A Stanford researcher's groundbreaking work using AI to slash the time and cost of verifying software is revitalizing the niche field of formal verification, with startups racing to make code more reliable and secure than ever before.
Chuyue Sun, a Stanford computer scientist, demonstrated AI's power by having it complete an engineering project in less than half a day for under $500. This pales in comparison to the five months it took three human experts to do the same task manually. This dramatic efficiency boost, detailed in Sun's recent paper, is putting a spotlight on formal verification, a complex area of coding and mathematics aimed at proving software is bug-free.
For years, developers have dreamed of using math to guarantee flawless software. This involves meticulously writing down software goals and translating code into verifiable formulas. While rigorous testing is standard practice, formal verification, which can catch even obscure bugs, has been too time-consuming and costly for widespread adoption. Now, a surge of startups, including &Truth, which Sun recently joined, are betting that generative AI can finally make formal verification both practical and essential.
&Truth, backed by $70 million in funding, aims to verify any programming language. Meanwhile, competitor Harmonic, co-founded by Robinhood CEO Vlad Tenev and boasting $295 million in funding, has launched an AI agent called Aristotle capable of verifying C code and Verilog hardware designs. Nvidia and Tensordyne are among the potential users evaluating Harmonic's technology.
The overarching goal is a future with more dependable software and fewer security nightmares. However, the big question remains whether AI can push formal verification beyond critical systems at organizations like NASA and Apple into mainstream use. While demand is high, the exact cost customers are willing to pay and their preferred adoption models are still unclear. Some experts are skeptical about its ability to detect bugs arising from user errors or hardware failures.
Will Wilson, head of the AI bug-hunting startup Antithesis, even calls formal verification "a trap," having spent millions on the process himself. Despite the challenges, he notes that his company still found additional errors using its own tools, even in software that had undergone formal verification. Vitalik Buterin, creator of Ethereum, echoed this sentiment, stating formal verification is "not a panacea." Yet, proponents like Buterin believe it will be crucial in defending against AI-powered cyberattacks.
Despite the hurdles, companies like Apple and Amazon already use formally verified software in critical areas like encryption and cloud security. Apple's security team noted that formal verification uncovered issues in its core encryption library that other methods missed, though they must be cautious to maintain development speed. Startups are also exploring ways to make this technology more accessible, with some hoping to automate the complex process of defining program behavior, ultimately aiming to make AI safer and more secure.
