← All papers
First page of Proof-Carrying Evolution: Black-Box Search, White-Box Flight

Proof-Carrying Evolution: Black-Box Search, White-Box Flight

Amit Jain, Sergio Sanchez-Hurtado, Victor Rodriguez-Fernandez, Richard Linares

cs.RO Oct 30, 2026 · v1 cs.NE eess.SY
A certificate compiler generates Lean 4 proofs of stability, safety, docking, capture and SO(3) decrease properties for the champion controllers, checked by the Lean kernel.
We study whether a language model can help design controllers whose behavior can be formally checked. In proof-carrying evolution (PCE), a search proposes controllers together with their certificates. Their mathematical forms are fixed; a proposer chooses their numerical parameters together. Certificate checks guide selection, and only a certified candidate can be returned. The deployed artifact is a control law and its certificate; the language model is used only during design. We compare four language models with classical search and synthesis on docking under a speed limit, pursuit of a maneuvering target, and attitude control on SO(3), using paired runs and shared proposal allowances. Certificates are checked in exact rational arithmetic during search on the linear problems. On SO(3), the search uses floating-point checks, followed by exact re-verification of every reported champion. The best run of each method also receives Lean 4 proofs of its stated control properties. On the linear problems, the strongest models beat the standard classical baselines on every run, but a classical optimizer that chooses certificates for the same objective closes most of that lead. Among the cited pursuit champions, the ranking does not survive a change from Euler to zero-order-hold dynamics. On SO(3), no model detectably outperforms CMA-ES when mixed with classical mutation. When models write every proposal, one tested model improves on CMA-ES and the other performs worse than its mixed variant. All search medians remain below the hand-tuned law. In a docking control with the objective and mutation operator held fixed, retaining certified candidates yields new certified designs in every run; removing this rule yields none.

Spacecraft controllers need reviewable formal guarantees. The question is whether language models can propose controller and certificate parameters inside a certifiable design space, so that the deployed artifact is an explicit control law with a machine-checked certificate.

Proof-carrying evolution (PCE) runs an evolutionary search in which language models or classical operators propose controller gains together with Lyapunov certificate parameters. Certificate checks gate selection: exact rational arithmetic on the linear docking and pursuit problems, and floating-point linear programs on SO(3) attitude control. Four language models are compared with classical baselines over paired seeds. A certificate compiler turns the best run of each method into Lean 4 proofs of its stated control properties, with axiom footprints audited independently.

On the linear problems the strongest models beat the standard classical baselines on every run, but a classical certificate optimizer closes most of that gap. On SO(3) no model detectably beats CMA-ES, and the hand-tuned law remains better than every search arm's median. Lean proofs also certify 11 of 12 docking champions under saturated thrust, covering the true clipped dynamics.

ModelDocking N (lower)Pursuit r_cap (lower)SO(3) deg (higher)
Astra38.50.02857105.2
Sol380.0296098.5
Opus68.50.02986102.0
gpt-oss950.0400999.9
Strongest standard baseline520.03388105.2
Model medians on the three problems versus the strongest standard baseline