The Paradox of Correctness Feedback in Formal Verification
As software engineering teams increasingly integrate large language models into formal verification pipelines, maintaining rigorous mathematical guarantees requires more than just ensuring a program compiles successfully. Formal verification checks whether an implementation satisfies a written specification, but a program can pass all verification checks while still violating intended behavior if the written contract is incomplete or too weak. Completeness auditing aims to uncover these missing specification obligations by searching for adversarial witnesses—programs that satisfy the written contract but violate intended behavior.
However, a formal verification research paper titled "When Correctness Feedback Erases Evidence: Phase-Separated Completeness Auditing in Verus" identifies a critical paradox: providing correctness feedback during this discovery phase causes an objective reversal. Correctness feedback pushes the LLM toward fixing the implementation to match the intended solution before the admitted failure or witness can be captured and certified. As a result, the feedback suppresses the very evidence needed to prove the contract was incomplete in the first place.
Experimental Discovery Gaps and Phase-Separated Workflows
Across a benchmark evaluation of twelve Verus and Rust tasks across four model families, the study compared standard corrective feedback loops against independent, no-feedback discovery searches. The corrective feedback approach yielded a certified-witness discovery rate of only 27.1 per cent. In contrast, the no-feedback discovery method yielded a certified-witness discovery rate of 59.0 per cent—more than double the feedback loop's performance under identical call budgets.
To resolve the conflict between discovering failures and repairing code, the study introduces a Phase-Separated Completeness Auditing framework. The workflow separates the process into two distinct stages. In the first phase, adversarial discovery searches for witnesses without providing correctness feedback, freezing and certifying the discovered failure. In the second phase, correctness feedback is introduced to repair the written specification and implementation only after the witness has been preserved.
Downstream Impacts on Contract Repair Quality
Preserving witnesses through phase separation led to significantly stronger contract repairs in downstream evaluations. Contracts repaired using phase-preserved witnesses achieved an 81.3 per cent implementation success rate, compared to just 62.5 per cent for contracts repaired via feedback-suppressed loops.
While this evidence-erasure effect was consistently observed across all evaluated LLM families within the Verus and Rust ecosystem, the study notes it did not reproduce in available evaluations for other verifiers such as Dafny and Lean, establishing a specific empirical boundary around Verus and Rust workflow interactions. The findings establish a guiding rule for LLM-assisted formal verification: preserve and certify the admitted failure before starting correctness-oriented repairs.
For further analysis on software verification and model reasoning architectures, explore our coverage on Google Launches Gemini 4 Argon for Deep Engineering & Workflows and view our dedicated reporting under Tools & Applications.
