Generative Language Modeling for Automated Theorem Proving
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Artificial Intelligence in Health Care: the Hope, the Hype, the Promise, the Peril
Artificial Intelligence in Health Care: The Hope, the Hype, the Promise, the Peril Michael Matheny, Sonoo Thadaney Israni, Mahnoor Ahmed, and Danielle Whicher, Editors WASHINGTON, DC NAM.EDU PREPUBLICATION COPY - Uncorrected Proofs NATIONAL ACADEMY OF MEDICINE • 500 Fifth Street, NW • WASHINGTON, DC 20001 NOTICE: This publication has undergone peer review according to procedures established by the National Academy of Medicine (NAM). Publication by the NAM worthy of public attention, but does not constitute endorsement of conclusions and recommendationssignifies that it is the by productthe NAM. of The a carefully views presented considered in processthis publication and is a contributionare those of individual contributors and do not represent formal consensus positions of the authors’ organizations; the NAM; or the National Academies of Sciences, Engineering, and Medicine. Library of Congress Cataloging-in-Publication Data to Come Copyright 2019 by the National Academy of Sciences. All rights reserved. Printed in the United States of America. Suggested citation: Matheny, M., S. Thadaney Israni, M. Ahmed, and D. Whicher, Editors. 2019. Artificial Intelligence in Health Care: The Hope, the Hype, the Promise, the Peril. NAM Special Publication. Washington, DC: National Academy of Medicine. PREPUBLICATION COPY - Uncorrected Proofs “Knowing is not enough; we must apply. Willing is not enough; we must do.” --GOETHE PREPUBLICATION COPY - Uncorrected Proofs ABOUT THE NATIONAL ACADEMY OF MEDICINE The National Academy of Medicine is one of three Academies constituting the Nation- al Academies of Sciences, Engineering, and Medicine (the National Academies). The Na- tional Academies provide independent, objective analysis and advice to the nation and conduct other activities to solve complex problems and inform public policy decisions. -
Experience Implementing a Performant Category-Theory Library in Coq
Experience Implementing a Performant Category-Theory Library in Coq Jason Gross, Adam Chlipala, and David I. Spivak Massachusetts Institute of Technology, Cambridge, MA, USA [email protected], [email protected], [email protected] Abstract. We describe our experience implementing a broad category- theory library in Coq. Category theory and computational performance are not usually mentioned in the same breath, but we have needed sub- stantial engineering effort to teach Coq to cope with large categorical constructions without slowing proof script processing unacceptably. In this paper, we share the lessons we have learned about how to repre- sent very abstract mathematical objects and arguments in Coq and how future proof assistants might be designed to better support such rea- soning. One particular encoding trick to which we draw attention al- lows category-theoretic arguments involving duality to be internalized in Coq's logic with definitional equality. Ours may be the largest Coq development to date that uses the relatively new Coq version developed by homotopy type theorists, and we reflect on which new features were especially helpful. Keywords: Coq · category theory · homotopy type theory · duality · performance 1 Introduction Category theory [36] is a popular all-encompassing mathematical formalism that casts familiar mathematical ideas from many domains in terms of a few unifying concepts. A category can be described as a directed graph plus algebraic laws stating equivalences between paths through the graph. Because of this spar- tan philosophical grounding, category theory is sometimes referred to in good humor as \formal abstract nonsense." Certainly the popular perception of cat- egory theory is quite far from pragmatic issues of implementation. -
Specifying Verified X86 Software from Scratch
Specifying verified x86 software from scratch Mario Carneiro Carnegie Mellon University, Pittsburgh, PA, USA [email protected] Abstract We present a simple framework for specifying and proving facts about the input/output behavior of ELF binary files on the x86-64 architecture. A strong emphasis has been placed on simplicity at all levels: the specification says only what it needs to about the target executable, the specification is performed inside a simple logic (equivalent to first-order Peano Arithmetic), and the verification language and proof checker are custom-designed to have only what is necessary to perform efficient general purpose verification. This forms a part of the Metamath Zero project, to build a minimal verifier that is capable of verifying its own binary. In this paper, we will present the specification of the dynamic semantics of x86 machine code, together with enough information about Linux system calls to perform simple IO. 2012 ACM Subject Classification Theory of computation → Program verification; Theory of com- putation → Abstract machines Keywords and phrases x86-64, ISA specification, Metamath Zero, self-verification Digital Object Identifier 10.4230/LIPIcs.ITP.2019.19 Supplement Material The formalization is a part of the Metamath Zero project at https://github. com/digama0/mm0. Funding This material is based upon work supported by AFOSR grant FA9550-18-1-0120 and a grant from the Sloan Foundation. Acknowledgements I would like to thank my advisor Jeremy Avigad for his support and encourage- ment, and for his reviews of early drafts of this work. 1 Introduction The field of software verification is on the verge of a breakthrough. -
AI Computer Wraps up 4-1 Victory Against Human Champion Nature Reports from Alphago's Victory in Seoul
The Go Files: AI computer wraps up 4-1 victory against human champion Nature reports from AlphaGo's victory in Seoul. Tanguy Chouard 15 March 2016 SEOUL, SOUTH KOREA Google DeepMind Lee Sedol, who has lost 4-1 to AlphaGo. Tanguy Chouard, an editor with Nature, saw Google-DeepMind’s AI system AlphaGo defeat a human professional for the first time last year at the ancient board game Go. This week, he is watching top professional Lee Sedol take on AlphaGo, in Seoul, for a $1 million prize. It’s all over at the Four Seasons Hotel in Seoul, where this morning AlphaGo wrapped up a 4-1 victory over Lee Sedol — incidentally, earning itself and its creators an honorary '9-dan professional' degree from the Korean Baduk Association. After winning the first three games, Google-DeepMind's computer looked impregnable. But the last two games may have revealed some weaknesses in its makeup. Game four totally changed the Go world’s view on AlphaGo’s dominance because it made it clear that the computer can 'bug' — or at least play very poor moves when on the losing side. It was obvious that Lee felt under much less pressure than in game three. And he adopted a different style, one based on taking large amounts of territory early on rather than immediately going for ‘street fighting’ such as making threats to capture stones. This style – called ‘amashi’ – seems to have paid off, because on move 78, Lee produced a play that somehow slipped under AlphaGo’s radar. David Silver, a scientist at DeepMind who's been leading the development of AlphaGo, said the program estimated its probability as 1 in 10,000. -
Lemma Functions for Frama-C: C Programs As Proofs
Lemma Functions for Frama-C: C Programs as Proofs Grigoriy Volkov Mikhail Mandrykin Denis Efremov Faculty of Computer Science Software Engineering Department Faculty of Computer Science National Research University Ivannikov Institute for System Programming of the National Research University Higher School of Economics Russian Academy of Sciences Higher School of Economics Moscow, Russia Moscow, Russia Moscow, Russia [email protected] [email protected] [email protected] Abstract—This paper describes the development of to additionally specify loop invariants and termination an auto-active verification technique in the Frama-C expression (loop variants) in case the function under framework. We outline the lemma functions method analysis contains loops. Then the verification instrument and present the corresponding ACSL extension, its implementation in Frama-C, and evaluation on a set generates verification conditions (VCs), which can be of string-manipulating functions from the Linux kernel. separated into categories: safety and behavioral ones. We illustrate the benefits our approach can bring con- Safety VCs are responsible for runtime error checks for cerning the effort required to prove lemmas, compared known (modeled) types, while behavioral VCs represent to the approach based on interactive provers such as the functional correctness checks. All VCs need to be Coq. Current limitations of the method and its imple- mentation are discussed. discharged in order for the function to be considered fully Index Terms—formal verification, deductive verifi- proved (totally correct). This can be achieved either by cation, Frama-C, auto-active verification, lemma func- manually proving all VCs discharged with an interactive tions, Linux kernel prover (i. e., Coq, Isabelle/HOL or PVS) or with the help of automatic provers. -
The Metamathematics of Putnam's Model-Theoretic Arguments
The Metamathematics of Putnam's Model-Theoretic Arguments Tim Button Abstract. Putnam famously attempted to use model theory to draw metaphysical conclusions. His Skolemisation argument sought to show metaphysical realists that their favourite theories have countable models. His permutation argument sought to show that they have permuted mod- els. His constructivisation argument sought to show that any empirical evidence is compatible with the Axiom of Constructibility. Here, I exam- ine the metamathematics of all three model-theoretic arguments, and I argue against Bays (2001, 2007) that Putnam is largely immune to meta- mathematical challenges. Copyright notice. This paper is due to appear in Erkenntnis. This is a pre-print, and may be subject to minor changes. The authoritative version should be obtained from Erkenntnis, once it has been published. Hilary Putnam famously attempted to use model theory to draw metaphys- ical conclusions. Specifically, he attacked metaphysical realism, a position characterised by the following credo: [T]he world consists of a fixed totality of mind-independent objects. (Putnam 1981, p. 49; cf. 1978, p. 125). Truth involves some sort of correspondence relation between words or thought-signs and external things and sets of things. (1981, p. 49; cf. 1989, p. 214) [W]hat is epistemically most justifiable to believe may nonetheless be false. (1980, p. 473; cf. 1978, p. 125) To sum up these claims, Putnam characterised metaphysical realism as an \externalist perspective" whose \favorite point of view is a God's Eye point of view" (1981, p. 49). Putnam sought to show that this externalist perspective is deeply untenable. To this end, he treated correspondence in terms of model-theoretic satisfaction. -
Better SMT Proofs for Easier Reconstruction Haniel Barbosa, Jasmin Blanchette, Mathias Fleury, Pascal Fontaine, Hans-Jörg Schurr
Better SMT Proofs for Easier Reconstruction Haniel Barbosa, Jasmin Blanchette, Mathias Fleury, Pascal Fontaine, Hans-Jörg Schurr To cite this version: Haniel Barbosa, Jasmin Blanchette, Mathias Fleury, Pascal Fontaine, Hans-Jörg Schurr. Better SMT Proofs for Easier Reconstruction. AITP 2019 - 4th Conference on Artificial Intelligence and Theorem Proving, Apr 2019, Obergurgl, Austria. hal-02381819 HAL Id: hal-02381819 https://hal.archives-ouvertes.fr/hal-02381819 Submitted on 26 Nov 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Better SMT Proofs for Easier Reconstruction Haniel Barbosa1, Jasmin Christian Blanchette2;3;4, Mathias Fleury4;5, Pascal Fontaine3, and Hans-J¨orgSchurr3 1 University of Iowa, 52240 Iowa City, USA [email protected] 2 Vrije Universiteit Amsterdam, 1081 HV Amsterdam, the Netherlands [email protected] 3 Universit´ede Lorraine, CNRS, Inria, LORIA, 54000 Nancy, France fjasmin.blanchette,pascal.fontaine,[email protected] 4 Max-Planck-Institut f¨urInformatik, Saarland Informatics Campus, Saarbr¨ucken, Germany fjasmin.blanchette,[email protected] 5 Saarbr¨ucken Graduate School of Computer Science, Saarland Informatics Campus, Saarbr¨ucken, Germany [email protected] Proof assistants are used in verification, formal mathematics, and other areas to provide trust- worthy, machine-checkable formal proofs of theorems. -
Testing Noninterference, Quickly
Testing Noninterference, Quickly Cat˘ alin˘ Hrit¸cu1 John Hughes2 Benjamin C. Pierce1 Antal Spector-Zabusky1 Dimitrios Vytiniotis3 Arthur Azevedo de Amorim1 Leonidas Lampropoulos1 1University of Pennsylvania 2Chalmers University 3Microsoft Research Abstract To answer this question, we take as a case study the task of Information-flow control mechanisms are difficult to design and extending a simple abstract stack-and-pointer machine to track dy- labor intensive to prove correct. To reduce the time wasted on namic information flow and enforce termination-insensitive nonin- proof attempts doomed to fail due to broken definitions, we ad- terference [23]. Although our machine is simple, this exercise is vocate modern random testing techniques for finding counterexam- both nontrivial and novel. While simpler notions of dynamic taint ples during the design process. We show how to use QuickCheck, tracking are well studied for both high- and low-level languages, a property-based random-testing tool, to guide the design of a sim- it has only recently been shown [1, 24] that dynamic checks are ple information-flow abstract machine. We find that both sophis- capable of soundly enforcing strong security properties. Moreover, ticated strategies for generating well-distributed random programs sound dynamic IFC has been studied only in the context of lambda- and readily falsifiable formulations of noninterference properties calculi [1, 16, 25] and While programs [24]; the unstructured con- are critically important. We propose several approaches and eval- trol flow of a low-level machine poses additional challenges. (Test- uate their effectiveness on a collection of injected bugs of varying ing of static IFC mechanisms is left as future work.) subtlety. -
An Anti-Locally-Nameless Approach to Formalizing Quantifiers Olivier Laurent
An Anti-Locally-Nameless Approach to Formalizing Quantifiers Olivier Laurent To cite this version: Olivier Laurent. An Anti-Locally-Nameless Approach to Formalizing Quantifiers. Certified Programs and Proofs, Jan 2021, virtual, Denmark. pp.300-312, 10.1145/3437992.3439926. hal-03096253 HAL Id: hal-03096253 https://hal.archives-ouvertes.fr/hal-03096253 Submitted on 4 Jan 2021 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. An Anti-Locally-Nameless Approach to Formalizing Quantifiers Olivier Laurent Univ Lyon, EnsL, UCBL, CNRS, LIP LYON, France [email protected] Abstract all cases have been covered. This works perfectly well for We investigate the possibility of formalizing quantifiers in various propositional systems, but as soon as (first-order) proof theory while avoiding, as far as possible, the use of quantifiers enter the picture, we have to face one ofthe true binding structures, α-equivalence or variable renam- nightmares of formalization: quantifiers are binders... The ings. We propose a solution with two kinds of variables in question of the formalization of binders does not yet have an 1 terms and formulas, as originally done by Gentzen. In this answer which makes perfect consensus . -
In-Datacenter Performance Analysis of a Tensor Processing Unit
In-Datacenter Performance Analysis of a Tensor Processing Unit Presented by Josh Fried Background: Machine Learning Neural Networks: ● Multi Layer Perceptrons ● Recurrent Neural Networks (mostly LSTMs) ● Convolutional Neural Networks Synapse - each edge, has a weight Neuron - each node, sums weights and uses non-linear activation function over sum Propagating inputs through a layer of the NN is a matrix multiplication followed by an activation Background: Machine Learning Two phases: ● Training (offline) ○ relaxed deadlines ○ large batches to amortize costs of loading weights from DRAM ○ well suited to GPUs ○ Usually uses floating points ● Inference (online) ○ strict deadlines: 7-10ms at Google for some workloads ■ limited possibility for batching because of deadlines ○ Facebook uses CPUs for inference (last class) ○ Can use lower precision integers (faster/smaller/more efficient) ML Workloads @ Google 90% of ML workload time at Google spent on MLPs and LSTMs, despite broader focus on CNNs RankBrain (search) Inception (image classification), Google Translate AlphaGo (and others) Background: Hardware Trends End of Moore’s Law & Dennard Scaling ● Moore - transistor density is doubling every two years ● Dennard - power stays proportional to chip area as transistors shrink Machine Learning causing a huge growth in demand for compute ● 2006: Excess CPU capacity in datacenters is enough ● 2013: Projected 3 minutes per-day per-user of speech recognition ○ will require doubling datacenter compute capacity! Google’s Answer: Custom ASIC Goal: Build a chip that improves cost-performance for NN inference What are the main costs? Capital Costs Operational Costs (power bill!) TPU (V1) Design Goals Short design-deployment cycle: ~15 months! Plugs in to PCIe slot on existing servers Accelerates matrix multiplication operations Uses 8-bit integer operations instead of floating point How does the TPU work? CISC instructions, issued by host. -
Proof-Assistants Using Dependent Type Systems
CHAPTER 18 Proof-Assistants Using Dependent Type Systems Henk Barendregt Herman Geuvers Contents I Proof checking 1151 2 Type-theoretic notions for proof checking 1153 2.1 Proof checking mathematical statements 1153 2.2 Propositions as types 1156 2.3 Examples of proofs as terms 1157 2.4 Intermezzo: Logical frameworks. 1160 2.5 Functions: algorithms versus graphs 1164 2.6 Subject Reduction . 1166 2.7 Conversion and Computation 1166 2.8 Equality . 1168 2.9 Connection between logic and type theory 1175 3 Type systems for proof checking 1180 3. l Higher order predicate logic . 1181 3.2 Higher order typed A-calculus . 1185 3.3 Pure Type Systems 1196 3.4 Properties of P ure Type Systems . 1199 3.5 Extensions of Pure Type Systems 1202 3.6 Products and Sums 1202 3.7 E-typcs 1204 3.8 Inductive Types 1206 4 Proof-development in type systems 1211 4.1 Tactics 1212 4.2 Examples of Proof Development 1214 4.3 Autarkic Computations 1220 5 P roof assistants 1223 5.1 Comparing proof-assistants . 1224 5.2 Applications of proof-assistants 1228 Bibliography 1230 Index 1235 Name index 1238 HANDBOOK OF AUTOMAT8D REASONING Edited by Alan Robinson and Andrei Voronkov © 2001 Elsevier Science Publishers 8.V. All rights reserved PROOF-ASSISTANTS USING DEPENDENT TYPE SYSTEMS 1151 I. Proof checking Proof checking consists of the automated verification of mathematical theories by first fully formalizing the underlying primitive notions, the definitions, the axioms and the proofs. Then the definitions are checked for their well-formedness and the proofs for their correctness, all this within a given logic. -
Can the Computer Really Help Us to Prove Theorems?
Can the computer really help us to prove theorems? Herman Geuvers1 Radboud University Nijmegen and Eindhoven University of Technology The Netherlands ICT.Open 2011 Veldhoven, November 2011 1Thanks to Freek Wiedijk & Foundations group, RU Nijmegen Can the computer really help us to prove theorems? Can the computer really help us to prove theorems? Yes it can Can the computer really help us to prove theorems? Yes it can But it’s hard ... ◮ How does it work? ◮ Some state of the art ◮ What needs to be done Overview ◮ What are Proof Assistants? ◮ How can a computer program guarantee correctness? ◮ Challenges What are Proof Assistants – History John McCarthy (1927 – 2011) 1961, Computer Programs for Checking Mathematical Proofs What are Proof Assistants – History John McCarthy (1927 – 2011) 1961, Computer Programs for Checking Mathematical Proofs Proof-checking by computer may be as important as proof generation. It is part of the definition of formal system that proofs be machine checkable. For example, instead of trying out computer programs on test cases until they are debugged, one should prove that they have the desired properties. What are Proof Assistants – History Around 1970 five new systems / projects / ideas ◮ Automath De Bruijn (Eindhoven) ◮ Nqthm Boyer, Moore (Austin, Texas) ◮ LCF Milner (Stanford; Edinburgh) What are Proof Assistants – History Around 1970 five new systems / projects / ideas ◮ Automath De Bruijn (Eindhoven) ◮ Nqthm Boyer, Moore (Austin, Texas) ◮ LCF Milner (Stanford; Edinburgh) ◮ Mizar Trybulec (Bia lystok, Poland)