Lean statement

Randomized approximation of the perfect-matching count

Lean is a language for mathematical statements and proofs that a computer can verify. This page shows one statement file from OpenAI’s release, possible paper matches and independent reports. The code-like names below identify the definitions or theorems selected by the proof-verification settings.

Theorem selected for verification: OAI.MatchingFPRAS.thm_main

Lean statement file: MatchingFPRAS.leanShow on the mapOpenAI’s Lean catalogue does not list this as a main result; the release’s Lean notes for family 113 link it.

See the candidate theorem Who ran the proof-verification program Report a comparison with the paper (GitHub issue)

The Lean statement

The lines of the Lean statement that state the theorem, then the definitions in the file that it uses.

def MainStatement : Prop :=  ∃ (A : RandomMachine) (C d : ℕ), 0 < C ∧    ∀ (G : GraphInput) (ε δ : ℚ), 0 < ε → ε < 1 → 0 < δ → δ < 1 / 2 →      let t := timeBound C d G ε δ      (∀ bits : Fin t → Bool, ∃ q : ℚ, 0 ≤ q ∧ Outputs A (encodeInput G ε δ) bits q) ∧      (Z G = 0 → ∀ bits : Fin t → Bool, Outputs A (encodeInput G ε δ) bits 0) ∧      ((goodTapes A G ε δ t).card : ℚ) / (2 : ℚ) ^ t ≥ 1 - δ⋮theorem thm_main : MainStatement := by  sorry

A Lean statement states the theorem and leaves its proof as sorry on purpose. OpenAI’s proof is in a separate solution module, and a program called Comparator checks that proof against this statement.

Definitions needed to read it

Local definitions the statement names, followed through the definitions they name in turn. The match is by name in the source text, so a name reached only through notation can be missed; the full file is below.

structure OAI.MatchingFPRAS.GraphInput line 8

structure GraphInput where  n : ℕ  edges : Finset (Fin n × Fin n)  increasing : ∀ e ∈ edges, e.1 < e.2

definition OAI.MatchingFPRAS.Perfect line 14

def Perfect (G : GraphInput) (M : Finset (Fin G.n × Fin G.n)) : Prop :=  M ⊆ G.edges ∧ ∀ v : Fin G.n, ∃! e, e ∈ M ∧ (e.1 = v ∨ e.2 = v)

definition OAI.MatchingFPRAS.perfectMatchings line 17

noncomputable def perfectMatchings (G : GraphInput) : Finset (Finset (Fin G.n × Fin G.n)) :=  by    classical    exact G.edges.powerset.filter (Perfect G)

definition OAI.MatchingFPRAS.Z line 23

noncomputable def Z (G : GraphInput) : ℕ := (perfectMatchings G).card

abbreviation OAI.MatchingFPRAS.Symbol line 25
```
abbrev Symbol := Fin 8
```

definition OAI.MatchingFPRAS.encodeNat line 28

def encodeNat (n : ℕ) : List Symbol :=  (Nat.bits n).map (fun b => if b then 2 else 1) ++ [3]

definition OAI.MatchingFPRAS.encodeInt line 31

def encodeInt (z : ℤ) : List Symbol :=  (if z < 0 then [5] else [4]) ++ encodeNat z.natAbs

definition OAI.MatchingFPRAS.encodeRat line 35

def encodeRat (q : ℚ) : List Symbol := encodeInt q.num ++ encodeNat q.den

definition OAI.MatchingFPRAS.encodeInput line 38

def encodeInput (G : GraphInput) (ε δ : ℚ) : List Symbol :=  encodeNat G.n ++ encodeNat G.edges.card ++    (((G.edges.map toLex.toEmbedding).sort (· ≤ ·)).flatMap fun e =>      encodeNat (ofLex e).1.val ++ encodeNat (ofLex e).2.val) ++    encodeRat ε ++ encodeRat δ

structure OAI.MatchingFPRAS.RandomMachine line 45

structure RandomMachine where  states : ℕ  transition : Fin (states + 1) → Symbol → Bool →    Option (Fin (states + 1) × Turing.TM0.Stmt Symbol)

structure OAI.MatchingFPRAS.Configuration line 50

structure Configuration (A : RandomMachine) where  state : Option (Fin (A.states + 1))  tape : Turing.Tape Symbol

definition OAI.MatchingFPRAS.tick line 56

def tick (A : RandomMachine) (c : Configuration A) (bit : Bool) : Configuration A :=  match c.state with  | none => c  | some s => match A.transition s c.tape.head bit with    | none => ⟨none, c.tape⟩    | some (s', action) =>      ⟨some s', match action with        | .move d => c.tape.move d        | .write a => c.tape.write a⟩

definition OAI.MatchingFPRAS.initial line 66

def initial (A : RandomMachine) (input : List Symbol) : Configuration A :=  ⟨some 0, Turing.Tape.mk₁ input⟩

definition OAI.MatchingFPRAS.run line 70

def run (A : RandomMachine) (input : List Symbol) {t : ℕ}    (bits : Fin t → Bool) : Configuration A :=  (List.ofFn bits).foldl (tick A) (initial A input)

definition OAI.MatchingFPRAS.Outputs line 74

def Outputs (A : RandomMachine) (input : List Symbol) {t : ℕ}    (bits : Fin t → Bool) (q : ℚ) : Prop :=  (run A input bits).state = none ∧    (run A input bits).tape.right₀ = Turing.ListBlank.mk (encodeRat q)

definition OAI.MatchingFPRAS.timeBound line 81

def timeBound (C d : ℕ) (G : GraphInput) (ε δ : ℚ) : ℕ :=  C * ((encodeInput G ε δ).length + ⌈ε⁻¹⌉₊ + Nat.clog 2 ⌈δ⁻¹⌉₊ + 1) ^ d

definition OAI.MatchingFPRAS.goodTapes line 84

noncomputable def goodTapes (A : RandomMachine) (G : GraphInput) (ε δ : ℚ)    (t : ℕ) : Finset (Fin t → Bool) := by  classical  exact Finset.univ.filter fun bits => ∃ q : ℚ,    Outputs A (encodeInput G ε δ) bits q ∧    (1 - ε) * (Z G : ℚ) ≤ q ∧ q ≤ (1 + ε) * (Z G : ℚ)

Possible paper match, with no recorded review

Atlas selected this possible match by comparing words in the Lean statement with every statement in the family. No review of whether the statements mean the same thing is recorded.

Words of the Lean statement, its names split into words, that also appear in the theorem: 1/2, parameters, randomized, encoding, output, rational, returns, nonnegative and eight more. Found in the paper’s title, which its main theorem states: approximation, scheme, fully, graphs, perfect and matchings. Shared only with the release’s name for the Lean statement or OpenAI’s note on it: delta.

Statements in A Fully Polynomial Randomized Approximation Scheme for Perfect Matchings in General Graphs come first because the release’s name for this Lean statement shares words with that paper’s title.

Theorem 1.1 of A Fully Polynomial Randomized Approximation Scheme for Perfect Matchings in General Graphs

Theorem

There is a uniform classical randomized algorithm which, given G and rational parameters 0<\eps<1 and 0<\delta<1/2, returns a nonnegative rational number \widehat Z such that

\Prb\bigl[(1-\eps)Z(G)\le \widehat Z\le(1+\eps)Z(G)\bigr] \ge 1-\delta.

If Z(G)=0, the output is zero with certainty. The worst-case bit running time is polynomial in the input encoding length, \eps^{-1}, and \log\delta^{-1}.

Section 1, Introduction Read it in the paper TeX source, line 132

Show the TeX

There is a uniform classical randomized algorithm which, given $G$ and
rational parameters $0<\eps<1$ and $0<\delta<1/2$, returns a nonnegative
rational number $\widehat Z$ such that
\[
 \Prb\bigl[(1-\eps)Z(G)\le \widehat Z\le(1+\eps)Z(G)\bigr]
 \ge 1-\delta.
\]
If $Z(G)=0$, the output is zero with certainty. The worst-case bit running
time is polynomial in the input encoding length, $\eps^{-1}$, and
$\log\delta^{-1}$.

Other possible paper matches, closest wording first

Corollary 10.1 of A Fully Polynomial Randomized Approximation Scheme for Perfect Matchings in General Graphs. Words of the Lean statement, its names split into words, that also appear in the theorem: execution, 1/2, encoding, randomized, empty, exactly and twelve more. Shared only with the release’s name for the Lean statement or OpenAI’s note on it: delta.
Theorem 7.3 of A Fully Polynomial Randomized Approximation Scheme for Perfect Matchings in General Graphs. Words of the Lean statement, its names split into words, that also appear in the theorem: state, representations, run, tables, transition, within and eleven more. Shared only with the release’s name for the Lean statement or OpenAI’s note on it: error and probabilities.
Theorem 1.2 of Entropy and Face Dimension of the Perfect-Matching Polytope. Words of the Lean statement, its names split into words, that also appear in the theorem: list, includes, binary, exactly, output, returns and twelve more. Found in the paper’s title, which its main theorem states: perfect and matching.
Proposition C.1 of Entropy and Face Dimension of the Perfect-Matching Polytope. Words of the Lean statement, its names split into words, that also appear in the theorem: including, binary, lists, exactly, output, rational and twelve more. Shared only with the release’s name for the Lean statement or OpenAI’s note on it: gives.
Corollary A.7 of Entropy and Face Dimension of the Perfect-Matching Polytope. Words of the Lean statement, its names split into words, that also appear in the theorem: vertex, empty, exactly, edges, positive, edge and seven more.
Proposition 10.1 of Entropy and Face Dimension of the Perfect-Matching Polytope. Words of the Lean statement, its names split into words, that also appear in the theorem: output, time, uniform, input, length, bit and one more.

How Atlas selects possible matches: it compares words in the Lean statement with every statement in the family. It also splits Lean names into words. The release’s label and note receive less weight; a main theorem wins a close match. If the Lean wording yields no clear match, Atlas uses the catalogue description. This selects passages to compare; it does not establish that they mean the same thing.

Reported Comparator runs

two independent groups report that Comparator accepted runs for this Lean statement file: Carlos Toledo’s cert-machine; MathVet. Each group reports its own Comparator run for this statement file. Atlas has not repeated the runs.

For a configured theorem, Comparator tests whether OpenAI’s proof proves the exact Lean statement. Some files instead configure definitions for comparison by name and type. Acceptance does not establish that the statement means the same thing as the paper’s theorem.

Carlos Toledo’s cert-machine

How they ran it, in their words

Every Comparator challenge re-run on Linux with nanoda switched on, decided by a preregistered rule; every family’s challenge statements read against OpenAI’s headline, clause by clause. Decider: Comparator (leanprover/comparator d03acab1 = tag v4.34.0, built with the release’s toolchain v4.34.1), lean4export 076e8e57, landrun 811cfff5, nanoda_lib 3a240721 — on GitHub’s Linux runners (.github/workflows/openai-math-kernel.yml), one j…

Accepted Their term: “CERTIFIED”.
Re-run through Comparator with the independent nanoda kernel switched on: Lean’s kernel and nanoda both accept OpenAI’s solution.
Reported 10 October 2026, at the release version shown here. Original verification report

MathVet

How they ran it, in their words

An independent, model-assisted, pre-referee reading of each family’s challenge statements against its headline claim under a published rubric (PROTOCOL.md), with its own Comparator runs per challenge. Its protocol describes a planned error-rate study; this import does not establish that the study has been completed.

Accepted Their term: “comparator-sandboxed-pass”.
Re-run through Comparator in a sandboxed virtual machine: accepted.
Reported 8 October 2026, at the release version shown here. Original verification report

What an accepted Comparator run would establish

If Comparator is run under this configuration and accepts, the solution proves the configured theorem using only the allowed axioms, and the Lean kernel accepts every step.

This configuration lists no definition holes, so every definition the statement uses is compared as it is written in this file.

Allowed axioms: propext, Quot.sound, Classical.choice

Acceptance leaves open whether the Lean statement means the same thing as the paper’s theorem, whether the paper’s other claims are correct, and whether the result is new. Those questions require comparing the definitions and statements, reviewing the paper’s arguments, and reading the earlier literature.

Do family 113’s Lean statements express the advertised result?

These assessments compare all the family’s Lean statements with the whole result OpenAI describes in its catalogue. They do not assess this statement alone. Each group uses its own published rules.

MathVet and cert-machine agree on how much of the advertised result the Lean statements express.

MathVet
Finds the whole advertised result stated or implied Their term: “full”.
The challenge statements imply the headline claim after unpacking definitions or one routine step. Their record
Their note: None for the FPRAS and the pointwise entropy bounds; the sharp face-dimension bound is not stated (TriangleFace is only the triangle-expansion face correspondence).
Definitions the group asks readers to compare with the paper: Randomized machine is hand-rolled: RandomMachine (single finite transition table on Turing.Tape (Fin 8), one fair coin per tick, tick = one write/move via Turing.TM0.Stmt), input encoded sparsely with binary encodeNat; maxMatchingEntropy := sSup (entropy '' feasibleLaws y) (nonempty and bounded on the matching polytope)
Carlos Toledo’s cert-machine
Finds the whole advertised result stated or implied Their term: “MATCHES”.
The challenge statements state the headline as OpenAI wrote it. Their record

Read the complete assessments on the family page.

OpenAI’s own note on what this Lean statement covers

“The formalization gives a fully polynomial randomized approximation scheme for counting perfect matchings in every finite simple undirected graph. For rational $0<\varepsilon<1$ and $0<\delta<1/2$, it returns a nonnegative rational estimate with relative error at most $\varepsilon$ with probability at least $1-\delta$. If the graph has no perfect matching, every execution returns zero.”
Quoted from OpenAI’s Lean note for this family

An AI agent drafted an interpretation of that note, classifying this statement as “states a paper’s theorem as the paper does”. No human review of the draft is recorded.

Supporting material

The complete Lean statement file

110 lines, copied from release version fd4aeeb. A name defined in this file links to its line; pointing at the name shows its definition.

Declared in this fileOpenAI’s library at fd4aeebOther linked names open the current documentation for Mathlib, Lean’s mathematical library.

Links in the file: 57 to its own declarations, 53 to Mathlib’s documentation. 19 declared names also link to the same declaration in OpenAI’s library. OpenAI uses Mathlib version d13f23b. The linked documentation describes the current version, so names that have since changed may be missing there.

Definitions and lemmas named by the statement

If Comparator accepts a proof, it proves thm_main exactly as written here. To compare that statement with the paper, also read the definitions and lemmas listed below. Atlas found them by following names in the source text and lists each after the names it uses. For x.foo, Atlas includes every foo defined here for a type, even when the statement may use only one of them.

It reaches all 18 other declarations of the file; with the theorem itself they span 64 lines. 1 of them is named in the statement itself.

Names in the namespace OAI.MatchingFPRAS are listed without it.

structure GraphInputline 8library
def Perfectline 14library
def perfectMatchingsline 17library
def Zline 23library
abbrev Symbolline 25library
def encodeNatline 28library
def encodeIntline 31library
def encodeRatline 35library
def encodeInputline 38library
structure RandomMachineline 45library
structure Configurationline 50library
def tickline 56library
def initialline 66library
def runline 70library
def Outputsline 74library
def timeBoundline 81library
def goodTapesline 84library
def MainStatementline 94in the statementlibrary
theorem thm_mainline 105selected theoremlibrary

import Mathlibnamespace OAInamespace MatchingFPRAS/-- Each unordered edge is represented once, by increasing endpoints. -/structure GraphInput where  n : ℕ  edges : Finset (Fin n × Fin n)  increasing : ∀ e ∈ edges, e.1 < e.2/-- Exactly one selected edge is incident to every vertex. -/def Perfect (G : GraphInput) (M : Finset (Fin G.n × Fin G.n)) : Prop :=  M ⊆ G.edges ∧ ∀ v : Fin G.n, ∃! e, e ∈ M ∧ (e.1 = v ∨ e.2 = v)noncomputable def perfectMatchings (G : GraphInput) : Finset (Finset (Fin G.n × Fin G.n)) :=  by    classical    exact G.edges.powerset.filter (Perfect G)/-- The exact unweighted count, including the empty graph. -/noncomputable def Z (G : GraphInput) : ℕ := (perfectMatchings G).cardabbrev Symbol := Fin 8/-- Binary numeral followed by a delimiter. Tape blank is 0; bits use 1 and 2. -/def encodeNat (n : ℕ) : List Symbol :=  (Nat.bits n).map (fun b => if b then 2 else 1) ++ [3]def encodeInt (z : ℤ) : List Symbol :=  (if z < 0 then [5] else [4]) ++ encodeNat z.natAbs/-- A rational encoded by its reduced numerator and positive denominator. -/def encodeRat (q : ℚ) : List Symbol := encodeInt q.num ++ encodeNat q.den/-- Explicit sparse graph encoding, then the two rational parameters. -/def encodeInput (G : GraphInput) (ε δ : ℚ) : List Symbol :=  encodeNat G.n ++ encodeNat G.edges.card ++    (((G.edges.map toLex.toEmbedding).sort (· ≤ ·)).flatMap fun e =>      encodeNat (ofLex e).1.val ++ encodeNat (ofLex e).2.val) ++    encodeRat ε ++ encodeRat δ/-- A uniform randomized Post-Turing machine: a single finite transition table. -/structure RandomMachine where  states : ℕ  transition : Fin (states + 1) → Symbol → Bool →    Option (Fin (states + 1) × Turing.TM0.Stmt Symbol)structure Configuration (A : RandomMachine) where  state : Option (Fin (A.states + 1))  tape : Turing.Tape Symbol/-- A halted configuration is absorbing. Each nonhalting tick is exactly onewrite or one move, or the detection of halt. -/def tick (A : RandomMachine) (c : Configuration A) (bit : Bool) : Configuration A :=  match c.state with  | none => c  | some s => match A.transition s c.tape.head bit with    | none => ⟨none, c.tape⟩    | some (s', action) =>      ⟨some s', match action with        | .move d => c.tape.move d        | .write a => c.tape.write a⟩def initial (A : RandomMachine) (input : List Symbol) : Configuration A :=  ⟨some 0, Turing.Tape.mk₁ input⟩/-- Bounded execution on a finite prefix of the random tape. -/def run (A : RandomMachine) (input : List Symbol) {t : ℕ}    (bits : Fin t → Bool) : Configuration A :=  (List.ofFn bits).foldl (tick A) (initial A input)def Outputs (A : RandomMachine) (input : List Symbol) {t : ℕ}    (bits : Fin t → Bool) (q : ℚ) : Prop :=  (run A input bits).state = none ∧    (run A input bits).tape.right₀ = Turing.ListBlank.mk (encodeRat q)/-- A fixed-degree polynomial in input bits, ε⁻¹, and log δ⁻¹.Natural ceilings and binary ceiling-log change this bound only by constants. -/def timeBound (C d : ℕ) (G : GraphInput) (ε δ : ℚ) : ℕ :=  C * ((encodeInput G ε δ).length + ⌈ε⁻¹⌉₊ + Nat.clog 2 ⌈δ⁻¹⌉₊ + 1) ^ dnoncomputable def goodTapes (A : RandomMachine) (G : GraphInput) (ε δ : ℚ)    (t : ℕ) : Finset (Fin t → Bool) := by  classical  exact Finset.univ.filter fun bits => ∃ q : ℚ,    Outputs A (encodeInput G ε δ) bits q ∧    (1 - ε) * (Z G : ℚ) ≤ q ∧ q ≤ (1 + ε) * (Z G : ℚ)/-- A uniform approximation scheme using independent fair bits. All tapes haltwithin the fixed polynomial bound and return a nonnegative rational.A zero count always produces encoded zero. -/def MainStatement : Prop :=  ∃ (A : RandomMachine) (C d : ℕ), 0 < C ∧    ∀ (G : GraphInput) (ε δ : ℚ), 0 < ε → ε < 1 → 0 < δ → δ < 1 / 2 →      let t := timeBound C d G ε δ      (∀ bits : Fin t → Bool, ∃ q : ℚ, 0 ≤ q ∧ Outputs A (encodeInput G ε δ) bits q) ∧      (Z G = 0 → ∀ bits : Fin t → Bool, Outputs A (encodeInput G ε δ) bits 0) ∧      ((goodTapes A G ε δ t).card : ℚ) / (2 : ℚ) ^ t ≥ 1 - δ/-- A fully polynomial randomized approximation scheme for perfect matchingsin every finite simple undirected graph. -/theorem thm_main : MainStatement := by  sorryend MatchingFPRASend OAI

Every extracted statement of the accompanying papers

The statements the atlas extracted automatically from each accompanying paper’s TeX source, with links to the full sources.

A Fully Polynomial Randomized Approximation Scheme for Perfect Matchings in General Graphs

Theorem

There is a uniform classical randomized algorithm which, given G and rational parameters 0<\eps<1 and 0<\delta<1/2, returns a nonnegative rational number \widehat Z such that

\Prb\bigl[(1-\eps)Z(G)\le \widehat Z\le(1+\eps)Z(G)\bigr] \ge 1-\delta.

If Z(G)=0, the output is zero with certainty. The worst-case bit running time is polynomial in the input encoding length, \eps^{-1}, and \log\delta^{-1}.

Section 1, Introduction Read it in the paper TeX source, line 132

Show the TeX

There is a uniform classical randomized algorithm which, given $G$ and
rational parameters $0<\eps<1$ and $0<\delta<1/2$, returns a nonnegative
rational number $\widehat Z$ such that
\[
 \Prb\bigl[(1-\eps)Z(G)\le \widehat Z\le(1+\eps)Z(G)\bigr]
 \ge 1-\delta.
\]
If $Z(G)=0$, the output is zero with certainty. The worst-case bit running
time is polynomial in the input encoding length, $\eps^{-1}$, and
$\log\delta^{-1}$.

Entropy and Face Dimension of the Perfect-Matching Polytope

Theorem (Pointwise entropy bounds)

Let G be a loopless multigraph on 2m\ge2 vertices with at least one perfect matching. For every x\in P(G),

F(x)-\left(2-\frac2m\right)B(x) \le H(x)\le F(x).

Section 1, Introduction Read it in the paper TeX source, line 33

Show the TeX

Let $G$ be a loopless multigraph on $2m\ge2$ vertices with at least one
perfect matching. For every $x\in P(G)$,
\begin{equation}
                  F(x)-\left(2-\frac2m\right)B(x)
                  \le H(x)\le F(x).
\end{equation}

Theorem (Deterministic approximate counting)

There is one uniform deterministic algorithm which, on a graph on n vertices with nonnegative binary integer pair multiplicities, returns an integer A\ge0 satisfying

N(G)/512^n\le A\le N(G).

Its running time and output length are polynomial in the input bit length. In particular, A=0 exactly when N(G)=0. The guarantee includes a compact input consisting of binary n and a list of positive pair records.

Section 1, Introduction Read it in the paper TeX source, line 201

Show the TeX

There is one uniform deterministic algorithm which, on a graph on $n$
vertices with nonnegative binary integer pair multiplicities, returns an
integer $A\ge0$ satisfying
\[
                         N(G)/512^n\le A\le N(G).
\]
Its running time and output length are polynomial in the input bit length.
In particular, $A=0$ exactly when $N(G)=0$. The guarantee includes a compact
input consisting of binary $n$ and a list of positive pair records.

Configuration and file facts

File: lean/ComparatorChallenges/MatchingFPRAS.lean
OpenAI’s Lean catalogue: OpenAI’s Lean catalogue does not list this as a main result; the release’s Lean notes for family 113 link it.
Solution module: OAI.Combinatorics.MatchingCount.Main
Allowed axioms: propext, Quot.sound, Classical.choiceThe axioms this configuration allows a proof to use. A replay shows which of them a proof uses.
Imports: Mathlib
Imports from outside Mathlib: None
Local vocabulary: 18 local vocabulary declarations
Lines of Lean, without comments or blank lines: 64
Second proof-verification program (nanoda): Off in OpenAI's configuration.

A shareable summary of this page: the proposed paper match, what the Lean statement expresses, and which reviews are recorded.

Plectis Atlas