Green proofs, empty promises: when AI agents write their own specifications

说明与用途

LLM 生成的代码可能通过 Dafny 验证，但由于规范不完整仍存在错误。文章提出一种通过证明后置条件唯一性并生成证据来检测空规范的方法。

问题

AI coding agents can produce formally verified code that still contains bugs because the specifications they write are incomplete.

结果

Out of 24 agent-written Dafny contracts, 15 had unique postconditions, 6 were underspecified with witnesses, and 3 were inconclusive. The Haiku model produced one escaped bug in both Python and Dafny arms, but the Dafny bug was due to an underspecified contract.

工作流

• 1. Generate Dafny code and specifications with an LLM.
• 2. Run dafny verify to ensure the verifier accepts the solution.
• 3. For each method, ask Dafny to prove that two different results satisfy the postcondition for the same input.
• 4. If the proof fails, construct concrete inputs and run the method to obtain actual outputs.
• 5. Build neighboring outputs and ask Dafny to prove the contract accepts both.
• 6. If both proofs succeed, the contract is underspecified; record the witness.
• 7. Aggregate results to assess the prevalence of underspecification.

证据

A verifier only guarantees what you ask it to.

来源

For a method with precondition R and postcondition E, ask: Can two different results both satisfy E, for the same valid input?

来源

The trick: take small concrete inputs, run the method to get its actual answer a, build neighbouring answers b, and ask Dafny to prove that the contract accepts both a and b on those concrete values.

来源

The six witnesses: ...

来源