machine-checked proofs, and distilling these results into a reusable library that significantly improves proof efficiency and success rates compared to vanilla agents.

Original authors: Ziyi Yang, Wenji Fang, Chen Chen, Zhiyao Xie, Hongce Zhang

Published 2026-07-31

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Ziyi Yang, Wenji Fang, Chen Chen, Zhiyao Xie, Hongce Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Detective's Dilemma: Why We Need Smarter Hardware

Imagine you are building a massive, incredibly complex Lego city. Every brick is a tiny electronic switch, and together they form a computer chip that powers everything from your phone to the self-driving cars of the future. The problem? These cities are getting so huge and complicated that even the best human architects can't check every single brick to make sure it won't fall apart. If one tiny switch is in the wrong place, the whole city could crash.

For years, the standard way to check these cities has been like a "black box" test. You build a specific version of the city (say, with 8 floors), run a super-fast robot to see if it works, and it gives you a simple "Pass" or "Fail" stamp. If it fails, the robot might show you a picture of the broken brick. But here's the catch: the robot doesn't tell you why it broke, and it doesn't remember the lesson for the next city. If you build a slightly bigger city with 16 floors, the robot has to start from scratch, re-figuring out all the same rules, even though the logic is almost identical. It's like solving a math problem, getting the answer, and then throwing away your work so you have to re-solve the exact same problem for the next question.

This is where a new field called "formal verification" comes in. Instead of just testing, it tries to write a mathematical proof that the city is perfect. But writing these proofs is usually a super-hard job that requires a human genius to guide a computer step-by-step. Now, a new team of researchers has built a tool that acts like a super-smart detective who not only solves the puzzle but also writes a "cheat sheet" for future detectives, making the job faster and easier every time.

CircuitProver: The Detective Who Learns from Every Case

The paper introduces CircuitProver, a new system designed to check hardware designs (the "cities") using a programming language called Lean 4. Think of Lean 4 as a super-strict math teacher who never accepts a wrong answer. CircuitProver is an "agent," which is just a fancy word for an AI robot that can talk to this teacher, try to solve the problem, listen to the teacher's corrections, and try again until it gets it right.

But the real magic isn't just that it can solve the problems; it's what it does after it solves them.

The Old Way vs. The New Way

In the past, verifying hardware was like checking a single lock on a single door. If you had a door that could be 8 inches wide, 16 inches wide, or 100 inches wide, you had to check the 8-inch version, throw away the notes, check the 16-inch version, throw away the notes, and so on. The paper argues that this is wasteful. The logic for how the lock works is the same, regardless of the size.

CircuitProver changes the game by treating the door as a "parameterized" design. It asks, "Can we prove this lock works for any size?" Instead of checking one specific door, it proves a general rule that covers all possible sizes at once.

The "Cheat Sheet" Library

Here is the most exciting part: CircuitProver keeps a Reusable Proof Library. Imagine you are a detective solving a series of burglaries.

The First Case: You solve a tricky burglary. It takes you 13 rounds of investigation. You figure out that the thief always leaves a specific type of mud on the windowsill.
The Old Way: The next time a similar burglary happens, you ignore your notes. You spend 13 rounds of investigation again, rediscovering the mud clue.
The CircuitProver Way: After solving the first case, you write down a "Proof Strategy" note: "If you see mud on the windowsill, check the attic immediately." You also save the "Machine-Checked Fact" (the proof that the mud means the thief was there).
The Next Case: When a new burglary happens, your robot detective looks at the library. It sees the mud clue, grabs the "check the attic" strategy, and solves the case in just 6 rounds.

The paper shows that by using this library, the system didn't just get faster; it got smarter. It could solve problems that a standard robot (without the library) couldn't solve at all.

What the Numbers Say

The researchers tested CircuitProver on 63 different hardware tasks, ranging from simple math circuits to complex memory systems.

Success Rate: A standard robot (called a "vanilla agent") managed to solve 92.1% of the tasks. CircuitProver, with its library and smart strategies, solved 100% (all 63 tasks).
Speed: The standard robot took an average of 9.2 rounds of trying and failing to get a proof. CircuitProver only needed 4.6 rounds—it was twice as fast.
Time: The total time to verify the designs dropped by 23.2%.
Complexity: The proofs themselves were 16.3% shorter, meaning the logic was cleaner and easier to read.

The paper also tested this on huge, processor-level designs (like the brains of real computers). Here, the benefits were even bigger. CircuitProver reduced the time and effort by more than 50% compared to the standard robot. This suggests that as hardware gets more complex, the "cheat sheet" library becomes even more valuable, saving researchers from having to reinvent the wheel every time.

How It Works (The Magic Trick)

CircuitProver works in three main steps:

Translation: It takes the hardware design (written in a language called Chisel) and translates it into the strict math language of Lean 4. It also translates the human description of what the hardware should do into a math problem.
The Detective Work: The AI agent tries to prove the math problem. If it gets stuck, it asks the Lean 4 teacher for help. The teacher says, "No, that step is wrong," and the agent tries a different path.
The Library Update: Once the proof is done, the system doesn't just file it away. It analyzes how it solved the problem. It extracts the "aha!" moments (like "use this specific math trick for carry-overs") and adds them to the library. Next time, the agent can just grab that trick instead of figuring it out from scratch.

Why This Matters

The paper suggests that this approach is a major step forward for hardware verification. By accumulating knowledge, we stop treating every new chip design as a brand-new mystery. Instead, we build a growing library of solved puzzles that makes verifying future, more complex chips faster and more reliable.

The researchers admit that their system currently works best with specific types of hardware designs and that it relies on powerful AI models (they tested it with different versions of an AI called Claude, finding that the smarter the AI, the better the results). However, the core idea—that we can teach computers to learn from their own proofs and share that knowledge—is a powerful new direction. It turns hardware verification from a repetitive, manual grind into a smart, self-improving process.

In short, CircuitProver is like giving a detective a memory and a notebook. It doesn't just solve the case; it remembers how it did it, so the next time a similar crime happens, the city is safe much faster.

Technical Summary: CircuitProver

Problem Statement

Modern integrated circuit (IC) design faces a critical bottleneck in functional verification due to increasing complexity. The dominant methodology, model checking, verifies each design instance separately, exposing only pass/fail results or counterexamples. Consequently, the reasoning behind a proof remains locked within solver heuristics, and similar reasoning must be repeatedly reconstructed across related designs. While interactive theorem proving (ITP) offers explicit, reusable proof artifacts, its application to hardware remains largely manual, requiring significant expert effort for formalization, invariant discovery, and proof construction.

Existing tools lack reusable knowledge: model checking hides reasoning, while current ITP frameworks (e.g., Coq, ACL2) rely heavily on human experts. In the emerging "agent era," where autonomous agents participate in hardware generation and optimization, verification tools must not only check correctness but also accumulate and preserve explicit proof artifacts and reasoning strategies to guide future agents.

Methodology: CircuitProver

The paper presents CircuitProver, an agentic, Lean 4-based verification framework designed for proof-accumulating hardware verification. It targets parameterized hardware designs (specifically Chisel), enabling a single proof to establish correctness for an entire family of hardware instances rather than verifying instantiated designs individually.

The framework operates through three distinct phases:

Phase I: Hardware Auto-Formalization

CircuitProver automatically translates parameterized hardware implementations and natural language specifications into executable Lean 4 models.

Translation: A deterministic Chisel-to-Lean translator ( $\mathcal{T}_{impl}$ ) converts hardware designs into a unified Lean 4 semantic model ( $L_D$ ). This model preserves design parameters, I/O interfaces, register states, and transition behaviors using width-aware bit-vector types.
Validation: The translation is validated via exhaustive small-bit-width co-simulation to ensure the Lean model behaves identically to the original Chisel design.
Specification Formulation: A reasoning agent ( $\mathcal{F}_{spec}$ ) interprets natural language specifications ( $S$ ) within the hardware context to generate formal Lean 4 properties ( $L_S$ ), preserving parameters symbolically.

Phase II: Agentic Hardware Theorem Proving

A hardware-oriented reasoning agent iteratively constructs machine-checked proofs through interaction with the Lean 4 theorem prover. The workflow includes:

Proof Planning & Scaffold Construction: Instead of direct tactic search, the agent decomposes the correctness proof into structured intermediate obligations.
- For combinational designs, it focuses on one-cycle computation correctness, generating lemmas for arithmetic and bit-vector logic.
- For sequential designs, it constructs local one-step transition proofs and discovers inductive invariants to connect step-wise correctness with global behavior.
Iterative Proving: The agent ( $\mathcal{F}_{proof}$ ) generates proof scripts, invokes Lean, and analyzes feedback (proof states and error messages). It refines reasoning, introduces lemmas, or strengthens invariants based on Lean's feedback until all obligations are discharged.

Phase III: Reusable Proof Library

Successful proof trajectories are distilled into two complementary libraries to support future tasks:

Proof Guidance Library: Stores natural-language strategies explaining how a proof was decomposed, why specific lemmas were chosen, and how to adapt plans based on feedback. It captures the "route" for proof construction.
Lean-Checked Theorem Library: Stores module-independent, machine-checked facts. Proofs are decoupled from specific module definitions and reformulated over symbolic parameters and generic interfaces, allowing verified lemmas (e.g., carry-skip logic) to be reused across different hardware designs.

Key Contributions

Agent-Native Hardware Verification: Introduction of CircuitProver, a framework integrating auto-formalization, agentic theorem proving, and reusable proof libraries.
Hardware Auto-Formalization: A pipeline that translates Chisel implementations and natural language specs into unified, machine-checkable Lean 4 representations.
Agentic Theorem Proving Workflow: A hardware-aware workflow where agents iteratively construct proofs using feedback, specifically addressing parameterized designs and fixed-width semantics.
Reusable Proof Library: A mechanism to distill proof traces into natural-language strategies and formal artifacts, enabling knowledge transfer across verification tasks.
Benchmark Suite: The first benchmark suite for evaluating agentic hardware theorem proving, covering 63 parameterized Chisel tasks (arithmetic, control, memory, miscellaneous) and processor-level modules.

Experimental Results

The authors evaluated CircuitProver against a vanilla agent (same LLM and setup but without reusable libraries or hardware guidance) and Chicala/Stainless.

Success Rate: CircuitProver successfully proved 100% (63/63) of the benchmark tasks. The vanilla agent solved 92.1% (58/63), and Chicala/Stainless struggled with front-end robustness, failing to compile many designs.
Efficiency: Compared to the vanilla agent, CircuitProver reduced:
- Average proof rounds by 50.0%.
- Verification time by 23.2%.
- Proof Lines of Code (LoC) by 16.3%.
Scalability: On larger processor-level modules (XiangShan and Rocket multipliers/dividers), CircuitProver reduced verification time by 56.8% and proof LoC by 54.4% compared to the vanilla agent.
Ablation Studies:
- Removing the Theorem Library reduced the success rate from 100% to 95.2% (60/63), indicating the library helps solve difficult cases.
- Removing Proof Guidance increased the rounds required for full coverage from 18 to 29, showing guidance accelerates the search process.
Model Scaling: Performance scaled with LLM capability, with the strongest model (Opus 4.8) achieving 100% success, while weaker models (Haiku 4.5) solved only 31/63 tasks.

Significance and Claims

The paper claims that reusable proof knowledge is a critical enabler for automated hardware verification in the agent era. By shifting from isolated, implicit verification outputs to accumulated, explicit proof artifacts, CircuitProver demonstrates that:

Proof accumulation significantly reduces redundant effort on related verification tasks.
Hardware-aware guidance is essential for efficient proof search, particularly for parameterized and sequential designs.
Agentic theorem proving can achieve full coverage on diverse hardware benchmarks where traditional model checking fails to provide reusable reasoning and manual ITP is too labor-intensive.

The authors position CircuitProver as a step toward verification tools that not only validate hardware but also learn and improve over time by distilling successful reasoning patterns into reusable libraries.