LLM 검증 파이프라인 수렴 정리와 자동화 검증의 확실한 종료 보장

📝 Abstract

The integration of Formal Verification tools with Large Language Models (LLMs) offers a path to scale software verification beyond manual workflows. However, current methods remain unreliable: without a solid theoretical footing, the refinement process acts as a black box that may oscillate, loop, or diverge. This work bridges this critical gap by developing an LLM-Verifier Convergence Theorem, providing the first formal framework with provable guarantees for termination in multi-stage verification pipelines. We model the interaction not as a generic loop, but as a sequential absorbing Markov Chain comprising four essential engineering stages: CodeGen, Compilation, InvariantSynth, and SMTSolving. We prove that for any non-zero stage success probability (δ > 0), the system reaches the Verified state almost surely. Furthermore, because of the sequential nature of the pipeline, we derive a precise latency bound of E[n] ≤ 4/δ. We stress-tested this prediction in an extensive empirical campaign comprising over 90,000 trials. The results match the theory with striking consistency: every run reached verification, and the empirical convergence factor clustered tightly around C f ≈ 1.0, confirming that the 4/δ bound accurately mirrors system behavior rather than serving as a loose buffer. Based on this data, we identify three distinct operating zones -marginal, practical, and high-performance -and propose a dynamic calibration strategy to handle parameter drift in real-world environments. Together, these contributions replace heuristic guesswork with a rigorous architectural foundation, enabling predictable resource planning and performance budgeting for safety-critical software.

💡 Analysis

The integration of Formal Verification tools with Large Language Models (LLMs) offers a path to scale software verification beyond manual workflows. However, current methods remain unreliable: without a solid theoretical footing, the refinement process acts as a black box that may oscillate, loop, or diverge. This work bridges this critical gap by developing an LLM-Verifier Convergence Theorem, providing the first formal framework with provable guarantees for termination in multi-stage verification pipelines. We model the interaction not as a generic loop, but as a sequential absorbing Markov Chain comprising four essential engineering stages: CodeGen, Compilation, InvariantSynth, and SMTSolving. We prove that for any non-zero stage success probability (δ > 0), the system reaches the Verified state almost surely. Furthermore, because of the sequential nature of the pipeline, we derive a precise latency bound of E[n] ≤ 4/δ. We stress-tested this prediction in an extensive empirical campaign comprising over 90,000 trials. The results match the theory with striking consistency: every run reached verification, and the empirical convergence factor clustered tightly around C f ≈ 1.0, confirming that the 4/δ bound accurately mirrors system behavior rather than serving as a loose buffer. Based on this data, we identify three distinct operating zones -marginal, practical, and high-performance -and propose a dynamic calibration strategy to handle parameter drift in real-world environments. Together, these contributions replace heuristic guesswork with a rigorous architectural foundation, enabling predictable resource planning and performance budgeting for safety-critical software.

📄 Content

The 4/δ Bound: Designing Predictable LLM-Verifier Systems for Formal Method Guarantee Pierre Dantas1,2*, Lucas Cordeiro1,2†, Youcheng Sun1†, Waldir Junior2† 1*Dept. of Computer Science, The University of Manchester, UK. 2Dept. of Electrical Engineering, Federal University of Amazonas (UFAM), Brazil. *Corresponding author(s): pierre.dantas@gmail.com, 0000-0001-6390-9340; Contributing authors: lucas.cordeiro@manchester.ac.uk, 0000-0002-6235-4272; techieyoucheng@gmail.com, 0000-0002-1893-6259; waldirjr@ufam.edu.br, 0000-0003-3095-0042; †These authors contributed equally to this work. Abstract The integration of Formal Verification tools with Large Language Models (LLMs) offers a path to scale software verification beyond manual workflows. However, current methods remain unre- liable: without a solid theoretical footing, the refinement process acts as a black box that may oscillate, loop, or diverge. This work bridges this critical gap by developing an LLM-Verifier Convergence Theorem, providing the first formal framework with provable guarantees for termi- nation in multi-stage verification pipelines. We model the interaction not as a generic loop, but as a sequential absorbing Markov Chain comprising four essential engineering stages: CodeGen, Compilation, InvariantSynth, and SMTSolving. We prove that for any non-zero stage success probability (δ > 0), the system reaches the Verified state almost surely. Furthermore, because of the sequential nature of the pipeline, we derive a precise latency bound of E[n] ≤4/δ. We stress-tested this prediction in an extensive empirical campaign comprising over 90,000 trials. The results match the theory with striking consistency: every run reached verification, and the empirical convergence factor clustered tightly around Cf ≈1.0, confirming that the 4/δ bound accurately mirrors system behavior rather than serving as a loose buffer. Based on this data, we identify three distinct operating zones – marginal, practical, and high-performance – and propose a dynamic calibration strategy to handle parameter drift in real-world environments. Together, these contributions replace heuristic guesswork with a rigorous architectural foun- dation, enabling predictable resource planning and performance budgeting for safety-critical software. Keywords: Formal Verification, Large Language Models, SMT Solvers, Bounded Model Checking, Automated Program Repair, Specification Synthesis, ESBMC 1 arXiv:2512.02080v2 [cs.AI] 16 Dec 2025 1 Introduction Formal software verification is essential in areas such as aerospace [1], medical devices [2], and autonomous systems [3]. It uses mathematical methods to check that systems work as intended. For example, techniques such as Bounded Model Checking (BMC) [4] analyze software to detect hidden problems, such as numerical errors and memory-safety issues. Regular testing often misses these kinds of issues. Tools such as Efficient SMT-based Context-Bounded Model Checker (ESBMC) [5, 6] help with this process [7]. However, a significant specification bottleneck limits widespread adoption: the extensive manual effort required to formulate precise formal specifications from ambiguous requirements [8]. We now have a few solid ways to handle this problem, thanks to the recent arrival of large language models (LLMs). These models are proving incredibly useful; for example, they can easily generate formal specifications [9], construct tricky loop invariants [10], and significantly speed up automated program repair [11]. Despite the promising results mentioned, a central problem remains: the process that improves the use of LLMs and verifiers does not always guarantee precise and reli- able outcomes [9–11]. Although researchers have developed strong theoretical foundations for both LLMs [12, 13] and Formal Verification tools [4, 5, 7] individually, they have not yet mathematically analyzed how these components behave when used together in an iterative process [14, 15]. This gap causes the system to behave unpredictably, making it unsafe to use in critical areas. The Fundamental Gap addressed in this work: Unpredictable Artificial Intelligence (AI)- Verifier Interactions. We cannot predict how AI and Verifiers will interact in multi-stage workflows. Mixing statistical AI components with reliable, deterministic verification tools creates a core conflict that current methods have not solved mathematically. Even though specific tests look promising [10, 16], we lack a reliable convergence theory for the repeated refinement cycles typical of modern verification pipelines. Most existing approaches treat LLM refinement as a generic “black box” loop, ignoring the sequential engineering dependencies required to build valid proofs. This missing piece creates three problems that prevent the deployment of these systems in real-world applications:

1. Unpredictable Termination: Without mathematical guarantees that the sequential process will converge, the refinement can get stu

This content is AI-processed based on ArXiv data.