3 ms·

"Lean-verified" is not some magical incantation that makes a supposed proof irrefutable. Even disregarding potential bugs in the kernel as others have said. Sa

"Lean-verified" is not some magical incantation that makes a supposed proof irrefutable. Even disregarding potential bugs in the kernel as others have said. Say that AI gives you a Lean proof and says it proves Theorem X. It could just as easily give you the same proof but claim that it proves (not X). How would you know the difference? Nothing can really be considered proven unless a human expert can read the Lean proof and determine that (X as defined in the Lean proof) corresponds to X. The proof (at least the statement of the theorem) must be intelligible to humans to have value. It's possible people will just start taking AI at its word. Maybe AI says "Here is a Lean proof of X" and we all just shrug and go "Okay, X is proven." But that's not how it works right now for human mathematicians. Why would we apply that standard for AI?

tmhn2 22d ago
I'm not totally sure what you mean. You can validate the proof using lean, which is what it's for--the whole magic of it is you don't have to just trust what AI says. That said, to your larger point, there are loopholes, and we'd certainly better be able to read the statement in lean, etc.
- evenhash 21d ago
  What I’m saying is that you can’t just trust what the AI says because it produces a Lean artifact. The statement of the theorem has to be correctly translated from English into Lean code. It’s like translating user requirements into code. The code could run without bugs but not do what the users want. The only way to know the AI did it correctly is to check. You can’t just take it at face value.
  - tmhn2 20d ago
    Yes, everyone is aware that the statement needs to be checked. No one has suggested otherwise. It goes without saying. The "magic" of lean is that (in principle, assuming lean is sound and the proof is verified) that is all you have to check by hand. That is a big deal.
- zahlman 20d ago
  Just because a proof is valid doesn't mean it proves the thing you want it to prove.
  - tmhn2 20d ago
    Of course you must check the statement, that is obvious. The advantage (to put it mildly) is that you don't have to check the entire proof by hand.
aureianimus 22d ago
The thing is that there is a standard format where the definition of the theorem is split from the proof, and verifying that the definition matches the mathematical concept is a LOT less work then reading the proof, especially if you're willing to assume that definitions in Mathlib are correct.

tmhn2 22d ago

I'm not totally sure what you mean. You can validate the proof using lean, which is what it's for--the whole magic of it is you don't have to just trust what AI says. That said, to your larger point, there are loopholes, and we'd certainly better be able to read the statement in lean, etc.

evenhash 21d ago
What I’m saying is that you can’t just trust what the AI says because it produces a Lean artifact. The statement of the theorem has to be correctly translated from English into Lean code. It’s like translating user requirements into code. The code could run without bugs but not do what the users want. The only way to know the AI did it correctly is to check. You can’t just take it at face value.
- tmhn2 20d ago
  Yes, everyone is aware that the statement needs to be checked. No one has suggested otherwise. It goes without saying. The "magic" of lean is that (in principle, assuming lean is sound and the proof is verified) that is all you have to check by hand. That is a big deal.
zahlman 20d ago
Just because a proof is valid doesn't mean it proves the thing you want it to prove.
- tmhn2 20d ago
  Of course you must check the statement, that is obvious. The advantage (to put it mildly) is that you don't have to check the entire proof by hand.

aureianimus 22d ago

The thing is that there is a standard format where the definition of the theorem is split from the proof, and verifying that the definition matches the mathematical concept is a LOT less work then reading the proof, especially if you're willing to assume that definitions in Mathlib are correct.