Neuro-symbolic provers verify 84% of Triton kernel safety invariants

Machine learning systems researchers and formal methods engineers at UC Berkeley and San Francisco research labs released KernelProof-Bench on Friday morning, an open-source verification program written in the Lean 4 Theorem Prover that evaluates whether neuro-symbolic language models can formally prove memory-safety and numerical equivalence invariants for custom GPU Triton and CUDA kernels. As production inference engines increasingly rely on model-synthesized fused kernels for sparse attention, quantized matrix-vector multiplication, and rotary position embeddings, subtle indexing arithmetic bugs or missing warp-synchronization barriers can silently corrupt floating-point activations without triggering immediate runtime crashes. Rather than relying solely on stochastic unit tests across fixed tensor shapes, KernelProof-Bench translates Triton intermediate representation (TTIR) blocks into typed Lean 4 proof obligations covering arbitrary symbolic batch, head, and sequence dimensions.

In benchmark evaluations across 320 production-grade kernels drawn from open-weight transformer runtimes, a hybrid pipeline combining a 14-billion-parameter proof-step generator with Mathlib4 omega and bv_decide tactics discharged 84.1 percent of memory-bounds and shared-memory barrier safety theorems within a ninety-second wall-clock budget per kernel. By comparison, unguided frontier reasoning models prompting Lean 4 without compiler abstract-interpretation hints solved only 41.6 percent of the same verification obligations before exhausting token budgets.

Crucially, the formal verifier uncovered eleven previously undocumented edge-case bugs in widely forked community kernels where non-power-of-two sequence lengths coupled with ragged kv-cache paging offsets caused silent out-of-bounds reads in shared SRAM tiles. When the Lean 4 kernel checker rejects an invalid proof state, the pipeline extracts a concrete counterexample tuple—such as (seq_len = 2051, block_m = 64, stride_k = 128)—and feeds it back into the kernel synthesizer to repair the pointer mask automatically.

The full Lean 4 formalization semantics, TTIR-to-Lean transpiler, and evaluation harness are available under an Apache 2.0 license for integration into continuous integration workflows. Compiler engineers can inspect the tactic library and reproduce the evaluation tables via the Lean Prover Community Documentation.