A Deductive Verifier for Probabilistic Programs

Project Information

VERIPROB

Grant agreement ID: 101158076

DOI

10.3030/101158076

Project closed

EC signature date 6 February 2024

Start date 1 November 2024

End date 30 April 2026

Funded under

• European Research Council (ERC)

Total cost

No data

EU contribution

€ 150 000,00

Coordinated by

RHEINISCH-WESTFAELISCHE TECHNISCHE HOCHSCHULE AACHEN
Germany

Periodic Reporting for period 1 - VERIPROB (A Deductive Verifier for Probabilistic Programs)

Reporting period: 2024-11-01 to 2026-04-30

Summary of the context and overall objectives of the project

Program verification aims to establish that software satisfies its specification. For probabilistic programs, this requires quantitative
reasoning about probabilities, expected values, expected runtimes, termination probabilities, and distributional guarantees.
Classical Boolean verification techniques are therefore insufficient.

VERIPROB built on the ERC AdG FRAPPANT project and the Caesar research prototype. Caesar is a deductive verifier for probabilistic programs base on the quantitative intermediate verification language and a quantitative logic. The project objective was to mature Caesar from a foundational prototype into an experimental proof of concept suitable for future uptake, moving from TRL1 to TRL3.

The project focused on five tasks:
• Task 1: strengthening Caesar’s core features, including diagnostics, slicing, quantifier handling, and invariant synthesis;
• Task 2: developing support for Stan as a practical probabilistic programming language;
• Task 3: investigating interoperability with existing verification and model-checking ecosystems, especially JANI/Storm and selected Boolean-verifier backends;
• Task 4: developing professional documentation and user interfaces;
• Task 5: carrying out market analysis and business-planning work.

The expected impact was to bridge the gap between probabilistic verification theory and usable tooling. Potential users include researchers and developers working on randomized algorithms, distributed protocols, probabilistic programming, security/privacy mechanisms, robotics, and probabilistic risk analysis. The completed market analysis identifies distributed systems and digital infrastructure as the initial beachhead market.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

The work followed the five-task structure of the VERIPROB Proof-of-Concept proposal. The main work performed and achievements are as follows:

Task 1: Caesar’s core verification infrastructure was strengthened. The main achievement was Brutus, a slicing-based diagnostic component that localises failed quantitative verification attempts and simplifies successful proof artefacts. Caesar also improved soundness-aware proof/refutation feedback, quantifier handling including limited functions, and proof-rule guardrails. Invariant synthesis advanced as project-period prototype/thesis work, and project members used Caesar’s documentation with AI-assisted workflows to draft invariants and debug verification tasks. These changes improved the path from examples and course material to reusable verification tasks.

Task 2: the project clarified translation and theory-library requirements for connecting Caesar/HeyVL to Stan and related probabilistic-programming languages. A prototypical translation of Stan into HeyVL has been developed, and initial progress has been made to prove the correctness of this translation using the Lean theorem prover. The full integration of this translation into Caesar is left for future work.

Task 3: Caesar has been extended with two new interoperability backends. The JANI/Storm backend translates executable finite-state HeyVL programs to JANI and can run Storm for operational model checking, expected-value computation, and cross-checking against deductive proof obligations. A Dafny backend covers the applicable non-probabilistic / Boolean HeyVL fragment and has been used to validate non-probabilistic Caesar benchmarks. This gives users complementary deductive and model-checking analysis routes. Separately, background exchange with verifier communities, including ETH Zurich (the developers of the Viper verifier), informed Caesar’s engineering around solver-backed deductive verification, solver debugging, uninterpreted functions, and quantifier-handling techniques.

Task 4: Caesar now has adoption-oriented public documentation, CLI/debugging/model-checking material, developer guidance, and Visual Studio Code/LSP support with diagnostics, verification commands, editor indicators, inline verification-condition explanations, automatic installation/updating, and slicing results. Caesar was used in two training settings: RWTH Aachen University’s Probabilistic Programming (WS 2025/26) course (an elective course for master students) with 60 students, and the SRI Summer School for Formal Techniques at Menlo Park (CA), where Caesar/HeyVL material was used in two labs with approximately 60 (primarily PhD) students.

Task 5: an external market and competitive analysis by aixsolution e.V. was completed. The 46-page document confirmed Caesar’s unique position, recommended distributed systems and digital infrastructure as the beachhead market, and positioned Caesar as a probabilistic verification layer complementing existing model checkers and proof assistants.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

VERIPROB’s main result beyond the state of the art is a quantitative intermediate verification infrastructure for probabilistic programs. Classical deductive verifiers such as Dafny (developed by Amazon Web Services), Boogie, and Viper target Boolean correctness of classical programs. Caesar extends the intermediate-verification-language paradigm to quantitative reasoning about probabilities, expected values, expected runtimes, termination probabilities, tail bounds, and lower/upper-bound proof rules.

A second result is slicing-based diagnostics for quantitative verification. Brutus (a new component in Caesar) maps failed or successful verification attempts to smaller diagnostic slices for error localisation, proof simplification, and verification preservation. Together with soundness-aware proof and refutation reporting, this helps users distinguish genuine refutations from failed or inconclusive proof attempts under one-sided quantitative proof rules. This offers a smoothened verification for Caesar users.

A third result is broadened expressivity and further integration with existing tools. Caesar-related work now covers continuous probabilistic programs,
slicing diagnostics, many quantitative objectives via reward transformations, almost-sure termination of randomised distributed algorithms, and model-checking interoperability through JANI/Storm. The Dafny backend supports comparison with a classical Boolean verifier, while Stan frontend and weighted-programming connections remain follow-up/prototype directions. These integrations make Caesar a common layer for cross-checking and future extensions, not only a standalone verifier.

A fourth result is commercial validation. The market analysis concludes that "Caesar occupies a genuinely novel position: no other surveyed tool combines a verification-aware programming language, semi-automated deductive verification, and native probabilistic reasoning in one coherent framework". It estimates a multi-million-euro European opportunity and recommends distributed systems and digital infrastructure as the beachhead market.

The result overview is therefore: quantitative IVL, diagnostics, trustworthiness, interoperability, and a commercial route. Further uptake will require more practical benchmarks, polished language integrations, continued invariant-synthesis work, and industrial pilot cases.