Search papers, labs, and topics across Lattice.
This paper introduces TLA-Prover, a 20-billion-parameter model designed for synthesizing TLA+ specifications that can be verified by the TLC model checker. By employing a combination of supervised fine-tuning on verified examples and a novel repair-based group-relative policy optimization (GRPO), TLA-Prover significantly improves the semantic correctness of generated specifications. The model achieves a pass rate of 30% at both Gold and Diamond levels on a benchmark, outperforming the best public baseline by approximately 3.5 times in terms of semantic model-checking success.
TLA-Prover triples the success rate of LLM-generated TLA+ specifications, transforming how we ensure correctness in distributed systems verification.
TLA+ is a formal specification language for verifying distributed systems and safety-critical protocols. Large language models (LLMs) frequently produce TLA+ specifications that fail the TLC model checker for semantic reasons. Across 25 LLMs, the best public baseline is 26.6% syntactic parse and 8.6% semantic model-check. We present TLA-Prover, a 20-billion-parameter model for TLA+ specification synthesis. Training combines supervised fine-tuning (SFT) on verified examples with repair-based group-relative policy optimization (GRPO). In the GRPO stage, the model learns to fix its own rejected specifications. We also train a direct preference optimization (DPO) variant from the same SFT checkpoint as an ablation. TLC provides the reward signal directly, with no learned reward model. Four tiers grade each output: Bronze (parses), Silver (no warnings), Gold (passes TLC), and Diamond. To reach Diamond, the model's correctness property is automatically altered in a small way; TLC must then detect a violation. If TLC still passes, the property was always-true and contributes nothing; the output fails Diamond. TLA-Prover reaches 9/30 (i.e. pass@1 = 30%) at both Gold and Diamond on a held-out 30-problem benchmark. This is roughly 3.5x the 8.6% untuned baseline. The DPO variant reaches 20% at Diamond. Gold and Diamond coincide at every checkpoint; this prevents the trivial-property failure mode.
