L
Leonardo de Moura
leodemoura.github.io · Personal blog · on HN since 2015
Leonardo de Moura, creator of the Lean theorem prover, writes about Lean, formal verification, and verifying AI-written software.
What HN saysHN links it for the postmortem of a Lean kernel soundness bug and for posts on autoformalization and verification in the age of AI.
18HN people shared it
6linked it in comments
12stories submitted
25story points
3 months agolast shared
2015people per year2026
Most-shared posts
- 1Postmortem for Kernel Soundness Bug #145764 people · 9 points · first shared 2026 · 1 comments on HN
- 2Why Lean?2 people · 4 points · first shared 2026 · discussion on HN
- 3Signal Shot: verify the Signal protocol and its Rust implementation using Lean2 people · 3 points · first shared 2026 · discussion on HN
- 4When AI Writes the Software, Who Verifies It?2 people · 2 points · first shared 2026 · discussion on HN
- 5When AI Writes the Software, Who Verifies It?2 people · 2 points · first shared 2026 · discussion on HN
- 6About2 people · first shared 2015
- 7The Lean Programming Language and Theorem Prover1 people · 2 points · first shared 2026 · discussion on HN
- 8Who Watches the Provers?1 people · 1 points · first shared 2026 · discussion on HN
- 9The Lean Theorem Prover: Design, Evolution, and Impact1 people · 1 points · first shared 2026 · discussion on HN
- 10Proof Assistants in the Age of AI1 people · 1 points · first shared 2026 · discussion on HN
What HN people wrote when they linked it
Jblx2 · 2026-08-19
Yes, you still need to be careful, especially if you have reason to think that the proof was from a malicious actor.
https://leodemoura.github.io/blog/2026-8-1-postmortem-for-kernel-sound…
(N.B. from August 2026)
ameliaquining · 2026-08-13
LLMs are not at the point where they can reliably complete this kind of task without making mistakes. The model checker can tell you whether the formal design specification contradicts itself, but it can't tell you whether it matches the implementation, nor whether it matches the programmers' intentions. And it's too much for humans to review by hand.
This is importantly different from formal code verification, in which the specification that needs to match the programmers' intentions is small enough to review, while the bulk of the LLM's output is proof tactics and such, which don't need human review because the verifier guarantees* that they're right.
I suppose you could just tell Fable "hey try using TLA+ to look for bugs in this code" and see whether it finds any.
* Uh, usually. https://leodemoura.github.io/blog/2026-8-1-postmortem-for-kernel-sound…
red_trumpet · 2026-08-05
Here is the postmortem of the lean bug: https://leodemoura.github.io/blog/2026-8-1-postmortem-for-kernel-sound…
gwern · 2026-03-04
> I encourage everyone to RTFA and not just respond to the headline.
This is an example of an article which 'buries the lede'†.
It should have started with the announcement of the new zlib autoformalization (!) https://leodemoura.github.io/blog/2026/02/28/when-ai-writes-the-worlds… to get you excited.
Then it should have talked about the rest - instead of starting with rather graceless and ugly LLM-written generic prose about AI topics that to many readers is already tiresomely familiar and doubtless was tldr for even the readers who aren't repelled automatically by that.
† or in my terms, fails to 'make you care': https://gwern.net/blog/2026/make-me-care
zero_k · 2024-10-11
Correction, Lean4 [1] is sponsored by Amazon, the lead developer, Leonardo de Moura is at AWS now [2]. He was previously at Microsoft Research [3]. Meeting him is a real ride, I only had the chance to talk with him once.
[1] https://lean-lang.org/
[2] https://leodemoura.github.io/about.html
[3] https://www.microsoft.com/en-us/research/blog/the-inner-magic-behind-t…
fspeech · 2015-04-23
Leonardo de Moura is also the architect of Z3 prover: https://leodemoura.github.io/about.html
What a productive guy!