Anthropic’s 180-Million-Line Formal Verification Milestone: Why Bend 2 Was Invented for Exactly This

Anthropic’s Frontier Red Team and Theorem proved 239 open-source fuzz targets using 180 million lines of Rocq, burning over 100 million tokens and 30+ minutes of CPU checking time per proof. Here is how Bend 2 was designed from day one to collapse that verification loop into 0.38 seconds.

Executive Summary: Bottom Line Up Front

On October 22, 2026, Anthropic’s Frontier Red Team (in collaboration with formal-methods lab Theorem) published “LLMs are making formal software verification feasible at a much larger scale”. Using Claude, they generated machine-checked mathematical proofs across 239 fuzz-test entry points in 123 open-source libraries (OpenSSL, zstd, cJSON, libexpat, mbedTLS, and libpcap) from Google’s OSS-Fuzz suite (Anthropic Formal Verification).

While proving that those compiled RISC-V binaries never crash on inputs under 64 MB, Claude uncovered deep-seated memory bugs that had survived years of production use and trillions of fuzzing runs. Those discoveries included a 20 MB counter-underflow out-of-bounds write and rediscovering CVE-2026-56132 in libexpat (OSS Verify Proofs).

Yet Anthropic’s technical disclosures also expose the four massive engineering bottlenecks of retrofitting legacy theorem provers (Rocq, Lean 4, Verus) onto legacy imperative languages (C, C++, RISC-V assembly):

1. 180 Million Lines of Proof Code (~600,000 Lines per Entry Point): Proving a median binary of 18,000 RISC-V instructions required roughly 600,000 lines of Rocq proof script (33x proof-to-code bloat) (Anthropic Formal Verification).
2. 30 Minutes to Hours of CPU Time per Proof Check: Anthropic’s appendix notes that running the proof checker on a single proof takes 30 minutes to several hours of CPU time. Each verified program also consumes over 100 million LLM tokens, even with 40 % model efficiency gains and 17 % workspace proof reuse (Anthropic Formal Verification).
3. Single-Threaded Execution Limits: Reasoning about shared-memory threads in C or RISC-V assembly is intractable. Consequently, Anthropic’s proofs had to assume single-threaded static binaries (Anthropic Formal Verification).
4. The Specification & Extraction Gap: Proving assembly instructions in Rocq separates the human-readable algorithm from the proof artifact. Most C programs also rely on a weak “does not crash” fuzz spec rather than algebraic correctness laws (Anthropic Formal Verification).

This exact four-part bottleneck is why HigherOrderCO invented Bend 2 (bendlang/bend). Rather than bolting an external proof assistant onto C or assembly, Bend 2 unifies executable code, human-locked laws (LAWS.bend), 0.38 s proofs (PROOF.bend), and 16-core CPU / GPU parallel execution (BendRT) in one file (bendlang/bend).

1. Point-by-Point: Anthropic’s Rocq/RISC-V Pipeline vs. Bend 2 (BendTT + BendRT)

Every architectural pain point documented in Anthropic’s formal verification report corresponds directly to a first-principles design decision in Bend 2:

2. Why Anthropic Needed 180 Million Lines of Rocq (and How Bend 2 Eliminates Tactic Bloat)

Why did proving 239 open-source entry points require 180 million lines of Rocq and over 100 million tokens per program (Anthropic Formal Verification)?

2.1 The Cost of Proving Imperative Pointer Mutation After Compilation

When a library is written in C (libexpat, cJSON, zstd), every loop mutates raw pointers, stack frames, and heap buffers. To verify that binary without trusting a source-level translator, Anthropic and Theorem lifted compiled RISC-V machine instructions into Rocq. Assembly-level buffer-safety proofs must track register transitions, memory aliasing invariants, and 64-bit pointer arithmetic across 600,000 lines of Rocq tactics.

2.2 Bend 2’s Alternative: Affine Algebraic Types + Computational Equality ({==})

Bend 2 was designed around a direct architectural question: how do we design a programming language so that formal proofs become trivial for both humans and LLMs?

In Bend 2’s affine dependent type theory (BendTT): 1. No Raw Pointers or Unaliased Mutation: Every value is an immutable algebraic term packed into a 64-bit word ([rfc(1) | tag(7) | aux(16) | loc(40)]) with affine ownership (used at most once by default) (bendlang/bend). Buffer overflows, use-after-free bugs, and null-pointer dereferences cannot be expressed in safe Bend 2. 2. No Separate Tactic Language: In Rocq or Lean 4, code is written in one syntax while proofs are written in a stateful tactic DSL (intros, destruct, omega, simp). In Bend 2, a proof is just an ordinary recursive function whose return type is an equality proposition (a == b) (Proof-Blocked AI study). 3. Evaluation Does the Heavy Lifting: Because every non-@unsafe Bend 2 function is guaranteed to terminate (via structural recursion checks), the type checker can simply run the function symbolically on each pattern-matched branch.

Anthropic notes that proving codec roundtripping (decode(encode(x)) == x) or idempotence (normalize(normalize(x)) == normalize(x)) provides a strong algebraic specification (Anthropic Formal Verification). Here is that complete specification, implementation, and machine-checked proof in one .bend file:

# 1. Executable Domain Code: Packet Frame Codec
type Frame is Data:
  Ping{seq: U32}
  DataBlock{seq: U32, checksum: U32}

type WirePacket is Data:
  Wire{tag: U32, a: U32, b: U32}

def encode(f: Frame) -> WirePacket:
  match f:
    case Ping{seq}:
      Wire{0, seq, 0}
    case DataBlock{seq, checksum}:
      Wire{1, seq, checksum}

def decode(w: WirePacket) -> Frame:
  match w:
    case Wire{tag, a, b}:
      match tag:
        case 0:
          Ping{a}
        case _:
          DataBlock{a, b}

# 2. Human-Locked Specification (LAWS.bend)
def Law_Roundtrip(f: Frame) -> Type:
  all f: Frame, decode(encode(f)) == f

# 3. Machine-Checked Structural Proof (PROOF.bend)
# Checked in < 5 ms with zero tactic scripts:
def proof_roundtrip(f: Frame) -> decode(encode(f)) == f:
  match f:
    case Ping{seq}:
      {==}
    case DataBlock{seq, checksum}:
      {==}

Look closely at proof_roundtrip: - There are zero lines of RISC-V assembly lifting, zero separation-logic heap predicates, and zero tactic search heuristics. - Once match f splits Frame into Ping{seq} and DataBlock{seq, checksum}, the Bend 2 kernel normalizes decode(encode(Ping{seq})) directly to Ping{seq} by beta-reduction and discharges Ping{seq} == Ping{seq} with {==} (reflexivity) in microseconds (bendlang/bend).

3. Solving the “30 Minutes to Hours” Feedback Bottleneck for AI Coding Agents

The single most important number in Anthropic’s formal verification article is buried in the appendix on proof-checking compute:

“Running the proof checker to see if it passes the spec on one proof can take from 30 minutes to several hours of CPU time.” (Anthropic Formal Verification)

When an AI coding agent has to wait 30 minutes to several hours (or even 19.2 seconds in Lean 4 or 6.0 seconds in Rocq) to learn whether a single proof step succeeded, two bad things happen: 1. Token Budgets Explode: The agent cannot iterate interactively; it must generate massive speculative proof scripts or spawn parallel search trees, burning over 100 million tokens per verified component (Anthropic Formal Verification). 2. Formal Verification Remains Offline: No developer or CI pre-commit hook can block for 45 minutes on every code edit.

flowchart LR
    subgraph Legacy ["Anthropic / Theorem Legacy C-to-Rocq Pipeline"]
        A1["C / C++ Source<br/>(OSS-Fuzz Target)"] --> A2["Compile to Static<br/>Single-Thread RISC-V"]
        A2 --> A3["Claude Generates<br/>~600,000 Lines of Rocq"]
        A3 --> A4["Rocq Kernel Check<br/>(30 min to Hours CPU Time)"]
    end

    subgraph Bend2 ["Bend 2 Native Proof-Blocked AI Pipeline"]
        B1["Human Pins Spec<br/>(LAWS.bend)"] --> B2["AI Writes Code & Proof<br/>(main.bend + PROOF.bend)"]
        B2 --> B3["bend PROOF.bend<br/>(0.38 s Verification Loop)"]
        B3 --> B4["bend -o main<br/>(16c CPU / Metal / CUDA / JS)"]
    end

Bend 2 was specifically engineered to serve as a real-time inner-loop oracle for AI coding agents (Proof-Blocked AI field guide): - On our 3,200 generic instantiation stress test on Apple M4 Max, bend PROOF.bend completes in 0.38 seconds, beating Rocq (6.0 s) by 15.8x and Lean 4 (19.2 s) by 50.5x (Kevin Ngo benchmark). - On individual package proofs across the 100 verified packages in bend2-packages (double-entry-ledger, merkle-tree, oauth2-fsm, raft-consensus), bend PROOF.bend returns "All terms check." in 3.11 ms to 4.95 ms (DevSecOps policy benchmark). - At 4 ms per check, an AI agent can run bend PROOF.bend after every single tool call, converging on a valid implementation and proof in seconds rather than burning 100 million tokens across hours of CPU time.

4. Breaking the Single-Threaded Barrier: Verified Parallel CPU & GPU Execution

In their limitations section, Anthropic and Theorem emphasize that their RISC-V proofs apply only to single-threaded, statically linked binaries (Anthropic Formal Verification). Why? Because in C, C++, or RISC-V assembly, adding a second thread introduces weak memory models, lock ordering hazards, and data races that multiply proof complexity exponentially.

Bend 2 eliminates this trade-off through Church-Rosser confluence (mechanically proved in 20,981 lines of Lean 4 inside bend2/bendtt.lean):

• Prove Sequential Semantics, Execute in Parallel: In Bend 2, a b = f(x) g(y) preserves identical semantics on 1 CPU core (SEQ-CPU), 16 CPU cores (PAR-CPU), or 16,384 GPU Task Cube rings (PAR-GPU) (benchmark dataset).
• C-Level Single-Core Speed + Up to 123.9x GPU Speedup: You never have to choose between formal verification and hardware performance. Across 16 Apple M4 Max benchmarks, verified .bend programs hit 0.063 s on Conway’s Game of Life (123.9x GPU speedup), 0.059 s on N-Body (97.6x), and 0.071 s on Merkle Trees (59.5x). Twelve of those 16 workloads also run in just 2.0 MB to 2.8 MB RSS (benchmark dataset).

5. Differential Conformance Oracles: Anthropic’s Python-in-Rust Case Study vs. Bend 2 SMOKE.bend

Beyond the 239 OSS-Fuzz C libraries, Anthropic’s formal verification post highlights a second major pattern. Claude built a Python interpreter in safe Rust (verified with Verus and Z3) and checked behavioral equivalence against CPython across 1.7 million random programs, achieving 99.95 % consistency.

As we detailed in Bend 2 vs. Lean 4 and our Bend 2 Strengths & Weaknesses Decision Guide, Bend 2 is a turnkey engine for this exact differential conformance architecture:

1. Author the Normative Specification in Bend 2 (LAWS.bend + PROOF.bend): Prove that your reference state machine, parser, or settlement engine satisfies conservation, roundtrip, and safety laws in 0.38 s without Z3 SMT timeouts.
2. Compile the Reference Model to Both Native C and JavaScript (bend -o):
   • bend SMOKE.bend -o oracle emits a multi-core native binary (+RTS --threads 16) capable of sweeping millions of state transitions per second.
   • bend SMOKE.bend -o oracle.js emits a zero-dependency JavaScript module that runs in-process inside bun test, Node.js, or Vitest.
3. Verify Production Rust, TypeScript, C, or Python Against the Proved Bend 2 Oracle: Feed every state transition or fuzz input through both your production service and the proved Bend 2 oracle (compare.bend). This catches semantic drift and edge-case bugs (like the libexpat counter underflow) before code ever merges.

6. Summary: When to Use Anthropic’s OSS Verify (Rocq/RISC-V) vs. Bend 2

Both approaches represent a watershed moment in software engineering: AI coding agents paired with uncompromising proof kernels make formal verification practical for everyday engineering teams (The Practical Value of Machine-Checked Proofs). Choose the right tool for your layer of the stack:

• Use Theorem & Anthropic’s Binary Verification (OSS Verify / Rocq over RISC-V) when you maintain an existing legacy C or C++ library (OpenSSL, libexpat, zstd) that cannot be rewritten. It provides an offline batch proof that compiled fuzz entry points cannot crash on inputs under 64 MB (theorem-labs/oss-verify).
• Use Bend 2 (LAWS.bend + PROOF.bend + BendRT) when you are designing new algorithms, state machines, parsers, policy engines, simulations, or differential test oracles alongside AI coding agents. Bend 2 delivers human-locked specifications (LAWS.bend), 0.38 s inner-loop proof checking, zero tactic scripts, and automatic 16-core CPU / GPU parallel execution (bendlang/bend).

Further Reading & Primary Sources

• Anthropic Frontier Red Team & Theorem: LLMs are making formal software verification feasible at a much larger scale (Oct 22, 2026) and theorem-labs/oss-verify-proofs
• Verification Series on gerryburde.com:
  • Part 1: The Practical Value of Machine-Checked Proofs
  • Part 2: Navier-Stokes Blowup: What Machine-Checked Discovery Unlocks for Engineering
  • Part 3: Bend 2 and Proof-Blocked AI: What a Law File Actually Buys
• Bend 2 Architecture & Comparisons on bend2.org:
  • Bend 2 vs. Lean 4, Rocq & Agda: Executable Test Engine & Proof Speed Compared
  • Bend 2 Strengths, Weaknesses & Complete Decision Matrix
  • Bend 2 vs. Rust and Bend 2 vs. C