Goedel-Code-Prover: Hierarchical Proof Search for Open State-of-the-Art Code Verification
Zenan Li, Ziran Yang, Deyuan He, Haoyu Zhao, Andrew Zhao, Shange Tang, Kaiyu Yang, Aarti Gupta, Zhendong Su, Chi Jin
cs.SE
Mar 18, 2026 · v3
cs.AI
TL;DR
Trains an 8B LLM to decompose and prove Lean 4 code-verification goals, using Lean compiler feedback and quickcheck to score lemma decompositions.
Abstract
Large language models (LLMs) can generate plausible code but offer limited guarantees of correctness. Formally verifying that implementations satisfy specifications requires constructing machine-checkable proofs, a task that remains beyond current automation. We propose a hierarchical proof search framework for automated code verification in Lean 4 that decomposes complex verification goals into structurally simpler subgoals before attempting tactic-level proving. Central to our approach is a principled decomposition score that combines constructive justification with structural effectiveness. The same score serves as both the training reward and the inference-time ranking criterion, aligning optimization and deployment. We train Goedel Code Prover, a single unified policy for both decomposition and completion, through supervised initialization followed by hybrid reinforcement learning, where a continuous decomposition reward supports planning exploration while supervised replay stabilizes proof generation. On three Lean-based code verification benchmarks comprising 427 tasks, our 8B-parameter model achieves a 62.0% prove success rate, a 2.6 improvement over the strongest baseline under the reported inference settings. We further observe consistent inference-time scaling: success rates improve monotonically with search iterations and sampling budget, while whole-proof baselines plateau within the evaluated budgets.
Problem
Formally verifying that programs meet their specifications requires machine-checkable proofs, and current automation cannot construct them reliably. Code verification also lacks a reusable lemma library like Mathlib, so provers trained on mathematics generalize poorly to it.
Approach
A hierarchical proof search framework for Lean 4 recursively decomposes a verification goal into sub-lemmas, then proves the leaf lemmas with iterative tactic generation guided by compiler feedback. A decomposition score ranks candidate decompositions using two criteria: constructive justification (a Lean-checked parent proof that uses every lemma, with each lemma surviving quickcheck counterexample search) and structural simplicity (a reduction in goal complexity). The same score serves as the training reward and as the inference-time ranking criterion. A single 8B policy handles both decomposition and completion; it is trained by supervised initialization followed by hybrid reinforcement learning.
Results
On 427 tasks from the Verina, Clever and AlgoVeri benchmarks, the model reaches a 62.0% prove rate. This is 2.6× the strongest baseline and beats neural provers up to 84× larger. Success rates improve monotonically with search iterations and sampling budget, and ablations show that the trained decomposition and completion modules contribute synergistically.
| Decomposition | Completion | Verina |
|---|
| — | Gemini-3-Flash | 26.4 |
| GPT-5.2-Pro | Gemini-3-Flash | 54.4 |
| Ours | Gemini-3-Flash | 58.2 |
| GPT-5.2-Pro | Ours | 59.2 |
| Ours | Ours | 68.7 |
Ablation on Verina: decomposition and completion module combinations (prove rate %)