Verifying Probabilistic Programs in Rust

Abstract: Recent work has developed many techniques for formally verifying probabilistic programs. However, existing verification frameworks for probabilistic programs are restricted to idealized languages designed for verification. As a result, they cannot be used to verify off-the-shelf probabilistic programs written in standard languages. In contrast, for non-probabilistic programs, a number of verification tools now support verifying realistic code written in widely used languages such as Go, C, and Rust. To verify probabilistic programs written in these languages, it would be useful to be able to reuse, as much as possible, the extensive development work that has gone into such tools. This paper presents Alerus, a framework for verifying probabilistic Rust programs. Alerus is based on Verus, a verification tool for Rust that supports SMT-based automation and separation-logic-inspired reasoning features. Alerus extends Verus with support for probabilistic reasoning while retaining these expressive features. To do so, Alerus uses a lightweight encoding of probabilistic error credits, a form of ghost state for randomized reasoning introduced in the Eris program logic. By deriving an appropriate specification using error credits, Alerus supports verifying the correctness of randomized sampling algorithms. We use this technique to verify several sampling routines for discrete distributions, including samplers for the discrete Gaussian distributions, the alias method, and the fast loaded dice roller. We establish the soundness of our error credit extension by adapting VerusBelt, a recently developed logical relations model of Verus that encodes its features in terms of the Iris separation logic. To do so, we replace the use of Iris's standard weakest precondition in this model with Eris's probabilistic weakest precondition instead. The resulting soundness proof is fully mechanized in Rocq.

• The paper presents Alerus, a novel framework that integrates probabilistic reasoning into Rust through error credits and affine ghost state.
• It employs a lightweight axiomatized extension of Verus to enable formal verification of randomized algorithms and almost-sure termination.
• Verification examples include discrete Laplace/Gaussian samplers, the alias method, and fast dice rollers, demonstrating practical and modular proof techniques.

Authoritative Summary of "Verifying Probabilistic Programs in Rust" (2607.12282)

Motivation and Context

Formal verification of probabilistic programs has historically been limited to idealized or domain-specific languages, restricting real-world applicability. Meanwhile, verification tools for mainstream languages like Rust have advanced considerably, enabling the specification and checking of complex ownership and memory safety properties. Efforts to import probabilistic verification to such languages have been fundamentally challenged by the divergences in assertion representation, semantic models, and ghost state management. This paper introduces a novel framework, Alerus (informally referred to as \thetool), which builds on the Verus semi-automated Rust verifier to support probabilistic reasoning through an extension based on probabilistic error credits from the Eris logic.

Technical Approach

Integration with Rust and Verus

Alerus leverages the tracked ghost state mechanism of Verus: error credits are encoded as affine ghost resources, analogous to separation logic permissions. The credit algebra is implemented via Verus’s ResourceAlgebra and PCM traits, using real-valued carriers to match Eris's assertion semantics. The embedding is lightweight, requiring only two axiomatized extensions—one for expectation-preservation with random sampling, and one for "thin air" credit generation. These enable reasoning about failure probabilities and correctness of randomized algorithms with minimal trust extension.

Error Credits and Probabilistic Reasoning

Error credits, denoted $\upto{\err}$, formalize logical permissions to execute probabilistic actions with failure probability at most $\err$. Verus’s affine ghost state ensures modular and local reasoning, supporting splitting and combining credits across program fragments, a key property for scalable verification.

The framework supports specification of the probability distribution of program outputs using expectation-preserving credit redistribution, following the soundness theorem from [cpp26-distribution]. This enables the specification and proof of sampler correctness not only as upper bounds on failure, but as precise distributional properties of randomized routines.

Termination—Almost-Sure Termination via Credit Amplification

Probabilistic programs often require reasoning about almost-sure termination (termination with probability $1$), a challenging property for traditional decreases-based termination proofs. Alerus exploits credit amplification: it inductively tracks increasing credits in non-terminating branches until full credit ($\upto{1}$) is realized, which collapses the branch. This aligns with soundness completeness theorems showing Eris-style credits suffice for almost-sure termination ([completeness]), and extends naturally via existing decreases annotations in Verus.

Verification Examples and Results

Alerus demonstrates verification of several canonical and security-critical sampling routines in Rust:

• Discrete Laplace and Gaussian Samplers: Full verification of OpenDP implementations of discrete Laplace and discrete Gaussian samplers using CKS algorithms, including negative exponential Bernoulli and geometric samplers.
• Alias Method: Modular verification of the classic alias sampling technique, connecting stateful preprocessing invariants with probabilistic postconditions, marking a novel verification result for such stateful probabilistic algorithms.
• Fast Loaded Dice Roller (FLDR): Verification of FLDR and its uniform variant (Fast Dice Roller), modeling rejection sampling and tree traversal with affine credits, with mathematical recurrences for credit allocation and expectation checks.

All proofs are organized using separation of pure mathematical lemmas and code-level ghost reasoning, leveraging SMT automation (Z3) and LLM-assisted proof construction (Claude Opus 4.7/4.8). Performance and scalability characteristics are not empirically reported, but the modularity and breadth of examples suggest effective SMT-backed practical usability.

Soundness and Semantic Modeling

To establish the soundness of the encoding, the authors adapt VerusBelt, a deep semantic model of Verus built atop Iris separation logic. By swapping Iris’s weakest precondition for Eris’s probabilistic variant and porting later credits modality (following recent advances in [hupd]), the framework ensures compatibility between advanced Rust features (e.g., affine resources, permissions, limited prophecy variables) and probabilistic reasoning. Concurrency and full prophecy variable support are not modeled, but may be feasible with extensions (e.g., ConEris for concurrency).

The soundness proofs are fully mechanized in Rocq. Removal of prophecy variable support, due to known incompatibilities with Eris, is acknowledged as a limitation, though inconsequential for the presented examples.

Implications and Future Directions

Alerus represents the first unified framework for verifying probabilistic programs written in a realistic, modern language and connects state-of-the-art program logic with practical language-based verification. The technical flexibility—modular reasoning about heap, pointers, affine ownership, and discrete probability distributions—extends verification frontiers for critical applications (cryptography, differential privacy, probabilistic data structures).

Potential future developments include extending soundness to restricted prophecy variables, concurrency, and relational properties (e.g., privacy guarantees via probabilistic couplings). The framework also provides a platform for modular verification of complex probabilistic systems, facilitating integration with Rust’s evolving verification ecosystem.

Conclusion

Alerus successfully bridges the gap between probabilistic program verification and Rust’s practical specification tools, embedding Eris-style error credits into Verus’s ghost state machinery. Through axiomatization and semantic modeling, it enables formal reasoning about randomized behavior, distributional correctness, and almost-sure termination for real-world Rust programs. The framework’s modularity and compatibility with separation logic techniques open significant avenues for application in security, privacy, and randomized systems verification, with potential for further enrichment to handle more advanced language features and probabilistic properties.