# Lecture 116: GPU Kernel Formal Verification

## Executive summary

The talk addresses the critical challenge of establishing trust in high-performance GPU kernels generated by AI systems. While AI-based generators (like KForge) can produce highly efficient kernels, their correctness cannot be guaranteed by traditional testing methods. The speaker introduces formal verification, using a tool called Tatwa, which reasons about the semantic equivalence between a reference program (e.g., PyTorch model) and an optimized candidate (e.g., Triton kernel). The process involves decomposing high-level operations into basic mathematical primitives and expanding tensor operations into scalar terms for analysis by solvers like Z3. The primary limitations discussed include scalability, handling low-level semantics (like hardware intrinsics), and reasoning about thread synchronization.

## Key takeaways

- Limitations of Testing vs. Verification: Testing is inherently sampling and can only confirm correctness for tested inputs. Formal verification, however, aims to prove that the two programs (baseline and candidate) cannot disagree for *any* possible input, addressing the fundamental question of semantic equivalence.
- Identifying Semantic Bugs (The Missing Clamp): A key example demonstrated a scenario where an optimized candidate failed to include an intermediate `clamp` operation required by the reference program. This bug was missed by testing/fuzzing but was successfully identified by the verifier because it reasoned about the mathematical semantics, not just the output for sampled inputs.
- Formal Verification Workflow: The process involves taking the PyTorch/Triton programs, lowering them to mathematical primitives, and then expanding tensor operations (like matrix multiplication) into scalar terms to allow solvers (Z3) to reason about the computation at the element level.
- Bounded Verification Approach: Due to scalability issues, the approach uses bounded verification, limiting the summation range (e.g., capping a summation over K to a small value) to make the problem solvable by current solvers, acknowledging this as a current limitation.

## Technical details

- Kernel Generation and Verification: The ecosystem uses AI (e.g., KForge) to generate high-performance GPU kernels. The goal of formal verification is to guarantee that the generated kernel is correct, compiles, and is faster than the baseline.
- Tensor Algebra Equivalence Checking: The tool Tatwa is a tensor algebra equivalence checker that compares the semantic equivalence of a reference program (PyTorch) and an optimized candidate (Triton/PyTorch). It requires decomposing operations into basic mathematical primitives.
- Scalability and Solvers: Reasoning about complex tensor operations requires expanding them into scalar terms for solvers like Z3. Scalability remains a challenge, leading to the adoption of bounded verification techniques.
- Low-Level Semantics: Future work must address reasoning at lower levels, including PTX, thread synchronization, and hardware intrinsics (e.g., NVFP4 mat), which are significantly more complex than current computation graph analysis.

## Practical implications

- The integration of formal verification tools into the kernel generation loop is necessary to establish trust in AI-generated high-performance kernels.
- Build systems must evolve to handle semantic equivalence checking, moving beyond simple unit and integration testing.
- Developers must be aware of the limitations of current verification tools, particularly regarding scalability and low-level hardware semantics (e.g., floating-point precision, synchronization).

## Topics

Formal Verification, GPU Computing, AI/ML Infrastructure, Compiler Optimization, KForge, Tatwa, Z3, Alive2, Gimlet Labs

Source: https://www.youtube.com/watch?v=WRAQYXBA_Qc