PDD Kit uses formal proofs to verify AI-generated code

Microsoft Research has introduced PDD Kit, a new toolkit designed to bring formal verification methods to everyday software development driven by AI agents. Published on November 5, 2026, this approach addresses the growing challenge of validating large volumes of code generated by autonomous coding assistants. By combining mathematical proofs with empirical testing, PDD Kit aims to ensure that agent-written applications strictly adhere to developer intent without requiring manual line-by-line review.

What happened

As AI agents become capable of generating entire features or full-stack applications in single sessions, traditional code review processes are struggling to keep pace. Developers often rely on natural language plans as contracts for these agents, but there is no inherent mechanism forcing the agent to follow the plan precisely. Agents may drift from specifications, implementing slightly different logic and then writing tests that pass for their incorrect implementation rather than the intended behavior. This creates a hidden gap between what was requested and what is shipped, which standard continuous integration pipelines often fail to detect because they only check specific test cases.

To solve this, Microsoft Research developed Proof-Driven Development (PDD) and its accompanying toolkit, PDD Kit. This system integrates with GitHub Next’s Chopin planning environment to turn user intent into formal specifications. It then uses these specifications to mathematically prove that the generated code is correct for every possible input. For aspects of the software that cannot be formally proven, such as interactions with third-party libraries or user interfaces, the kit falls back to high-quality empirical tests. This hybrid approach allows engineers without a background in formal methods to apply rigorous verification to their projects.

The research team demonstrated PDD Kit by building Pet Store, a full-stack web application written in Rust. The application includes a backend using Axum and SQLite, and a frontend built with Leptos compiled to WebAssembly. While the entire application consists of approximately 5,000 lines of code, the team focused their formal verification efforts on the login logic. This critical component handles authentication and authorization, making it an ideal candidate for proof-based validation. The process allowed the developer to review the intent and specification without reading every line of the generated code, yet still achieve a high degree of confidence in the security and correctness of the login flow.

How it works

PDD Kit operates by bridging the gap between natural language intent and formal mathematical specifications. When a developer provides a request, the toolkit asks clarifying questions to resolve ambiguities, such as distinguishing between "only get a token with the right password" and "the right password always works." These decisions are recorded in an intent artifact, which maps user requirements to formal specs in Verus, a proof language for Rust. The kit then generates proofs that the code satisfies these specs for all inputs, while simultaneously creating tests for parts of the system that lie outside the scope of formal verification, known as the Trusted Computing Base.

The verification process distinguishes between two types of assurance: formal verification and empirical verification. Formal verification uses the Verus verifier to provide a mathematical proof that the code meets its specification for every possible input. Empirical verification, on the other hand, relies on running the code and observing its behavior through unit tests, end-to-end tests, and browser agents. PDD Kit makes the boundary between these two explicit, requiring developers to sign off on each trusted component, such as external cryptography libraries or database queries, ensuring that the assumptions underlying the proofs are clearly understood and accepted.

Key details

• PDD Kit integrates with GitHub Next’s Chopin environment to facilitate real-time, multiplayer planning and verification.
• The toolkit uses Verus, a proof language for Rust, to generate mathematical proofs that code satisfies formal specifications for all inputs.
• It automatically converts parts of user intent that cannot be formally proven into informal specifications covered by empirical tests.
• The system explicitly defines the Trusted Computing Base, requiring developer sign-off on external dependencies and assumed behaviors.
• In the Pet Store demo, PDD Kit verified the login logic of a 5,000-line Rust application, uncovering existing bugs and proving the absence of login errors relative to the spec.
• The workflow includes an intent map that links requirements to formal specs and tests, providing a clear audit trail of how user intent was implemented.

Why it matters

For software engineers and technical leads, PDD Kit offers a scalable solution to the reliability crisis posed by AI-generated code. As agents produce larger and more complex codebases, the cost of manual review becomes prohibitive, and traditional testing strategies leave significant gaps in coverage. By automating the creation of formal proofs, PDD Kit provides a level of assurance that testing alone cannot match, catching edge cases and logical errors that might otherwise slip into production. This shifts the role of the developer from a line-by-line reviewer to a high-level architect who defines intent and validates specifications.

Furthermore, this approach democratizes formal methods, which have historically been reserved for niche, safety-critical systems due to their complexity and cost. By leveraging AI to handle the heavy lifting of proof generation and specification writing, PDD Kit makes these rigorous techniques accessible to everyday application development. This could lead to a new standard in software quality, where critical components like authentication, financial transactions, and data handling are routinely verified mathematically, reducing the risk of severe bugs and security vulnerabilities.

What you can do

• Evaluate your current code review processes to identify bottlenecks caused by large AI-generated pull requests.
• Identify critical components in your application, such as authentication or payment logic, that would benefit most from formal verification.
• Explore the capabilities of Verus and other formal verification tools for Rust to understand their potential integration into your workflow.
• Experiment with specifying clear, unambiguous requirements for AI agents to reduce the likelihood of implementation drift.
• Consider adopting a hybrid testing strategy that combines traditional unit tests with property-based testing to cover more input scenarios.
• Stay informed about developments in Proof-Driven Development and tools like PDD Kit as they become more widely available.