VERIMED: Neurosymbolic Medical Requirements Auditing

• VERIMED is a neurosymbolic framework for auditing natural-language software requirements in safety-critical medical devices using LLM autoformalization and SMT-solver validations.
• The system uses a four-stage pipeline—ambiguity resolution, autoformalization, property verification, and query verification—to detect ambiguity, inconsistency, vacuousness, violatability, and redundancy.
• Experimental evaluations on medical device benchmarks demonstrate high fidelity, effective counterexample-guided repair, and precise ambiguity detection that enhance requirement verifiability.

VERIMED is a neurosymbolic framework for auditing natural-language software requirements in safety-critical medical-device settings. It combines LLM-based autoformalization with SMT-solver checks to detect ambiguity, inconsistency, vacuousness, violatability, and redundancy, and it uses solver-generated counterexamples for repair and scenario-based answer verification (Hall et al., 13 May 2026). In the surrounding 2025–2026 literature, the name also appears indirectly as a thematic label for verification-centered medical AI, but several papers explicitly state that VERIMED is absent, unrelated, or only contextually relevant rather than the evaluated system itself.

1. Terminological scope and usage

The most direct and technically specific use of VERIMED is in the requirements-auditing system introduced in "Neurosymbolic Auditing of Natural-Language Software Requirements" (Hall et al., 13 May 2026). A second, looser usage appears in "Efficient Medical VIE via Reinforcement Learning," where VERIMED is described not as a separate acronym with an expanded form, but as the paper’s medical VIE setting and the proposed RLVR-trained VIE model family for that setting (Liu et al., 16 Jun 2025). Other papers use expressions such as "VERIMED-style" to denote evidence-grounded verification or verifier-mediated supervision rather than the same pipeline, including work on biomedical RAG verification, evidence-aware clinical summarization, and medical VQA synthesis (Ji et al., 10 Jan 2026, Liu et al., 11 Mar 2026, Huang et al., 29 Oct 2025).

Paper	How VERIMED appears	Status
"Neurosymbolic Auditing of Natural-Language Software Requirements" (Hall et al., 13 May 2026)	neurosymbolic pipeline for medical-device requirements auditing	exact system
"Efficient Medical VIE via Reinforcement Learning" (Liu et al., 16 Jun 2025)	medical VIE setting and RLVR-trained VIE model family	contextual use
"Comparative Evaluation of Generative AI Models for Chest Radiograph Report Generation in the Emergency Department" (Lim et al., 29 Nov 2025)	VERIMED is not explicitly mentioned anywhere in the paper	absent
"Veritas-RPM: Provenance-Guided Multi-Agent False Positive Suppression for Remote Patient Monitoring" (Misro et al., 17 Apr 2026)	VERIMED is not mentioned and is not an exact name match	unrelated

This distribution suggests that VERIMED has a primary meaning as a specific neurosymbolic auditing framework, while adjacent work uses the term only by analogy, by contextual reference, or not at all.

2. Pipeline architecture and formal representation

VERIMED operates as a four-stage pipeline: Ambiguity Resolver, Autoformalizer, Property Verifier, and Query Verifier (Hall et al., 13 May 2026). The Ambiguity Resolver repeatedly samples multiple formalizations of the same natural-language requirement and uses SMT equivalence checking to determine whether the samples are semantically the same. The Autoformalizer translates disambiguated requirements into one unified SMT-LIB model using a shared typed schema of device state variables and background domain constraints. The Property Verifier runs requirement-level audits on the resulting model. The Query Verifier checks whether an LLM-produced answer to a scenario-based question is entailed by the requirements under the scenario.

The framework defines a translation from a requirement $r_i$ to a formal encoding $\rho_i$. For conditional requirements, the encoding is

$$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$

where $\mathbf{x}$ are typed state variables, $p_i$ is the trigger condition, and $q_i$ is the required consequence. Invariant requirements are encoded directly as $\rho_i(\mathbf{x})$ with no antecedent. The full model is

$M = C \wedge \bigwedge_{i=1}^{n} \rho_i,$

where $C(\mathbf{x})$ are global domain constraints.

The LLM is used for translating requirements into formal logic, translating formal models back into natural language for round-trip checking, generating answers to scenario-based safety questions, repairing formalizations or answers based on feedback, and rewriting ambiguous requirements after solver-guided clarification. The SMT solver is Z3, and it checks satisfiability of the model, entailment of scenario answers, reachability of conditions, violatability, redundancy, and semantic equivalence between formalizations. In the paper’s own summary, the division of labor is succinct: the LLM proposes, and the SMT solver judges (Hall et al., 13 May 2026).

3. Ambiguity detection as stochastic formalization disagreement

A central contribution of VERIMED is its treatment of ambiguity as a solver-checkable property rather than a purely linguistic intuition (Hall et al., 13 May 2026). Given two candidate encodings $\rho_i^a$ and $\rho_i$0 of the same requirement $\rho_i$1, the system declares agreement only if both

$\rho_i$2

and

$\rho_i$3

are unsatisfiable. This is bidirectional semantic equivalence under the domain constraints $\rho_i$4. If either direction is satisfiable, the solver returns a witness state that belongs to one formalization but not the other.

The ambiguity resolver samples $\rho_i$5 encodings of the same requirement and checks pairwise agreement. If more than one distinct equivalence class appears, the requirement is flagged as ambiguity-sensitive. The paper reports this process with $\rho_i$6 samples per requirement. A recurring ambiguity involved endpoint handling in numeric ranges such as “0 to 200 mL/min” and “200 to 400 mL/min,” where solver witnesses exposed disagreement exactly at the boundary value 200 mL/min. Another example concerned dialysate temperature, where disagreement witnesses included concrete values such as 33°C or 40°C, depending on whether endpoints were interpreted as included or excluded.

This mechanism turns underdetermined language into a machine-checkable defect. Rather than asking whether text merely “looks vague,” VERIMED asks whether multiple plausible formalizations remain inequivalent after conditioning on the same domain constraints.

4. Requirement-level audits and counterexample-guided repair

Beyond ambiguity, VERIMED performs four requirement-level audits over the unified model $\rho_i$7 (Hall et al., 13 May 2026). Global consistency asks whether $\rho_i$8 is satisfiable; if it is unsatisfiable, the requirement set is mutually inconsistent, and the unsat core identifies a conflicting subset. Vacuousness checks, for a conditional requirement, whether

$\rho_i$9

is satisfiable; if it is unsatisfiable, the trigger can never occur. Violatability checks, for conditional requirements,

$$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$0

and for invariants,

$$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$1

If satisfiable, the solver provides a violating assignment. Redundancy is analyzed by defining

$$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$2

and then checking whether the remaining requirements already force $$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$3.

The query-verification stage uses the verification condition

$$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$4

where $$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$5 is a scenario and $$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$6 is an LLM-produced answer. If the formula is unsatisfiable, the answer is entailed by the requirements under the scenario. If it is satisfiable, the solver returns a counterexample state consistent with the model and scenario but inconsistent with the answer.

VERIMED uses that counterexample in a repair loop. The paper distinguishes generic rejection / self-repair, requirement-only feedback, and full CEGR, where the solver counterexample itself is included. The framework’s main claim is that the granularity of symbolic feedback matters: violated requirement text helps, but concrete SMT witnesses help much more because they localize the mismatch between the current answer or formalization and the underlying specification.

5. Experimental evaluation and reported findings

The main benchmark is a hemodialysis machine case study with 64 natural-language safety requirements and 85 typed variables, covering alarm conditions, flow constraints, connectivity constraints, and numeric limits (Hall et al., 13 May 2026). Generalizability is assessed on an open-source PCA pump requirement set with 144 requirements. The main LLM is claude-sonnet-4-6; claude-haiku-4-5-20251001 is used for answer-to-schema translation. Temperatures are 0 for deterministic answer generation and repair, 1.0 for ambiguity detection, and 0.2 for ambiguity clarification. The solver is Z3 over SMT-LIB2 with quantifier-free linear real arithmetic with Booleans.

On hemodialysis autoformalization, the system formalized all 64 requirements successfully, produced a globally consistent model, found no vacuous requirements, identified 2 redundant requirements, passed round-trip equivalence for all 64 requirements, achieved 96.2% mean cosine similarity between original and reconstructed text, and detected 249/256 mutated requirements, or 97.3%. The redundant requirements reported are $$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$7 as redundant because of $$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$8, and $$\rho_i(\mathbf{x}) \equiv p_i(\mathbf{x}) \Rightarrow q_i(\mathbf{x}),$$9 as redundant because of $\mathbf{x}$0. On the PCA pump benchmark, the system reconstructed 144/144 requirements; 135/144 were initially semantically equivalent, a single repair iteration fixed the remaining 9, final equivalence reached 144/144, and mean cosine similarity was 0.8688.

The counterexample-guided repair experiment used 65 scenario-based safety questions: 29 single-requirement queries, 15 multi-requirement queries, and 21 no-requirement queries. Final verified accuracy was 55.4% with no feedback, 58.5% with self-repair, 80.0% with requirement-only feedback, and 98.5% with full CEGR. Repair success rates were 12.1%, 10.0%, 59.4%, and 97.1%, respectively. The reported difference between requirement-only feedback and full CEGR was 18.5 points.

In end-to-end fault detection, the paper mutated each of the 64 requirements one at a time and reports 63/64 defects detected, or 98.4%. Every mutated specification remained globally satisfiable, so the defect signal came not from inconsistency checking alone but from bidirectional semantic distinction between original and mutated encodings. In ambiguity resolution, 12/64 requirements were flagged as ambiguity-sensitive, or 18.8%. Pairwise SMT agreement across all samples was initially 44.0%; after clarification, ambiguity-sensitive requirements dropped to 0/64, pairwise SMT agreement rose to 100%, and mean distinct encodings per requirement fell from 1.59 to 1.00.

6. Relation to adjacent verification-centered medical AI

Several contemporaneous systems instantiate verification-centered designs that are related to VERIMED at the methodological level but are not the same framework: RLVR for medical visual information extraction (Liu et al., 16 Jun 2025), claim-verification-driven DPO for Brief Hospital Course summarization (Liu et al., 11 Mar 2026), claim-level verification for biomedical RAG (Ji et al., 10 Jan 2026), and rubric-guided generator-verifier synthesis for medical VQA (Huang et al., 29 Oct 2025).

The medical VIE work based on RLVR fine-tunes Qwen2.5-VL-7B using only 100 annotated medical report images selected for diversity from a pool of over 17,000 medical images (Liu et al., 16 Jun 2025). Its reward is designed to be verifiable, balanced, and aligned with practical extraction needs: a format reward enforces the required output structure, and a matching reward balances precision and recall over flattened JSON key–value pairs. The strongest reported model, RL-100, reaches 77.81 F1, 79.85 precision, and 75.88 recall on a 203 image–JSON pair medical VIE test set.

VERI-DPO uses a retrieval-augmented verifier that labels claim-evidence pairs as Supported, Not Supported, or Not Addressed through a single-token format and then mines length-controlled, contradiction-anchored preference pairs for DPO (Liu et al., 11 Mar 2026). On MIMIC-III-Ext-VeriFact-BHC, it reduces Not Supported claim rates from 10.7% to 1.9% under a local verifier judge and from 11.6% to 6.4% under a GPT-4o judge, while improving validity from 76.7% to 82.5% and increasing output length from 1855 chars to 2159 chars.

MedRAGChecker decomposes a biomedical RAG answer into atomic claims, verifies each claim against retrieved evidence with a textual NLI model, augments that with biomedical knowledge-graph consistency, and aggregates claim decisions into answer-level diagnostics such as faithfulness, hallucination, context precision, self-knowledge, claim recall, and safety-critical error rate (Ji et al., 10 Jan 2026). Its default checker is an F1-weighted ensemble, and on KG-aligned claims the fused NLI+KG system improves human-study accuracy from 63.4 to 69.8 and macro-F1 from 59.2 to 64.7.

MedVLSynther synthesizes medical multiple-choice VQA directly from open biomedical literature by conditioning on figure images, captions, and in-text references, then passing generated items through a three-stage verifier with essential gates, bonus criteria, and penalty criteria (Huang et al., 29 Oct 2025). The final dataset, MedSynVQA, contains 13,087 audited questions over 14,803 images spanning 13 imaging modalities and 28 anatomical regions. Training open-weight LMMs with reinforcement learning using verifiable rewards yields average accuracies of 55.85 for a 3B model and 58.15 for a 7B model across six medical VQA benchmarks.

Taken together, these papers indicate a broader design pattern: verification artifacts are no longer used only for post hoc evaluation but also for ambiguity detection, preference mining, reward definition, and repair. This suggests that VERIMED’s central idea—coupling generative modeling with machine-checkable constraints—has become a recognizable methodological theme across medical AI.

7. Limitations, boundaries, and non-equivalences

The VERIMED requirements-auditing paper states several limitations directly (Hall et al., 13 May 2026). Evaluation is mostly on hemodialysis and PCA pump requirements, so domain specificity remains significant. Faithfulness is not fully solved because the system relies on proxy signals rather than a direct oracle of intent. Temporal expressiveness is limited because the framework uses current-state SMT conditions rather than full temporal logic. Scalability to larger industrial documents remains an open concern. The paper also states that the system should not be used in safety-critical applications without expert review.

Several boundary cases in the surrounding literature are explicit. The emergency-department chest-radiograph benchmark evaluates AIRead, Lingshu, MAIRA-2, MedGemma, and MedVersa against radiologist-written reports, but it states that VERIMED does not appear in the title, abstract, methods, tables, figures, supplementary text, or references, and that it is not one of the evaluated models, not a dataset, not a benchmark, and not an acronym used in this study (Lim et al., 29 Nov 2025). The immersive EHR visualization system EXR is described as relevant to VERIMED because it addresses how complex, multimodal medical records can be made understandable in immersive environments, but it is an Extended Reality platform built around FHIR integration, volumetric imaging, and AI-generated segmentation rather than a requirements-auditing framework (Marteau et al., 5 Dec 2025). The community-driven DICOM validation service of "A Community-Driven Validation Service for Standard Medical Imaging Objects" is a web-based validator for standard medical imaging objects with client-side de-identification and structured JSON reporting, again a different technical lineage (Silva et al., 2018). Finally, the RPM architecture Veritas-RPM explicitly states that VERIMED is not mentioned in the paper and that, based on the paper content alone, it is unrelated (Misro et al., 17 Apr 2026).

These distinctions are important because the current literature uses verification in several non-equivalent ways: SMT-based auditing of natural-language requirements, evidence-grounded claim checking, reward verification for multimodal extraction, rubric-based dataset synthesis, interoperability validation for DICOM objects, and provenance-guided multi-agent triage. VERIMED refers most precisely to the neurosymbolic requirements-auditing pipeline, while broader uses of the term function mainly as thematic analogies rather than as exact system identity.