Anthropic with Theorem: Claude wrote formal proofs for 123 real open-source libraries
AspireAI · Anthropic
Formal verification translates code into a mathematical model and proves it obeys stated rules, but historically it demanded specialist effort: verifying the seL4 kernel took 20 person-years. In a collaboration with Theorem, Anthropic reports that Claude produced proofs at the assembly-code level (RISC-V) across 123 Google OSS-Fuzz libraries, covering 239 fuzzing entry points with about 180 million lines of Rocq proof. A typical proof runs roughly 600,000 lines and covers binaries with a median length of 18,000 RISC-V instructions. Anthropic says this is, to their knowledge, the first large-scale effort to apply formal verification to production software at the assembly code level, and that Claude also patched the bugs it found along the way. The honest caveats come from Anthropic directly: "formally verified" does not mean "bug-free," because a proof checker cannot tell you whether the specification matches reality. The proofs assume single-threaded static RISC-V binaries linked against musl libc, while most people run these libraries on x86 or ARM dynamically linked against glibc. Not every entry point was verified, and dead code is not covered. A subset of the proofs is published for anyone to verify and reuse.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.