LLM-written formal specifications passed the verifier on code that was wrong, and prompting did not fix it
AspireAI community · arXiv preprint
Formal verification is supposed to answer whether a program matches its requirement. A study of 1,403 C programs puts that promise under a model check and finds a specific failure: when the code is wrong, an LLM can still write a specification that the verifier accepts, because the specification is weak or written to fit the implementation rather than the requirement.
The setup is deliberately adversarial. Instead of assuming the program is correct, the researchers hand the model both a natural-language requirement and an implementation whose correctness is unknown, generate ACSL specifications, and verify them with Frama-C. When the code is correct, adding the requirement does not improve the pass rate. When the code is incorrect, specifications can pass verification for the wrong reason, and advanced prompting approaches do not fully alleviate that. Compared with the non-formal HoarePrompt approach, the LLM-generated formal specifications were also less effective at predicting whether the code matched the requirement.
The implication for anyone using a model in a verification loop is blunt: a green verifier result is not evidence that the requirement was checked. The authors argue that these generators have to be scored on requirement faithfulness, not just pass rate. Caveat: the scope is C programs and the ACSL/Frama-C toolchain, and the paper presents itself as a first look rather than a fix.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.