Proof of a computer program's functionality using a quantum computer and a proof assistant

Abstract

The present subject matter relates to a method as follows. A current proof state may be encoded into a vector of real numbers of a fixed length. The current proof state defines a task for proving at least part of the statement. The vector may be encoded into a quantum state of a quantum system of the quantum computer. The quantum state may be used as an input quantum state by a quantum machine learning model for providing by the quantum machine learning model an output quantum state, wherein the measurement of the output quantum state represents a proof step for the defined task. The proof step may be provided to the proof assistant. In response to providing the proof step, a next proof state may be received from the proof assistant. It may be determined whether the received proof state indicates that the proof is completed. In response to determining that the proof is not completed, the received proof state may be used as the current proof state for repeating the method.

Description

[0001] PROOF OF A COMPUTER PROGRAM’S FUNCTIONALITY USING A QUANTUM COMPUTER AND A PROOF ASSISTANT

[0002] Technical Field

[0003] Various example embodiments relate to computer systems, and more particularly to a method for proving a statement of a computer program.

[0004] Background

[0005] In the realm of computer science and mathematics, the process of proving the correctness of a statement or a program may be performed using a proof assistant. Proof assistants are software tools used for creating, verifying, and managing formal proofs in mathematics and computer science. The proof assistants provide a formal language for writing mathematical definitions, algorithms, and theorems, along with an environment for developing machine-checked proofs. Proof assistants play a role in ensuring the correctness and reliability of mathematical proofs and software systems; however, there is a need for an improved use of the proof assistants.

[0006] Summary

[0007] Example embodiments provide a method (also referred to as proof method) for proving a statement of a computer program using a quantum computer and a proof assistant, the statement being descriptive of a functionality of the computer program, the method comprising: a) encoding a current proof state into a vector of real numbers of a fixed length, the current proof state defining a task for proving at least part of the statement; b) encoding the vector into a quantum state of a quantum system of the quantum computer; c) using the quantum state as an input quantum state by a quantum machine learning model for providing by the quantum machine learning model an output quantum state whose measurement represents a proof step for the defined task; d) measuring the output quantum state, thereby obtaining the proof step for the defined task; e) providing the proof step to the proof assistant; f) in response to providing the proof step, receiving a next proof state from the proof assistant.

[0008] Example embodiments provide a computer system for proving a statement of a computer program using a quantum computer and a proof assistant, the statement being descriptive of a functionality of the computer program, the computer system comprising the proof assistant, the computer system being configured for: encoding a current proof state into a vector of real numbers of a fixed length, the current proof state defining a task for proving at least part of the statement; controlling the quantum computer for encoding the vector into a quantum state of a quantum system of the quantum computer; controlling the quantum computer for using the quantum state as an input quantum state by a quantum machine learning model for providing by the quantum machine learning model an output quantum state whose measurement represents a proof step for the defined task; controlling the quantum computer for measuring the output quantum state for obtaining the proof step for the defined task; providing the proof step to the proof assistant; in response to providing the proof step, receiving a next proof state from the proof assistant.

[0009] Example embodiments provide a computer program product comprising instructions for causing a computer system for performing at least the following: encoding a current proof state into a vector of real numbers of a fixed length, the current proof state defining a task for proving at least part of a statement of a computer program; controlling a quantum computer for encoding the vector into a quantum state of a quantum system of the quantum computer; controlling the quantum computer for using the quantum state as an input quantum state by a quantum machine learning model for providing by the quantum machine learning model an output quantum state whose measurement represents a proof step for the defined task; controlling the quantum computer for measuring the output quantum state for obtaining the proof step for the defined task; providing the proof step to a proof assistant; in response to providing the proof step, receiving a next proof state from the proof assistant.

[0010] Brief Description of the Drawings The accompanying figures are included to provide a further understanding of examples and are incorporated in and constitute part of this specification. In the figures:

[0011] Fig. 1 is a diagram illustrating a computer system in accordance with an example of the present subject matter.

[0012] Fig. 2 is a flowchart of a method for proving a statement of a computer program in accordance with an example of the present subject matter.

[0013] Fig. 3 is a block diagram of an exemplary computer system for implementing at least part of the present method in accordance with an example of the present subject matter.

[0014] Detailed Description

[0015] In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, interfaces, techniques, etc., in order to provide a thorough understanding of the examples. However, it will be apparent to those skilled in the art that the disclosed subject matter may be practiced in other illustrative examples that depart from these specific details. In some instances, detailed descriptions of well-known devices and / or methods are omitted so as not to obscure the description with unnecessary detail.

[0016] The present subject matter may allow the debugging of the computer program and the identification and elimination of vulnerabilities in the computer program. The present subject matter may enable a higher level of confidence in reliability and functionality of computer programs by, for example, proving the correctness of the computer program. For example, by using the present proof method, potential errors and bugs may be identified and eliminated before the program is deployed. This may lead to improved software quality and reduced risks associated with program failures or malfunctions.

[0017] The present subject matter may prove the statement of the computer program using the quantum computer and the proof assistant. The computer program may be a set of instructions written in a programming language that is executable by a computer to perform a specific task or solve a problem. The statement may be descriptive of a functionality of the computer program. The statement may, for example, be a specification of what the computer program is expected to do. This specification may include properties, requirements, or invariants that the computer program should satisfy. The specification may serve as a precise description of the desired behavior of the computer program. The statement may be stored as a plain text file or stored in a database or stored in a code repository. In one example, the statement may be a compound statement which may contain a sequence of statements. The sequence of statements may, for example, comprise intermediate statements or sub-statements of the compound statement. The combination of the intermediate statements may represent (or equivalent to) the compound statement of the computer program. Each intermediate statement may, for example, describe a functionality of a respective part of the computer program.

[0018] The proof assistant may be a software tool that assists in the development of formal proofs. The proof assistant may also be referred to as an interactive theorem proven The proof assistant may provide a formal language for expressing proofs and also provide a set of rules for manipulating these formal expressions. The proof assistant may generate, e.g., sequentially, proof states during a proof process. The proof state may represent the current state of a proof in the proof assistant. The proof state may provide a snapshot of the progress made in constructing the proof and guide the subsequent application of proof steps. The proof state may, for example, include a goal or a subgoal that nee<ds to be proven. The goal may represent a specific statement that to be proven, where the specific statement may be the statement of the computer program or an intermediate statement. The proof state may optionally further comprise at least one of: a definition, a property or an assumption that may be associated with the goal defined in the proof state. The proof state may be updated as proof steps are applied. The proof state may be represented as a structured data object.

[0019] A proof method may be used to prove the statement of the computer program using the quantum computer and the proof assistant. The proof method comprises the step (step a)) of encoding a current proof state into a vector of real numbers of a fixed length. The current proof state may be encoded into a vector of real numbers. The vector has a predefined length. The current proof state defines a task for proving at least part of the statement. For example, at start of the proof method, the proof assistant may be provided with the statement of the computer program and the computer program. In response, the proof assistant may generate the current proof state which may define the task of proving the whole statement. For example, the statement of the computer program and the computer program may be formalized or expressed using the programming language or syntax of the proof assistant. For example, the computer program may be expressed by defining data types, functions and operations of the computer program. The statement of the computer program may be expressed as one or more theorems. The theorem may capture the desired functionality of the computer program. The theorem may be expressed using the syntax of the proof assistant which has a computational interpretation.

[0020] To illustrate this by example, in case the computer program implements a sorting algorithm, the statement of the computer program may be expressed by a theorem that asserts that the computer program has the functionality of arranging elements in a specific order such as ascending order.

[0021] In one example, the encoding of the current proof state into the vector of real numbers of fixed length may be achieved by representing different aspects of the proof state as specific values within the vector. For example, the vector may include elements that represent the goal or any other relevant information related to the proof state. By encoding the proof state into a vector, it may become amenable to manipulation and processing by the quantum computer.

[0022] The proof method further comprises the step (step b)) of representing the vector into a quantum state of a quantum system of the quantum computer. For example, before the encoding, the vector of real number may be normalized so that the values of the vector may be between zero and one. For example, once the vector representation of the proof state is obtained, the quantum computer may be controlled to encode this vector into a quantum state of a quantum system. This encoding process may leverage the unique properties of quantum systems, such as superposition and entanglement, to represent the proof state in a quantum form. The quantum state serves as an input to a quantum machine learning model.

[0023] The proof method further comprises the step (step c)) of using the quantum state as an input quantum state by the quantum machine learning model for providing by the quantum machine learning (QML) model an output quantum state whose measurement represents a proof step for the defined task. For example, the quantum machine learning model may utilize the input quantum state to perform computations and generate the output quantum state. The output quantum state represents a proof step for the defined task. The measurement (step d)) of the output quantum state provides specific combination of data (e.g., classical bits) that represent the proof step and that can be manipulated and interpreted by a classical computer. This combination of data may be associated with a respective proof step in a predefined mapping. For example, the combination of data may be associated with a specific tactic or command of the proof assistant. The command may, for example, provide instructions that may be used by the classical computer to build the poof step. The tactic may, for example, refer to a high-level strategy or rule that may be used to construct the proof step. The tactic may be used by the classical computer to generate the proof step. The proof step may refer to the individual actions or operations taken during the proof construction process. The proof step may, for example, include the application of logical rules, the introduction or elimination of variables, and any other transformations or deductions made during the proof process. By leveraging quantum machine learning, the apparatus can explore and exploit the computational advantages offered by quantum systems to enhance the efficiency and accuracy of the proof process.

[0024] To further illustrate this, following the above sorting example, the theorem may be provided, to the proof assistant, as a predicate that checks if a list of natural numbers is in ascending order. The predicate may state that for any two elements a and b in the list, if a appears before b, then a is less than or equal to b in accordance with the sorting algorithm. As a proof state, the proof assistant may provide a list L that represents the list of positive natural numbers and a goal “isAscendingOrder” to show that the list L satisfies the property of being in ascending order. In response to the proof state, the proof step may be performed by computing the multiplicative inverse of the numbers of the list, applying the sorting algorithm to the resulting numbers, and showing that the order of the list has been inverted such that the item that was last in the original order becomes first, and so forth.

[0025] The proof method further comprises the step (step e)) of inputting the proof step to the proof assistant. For example, the proof step may be written in a language supported by the proof assistant before being provided to the proof assistant.

[0026] The proof method further comprises the step (step f)) of receiving a next proof state from the proof assistant. The proof assistant generates that next proof state based on the input proof step. The next proof state may represent the updated state of the proof task after applying the proof step. For example, the proof assistant may analyze the proof step and provide the next proof state. The next proof state may indicate the completion of the proof. Alternatively, the next proof state may include a goal, corrections to be made, or any other relevant information to advance the proof process. The updated proof state may then be used as the current proof state for a potential subsequent repetition of the proof method.

[0027] In one example (named incremental method example), the proof method may be repeated based on a status of the proof. In the incremental method example, the proof method may comprise a repeated execution of the method steps a) to f) until a stopping criterion is fulfilled. For example, the execution of the proof method may comprise a first execution of steps a) to f) followed by one or more other executions of the steps a) to f) until the stopping criterion is fulfilled. The stopping criterion may, for example, require that the proof is completed or that a maximum number of iterations is reached. For example, it may be determined whether the proof of the statement of the computer program is completed. For example, to determine whether the proof is completed, the received proof state may be examined. The proof state may include indicators or flags that signify the completion of the proof task. For example, the proof state may contain a specific value or a combination of values that indicate the successful completion of the proof. By analyzing the received proof state, it may be determined whether the proof is completed or if further iterations are required. In case the received proof state does not indicate that the proof is completed, the proof method may be repeated using the last received proof state as the current proof state for the repetition of the proof method. For this repetition of the proof method, the proof state may, for example, define a task to prove a sub-statement of the statement. This iterative process may allow to gradually progress towards completing the proof task by encoding, processing, and analyzing the proof states using the quantum computer and the proof assistant. In case the received proof state indicates that the proof is completed, the method may stop indicating that the statement is proved.

[0028] According to one example, the described functionality of the statement is a security property or security feature of the computer program. The security feature may refer to the mechanism and functionality implemented to protect the computer program and its data from unauthorized access, attacks, and vulnerabilities. The security feature may aim to ensure the confidentiality, integrity, and availability of the computer program and its associated resources. The security feature may, for example, comprise data encryption or authentication for verifying the identity of a user or entity before granting access to a computer system or its resources. The proof assistant may provide a proof state for proving the statement or proving an intermediate statement associated with the security feature. The proof step for proving the statement may comprise the application of a technique, such as induction, case analysis, or logical reasoning. In case of an encryption algorithm, the proof step may check the length of the key generated by the encryption algorithm. If the length is higher than or equal to the predefined lengths of the encryption algorithm, this may prove the algorithm. If the proof step is consistent with the security property and helps a progress toward solving the goal of the current proof state it may be accepted by the proof assistant. On the other hand, if the proof step contradicts the security property or does not contribute to solving the goal it may be rejected by the proof assistant. In case the proof is failed, the computer program may be analyzed for potential vulnerabilities and ensuring that it is resistant to attacks. Thus, the proof assistant may help to identify and fix security weaknesses in the program, such as buffer overflows and weak passwords.

[0029] According to one example, the method further comprises: in response to determining that the proof is not completed and failed to fulfill the security property, identifying security vulnerabilities in the computer program that cause the failure. The computer program may be adapted accordingly, and the method may be repeated for proving the statement of the adapted computer program. For example, following the adaptation of the computer program, the method may be repeated for proving the statement. However, the method is now applied to the adapted computer program. This repetition of the method may ensure that the proof is completed, and the security property is fulfilled.

[0030] This example may provide a feedback mechanism. This feedback mechanism is triggered when the proof is not completed and fails to fulfill the security property. For example, upon identifying the security vulnerabilities that may have caused the failure, the computer program may be adapted accordingly. These security vulnerabilities may be considered as the root cause of the failure and may have to be addressed in order to ensure the security of the computer program. The adaptation process may involve modifying the code, configurations, or settings of the computer program to mitigate or eliminate the identified security vulnerabilities. This adaptation may be a direct response to the specific vulnerabilities that have been identified, ensuring that the computer program becomes more secure.

[0031] For example, if the initial proof fails due to a security vulnerability related to input validation, this vulnerability may be identified, and the computer program may be adapted by implementing stricter input validation mechanisms. The method for proving the statement may then be repeated on the adapted computer program to ensure that the vulnerability has been effectively addressed and the security property is now fulfilled. Alternatively, different adaptation techniques may be employed depending on the nature of the identified security vulnerabilities. For instance, if the failure is caused by a vulnerability related to access control, the computer program may be adapted by implementing more robust access control mechanisms, such as role-based access control or attribute-based access control.

[0032] According to one example, the proving of the statement comprises proving the correctness of the computer program. Proving the correctness of the computer program may involve demonstrating that the computer program behaves as intended and does not have any logical or functional errors. This example may ensure that the computer program operates as intended.

[0033] According to one example implementation of the incremental method example, proving a statement or proving the correctness of the computer program may, in particular, be achieved by at least: before executing the method a part of the computer program is provided to the proof assistant for receiving the current proof state. The current proof state further indicates that the part of the computer program is correct or erroneous. The method further comprises: performing the method for another part of the computer program, in case the current proof state indicates that the part of the computer program is correct and / or that the proof is completed for the part of the computer program, and in case the current proof state indicates that the part of the computer program is erroneous or the proof is not completed, adapting the computer program.

[0034] For example, the computer program may comprise multiple parts. The proof assistant may initially be provided with the statement. The parts may be processed sequentially using the following program processing method. The current part of the computer program is provided to the proof assistant to obtain a current proof state. If the current proof state indicates that the part of the computer program is erroneous, the computer program may be adapted. If the current proof state indicates that the part of the computer program is correct, the method steps a) to f) may, optionally, be repeatedly performed until the stopping criterion is fulfilled. Therefore, the execution of the program processing method may either lead to the adaptation of the computer program or may confirm that the current part of the computer program is correct, optionally performing the proof for the currently correct part of the program. If the current proof state indicates that the part of the computer program is correct and / or that the proof is completed for the current part of the computer program, the next part of the computer program may be processed using the program processing method. The parts may be processed sequentially using the program processing method until all parts are processed or until the computer program is updated.

[0035] In another example, the computer program may comprise a sequence of parts, parti , part2, partN. The proof assistant may initially be provided with the statement. The first part parti may be provided to the proof assistant, then steps a) to f) may be repeatedly executed for this parti until the stopping criterion is fulfilled. If after the stopping criterion is fulfilled, the current proof state indicates that parti is correct and / or that the proof is completed for the parti , the second part part2 may be processed as described with reference to parti . However, if the current proof state indicates that parti is erroneous or the proof is not completed for parti , the computer program may be adapted and the method may end. If the method is not end, the second part part2 may be provided to the proof assistant, then steps a) to f) may be repeatedly executed for this part2 until the stopping criterion is fulfilled. If after the stopping criterion is fulfilled, the current proof state indicates that part2 is correct and / or that the proof is completed for the part2, the third part part3 may be processed as described with reference to parti . If the current proof state indicates that part2 is erroneous or the proof is not completed for part2, the computer program may be adapted and the method may end, and so forth. This process may be repeated until all parts are processed or until the computer program is adapted.

[0036] According to one example, encoding the current proof state into the vector comprises: providing a recurrent neural network (RNN) that is trained using proof states as sequential data in order to encode the proof state into a fixed-size vector and inputting the current proof state into to the recurrent neural network for obtaining the vector.

[0037] Indeed, during a proof, the proof state of the proof assistant may be given by a sequence of signs. Since the length of said sequence may change from proof step to proof step, the sequence may be encoded into a vector of real numbers of fixed length. One way of doing this may be by using the recurrent neural network to encode the proof state into a so-called "context". The recurrent neural network may be specifically designed and trained to process sequential data, such as proof states, in order to encode them into fixed-size vectors. The training of the recurrent neural network may involve using a large dataset of proof states, allowing it to learn patterns and relationships within the sequential data.

[0038] In an alternative example, instead of using a recurrent neural network, other machine learning techniques, such as convolutional neural networks (CNNs) or transformers, may be used to encode the proof state into a fixed-size vector. These alternative techniques may be more suitable for certain types of proof states or provide different advantages in terms of computational efficiency or accuracy.

[0039] Once the current proof state is encoded into a vector, it may be further utilized for various purposes. For instance, the encoded vector can be used for comparison with other proof states to identify similarities or differences. This can help in detecting patterns or recurring vulnerabilities in the computer program.

[0040] According to one example, encoding the vector into the quantum state is performed using amplitude encoding or angle encoding. The choice of encoding may, for example, depend on the quantum machine learning model of consideration.

[0041] Amplitude encoding may involve representing the vector as a linear combination of basis states, where the amplitudes of the states may correspond to the elements of the vector. This encoding technique may allow for efficient manipulation and processing of the quantum state. On the other hand, angle encoding may represent the vector by encoding the angles between the basis states. The angles may be determined based on the elements of the vector, and the quantum state is then prepared accordingly. Angle encoding may offer advantages in terms of robustness against certain types of errors and noise.

[0042] In an example where the vector to be encoded is [1 , 0], the prepared quantum state may be provided by the amplitude encoding as a linear combination of the basis states |0>, and 11 >, with amplitudes corresponding to the elements of the vector. For instance, the resulting quantum state could be represented as a|0) + |3|1 >, where a, and [3 are complex numbers determined by the vector elements.

[0043] Alternatively, if angle encoding is employed, the angles between the basis states may be determined based on the vector elements. If, for example, the angles are 01 , and 02 are provided for the basis states |0>, and |1 >, respectively, the quantum state may then be prepared by applying appropriate quantum gates to create the desired angles between the basis states. While amplitude encoding and angle encoding are described here as examples, other quantum encoding techniques may also be utilized. These alternative techniques could involve different mathematical representations or encoding schemes, depending on the specific requirements and constraints of the system.

[0044] According to one example, the method is automatically performed in response to receiving the statement of the computer program. This may speed up the proof process and reduce user interventions in the proof process.

[0045] According to one example, the proof assistant is configured to be executed on a classical computer, wherein the method is implemented by a hybrid classical algorithm a quantum algorithm. The execution of the classical algorithm on the classical computer causes the classical computer to perform the method comprising controlling, according to the quantum algorithm, the quantum computer to perform the encoding of the vector, the provision of the output quantum state and the measurement of the output quantum state. The present method may be hybridized, meaning that it can contain a combination of classical components and quantum components.

[0046] According to one example, the quantum system is defined by a number of qubits which is fixed based on the number of elements of the vector.

[0047] The quantum system may consist of a specific number of qubits which is determined based on the number of elements present in the vector. This determination may ensure that the quantum system is appropriately sized to handle the proof process. By keeping the number of qubits constant, this may ensure consistency and reliability in the proof process.

[0048] For example, the quantum system may comprise a set of qubits, wherein the number of qubits in the set is defined by the size of the vector. For example, if the size of the vector is N, the quantum system may comprise a number n of qubits where N = 2n. The quantum state may represent the values of the vector. In case the size of the vector is not a power of two, the vector may, for example, be padded with predefined values such as zeros to a dimension that is a power of 2.

[0049] According to one example, the size of the vector is fixed to a value dependent on available number of qubits in the quantum computer.

[0050] The fixed size of the vector is determined based on the number of qubits available in the quantum computer. This may ensure that the vector is optimized for the specific quantum computing resources being utilized. For example, the fixed size of the vector may be adjusted based on the specific requirements of the quantum computer being used. For example, if a different quantum computer with a different number of qubits is utilized, the size of the vector may be modified accordingly. This flexibility may allow the method to be adaptable to various quantum computing resources.

[0051] According to one example, the method comprises before the proving of the statement of the computer program: training the quantum machine learning model. The training comprises: providing a training dataset. The training dataset comprises entries, wherein each entry of the training dataset comprises a proof state and corresponding tactic or command to build a proof step. Alternatively, the training dataset may be provided so that each entry of the training dataset may comprise a proof state and corresponding proof step that is derived from a tactic. Alternatively, each entry of the training dataset comprises a proof and corresponding statement. The tactic may, for example, refer to a high-level strategy or rule used to construct the proof step, wherein the proof step may refer to the individual actions or operations taken during the proof construction process. The quantum machine learning model may be trained for providing a tactic for a specific proof state.

[0052] In one training data generation example, in order to generate the training dataset, a proof assistant may be used to generate a set of proof states. The proof states may represent intermediate steps in the process of proving program statements. Each proof state is associated, in the respective entry in the training dataset, with a corresponding tactic, which may be a specific strategy or rule used to build the proof step. According to one example, the training dataset is obtained using the proof assistant used by the proof method and / or one or more other proof assistants. This may allow for the collection of a comprehensive set of data that can be used for training the quantum machine learning model. Alternatively, the training dataset may be obtained using a different proof assistant than the one used by the proof method. This proof assistant may have different features or capabilities, allowing for a diverse range of proof states and tactics to be collected. This variation in the training dataset may help improve the robustness and generalization of the quantum machine learning model.

[0053] In addition to the proof assistant, alternative methods for obtaining the training dataset can be explored. For example, the dataset may be generated through the use of multiple automated theorem provers or formal verification tools. These tools may assist in generating proof states and corresponding tactics or statements that can be used as entries in the training dataset.

[0054] In one training data generation example, the method may generate the training dataset by directly providing a set of pre-existing proofs along with their corresponding statements. These proofs serve as examples for the quantum machine learning model to learn from. Once the training dataset is obtained, the method proceeds to train the quantum machine learning model. This training process may involve feeding the training dataset into the model and iteratively adjusting its parameters to optimize its performance in proving program statements.

[0055] In one training data generation example, the training dataset may be provided based on the field or domain of the computer program being proved. For example, where the method is used for proving sorting algorithms, the training of the quantum machine learning model may be performed to prove the correctness of sorting algorithms. The training dataset may be generated using the proof assistant. The proof assistant may generate a set of proof states, each representing a step in the proof of the correctness of a specific sorting algorithm. These proof states are then paired with the corresponding tactics, which outline the specific strategies used to build each proof step. Alternatively, if a set of pre-existing proofs is provided for the domain, the method may directly use these proofs along with their corresponding statements as the training dataset. For instance, a set of proofs demonstrating the correctness of various sorting algorithms can be used as the training dataset.

[0056] In one training data generation example, the training dataset as described above may be updated. For example, in order to further enhance the training process, the method may incorporate various techniques for data augmentation. The update may include manipulating the existing training dataset to create additional variations of the proof states and corresponding tactics or statements. This may be achieved through techniques such as data perturbation, where small modifications are made to the existing entries to create new instances. The updated training dataset may comprise the manipulated entries and optionally the existing training dataset. Another approach may involve generating synthetic data by using generative models or simulation techniques. The updated training dataset may comprise the synthetic data and optionally the existing training dataset.

[0057] In another example, alternative approaches may be used to generate the training dataset. For example, the method may incorporate techniques from natural language processing to generate statements that describe the desired properties of the program.

[0058] In one training data generation example, at least part of the training dataset may be generated using a machine learning model to generate true statements and proofs. The at least part of the training dataset may be the training dataset. Alternatively, the at least part of the training dataset may be a portion of entries of the training dataset. The other portions of the training dataset may, for example, be provided using one or more of the above training data generation examples. For example, the true statements and proofs may be generated using classical reinforcement learning or hybrid reinforcement learning or quantum reinforcement learning or other classical machine learning techniques or hybrid machine learning techniques or quantum machine learning techniques. These generated statements and proofs may, for example, be used to enrich an existing database of statements and proofs for the proof assistant, providing enough data points to train a quantum large language model "from scratch". For example, the machine learning model (to generate true statements) may be trained on a large corpus of existing true statements and proofs. This corpus can be sourced from various reliable and verified databases or repositories. The machine learning model learns the patterns, structures, and logical reasoning behind these true statements and proofs. Once the machine learning model is trained, it may generate new true statements and proofs based on the learned patterns and reasoning. These generated statements and proofs may then be used to create at least a portion of the training dataset. Each entry in the training dataset may comprise a generated true statement or proof and its corresponding proof step or tactic. Alternatively, the machine learning model may be trained on different subsets of existing true statements and proofs to create specialized training datasets. This may allow the quantum machine learning model to be trained for specific domains or problem types, enhancing its performance and accuracy in those areas. These generated true statements and proofs, along with their corresponding proof steps or tactics, form a part of the training dataset. The quantum machine learning model can then utilize this dataset to learn how to prove program statements using quantum computing techniques.

[0059] In one example, the machine learning model used for generating the training dataset may be fine-tuned and optimized based on the specific requirements of the quantum machine learning model being trained. Different machine learning algorithms and architectures can be explored to improve the quality and diversity of the generated statements and proofs.

[0060] In addition to using a machine learning model, alternative methods for generating the training dataset can also be considered. For example, instead of relying solely on a machine learning model, human experts may manually create a set of true statements and proofs that cover a wide range of scenarios. These manually created statements and proofs may then be combined with the machine-generated ones to form a comprehensive training dataset.

[0061] During the training process, the quantum machine learning model may learn to recognize patterns and relationships between the proof states and the corresponding tactics or statements. By iteratively adjusting its parameters, the model may become increasingly proficient at providing proof steps.

[0062] In one training example, the quantum machine learning model may comprise an encoding layer. The encoding layer may be configured to encode the vector of fixed size into a quantum state using a set of qubits. The quantum machine learning model may further comprise a learning layer having one or more trainable or free parameters. The learning layer may be configured to change the quantum state by applying one or more unitary transformations. The learnable parameters may, for example, be the rotation angles of single qubit Pauli rotation gates e.g., the Pauli rotation angle may be applied on qubits of the set of qubits after the quantum state has been created. The learnable parameters may, for example, comprise a number of rotation angles which are applied to the set of qubits respectively. The quantum machine learning model may further comprise a measurement layer for measuring the output quantum state. A loss function may be evaluated using the proof step represented by the measurement and the corresponding proof step in the training dataset. The quantum machine learning model may be trained by backpropagation using the loss function and an optimization technique that is performed by the classical computer to check a convergence criterion. The backpropagation may enable to update of the learnable parameters using gradient descent. The convergence criterion may, for example, require that the loss function exceeds a threshold.

[0063] In one training example, and in case the vector is provided by the recurrent neural network as described herein, the quantum machine learning model and the recurrent neural network may be jointly trained. For example, in each iteration of the training, the proof state may be input to the recurrent neural network to generate the vector, the vector is provided as input to the quantum machine learning model, and the resulting measurement may provide an indication of the proof step. A loss function may be evaluated using the measurement and the proof step in the training dataset. In case the loss function does not fulfill a convergence criterion, the backpropagation is performed in order to update both the learnable parameters of the quantum machine learning model as well as the weights of the recurrent neural network. The update of the recurrent neural network weights and the learnable parameters may be performed using gradient descent. In case the loss function fulfills the convergence criterion, the resulting trained recurrent neural network and quantum machine learning model may be provided. The convergence criterion may, for example, require that the loss function exceeds a threshold.

[0064] According to one example, the quantum machine learning model is a quantum reinforcement learning model, wherein before the proving of the statement of the computer program, the method comprises training the quantum reinforcement learning model using the proof assistant or another proof assistant as environment. Reinforcement learning is a type of machine learning where an agent learns to make decisions by interacting with an environment and receiving feedback in the form of rewards or penalties. The quantum reinforcement learning model utilizes quantum algorithms to optimize the decision-making process and improve the learning efficiency. This quantum reinforcement learning model may address the limitations of classical methods in efficiently and purposefully searching through large "Action Spaces".

[0065] During the training process, the quantum reinforcement learning model may interact with the proof assistant or another proof assistant, which serves as the environment. The model may learn to make decisions based on the current proof state provided by the proof assistant and the available tactics, aiming to reach the desired proof outcome. Through iterative training, the model may improve its ability to provide proof step(s) for a proof state.

[0066] In addition to the described example, there are alternative approaches that can be employed in the training process. For example, instead of using a proof assistant as the environment, the method may utilize a simulated environment specifically designed for training the quantum reinforcement learning model. This simulated environment may mimic the behaviour of a proof assistant and provide a controlled environment for training the model.

[0067] According to one example, the encoding of the current proof state into the vector is performed using a recurrent neural network, wherein the training of the quantum machine learning model comprises training the quantum machine learning model and the recurrent neural network in unison.

[0068] The RNN may be a type of artificial neural network that is capable of processing sequential data by maintaining an internal memory. This memory allows the RNN to capture and utilize information from previous proof states when encoding the current proof state. For example, the RNN can be implemented using various architectures such as Long Short-Term Memory (LSTM) or Gated Recurrent Unit (GRU). These architectures may enable the RNN to effectively capture long-term dependencies and handle vanishing or exploding gradient problems that may arise during training.

[0069] For example, the unison training may be performed as follows. The training dataset consists of entries, each entry containing a proof state and a corresponding tactic to build a proof step. The RNN encodes the proof state of a current entry into a vector representation, which is then fed into the quantum machine learning model. The model utilizes this encoded information to generate the appropriate tactic for the given proof state. Specifically, the training in unison between the RNN and the QML model may, for example, be performed as follows. The training dataset, in particular the roof states, may be prepared in a sequential format suitable for the RNN component. The training dataset may be compatible with both the RNN and the QML components. In each iteration of the training, a forward pass through the joint model may be performed, where the proof state is fed into the RNN component, and the output vector of the RNN is passed to the QML component as a quantum state. The QML component processes the quantum state and generates the output quantum state that represents a proof step. The loss between the predicted proof step and the target proof step of the training dataset is determined. A backpropagation may be performed through the QML component to compute the gradients of the parameters with respect to the loss. The parameters of the QML component may be updated e.g., using an optimization algorithm. A backpropagation through time in the RNN component may be performed to compute the gradients of the RNN weights with respect to the loss. Backpropagation Through Time (BPTT) may involve unfolding the RNN over time and propagating the gradients through each time step. The RNN weights may be updated using the optimization algorithm. The repetition may be for a specified number of iterations or until convergence is reached.

[0070] According to one example, the quantum machine learning model is a quantum neural network a Quantum Support Vector Machine (QSVM), a quantum large language model (LLM) or a quantum reinforcement learning model.

[0071] QSVM is a quantum version of the classical Support Vector Machine (SVM) algorithm, which is a supervised learning method used for classification and regression tasks. The QSVM utilizes quantum algorithms to perform classification tasks on quantum data. These quantum machine learning models may address the limitations of classical methods in efficiently. In this case, the RNN and the QSVM may, for example, be trained in unison as described in the document arXiv:2308.08467.

[0072] The quantum LLM model may be designed to process and understand natural language text using quantum algorithms. It can be trained on a large corpus of text data and used for tasks such as language translation, sentiment analysis, and text generation.

[0073] The proof assistant may, for example, be the LEAN proof assistant or any other proof assistant that may enable proving the statements according to the present subject matter.

[0074] Fig. 1 is a diagram illustrating a computer system in accordance with an example of the present subject matter. The computer system 100 comprises a classical computer 101. The computer system 100 may further comprise a quantum computer 102. An example implementation of the classical computer 101 is described with reference to Fig. 3. The quantum computer 102 may comprise qubits. For example, qubits may be part of quantum registers 105.1 through 105.L. The classical computer 101 may be configured to control operation of the quantum computer 102. The classical computer 101 may use an interface 103 with the quantum computer 102 to control operation of the quantum computer 102 in accordance with an example of the present subject matter. The classical computer may comprise a proof assistant 107. The proof assistant may, for example, be the LEAN proof assistant or any other proof assistant that may enable proving the statements according to the present subject matter.

[0075] FIG. 2 is a flowchart of a method for proving a statement of a computer program using a quantum computer and a proof assistant according to an example of the present subject matter. For the purpose of explanation, the method described in FIG 2 may be implemented in the system illustrated in FIG. 1 , but is not limited to this implementation. The method may, for example, be performed by the computer system 100.

[0076] A current proof state may be encoded in step 201 into a vector of real numbers of a fixed length. The current proof state defines a task for proving at least part of the statement. The vector may be encoded in step 203 into a quantum state of a quantum system of the quantum computer (e.g., 102). For example, the classical computer 101 may control the quantum computer 102 to perform step 203. The quantum state may be used in step 205 as an input quantum state by a quantum machine learning model for providing by the quantum machine learning model an output quantum state, wherein the measurement of the output quantum state represents a proof step for the defined task. The output quantum state may be measured e.g., in step 205. For example, the classical computer 101 may control the quantum computer 102 to perform step 205. The proof step may be provided in step 207 to the proof assistant (e.g., 107). In response to providing the proof step, a next proof state may be received in step 209 from the proof assistant 107. It may be determined in step 211 whether the received proof state indicates that the proof is completed. In response to determining that the proof is not completed, the received proof state may be used as the current proof state for repeating the method steps 201 to 211 . In one example, the repetition of the method steps 201 to 211 may be performed until a stopping criterion is fulfilled. The stopping criterion may, for example, require that the proof is completed or that a maximum number of iterations is reached. In response to determining, for example, that the proof is completed, the method may end.

[0077] Fig. 3 is a block diagram of an exemplary computer system for implementing at least part of the present method in accordance with an example of the present subject matter. The components of the computer system 702 may include, but are not limited to, one or more processors or processing units 703, a storage system 711 , a memory unit 705, and a bus 707 that couples various system components including memory unit 705 to processor 703. The storage system 711 may include for example a hard disk drive (HDD). The memory unit 705 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory.

[0078] The computer system 702 may also communicate with one or more external devices such as a keyboard, a pointing device, a display 713, etc.; one or more devices that enable a user to interact with computer system 702; and / or any devices (e.g., network card, modem, etc.) that enable the computer system 702 to communicate with one or more other computing devices. Such communication can occur via I / O interface(s) 719. Still yet, the computer system 702 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet) via a network adapter 709. As depicted, the network adapter 709 communicates with the other components of the computer system 702 via bus 707.

[0079] The memory unit 705 is configured to store applications that are executable on the processor 703. For example, the memory unit 705 may comprise an operating system as well as one or more application programs. The application programs comprise instructions that when executed enable to perform the method described with reference to Fig. 2.

[0080] As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as an apparatus, method, computer program or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer executable code embodied thereon. A computer program comprises the computer executable code or "program instructions".

[0081] Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable storage medium. A ‘computer-readable storage medium’ as used herein encompasses any tangible storage medium which may store instructions which are executable by a processor of a computing device. The computer-readable storage medium may be referred to as a computer-readable non-transitory storage medium. The computer-readable storage medium may also be referred to as a tangible computer readable medium. In some embodiments, a computer-readable storage medium may also be able to store data which is able to be accessed by the processor of the computing device.

[0082] ‘Computer memory’ or ‘memory’ is an example of a computer-readable storage medium. Computer memory is any memory which is directly accessible to a processor. ‘Computer storage’ or ‘storage’ is a further example of a computer-readable storage medium. Computer storage is any non-volatile computer-readable storage medium. In some embodiments computer storage may also be computer memory or vice versa.

[0083] A ‘processor’ as used herein encompasses an electronic component which is able to execute a program or machine executable instruction or computer executable code. References to the computing device comprising “a processor” should be interpreted as possibly containing more than one processor or processing core. The processor may for instance be a multi-core processor. A processor may also refer to a collection of processors within a single computer system or distributed amongst multiple computer systems. The term computing device should also be interpreted to possibly refer to a collection or network of computing devices each comprising a processor or processors. The computer executable code may be executed by multiple processors that may be within the same computing device or which may even be distributed across multiple computing devices.

[0084] Computer executable code may comprise machine executable instructions or a program which causes a processor to perform an aspect of the present invention. Computer executable code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages and compiled into machine executable instructions. In some instances the computer executable code may be in the form of a high level language or in a pre-compiled form and be used in conjunction with an interpreter which generates the machine executable instructions on the fly.

[0085] Generally, the program instructions can be executed on one processor or on several processors. In the case of multiple processors, they can be distributed over several different entities. Each processor could execute a portion of the instructions intended for that entity. Thus, when referring to a system or process involving multiple entities, the computer program or program instructions are understood to be adapted to be executed by a processor associated or related to the respective entity.

Claims

CLAIMS1 . A method for proving a statement of a computer program using a quantum computer (102) and a proof assistant (107), the statement being descriptive of a functionality of the computer program, the method being provided for proving the compliance of the computer program with the described functionality, the method comprising: a) encoding (201 ) a current proof state into a vector of real numbers of a fixed length, the current proof state defining a task for proving at least part of the statement; b) encoding (203) the vector into a quantum state of a quantum system of the quantum computer; c) using (205) the quantum state as an input quantum state by a quantum machine learning model for providing by the quantum machine learning model an output quantum state whose measurement represents a proof step for the defined task; d) measuring the output quantum state, thereby obtaining the proof step for the defined task; e) providing (207) the proof step to the proof assistant; f) in response to providing the proof step, receiving (209) a next proof state from the proof assistant.

2. The method of claim 1 , further comprising determining whether the received proof state indicates that the proof is completed; in response to determining that the proof is not completed, using the received proof state as the current proof state and repeating the method steps a) to f).

3. The method of claim 2, wherein the described functionality is a security property.

4. The method of claim 3, further comprising:in response to determining that the proof is not completed and failed to fulfill the security property, identifying security vulnerabilities in the computer program that cause the failure; adapting the computer program accordingly; and repeating the method steps a) to f) for proving the statement of the adapted computer program.

5. The method of any of the preceding claims 2 to 4, wherein the proving of the statement comprises proving the correctness of the computer program.

6. The method of any of the preceding claims 2 to 5, wherein before executing the method: a part of the computer program is provided to the proof assistant for receiving the current proof state, the current proof state further indicating that the part of the computer program is correct or erroneous; wherein the method further comprises: performing the method for another part of the computer program, in case the current proof state indicates that the part of the computer program is correct and / or that the proof is completed for the part of the computer program; and in case the current proof state indicates that the part of the computer program is erroneous or the proof is not completed, adapting the computer program.

7. The method of any of the preceding claims, wherein encoding the current proof state into the vector comprises: providing a recurrent neural network that is trained using proof states as sequential data in order to encode the proof state into a fixed-size vector; inputting the current proof state into the recurrent neural network for obtaining the vector.

8. The method of any of the preceding claims, wherein encoding the vector into the quantum state is performed using amplitude encoding or angle encoding.

9. The method of any of the preceding claims, being automatically performed in response to receiving the statement of the computer program.

10. The method of any of the preceding claims, wherein the proof assistant is configured to be executed on a classical computer, wherein the method is implemented by a hybrid quantum-classical algorithm whose execution on the classical computer causes the classical computer to perform the method comprising controlling the quantum computer to perform the encoding of the vector, the provision of the output quantum state and the measurement of the output quantum state.

11. The method of any of the preceding claims, wherein the quantum system is defined by a number of qubits which is fixed based on the number of elements of the vector.

12. The method of any of the preceding claims, wherein the size of the vector is fixed to a value dependent on available number of qubits in the quantum computer.

13. The method of any of the preceding claims, comprising before the proving of the statement of the computer program, training the quantum machine learning model, the training comprising: providing a training dataset, the training dataset comprising entries, wherein each entry comprises a proof state and corresponding tactic to build a proof step; or each entry comprises a proof and corresponding statement; training the quantum machine learning model for proving program statements using the training dataset.

14. The method of claim 13, wherein the training dataset is obtained using the proof assistant and / or one or more other proof assistants.

15. The method of claim 13 or 14, further comprising generating at least part of the training dataset using a machine learning model to generate true statements and proofs.

16. The method of any of the preceding claims 1 to 12, the quantum machine learning model being a quantum reinforcement learning model, wherein before the proving of the statement of the computer program, the method comprises training the quantum reinforcement learning model using the proof assistant or another proof assistant as an environment.

17. The method of any of the preceding claims 13 to 16, wherein the encoding of the current proof state into the vector is performed using a recurrent neural network, wherein the training of the quantum machine learning model comprises training the quantum machine learning model and the recurrent neural network in unison.

18. The method of any of the preceding claims, the quantum machine learning model being a quantum neural network a Quantum Support Vector Machine (QSVM), a quantum large language model or a quantum reinforcement learning model.

19. A computer system (100, 702) for proving a statement of a computer program using a quantum computer (102) and a proof assistant (107), the statement being descriptive of a functionality of the computer program, the computer system (100, 702) comprising the proof assistant, the computer system (100, 702) being configured for: encoding a current proof state into a vector of real numbers of a fixed length, the current proof state defining a task for proving at least part of the statement; controlling the quantum computer for encoding the vector into a quantum state of a quantum system of the quantum computer; controlling the quantum computer for using the quantum state as an input quantum state by a quantum machine learning model for providing by thequantum machine learning model an output quantum state whose measurement represents a proof step for the defined task; controlling the quantum computer for measuring the output quantum state for obtaining the proof step for the defined task; providing the proof step to the proof assistant; in response to providing the proof step, receiving a next proof state from the proof assistant.

20. The computer system of claim 19, comprising the quantum computer.

21. A computer program product comprising instructions for causing a computer system for performing at least the following: encoding a current proof state into a vector of real numbers of a fixed length, the current proof state defining a task for proving at least part of the statement; controlling the quantum computer for encoding the vector into a quantum state of a quantum system of the quantum computer; controlling the quantum computer for using the quantum state as an input quantum state by a quantum machine learning model for providing by the quantum machine learning model an output quantum state whose measurement represents a proof step for the defined task; controlling the quantum computer for measuring the output quantum state for obtaining the proof step for the defined task; providing the proof step to the proof assistant; in response to providing the proof step, receiving a next proof state from the proof assistant.

Images