- The paper introduces LRAT-Catcher, a tool that imports LRAT certificates into Lean4 as reusable theorems using reflection.
- The paper presents two workflows—kernel reflection for minimal trusted bases and native reflection for improved scalability and performance in cube-and-conquer proofs.
- The paper demonstrates significant memory and speed improvements over prior methods, validating its approach on pigeonhole principles, Schur, and Ramsey number proofs.
LRAT-Catcher: Efficient Import of SAT Solver Certificates into Lean 4 by Reflection
Problem Statement and Motivation
The paper addresses a central challenge in formalizing combinatorial results with SAT solvers within ITPs: bridging the "airgap" between external solver proofs—delivered as unsatisfiability (UNSAT) certificates in the LRAT format—and their representation as theorems inside a proof assistant such as Lean 4. Standard approaches either rely on explicit proof terms (as in Mathlib's lrat_proof command), which scale poorly due to memory overhead, or on externally-checked, trusted results that cannot be cited or composed within the logical framework of Lean. Integrating these certificates so that they become first-class, reusable theorems in Lean is necessary for modular formalization of large combinatorial theorems.
Architecture and Workflow of LRAT-Catcher
LRAT-Catcher is presented as a general, standalone tool for importing a DIMACS-formatted SAT instance and an LRAT certificate, reflecting the results into Lean 4 as a theorem. It leverages Lean’s formally verified LRAT checker (from Std.Tactic.BVDecide.LRAT) and provides two workflows:
- Kernel Reflection Workflow: Runs the verified checker entirely within the Lean kernel (using
decide), producing the smallest trusted base—only the kernel and three classical axioms—but limited to small instances for performance reasons.
- Native Reflection Workflow: Compiles the verified checker to native code for execution, significantly improving scaling but introducing dependency on the correctness of the Lean compiler (a single native axiom is added).
Both workflows are integrated in a single import command, with a user switch to select the trusted base/speed tradeoff.
In contrast to prior methods:
- Mathlib’s
lrat_proof is kernel-only, lacks support for general RAT steps, and embeds the formula in the proof term, leading to explosive memory growth.
- External checkers (e.g., cake) yield fast, scalable checking but cannot emit Lean theorems, leaving a gap in the theorem-proving chain.
LRAT-Catcher closes this gap, generalizing prior ad-hoc developments (e.g., the Keller conjecture proof-by-reflection) into a reusable, robust infrastructure for routine LRAT certificate import.
Handling Cube-and-Conquer and Theorem Composition
A major technical feature is LRAT-Catcher’s support for cube-and-conquer workflows, which are essential for scaling to large combinatorial instances. Here, a hard SAT problem is partitioned into many subproblems (cubes), each independently solved and refuted, with an additional cover-completeness check to ensure the cubes fully partition the space. LRAT-Catcher composes all per-cube refutations and the cover certificate entirely inside Lean, relying on a key composition theorem (if all leaves are unsat and cubes cover all assignments, then the base formula is unsat).
Crucially, the completeness of the cubing is itself justified by an LRAT certificate over a "negated-cubes" formula, so no step in the argument depends on unwarranted trust in a combinatorial argument combinator.
This enables high-confidence, machine-verifiable composition of massive SAT-based proofs such as Schur and Ramsey number upper bounds, where monolithic certificates are infeasible.
Empirical Evaluation
LRAT-Catcher is evaluated on a hierarchy of pigeonhole principles, and on formalizations of Schur and Ramsey numbers. Key findings are:
- Memory Usage: Mathlib’s explicit-term import (
lrat_proof) scales poorly due to proof-term size, reaching over 95GB and failing on large certificates. LRAT-Catcher’s native reflection, by contrast, completes the import for certificates up to 628MB with moderate memory (up to 8.9GB), consistently keeping the overhead approximately 14–35× the certificate size.
- Speed: Kernel-mode reflection is prohibitively slow on all but the smallest instances, while native reflection maintains practical wall-clock time even for large benchmarks. External checkers remain faster, but do not yield reusable Lean theorems.
- Scalability: LRAT-Catcher succeeds in importing as theorems the largest formally checked Schur number S(4)=44 and Ramsey number R(4,4)=18 ever stated in Lean. The Ramsey number in particular required a cube-and-conquer split into 1024 leaves, with the reflection-based composer handling the 49GB of total certificates end-to-end inside Lean.
- Trusted Base: In the monolithic workflow, only one additional native axiom is introduced; in the parallel split workflow, one per module. The result in both cases is a Lean theorem supported by a minimal and auditable trusted computing base.
These results provide rigorous evidence that reflection-based certificate import is the only approach that scales to combinatorial instances of contemporary research interest, while keeping the verification chain tight and reusable.
Implications and Future Directions
LRAT-Catcher substantially narrows the gap between the computational power of modern SAT solvers and the compositional reasoning capabilities of proof assistants like Lean. The ability to import arbitrary LRAT certificates as theorems, with robust handling of preprocessing (full RAT support), cube-and-conquer composition, and efficient scaling, lays the groundwork for formalizing a much broader class of combinatorial results.
The practical implication is that SAT-based combinatorial confirmations (e.g., in Ramsey theory, extremal constructions, or graph non-existence proofs) can be made into permanent, reusable elements of the formal corpus, rather than external artefacts. This advances the state of the art in computer-aided formal mathematics and enables end-to-end reproducible proofs for large proofs of traditional mathematical interest.
The compositional architecture also provides a blueprint for similar import pipelines in other domains. The PBLean tool, cited as a companion for pseudo-Boolean certificates, evidences a growing ecosystem for integrating solver certificates across logical frameworks and verifying combinatorial lower and upper bounds within Lean and other proof assistants.
A key open direction is extending this methodology to richer logical fragments (e.g., quantified Boolean formulas, constraint programming) and further optimizing native execution to handle even larger-scale verification tasks with minimal trusted code. Additionally, tighter integration with Lean’s emerging proof engineering workflows (e.g., Mathlib 4) would allow for seamless import and composition of solver certificates with human-written formal proofs.
Conclusion
LRAT-Catcher demonstrates that reflection-based import of LRAT certificates is a scalable, trustworthy, and compositional approach for turning SAT solver outputs into theorems within Lean 4. It establishes a minimal, configurable trusted base, efficiently handles cube-and-conquer compositions, and supports the full RAT rule. These advances make SAT-based combinatorial reasoning practical and reusable in large formal developments, closing longstanding gaps between solver evidence and formal theorem libraries.