Reformalization of the Jordan Curve Theorem

Abstract: We present a case study in reformalization, a variant of autoformalization in which the input proof is not natural language but a formal development in a different proof assistant. Concretely, we report three reformalizations of the Jordan Curve Theorem: from Mizar to Lean, from HOL Light to Lean, and from HOL Light to Agda. We analyse the results and identify pipeline design choices that matter for practical reformalization tasks.

• The paper introduces agent-driven reformalization, successfully transferring the Jordan Curve Theorem proofs between multiple proof assistants.
• It details a pipeline methodology using dependency extraction, library alignment, and proof synthesis that reduces human intervention from months to tens of hours.
• The study demonstrates that LLM-based, agentic approaches yield checkable, idiomatic proofs while addressing foundational mismatches and operational constraints.

Reformalization of the Jordan Curve Theorem: Agentic Pipelines and Library Integration

Introduction

The paper "Reformalization of the Jordan Curve Theorem" (2607.01734) investigates agent-driven reformalization: the transfer of large, verified proofs between proof assistants of different logical foundations and ecosystems. Distinct from autoformalization—formalization from natural language—reformalization operates on already formalized developments. The case study focuses on the Jordan Curve Theorem (JCT), a complex and historically challenging target within formal mathematics, analyzing the transfer from Mizar and HOL Light to Lean, and from HOL Light to Agda. The study elucidates key pipeline design characteristics and quantifies agent performance and resource costs, with a particular emphasis on leveraging modern LLMs within agentic frameworks.

Motivation and Context

Automated proof transfer across proof assistants has received persistent attention due to the impending need for foundational interoperability in formalization efforts. Prior approaches, relying on syntactic and low-level logical translation, have encountered core limitations: (1) foundational mismatch between logics (type theory, HOL, set theory), and (2) unaligned libraries and unnatural definitions in the target. Historically, this led to non-idiomatic, hard-to-maintain code in target systems and necessitated costly manual interventions for proper library alignment. These issues preserve the logical content but compromise conceptual clarity and integration.

Contrastingly, LLM-based agentic transfer—reformalization—prioritizes preservation of proof structure and mathematical ideas over syntactic identity, fostering idiomatic, aligned reconstructions. The JCT, with its mix of analytic topology, combinatorics, and geometry, acts as an effective stress-test for both strategy and tooling.

Methodology: Reformalization Pipelines

General Task Definition

Reformalization is defined as the production, given a source formal development of a theorem $T$ in assistant $S$, of a new, fully verified formalization of $T'$, the corresponding claim, in a (potentially very different) target proof assistant $T$. Unlike translation, this new development is expected to be idiomatic in $T$ and to leverage its library, tooling, and foundational style. The approach deliberately eschews forced syntactic or definitional equivalence, aiming for semantic and methodological faithfulness.

Case Study 1: Mizar to Lean

The Mizar-to-Lean pipeline proceeds in three distinct phases:

• Dependency Extraction: Automated tools parse Mizar's intermediate files to construct explicit dependency graphs and enumerate all theorems required for the JCT proof.
• Proof Skeleton Construction & Library Alignment: The dependency graph, MML sources, and Mathlib metadata are used by an alignment agent to produce Lean theorem skeletons, annotating matches or required imports from Mathlib.
• Proof Synthesis (Filling): Guided by the dependency graph, the agent fills in proofs, choosing between direct reimplementation and reuse of Mathlib lemmas. Manual intervention was minimal, limited to ~10 relevancy steerings.

Quantitative Results:

• 413 lemmas/theorems, 11,000 Lean lines vs. 23,500 lines in Mizar (size drop reflects Mathlib usage).
• Human time: ~20 hours. Elapsed: 10 days. LLM cost: dependent on provider.
• Emphasized that structural differences and idiomatic Mathlib usage led to divergence from the original Mizar machinery, e.g., bypassing Go-board constructions.

Case Study 2: HOL Light to Lean

The HOL Light-to-Lean pipeline is structured as a linear process per proof section:

• Catalogue Population: Extraction of all HOL Light theorems/definitions, classification wrt Mathlib coverage, necessity for translation, or superfluity.
• Lean Skeleton Generation: Automated, strict mapping to Lean, enforcing inclusion of all requisite theorems.
• Incremental Proof Completion: Agent-controlled, one-by-one proof implementation and verification, strictly following original proof structure to avoid unproductive "creativity."
• Verification and Progress Management: Status and catalog files are updated and serve as guardrails; agent autonomy increases during the process as pipeline maturity stabilizes.

Quantitative Results:

• ~1,400,000 Lean characters (29,000 lines), ~910 theorems/lemmas, 150 definitions; 116 new (not in HOL Light), 258 matched in Mathlib, 213 not applicable to Lean. Compiles in 206s.
• Human time: ~10 hours, mainly in setup/monitoring.
• End-to-end time: 1 week.
• Agent autonomy: nearly complete after pipeline stabilization.

Case Study 3: HOL Light to Agda

The transfer to Agda, while incomplete at reporting, exposed key operational differences:

• Foundation mismatch surfaced in the explicit handling of type inhabitation (HOL Light types are always inhabited, Agda types are not).
• Axiomatization Choices: The agent was directed to construct foundational objects from first principles, eschewing direct axiomatization.
• Operational Constraints: Severe slowdown and memory pressure caused partial failures (OOM kills in Docker) due to Agda's type checker. Agent+human feedback loops were required to enhance chunking/caching strategies for tractability.

Ported size: ~27,000 Agda lines; JCT main theorem not yet ported.

Practical Observations and Guardrail Design

The critical determinants of successful reformalization identified are:

• Library Maturity: Success and brevity of formalization are tightly correlated to the availability and maturity of aligned mathematical libraries. When matches are present, significant proof effort is saved.
• Operational Characteristics: Fast, informative tooling dramatically accelerates both agent and human productivity. Long compilation, poor feedback, or invisible errors significantly hinder agent progress.
• Foundational Mismatch: While nontrivial (e.g., inhabitedness of types), such mismatches can be bridged by explicit human or instruction-layer interventions.
• Agent Guardrails: LLM-based agents benefit from mechanical, progress-driven instructions, status file tracking, and strict requirements to follow source proofs and implement missing steps. Excessive agent “creativity” is often counterproductive.

Comparison to Traditional Automated Proof Transfer

Classical approaches to proof transfer (e.g., HOL Light to Isabelle/HOL via serialized proof-term translation [kaliszyk2013scalable]) minimize manual oversight and guarantee correctness by construction, but yield code that is rarely idiomatic or reusable in the target assistant. Crucially, such pipelines often result in non-integrated codebases incapable of leveraging rich target libraries and resisting further development.

Agentic reformalization, while not correct-by-construction or complete, produces checkable, human-readable, and idiomatic target developments. It embraces the target checker as the final arbiter and allows for seamless integration into the target's mathematical ecosystem.

Theoretical and Practical Implications

The single most salient empirical result reported is the reduction of active human involvement for transferring large, intricate proofs from months to tens of hours, with total calendar time on the order of a week. This constitutes a substantial step toward reducing the friction associated with formal mathematical library porting.

The study underscores the dependency of successful reformalization on assistant library and tooling maturity, at least for the class of theorems and assistants studied. Theoretical limitations remain for proofs that are highly entangled with foundational specifics, but “natural” mathematics is highly portable with the right infrastructure.

Agentic, LLM-driven reformalization represents a viable and scalable approach for cross-assistant verification transfer, potentially obviating the need for large-scale, manual proof migration and enlarging the interoperability prospects for verified mathematics.

Future Directions

Future work is indicated in further systematic integration of logic-aware translation elements—e.g., translation of set theory developments, generic foundation-bridging, and better handling of deep foundational mismatches. There is also opportunity for hybrid pipelines that merge the best of agentic and systematic approaches, and for continual improvement of verification tooling for both agents and human users.

Agentic reformalization frameworks provide a compelling architecture for integrating proof search, alignment, and library discovery. Continued development in LLM capabilities and proof assistant ecosystems is expected to facilitate formal mathematics’ expansion and cross-system coherence.

Conclusion

The case study convincingly demonstrates that agentic, LLM-based proof reformalization makes large-scale, library-integrated, and idiomatic proof porting feasible between mature proof assistants. While foundational mismatches or library absence still require nontrivial pipeline augmentation, practical and theoretical bottlenecks in mathematical library development across proof systems can be mitigated. Rigorous instruction design and workflow management are essential for agent-controlled formalization pipelines. The results call for further research into compositional, foundation-agnostic proof transfer methods, and indicate high near-term impact for LLM-guided formal mathematics (2607.01734).