VIASM Mini-Course · Hanoi 2026 · Lecture 6

Auto-formalization of mathematics with Lean

Where AI meets the kernel — a human sets the target, AI assists the search, and the kernel is the sole referee.

dr Bartosz Naskręcki · Adam Mickiewicz University in Poznań · CCAI, Warsaw Univ. of Technology

▷ live lab: /lab-lambda

Why this matters

In about two years, machines went from solving essentially nothing at the IMO to olympiad gold.

• Curry–Howard, live in 2026: proofs are objects a machine can check.
• A proof assistant gives an absolute soundness guarantee relative to a tiny kernel.
• A chatbot's natural-language "proof" gives none.

Between those poles sits autoformalization — and that is exactly where a green checkmark can still certify the wrong theorem.

Two problems, one kernel

The engine of the field: proofs are hard to find but easy to check — the model proposes, the kernel disposes.

The faithfulness gap: a compiling lie

The kernel certifies $\text{proof} \vdash \text{statement}$, never $\text{statement} \models \text{intent}$.

-- claim: "every prime > 2 is odd"
-- faithful:  ∀ p : ℕ, p.Prime → 2 < p → Odd p
-- but this also type-checks and is trivially provable:
theorem primes_are_odd (p : ℕ) (hp : p.Prime) (h : p = 4) : Odd p := by
  subst h; exact absurd hp (by decide)

p = 4 with p.Prime is never satisfiable — vacuously true. A statement can be vacuous, over- or under-constrained, and still type-check.

The neural–symbolic loop

Model proposes a tactic $\to$ assistant returns the new goal or an error $\to$ search chooses what to try next.

de Bruijn criterion: only the small kernel re-checks the final proof term. The model and search harness are untrusted — no hallucinated proof survives.

• Premise selection — retrieve a few of $283{,}067$ Mathlib lemmas (ReProver / LeanDojo).
• Subgoal decomposition — blueprints & dependency graphs (DeepSeek-Prover-V2, Massot's Blueprint).
• Expert iteration / RL-from-verifier — the compiler's accept/reject is the reward.
• Self-correction — feed the Lean error back (Goedel-V2: $88.1\% \to 90.4\%$).

prove p -> (p -> q) -> q

The loop in miniature: hint is the model's "propose", each tactic reshapes the goal, and qed is the kernel's "dispose" — it extracts the λ-term and re-checks its principal type.

The 2024–2026 landscape, by the numbers

AlphaProof solved P6 — a problem only $5$ of $609$ humans cracked; AlphaGeometry 2 dispatched P4 in $19$ seconds. Substrate: Mathlib ($>2$M lines, Lean $4.32.0$).

Read the number with its benchmark

• miniF2F — $488$ olympiad/high-school statements — essentially saturated ($\sim 90\%$).
• PutnamBench — $672$ Lean problems — single digits (early 2025) $\to \sim 99\%$ in 18 months.
• FrontierMath — original, research-level, Fields-medalist-designed — below $2\%$ at launch, still far from saturated.

IMO 2025 paradigm split: Gemini Deep Think & an OpenAI model reached gold ($35/42$) in natural language, human-graded. Seed-Prover proved $5/6$ formally in Lean. Only one is checkable.

"AI can do mathematics" is a category error unless you say which benchmark, which $k$, which tier — and date it.

Human + AI + kernel: a working research mode

Lean + Mathlib is a shared substrate — acceptance is decided by a program, not a referee's taste.

Case study — EML: the mathematics

One binary operator with the sole constant $1$:

$$ \mathrm{eml}(x,y) \;:=\; \exp(x) - \log(y). $$

$\{\mathrm{eml},1\}$ generates the entire calculator repertoire through a three-production grammar:

$$ T \;::=\; 1 \;\mid\; x_n \;\mid\; \mathrm{eml}(T,T). $$

The analytic analogue of the Sheffer stroke (NAND): a single functionally complete primitive. Formalization: arXiv:2603.21852, Lean 4 + Mathlib $4.28$.

Two witnesses by hand

The simplest constant. $\mathrm{eml}(1,1) = \exp 1 - \log 1 = e - 0 = e$ — a tree of size $K=3$. The EML analogue of $\lnot p = \mathrm{NAND}(p,p)$.

Recovering log from a subtraction (for $z>0$):

$$ \log z \;=\; \mathrm{eml}\bigl(1,\ \mathrm{eml}(\mathrm{eml}(1,z),\,1)\bigr), \qquad K=7. $$

The domain constraint $z>0$ is forced by the innermost $\log z$; outside it the term has no value. Trig follows via Euler: cosTermℂ $= \exp(ix)$, so $\Re = \cos x$ ($K=1273$).

Engineering: partial evaluation

Mathlib functions are total (Real.log 0 = 0). Instead of fighting junk values, denote into Option:

noncomputable def EMLTerm.eval? (env : Nat → ℝ) : EMLTerm → Option ℝ
  | .one     => some 1
  | .var n   => some (env n)
  | .eml a b =>
      match EMLTerm.eval? env a, EMLTerm.eval? env b with
      | some va, some vb =>
          if 0 < vb then some (Real.exp va - Real.log vb) else none
      | _, _ => none

A claim is stated only where the witness genuinely has a value — exactly as the paper does.

The division of labour

Build reality: $36/36$ primitives sealed, $100$ public theorems, $8062$ lake jobs, sorry-free, no project axioms.

Run it yourself

Feel the "propose" step via functional completeness — rebuild $\lnot,\land,\lor$ from NAND. Open the Lambda Lab and type:

reduce NAND TRUE FALSE

Then reproduce the EML "hello world" in a Lean web editor:

-- e = eml(1,1):  exp 1 − log 1 = e − 0 = e
theorem e_witness : ∃ t : EMLTerm, ∀ env, EMLTerm.eval? env t = some (Real.exp 1) := by
  refine ⟨.eml .one .one, fun env => ?_⟩
  simp [EMLTerm.eval?, Real.log_one]

Live demo: the EML Tree Builder at nasqret.github.io/eml-formalization

What "sealed" actually guarantees

• #print axioms — EML shows only Classical.choice, propext, Quot.sound. "Sorry-free" is not "assumption-free".
• Seal vs conditional — corollaries gated on EDLTranscendenceBarrier (no instance) are sound but possibly vacuous. Ask if the hypotheses are ever satisfiable.
• Witness vs completeness — $\exists\,t,\ t.\mathtt{eval?}=v$ proves representability, not completeness, uniqueness or minimality.

Every EML seal has one shape: one literal tree + a kernel-checked equality, under the standard axioms — no more, no less.

The human's job moves upstream: are these the right statements? Is the result interesting? The kernel never decides that.

Recap & references

• Statement (faithfulness) $\ne$ proof (search) autoformalization.
• The kernel certifies proof-against-statement, never statement-against-intent.
• Benchmarks calibrate: miniF2F saturated, FrontierMath far from it — always say which $k$, which tier.
• EML: every elementary function from $\mathrm{eml}(x,y)=\exp x - \log y$, sealed across $8062$ jobs.

Odrzywołek, arXiv:2603.21852 · AlphaProof, Nature (Nov 2025) · DeepSeek-Prover-V2 · Goedel-Prover-V2 · LeanDojo · miniF2F · PutnamBench · FrontierMath · Tao, Equational Theories Project · EML repo: github.com/nasqret/eml-formalization · course book at /vietnam2026/book