aiqbench analysis
This research proposes a formal calculus for program translation that leverages Large Language Models as untrusted agents to construct and verify evidence-carrying proofs across different languages. By mechanizing trust verification in Lean 4, the system ensures that answers are self-certifying through witness replay rather than relying on opaque model outputs alone. The approach represents a significant step toward robust AI-assisted formal methods where LLMs act as architects for verified logical structures instead of direct answer generators.
Untrusted Authors, Trusted Answers: A Calculus of Fidelity-Graded Translations
arXiv:2607.14137v2 Announce Type: cross Abstract: To answer a question about a program, move the program to where the question is decidable. Every such move is a translation, and every translation is a place to be wrong. We study translation as a graph -- many languages, a few reasoning targets, independently built routes of honestly different trustworthiness -- and give it a calculus: pairs of languages close commuting squares that are directional (exactness is the identity-embedding special case of over-approximation), checkable per program, and composable, a route's contract being the componentwise meet of its hops' contracts -- assurance class, direction, kept observables, measured cost. One asymmetry organizes trust: witness-carrying answers are self-certifying by replay at the source; universal answers are where grades, independent branches, and re-checked certificates earn their cost. The compositional core, lax telescope included, is mechanized in Lean 4. hurdy-gurdy implements the calculus as two planes meeting in one registry. The use plane reads declarations and produces evidence-carrying answers; its builders and its intended player are both LLMs, untrusted by construction. The evolution plane grows the graph: unmet questions are recorded as demand, pairs are recommended by evidence and registered by humans, and a ratchet keeps every prior verdict standing. Answers never write; growth never answers. Run indefinitely, the loop converges on every reducibly decidable question, at fidelity that only rises. We measure the July 2026 snapshot -- per-construct conjoined coverage, dual-route branch agreement for two ISAs, source-level witness replay, certified unreachability re-validated by a formally verified checker, escape rates for the gate itself -- and report the defects the architecture caught in its own authors' work.
Abstract:To answer a question about a program, move the program to where the question is decidable. Every such move is a translation, and every translation is a place to be wrong. We study translation as a graph -- many languages, a few reasoning targets, independently built routes of honestly different trustworthiness -- and give it a calculus: pairs of languages close commuting squares that are directional (exactness is the identity-embedding special case of over-approximation), checkable per program, and composable, a route's contract being the componentwise meet of its hops' contracts -- assurance class, direction, kept observables, measured cost. One asymmetry organizes trust: witness-carrying answers are self-certifying by replay at the source; universal answers are where grades, independent branches, and re-checked certificates earn their cost. The compositional core, lax telescope included, is mechanized in Lean 4. hurdy-gurdy implements the calculus as two planes meeting in one registry. The use plane reads declarations and produces evidence-carrying answers; its builders and its intended player are both LLMs, untrusted by construction. The evolution plane grows the graph: unmet questions are recorded as demand, pairs are recommended by evidence and registered by humans, and a ratchet keeps every prior verdict standing. Answers never write; growth never answers. Run indefinitely, the loop converges on every reducibly decidable question, at fidelity that only rises. We measure the July 2026 snapshot -- per-construct conjoined coverage, dual-route branch agreement for two ISAs, source-level witness replay, certified unreachability re-validated by a formally verified checker, escape rates for the gate itself -- and report the defects the architecture caught in its own authors' work.
29 pages. v2: rewritten on the two-plane principle; directional squares primary (exactness = the identity-embedding case, mechanized incl. the lax telescope); the answerability loop and its economy (demand books, recommended-then-registered); post-snapshot exhibits. Code, evidence, Lean mechanization: this https URL (tag arxiv.2)
Programming Languages (cs.PL); Artificial Intelligence (cs.AI); Logic in Computer Science (cs.LO); Software Engineering (cs.SE)
arXiv:2607.14137 [cs.PL]
(or arXiv:2607.14137v2 [cs.PL] for this version)
From: Christoph M. Kirsch [view email] [v1] Fri, 10 Jul 2026 14:41:38 UTC (56 KB) [v2] Fri, 17 Jul 2026 14:29:07 UTC (71 KB)
Full text under the publisher's open licence · 350 words
Related coverage
News Archive 2026
Quantum Computing Report · Jul 25, 2026
More details on Fable 5’s cyber safeguards and our jailbreak framework
Anthropic · Jul 2, 2026

Digital States 2026: AI Moves From Experiment to Infrastructure
govtech.com · Sep 24, 2026

Automated Reasoning policy refinement in Amazon Bedrock
AWS · Aug 3, 2026