Beluga: Theory, Systems & Ecology

• Beluga is a multi-domain system that unifies a contextual type-theory proof environment, high-performance LLM memory architecture, BFT blockchain synchronizer, and automated whale detection pipeline.
• Beluga’s proof environment leverages multi-level contextual type theory to rigorously manage variables and substitution, enabling scalable mechanization of higher-order abstract syntax proofs.
• In distributed systems and ecology, Beluga delivers optimized CXL-based memory performance and state-of-the-art YOLOv8 segmentation for rapid blockchain consensus and accurate wildlife monitoring.

Beluga refers to several distinct, technically substantial constructs across computer science, formal methods, distributed systems, computer architecture, and ecological informatics. The name "Beluga" is given to (1) a multi-level contextual type-theory-based proof environment, (2) a high-performance, CXL-based memory architecture for LLM-serving, (3) a modular synchronizer for BFT consensus, and (4) a YOLOv8-based beluga whale detection pipeline leveraging advanced segmentation. Each system exhibits rigorously defined methodologies and has had substantial influence in its respective field.

1. Multi-Level Contextual Type Theory and the Beluga Proof Environment

Beluga is a proof environment for higher-order abstract syntax programming and mechanized metatheory, built directly on multi-level contextual type theory. This theory unifies bound variables, meta-variables, meta²-variables, and higher-level metavariables as a single indexed class: every variable is $x^k$, where $k\in \mathbb{N}$ denotes its level—distinguishing ordinary bindings ($k=0$), holes ($k=1$), variables dependent on holes ($k=2$), and so on. Contexts $\Gamma$ are ordered lists of typed variable declarations $x^k: A[\Phi]$ respecting strict invariants: all level-$k$ declarations appear before level-$m$ declarations for $k>m$, ensuring higher-level variables cannot depend on lower-levels. This allows uniform construction and manipulation of terms in the presence of arbitrarily many layers of uninstantiated variables (Boespflug et al., 2011).

Type checking is presented bi-directionally, distinguishing checking and synthesis for normal and atomic terms:

• $\Gamma \vdash M \Leftarrow A$ means $M$ in context $\Gamma$ checks against $A$,
• $\Gamma \vdash R \Rightarrow A$ means atomic $R$ synthesizes $A$,
• All terms are always maintained in $\beta\eta$-long normal form.

Central to managing holes is the generalized hereditary substitution $[\Phi.N/x^k](M)$, which combines explicit simultaneous substitution and eager reduction to guarantee normality; it operates recursively on structure and variable levels, always terminating via a measure on approximating types. These constructs are realized in Beluga’s core implementation architecture, automatically tracking arbitrary towers of meta-variable levels and handling all context/variable management uniformly (Boespflug et al., 2011).

2. Mechanization of Proofs and Context Management in Beluga

Beluga supports direct mechanization of normalization proofs, logical relations arguments, and properties over languages encoded in HOAS by assigning LF-contexts as first-class citizens and building a dependently-typed computation layer atop LF. Practical mechanizations benefit from:

• For-free context and substitution management: every context extension, substitution, and weakening/exchange lemma is handled by the system,
• First-class simultaneous substitutions $[\delta \vdash \gamma]$, with their equational theory built-in,
• Recursive (stratified) types and higher-order functions, facilitating higher-order logical relations or Kripke logical relations (Cave et al., 2015, Momigliano et al., 23 Apr 2024).

Advanced extensions such as refinement schemas introduce a datasort-style subtyping between context schemas. These allow finer-grained context discipline (e.g., relating algorithmic and declarative equality contexts by refinement), dramatically reducing the explicit boilerplate required in metatheoretic developments. The conservativity theorem associated with these refinements ensures that no new well-typed expressions are admitted by introducing schemas; sort-checking and type-checking are tightly unified, and conversions between refined and unrefined contexts are handled by mutual induction over the refinement structure (Gaulin et al., 2023).

Beluga’s capability is further exemplified by high-assurance mechanizations of the Church–Rosser property for various $\lambda$-calculi relying on HOAS, stratified types, and direct manipulation of contextual objects (Momigliano et al., 23 Apr 2024), as well as first formalizations of reversible calculi (CCSKP) and session typing using localized linearity predicates within a structural context (Cecilia, 19 Aug 2025, Sano et al., 2023).

3. Advanced Automation: The Harpoon Focusing Calculus

Beluga incorporates a focusing calculus for proof automation within the Harpoon environment. The calculus is sound and complete with respect to the core two-level logic of Beluga (Schwartzentruber et al., 2023). It distinguishes uniform (invertible) phases—where all right-introduction rules and elimination steps are eagerly applied—from focusing (left) phases where a single atomic assumption is decomposed per step. This alternation, together with built-in first-order and higher-order unification, enables bounded-depth proof search and automatic discharge of straightforward subcases.

The calculus is fully formalized for both contextual LF and the meta-logic, including sequents, computation types (which include boxed contextual judgments), and recursive definitions. Soundness and completeness are established by mutual induction, leveraging admissibility of cut and focusing invertibility in the underlying sequent calculus (Schwartzentruber et al., 2023). Harpoon can discharge classic normalizing proofs, such as logical relations-based weak-head normalization for STLC, without user-written substitution or context management lemmas.

4. Beluga for High-Performance Memory Management in LLM Serving

"Beluga" also names a rack-scale, Compute Express Link (CXL)-based disaggregated memory architecture for addressing the KVCache bottleneck in large-scale GPU-accelerated LLM inference (Yang et al., 25 Nov 2025). Its foundational distinction is enabling GPUs and CPUs to simultaneously access a shared, terabyte-scale memory pool via CXL 2.0 switches with true native load/store semantics—no RDMA work queues, no host DRAM bounce buffers. Internally, Beluga-KVCache integrates at the inference engine level (e.g., vLLM) by replacing RDMA protocols with direct memory-mapped CXL regions, GPU peer-to-peer DMA, and custom kernel-level block gather/scatter logic.

Key empirical results:

• 16KB CXL read/write latency: 3.64–5.98 μs, versus 8.50 μs for RDMA,
• vLLM throughput: 7.35× improvement ($11.32 / 1.54$ QPS),
• Time-to-First-Token reduced by 89.6% ($13.00 \,\mathrm{s} \to 1.36\,\mathrm{s}$),
• Bandwidth per host: up to 46 GB/s (read), with sub-μs tail latency.

The architecture's flat, low-latency memory model eliminates key scheduler pathologies: cache-locality can be disregarded, and request dispatch can be purely load-balanced. Current trade-offs include lack of multi-host hardware coherence in CXL 2.0, handled by explicit cache operations in software, and the need to scale out across multiple adapters and switches. The system’s generality extends to vector search, graph analytics, and in-memory database applications (Yang et al., 25 Nov 2025).

5. Beluga as a Modular Synchronizer for BFT Blockchain Consensus

Within the BFT consensus domain, "Beluga" defines a block synchronizer abstraction and its production implementation (Kichidis et al., 19 Nov 2025). A block synchronizer exposes a push/pull interface ensuring block availability, round progression/termination, and resource-aware block exchange, enabling dissociation between data dissemination and ordering in DAG-based and chain-based protocols (e.g., Mysticeti, Bullshark). Beluga achieves optimal $\delta$ push latency (matching network delay) on the honest path and bounds recovery costs under asynchrony and adversarial attack.

Innovations include:

• Admission-control-based optimistic push, with reputation and resource-awareness,
• Implicit Proof-of-Availability (ImPoA): a block is certified implicitly available as soon as it is referenced by $f+1$ subsequent blocks,
• Hybrid pull: distinguishing live (latency-sensitive, deterministic $O(n)$) from bulk (non-critical, randomized $O(1)$) pulling,
• Formal resilience against the pull-induction attack by dynamically adjusting parent selection based on block scarcity and detected adversarial behavior.

Empirically, integration into Mysticeti provides up to $3\times$ higher throughput and $25\times$ lower latency under attack in a geo-distributed AWS setup. Production adoption in Sui mainnet has demonstrated improved tail latencies, rapid isolation of faulty nodes, and zero regression in the optimistic path (Kichidis et al., 19 Nov 2025).

6. Beluga in Ecological Informatics: Automated Beluga Whale Detection

The "Beluga" pipeline for ecological monitoring employs a deep learning workflow for beluga whale detection from satellite VHR imagery (Zheng et al., 17 May 2025). The pipeline comprises:

• Efficient collection of point labels (center points of animal bodies, stratified by certainty),
• Generation of tight instance masks and bounding boxes using the Segment Anything Model (SAM-H) with point+buffer prompts,
• Automated overlap resolution enforcing one-to-one label assignments in dense aggregations,
• Downstream training of YOLOv8 single-stage multiclass detectors for “certain whale,” “uncertain whale,” and “harp seal.”

Performance on WorldView-3/2 imagery is state-of-the-art: YOLOv8 trained with SAM-generated labels achieves an $F_1$ score of $72.2\%$ for “whale overall” and $70.3\%$ for harp seals, outperforming buffer-box annotation by $8.4\%$ on harp seals and $8.6\%$ on certain whales. Annotation workload is reduced by more than $70\%$—requiring only point placement plus minimal correction—facilitating scalable surveys of marine populations (Zheng et al., 17 May 2025).

7. Synthesis and Broader Impact

Beluga—in its diverse forms—exemplifies the propagation of uniform, principled, and highly technical solutions to otherwise complex or ad-hoc problems:

• In proof engineering, it uniquely realizes the promise of higher-order abstract syntax, multi-level meta-variable management, and structural context manipulation for scalable mechanization.
• In distributed systems and architecture, Beluga instantiates memory and consensus abstractions that reconcile theoretical optimality with production deployments.
• In ecological informatics, Beluga pipelines enable rapid, low-impact, and more accurate large-scale environmental monitoring by combining weak supervision and advanced segmentation.

These systems are the result of rigorous domain-centric design, with proven empirical and theoretical advantages in their application areas (Boespflug et al., 2011, Gaulin et al., 2023, Zheng et al., 17 May 2025, Yang et al., 25 Nov 2025, Kichidis et al., 19 Nov 2025).