Rohan Padhye

Associate Professor at @S3DatCMU @SCSatCMU & Researcher at @AntithesisHQ.

[Rohan Padhye @moarbugs]

My research group has a new website! https://t.co/9yAi1OGCl4

[Rohan Padhye @moarbugs]

@tianyin_xu @ilyasergey @hillelogram @muratdemirbas Have either of you tried to translate the challenge problems from TLAPS-Bench to Veil and try to prove (or dis-prove) the invariants with Lean? I wonder which path is easier for agents.

[Rohan Padhye @moarbugs]

"Bug Finding Considered Harmful?" -- really nice article by @Keleesssss.

https://t.co/5VxgOiyMw1

[Rohan Padhye @moarbugs]

@maxvonhippel @alex_pokras @genproof Ahh, no wonder:

[Rohan Padhye @moarbugs]

@alex_pokras Can you share any details about how the 340+ bugs were found? I don't see any evidence of formal methods being used there. Most seem discoverable by straightforward AI code scans:

- https://t.co/S18uf1XbeC
- https://t.co/sBrHaQSBbS
- https://t.co/WIsxjWtH29

[Rohan Padhye @moarbugs]

@alex_pokras Can you share any details about how the 340+ bugs were found? I don't see any evidence of formal methods being used there. Most seem discoverable by straightforward AI code scans:

- https://t.co/S18uf1XbeC
- https://t.co/sBrHaQSBbS
- https://t.co/WIsxjWtH29

[Rohan Padhye @moarbugs]

@tianyin_xu Right ofc not "bug-free" I meant if TLAPS can prove property P in model of system S it is still possible for P to be violated in actual system S.

Related -- an interesting viz: https://t.co/7H4msECgre

[Rohan Padhye @moarbugs]

@tianyin_xu Makes sense. So even if agents can prove safety/liveness properties of various systems with TLAPS-Bench, that is not a guarantee that those systems are necessarily bug-free.

Would be great to clarify this in the paper/README! There's a lot of snake oil going around these days.

[Rohan Padhye @moarbugs]

@maxvonhippel Nice visualizations! For the message on assurance, I also like @joe_hellerstein's "No Room for Bugs": https://t.co/lGfqVDkF7l

[Rohan Padhye @moarbugs]

@mathur_umang Great insights! Thanks for explicitly drawing out figures for the ASan limitations.

I'm still impressed overall by Anthropic/Theorem's project as it seems to be a solid advancement in SoTA, but agree the general public should not get carried away by its implications.

[Umang Mathur @mathur_umang]

I was quite intrigued by oss-verify and convinced a few collaborators to dig deeper.

I thought I’d share what we found: https://t.co/VbQNVR26YO

As AI makes proofs easier, it’s important to check what we’re proving. And even more important to view claims with caution.

[Rohan Padhye @moarbugs]

@ilyasergey Very cool! Congrats and good luck @ilyasergey

[Rohan Padhye @moarbugs]

@valigo I guess I mean we spend more compute on analysis and proofs than fuzzing. The latter won't disappear, but it may become less dominant.

At least I hope things go that way otherwise we're all screwed.

[Rohan Padhye @moarbugs]

Hard to answer in absolute terms, but:

I conjecture that the total compute dedicated to software correctness will eventually follow:

matrix multiplication > systematic logic > random search

(it has historically been the other way around)

[Valentin Ignatev @valigo]

Can formal verification fully replace fuzzing? Genuine question.

[Rohan Padhye @moarbugs]

This is obviously easier said than done. But, I think being able to form an intuition for identifying these kinds of niches is *precisely* the differentiator of PhD-level skills.

[Rohan Padhye @moarbugs]

In my role as PhD advisor, I'm nowadays just telling my students to pick an important problem:

1. That is not trivially solvable by AI today
2. That is not theoretically unsolvable
3. For which a solution technique will just get better with AI advancements, not obsolete.

[Rohan Padhye @moarbugs]

@ArjunGuha @RanjitJhala I'm guessing also fewer integer overflows to consider everywhere in loops, etc.

[Rohan Padhye @moarbugs]

I'm quite happy to read this. Very promising directions!

With the insane frequency of security incidents we're witnessing, I really do hope verification can get ahead of exploitation sooner rather than later.

[Anthropic @AnthropicAI]

New on our Frontier Red Team blog: using Claude to formally verify software at large scale.

Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).

With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.

Read our research in full here: https://t.co/zUyx8CjBEk

[Rohan Padhye @moarbugs]

> “Gang, are you even reading this? be honest.” Honest answer: a language model was, and now so is everyone reading this post. Handwritten prompt injection is now in the autograder’s threat model.

--

Amazing write-up by @shrey_twr!

[Shrey Tiwari @shrey_twr]

This semester I am TAing 17-313, the undergrad software engineering course at CMU.

I built an autograder for the course... with AI writing every line of the code. It got me thinking about what's left of software engineering now that coding is automated away.

I jotted down my thoughts here: https://t.co/M2NSFw1S3I

[geoff @GeoffreyHuntley]

found a nasty bug with @AntithesisHQ. if a backup is happening during a leap second then the backup would be done/completed without doing a backup.

[Rohan Padhye @moarbugs]

Hey it's not just me, TIME magazine says so too.

[Rohan Padhye @moarbugs]

Time-Traveling Agents!

https://t.co/EIsaDYjnFe

The Antithesis Multiverse Debugger is now available via API and CLI :-)

[Antithesis @AntithesisHQ]

What if saying `claude build me a cloud platform make no mistakes` actually worked??? With the newest Antithesis release we have closed the loop and enabled agents to ship reliable systems: https://t.co/9VQbmXPTT3