Filtration-Compiled Autoformalization of Dynamic Financial Models

Abstract

Language models can translate mathematical prose into formal statements and produce machine-checked proofs, and they are increasingly used in finance. Such a proof, however, certifies the model as written, not the model intended. In dynamic finance the difference concerns information: a position must be chosen using only what is known when it is taken, and an exercise decision cannot depend on prices not yet observed. A formalization that allows more information than the model specifies can be proved correct and still be financially inadmissible. We show that auditing realized outcomes cannot detect such errors: one realized history is consistent with exponentially many patterns of look-ahead, while two scenarios suffice to expose one. We build the model’s information structure into the formalization procedure, so that every intermediate quantity provably uses only information available at its date, and verify the main theorems in Lean 4. On 2960 synthetic instances, removing only the information rules lowers certified success by 19.8 percentage points, and the procedure then declares 91.5% of look-ahead errors valid. When the model is read from prose, the main residual error is a timing convention the text never states; in an exploratory experiment, requiring a verbatim quotation for each convention eliminated it.

1. Introduction

Language models have become capable enough to translate mathematical prose into the syntax of a proof assistant and to search for proofs of the resulting statements (First et al., 2023; Jiang et al., 2023; Y. Wu et al., 2022; Yang et al., 2023), and in restricted domains they now produce proofs at a level that was recently out of reach (Trinh et al., 2024). At the same time, language models are being adopted across quantitative finance (Li et al., 2023; S. Wu et al., 2023). The natural combination—having a model read a description of a market, formalize it, and prove that a proposed trading or exercise rule is sound—is attractive precisely because the proof assistant appears to remove the need to trust the model.

It does not, and the reason is specific to dynamic finance. A proof assistant certifies the statement it is given about the model it is given. If the formalization silently enlarges the information available at a date, weakens predictability to adaptedness, shifts the convention that fixes when a position is chosen, or substitutes the physical measure for the pricing measure, then the resulting theorem is true and the financial claim is false. In a static valuation problem such errors are arithmetic and usually visible in the numbers. In a dynamic one they are informational: an admissible object must be measurable with respect to the filtration that describes what is known when it is formed (Föllmer & Schied, 2016; Harrison & Kreps, 1979; Harrison & Pliska, 1981), and a violation of that requirement need not disturb any number the model produces.

Consider a trading rule that fixes the position for $(t,t+1]$ after seeing $S_{t+1}$, a stopping rule that consults information revealed only after it claims to stop, or a value process that satisfies the terminal identity but not the local ones at intermediate nodes. Each is inadmissible in the model. Each can nevertheless reproduce a plausible profit and loss series, and some reproduce the exact numbers of a legitimate rule. The practical importance of this failure mode is well documented: backtest overfitting and its statistical consequences have been analyzed at length (Bailey et al., 2014; Harvey et al., 2016), and the literature on quantitative practice treats look-ahead contamination as a first-order source of model risk (López de Prado, 2018). What has been missing is a statement of how much of this contamination is detectable in principle from realized data, and a formalization procedure whose guarantees do not depend on the analyst noticing the problem.

This paper contributes both. Section 4 proves that validating an autoformalized model against its own output cannot detect such errors: given a predictable strategy and a realized path, one can construct exponentially many strategies with identical realized holdings, wealth and returns along that path whose sets of measurability failures are pairwise distinct. Any audit that reads only the realized record therefore returns the same verdict on a legitimate strategy and on a contaminated one. A second result shows that a refutation needs at least two terminal paths, so the two-path witness produced by our method is the smallest possible.

The positive contribution is a formalization procedure that treats the filtration as a specification rather than as a hypothesis. We say that the filtration is compiled into the procedure because, before any reasoning starts, it is turned into the structure of the procedure: for each distinct information state a slice of up to three components (forward, backward and reconciliation), and for each component a rule stating which objects it may read. Objects carry the date of the information they depend on, components exchange them only as messages that record this date, and information about the future may reach an earlier decision only as a conditional expectation given what is known at that decision. Under these rules non-anticipativity becomes a property of the protocol. Theorems 3 and 4 show that whatever a date-t component computes from legal inputs is ${\mathcal{F}}_t$-measurable, with no analysis of the computation itself and no assumption about the behavior of the language model that proposed the formalization. Theorems 6 and 7 supply the tower property in the finite setting and compose one-period identities into the global pricing identity, and Theorem 5 shows that one slice per distinct information state is the fewest any admissible decomposition can use. Figure 1 shows the procedure from prose to verified verdict.

Figure 1. The procedure from prose to verified verdict. A language model reads the specification and proposes the timing conventions and the model; a convention is admitted only together with a verbatim quotation from the source, and is otherwise marked as unstated (Section 11.3). After structural checks, the filtration compiler builds one slice of components per information state, and the exact core verifies the obligation with a forward and a backward pass over dates, a reconciliation at each date, and the message rules of Section 5. The result is a verdict with a certificate, or with a witness of the violation, which the Lean kernel checks again. If the verdict depends on a convention that the source leaves open, the procedure abstains and names the missing convention. Nothing above the dashed line is trusted; below it, the verdicts of the exact core are confirmed by the Lean kernel, the only part whose acceptance counts as a proof.

Every theorem stated below, apart from two counting corollaries, is verified in Lean 4 (de Moura & Ullrich, 2021) using only its core library. Instance data are carried as unnormalized pairs of integers, on which all operations reduce inside the kernel, and proved bridge lemmas transfer the resulting statements to the rational numbers; no computation outside the kernel is relied on. The language model sits entirely outside this trusted part: it proposes a formalization, and nothing it produces is accepted until the exact core—the part of the procedure that checks the obligations in exact rational arithmetic—verifies it, the information rules admit it and the kernel accepts the certificate.

The empirical part uses 2960 synthetic instances with exact rational data and addresses two separate questions. Section 10 asks whether the procedure verifies a model that is supplied to it, and isolates the contribution of the information rules. Section 11 asks what happens when a language model must first recover the model from prose, and tests the conclusions on five language models. There the dominant residual error is not a misread number but a timing convention that the text never states and the language model nevertheless supplies. In an exploratory experiment, a grounding constraint that admits a convention only when the language model quotes the sentence stating it removes these errors: the procedure then abstains on every under-determined specification and states which convention is missing.

Section 3 fixes the setting and the scope of the framework, Section 4, Section 5, Section 6 and Section 7 develop the theory, and Section 8 presents the formal development. Section 9 sets out the benchmark and the experimental design, Section 10 and Section 11 report the results, and Section 12, Section 13 and Section 14 give case studies, a discussion and conclusions. Appendix A lists the prompts and model settings, and Appendices Appendix B and Appendix C give additional results.

2. Related Work

The problem sits where several bodies of literature meet, each of which supplies part of the picture while leaving the informational question open.

• Autoformalization and machine-checked proof.

Translating mathematical prose into the language of a proof assistant, and searching for proofs of the result, has advanced quickly (First et al., 2023; Jiang et al., 2023; Polu & Sutskever, 2020; Y. Wu et al., 2022; Yang et al., 2023), to the point of competitive performance in restricted domains (Trinh et al., 2024). The benchmarks that drive this work are drawn from competition problems and from formal libraries such as mathlib (The Mathlib Community, 2020), where the statement to be proved is supplied and the difficulty lies in finding the proof. Evaluation is correspondingly proof-centric: a formalization is counted as correct when the kernel accepts it. That is the criterion this paper argues is insufficient for dynamic financial models, where a kernel-accepted proof of a subtly misspecified statement is the characteristic failure rather than an exception. The reverse direction—checking that a formal statement says what the informal one said—is recognized as the weak link, and is usually addressed by human inspection or by translating the formal statement back into prose. Neither helps here: the discrepancies that matter are invisible in the numbers a model produces, by Theorem 1.

• Formal methods for numerical and financial computation.

Formalizing analysis in a proof assistant is by now well developed, and surveys of that effort make clear where the weight has fallen: on real and floating-point arithmetic and on the libraries needed to reason about it (Boldo et al., 2016). Verification of numerical software inherits that emphasis, asking whether an implementation stays within a stated bound of its real-arithmetic specification, and taking the specification itself as given. The errors studied here are of the opposite type. They occur in the specification, they are exact rather than approximate, and they leave the computed numbers untouched. Our use of exact rational arithmetic is therefore not a sharpening of numerical error control but a way of making a residual into a certificate; Section 10 separates the two effects experimentally.

• Look-ahead and backtest validity.

That trading rules can be contaminated by information they should not have is well known in quantitative practice. The statistical literature quantifies the consequences of selecting a strategy on the same data used to evaluate it (Bailey et al., 2014; Harvey et al., 2016), and treats look-ahead as a first-order source of model risk (López de Prado, 2018). The instruments are inferential: deflated performance measures, multiple-testing corrections, out-of-sample protocols. All of them take the strategy as given and ask whether its measured performance is real. The prior question—whether the strategy is an admissible object of the model at all—is not one that realized performance can answer, and Corollary 1 explains why: contamination and legitimacy are compatible with the same record.

• Language-model systems for finance.

Domain-adapted language models and multi-component systems are being applied across financial analysis (Li et al., 2023; S. Wu et al., 2023), and are evaluated by agreement with reference answers. Such a measure cannot detect an informationally inadmissible intermediate step, because the reference answer records the conclusion, not the information used to reach it. The procedure proposed here also consists of several components, but they are indexed by the dates of a filtration, and what governs their communication is a measurability constraint rather than a workflow.

• Mathematical foundations.

The mathematics we formalize is classical (Cox et al., 1979; Delbaen & Schachermayer, 1994; Föllmer & Schied, 2016; Harrison & Kreps, 1979; Harrison & Pliska, 1981; Neveu, 1975; Peskir & Shiryaev, 2006; Snell, 1952). Our contribution is not to this theory but to its use as a specification: the filtration, which in the classical treatment is a hypothesis under which theorems are stated, becomes here a constraint that a verification procedure enforces on itself.

3. Discrete-Time Setting

3.1. Event Trees and Filtrations

Let $\mathcal{T}=(V,E,r,\ell )$ be a finite rooted tree with root r, level map $\ell :V\to \{0,\dots ,T\}$, and $V_t={\ell }^{-1}\left(t\right)$. For $v\in V_t$ with $t<T$ let $Ch\left(v\right)\subseteq V_{t+1}$ denote its children, and assume $Ch\left(v\right)\ne \varnothing$. Each edge carries a strictly positive rational transition probability $q(u\mid v)$ with ${\sum }_{u\in Ch\left(v\right)}q(u\mid v)=1$. The terminal level $\Omega =V_T$ is the path space; for $v\in V$ we write

$$C\left(v\right)=\{\omega \in \Omega :v\mathrm{lies}\mathrm{on}\mathrm{the}\mathrm{path}\mathrm{from}r\mathrm{to}\omega \},$$

and for $\omega \in \Omega$ we write $v_t\left(\omega \right)$ for the unique node of $V_t$ on its path and $C_t\left(\omega \right)=C\left(v_t\left(\omega \right)\right)$. The partitions ${\Pi }_t=\{C\left(v\right):v\in V_t\}$ generate the filtration ${\mathcal{F}}_t=\sigma \left({\Pi }_t\right)$, and ${\mathcal{F}}_0\subseteq \dots \subseteq {\mathcal{F}}_T$ because every element of ${\Pi }_t$ is a union of elements of ${\Pi }_{t+1}$. Since ${\Pi }_t$ is a finite partition that generates ${\mathcal{F}}_t$, a map $X:\Omega \to {\mathbb{Q}}^k$ is ${\mathcal{F}}_t$-measurable exactly when it is constant on each cell $C\left(v\right)$, $v\in V_t$. We use this characterization throughout and never require more of the underlying measure theory. Measurability is stated for vector-valued maps because the holdings and prices of d assets are vectors in ${\mathbb{Q}}^d$; conditional expectations are defined below for scalar maps $X:\Omega \to \mathbb{Q}$ and applied componentwise to vectors.

The pricing measure on $\Omega$ is $\mu \left(\omega \right)={\prod }_{t=0}^{T-1}q(v_{t+1}\left(\omega \right)\mid v_t\left(\omega \right))$, and for $A\subseteq \Omega$ we write $\mu \left(A\right)={\sum }_{\omega \in A}\mu \left(\omega \right)$. Because all transition probabilities are strictly positive, $\mu \left(C_t\left(\omega \right)\right)>0$ for every t and $\omega$, and the conditional expectation of $X:\Omega \to \mathbb{Q}$ is the exact rational quantity

$${\mathbb{E}}_Q[X\mid {\mathcal{F}}_t]\left(\omega \right)={\displaystyle \frac{1}{\mu \left(C_t\left(\omega \right)\right)}}\sum _{{\omega }^{\prime }\in C_t\left(\omega \right)}\mu \left({\omega }^{\prime }\right)X\left({\omega }^{\prime }\right).$$

(1)

When X is ${\mathcal{F}}_{t+1}$-measurable, (1) reduces to the familiar one-step average ${\sum }_{u\in Ch\left(v\right)}q(u\mid v)X\left(u\right)$ over the children of $v=v_t\left(\omega \right)$, where $X\left(u\right)$ denotes the common value of X on $C\left(u\right)$. We work with (1) because it is defined for arbitrary X and because it is the form in which the tower property is established in Section 6.

3.2. Obligations

Fix d risky assets with discounted prices $S_t:\Omega \to {\mathbb{Q}}^d$, adapted by construction, and a numeraire normalization fixed once for the model. Conditions stated for vector-valued objects are understood componentwise, and $S_t^a$ and $H_{t+1}^a$ denote the components for asset a. We adopt the convention that the position recorded for the interval $(t,t+1]$ is chosen at date t. A trading strategy is a family $H={\left(H_{t+1}\right)}_{t=0}^{T-1}$ of maps $H_{t+1}:\Omega \to {\mathbb{Q}}^d$, where the index $t+1$ names the interval $(t,t+1]$ over which the position is held, not the date at which it is chosen. This representation does not build measurability into the object, so predictability is a property to be verified rather than an assumption. The obligations we consider are the following.

Definition 1.

Let $X=\left(X_t\right)$ be a process, H a strategy, V a wealth process, G a terminal payoff, $\left(G_t\right)$ an adapted exercise payoff, and $\tau :\Omega \to \{0,\dots ,T\}$ a random time.

(i) 

X is adapted if $X_t$ is ${\mathcal{F}}_t$-measurable for every t.

(ii) 

H is predictable if $H_{t+1}$ is ${\mathcal{F}}_t$-measurable for every $t<T$.

(iii) 

V is self-financing for H if for all $t<T$ and $\omega \in \Omega$,

$$V_{t+1}\left(\omega \right)=V_t\left(\omega \right)+H_{t+1}{\left(\omega \right)}^{\top }\left(S_{t+1}\left(\omega \right)-S_t\left(\omega \right)\right).$$

(2)

(iv) 

S is a Q-martingale if $S_t\left(\omega \right)={\mathbb{E}}_Q[S_{t+1}\mid {\mathcal{F}}_t]\left(\omega \right)$ for all $t<T$ and ω.

(v) 

Y is the value process of G if $Y_T=G$ and $Y_t={\mathbb{E}}_Q[Y_{t+1}\mid {\mathcal{F}}_t]$ for $t<T$.

(vi) 

Z is the Snell envelope of $\left(G_t\right)$ if $Z_T=G_T$ and $Z_t=\max \{G_t,{\mathbb{E}}_Q[Z_{t+1}\mid {\mathcal{F}}_t]\}$ for $t<T$.

(vii) 

τ is a stopping time if $\{\tau \le t\}\in {\mathcal{F}}_t$ for all t.

Each obligation admits a short certificate in both directions. In the affirmative direction the certificate is the collection of local identities; in the negative direction it is a finite witness, and Section 7 shows that such a witness always exists and identifies the earliest date at which the model is already inconsistent.

3.3. Scope and Assumptions

The framework rests on the following assumptions, and every guarantee below holds under them.

(a)

Time is discrete and the horizon T is finite.

(b)

Uncertainty is described by a finite tree whose transition probabilities are strictly positive rationals. They are the probabilities of the pricing measure Q stated in the model, and prices are discounted by a numeraire fixed in the model.

(c)

Information is described by a filtration given as a sequence of partitions of the path space: the one generated by the tree, or, when the model says so, a coarser or finer one specified explicitly.

(d)

Markets are frictionless: there are no transaction costs, position limits or solvency constraints.

(e)

The obligations are those of Definition 1.

Within these assumptions the procedure decides each obligation exactly and returns a certificate in either direction.

Its guarantees are relative to the model it verifies. If the language model recovers the wrong model—a mistyped price, a misread information structure, a wrong measure—the procedure verifies the wrong model, and the information rules enforce the wrong filtration; Section 11 measures how often this happens. The procedure checks that discounted prices are martingales under the stated measure, but not whether that measure is the right one for the market at hand (Section 13 returns to this point). It does not estimate a model from data, and it covers continuous-time models only through their discretizations. Finally, the benchmark of Section 9 is synthetic: its results describe performance on constructed problems with known answers, not on specifications written by practitioners.

4. Blindness of Outcome-Based Auditing

We first make precise what an audit based on realized data can see. Fix a strategy H, an initial wealth $V_0\in \mathbb{Q}$, and let $V(H,V_0)$ denote the wealth process generated by (2) from $V_0$. For a realized path ${\omega }^{*}\in \Omega$ the observational record is

$$\mathcal{O}(H,{\omega }^{*})=\left({\left(S_t\left({\omega }^{*}\right)\right)}_{t\le T},{\left(H_{t+1}\left({\omega }^{*}\right)\right)}_{t<T},{\left(V{(H,V_0)}_t\left({\omega }^{*}\right)\right)}_{t\le T}\right).$$

(3)

This contains the realized price path, the realized holdings, the realized wealth path and hence the realized period returns and terminal wealth: everything an audit of the realized history can observe.

Lemma  1.

If $H_{t+1}^{\prime }\left({\omega }^{*}\right)=H_{t+1}\left({\omega }^{*}\right)$ for every $t<T$, then $V{(H^{\prime },V_0)}_t\left({\omega }^{*}\right)=V{(H,V_0)}_t\left({\omega }^{*}\right)$ for every $t\le T$, and consequently $\mathcal{O}(H^{\prime },{\omega }^{*})=\mathcal{O}(H,{\omega }^{*})$.

Proof. 

Induction on t. Both processes start at $V_0$. Suppose they agree at date t along ${\omega }^{*}$. Evaluating (2) at ${\omega }^{*}$, the two increments depend on the strategy only through $H_{t+1}\left({\omega }^{*}\right)$ and $H_{t+1}^{\prime }\left({\omega }^{*}\right)$, which coincide, and the prices are the same in both cases; so the processes agree at $t+1$.    □

The lemma already says that the record depends on the strategy only through its values on the single realized path. The next theorem turns this into a quantitative obstruction; Figure 2 illustrates its construction on a three-period tree. Write

$$\mathcal{K}\left({\omega }^{*}\right)=\left\{t<T:|C_t\left({\omega }^{*}\right)|\ge 2\right\},\kappa \left({\omega }^{*}\right)=\left|\mathcal{K}\left({\omega }^{*}\right)\right|,$$

the set of dates at which the realized path has not yet been separated from every other path. Since $C_{t+1}\left({\omega }^{*}\right)\subseteq C_t\left({\omega }^{*}\right)$, the set $\mathcal{K}\left({\omega }^{*}\right)$ is an initial segment $\{0,1,\dots ,\kappa \left({\omega }^{*}\right)-1\}$.

Figure 2. The construction of Theorem 1 on a three-period tree. The realized path ${\omega }^{*}$ is drawn in bold. At date 1 the strategy may not distinguish ${\omega }^{*}$ from any other path in the cell $C_1\left({\omega }^{*}\right)$; perturbing the holding at ${\omega }_1$ alone therefore breaks ${\mathcal{F}}_1$-measurability while leaving every quantity observed along ${\omega }^{*}$ unchanged. Doing this independently at each date in $\mathcal{K}\left({\omega }^{*}\right)$ produces $2^{\kappa }-1$ strategies with the same observational record.

Theorem 1

(Observational indistinguishability). Let H be predictable, let ${\omega }^{*}\in \Omega$, fix an asset index a, a scalar $\delta \in \mathbb{Q}\setminus \left\{0\right\}$, and for each $t\in \mathcal{K}\left({\omega }^{*}\right)$ a path ${\omega }_t\in C_t\left({\omega }^{*}\right)\setminus \left\{{\omega }^{*}\right\}$. For $D\subseteq \mathcal{K}\left({\omega }^{*}\right)$ define $H^D$ by

$$H_{t+1}^D\left(\omega \right)=H_{t+1}\left(\omega \right)+\delta e_a\mathbf{1}\{t\in D\mathrm{and}\omega ={\omega }_t\},$$

(4)

where $e_a$ is the a-th unit vector. Then

(i) 

$H_{t+1}^D\left({\omega }^{*}\right)=H_{t+1}\left({\omega }^{*}\right)$ for every $t<T$ and hence, $\mathcal{O}(H^D,{\omega }^{*})=\mathcal{O}(H,{\omega }^{*})$;

(ii) 

the set of dates t at which $H_{t+1}^D$ fails to be ${\mathcal{F}}_t$-measurable is exactly D.

In particular, the $2^{\kappa \left({\omega }^{*}\right)}-1$ strategies $H^D$ with $D\ne \varnothing$ are pairwise distinct in their sets of measurability failures and all share the observational record of the predictable strategy H.

Proof. 

For (i), note that ${\omega }_t\ne {\omega }^{*}$ for every $t\in D$, so the indicator in (4) vanishes at $\omega ={\omega }^{*}$; Lemma 1 then gives the equality of records.

For (ii), let $t\in D$. Both ${\omega }_t$ and ${\omega }^{*}$ lie in $C_t\left({\omega }^{*}\right)$, and since H is predictable, $H_{t+1}\left({\omega }_t\right)=H_{t+1}\left({\omega }^{*}\right)$. Therefore,

$$H_{t+1}^D\left({\omega }_t\right)=H_{t+1}\left({\omega }^{*}\right)+\delta e_a\ne H_{t+1}\left({\omega }^{*}\right)=H_{t+1}^D\left({\omega }^{*}\right),$$

so $H_{t+1}^D$ is not constant on $C_t\left({\omega }^{*}\right)$ and hence not ${\mathcal{F}}_t$-measurable. Conversely, if $t\notin D$ then $H_{t+1}^D=H_{t+1}$, which is ${\mathcal{F}}_t$-measurable because H is predictable. Distinctness of the $H^D$ for distinct D follows because their failure sets are distinct.    □

Corollary 1

(Audit blindness). Let A be any map assigning to an observational record one of the two verdicts admissible and inadmissible. Then for every predictable H, every ${\omega }^{*}$ and every nonempty $D\subseteq \mathcal{K}\left({\omega }^{*}\right)$, the map A returns the same verdict on H and on $H^D$, and is therefore incorrect on at least one of the two. In particular, on a family of such pairs the fraction of pairs on which A is correct on both members is zero.

Proof. 

By Theorem 1(i) the two records coincide, so A returns the same verdict; by (ii) exactly one of the two strategies is predictable.    □

Corollary 2

(Exponential ambiguity). If $v_t\left({\omega }^{*}\right)$ has at least two children for every $t<T$, then $\kappa \left({\omega }^{*}\right)=T$ and a single observational record is compatible with $2^T-1$ distinct nonempty patterns of measurability failure.

Proof. 

Fix $t<T$. By hypothesis $v_t\left({\omega }^{*}\right)$ has two distinct children $u_1\ne u_2$. Every node of a finite tree with $Ch\left(v\right)\ne \varnothing$ for all non-terminal v has at least one terminal descendant, so $C\left(u_1\right)$ and $C\left(u_2\right)$ are nonempty; they are disjoint because $u_1\ne u_2$ lie at the same level. Since $C\left(u_1\right)\cup C\left(u_2\right)\subseteq C_t\left({\omega }^{*}\right)$ we get $|C_t\left({\omega }^{*}\right)|\ge 2$, whence $\mathcal{K}\left({\omega }^{*}\right)=\{0,\dots ,T-1\}$ and $\kappa \left({\omega }^{*}\right)=T$.    □

The obstruction is not an artifact of allowing arbitrary perturbations: it persists when the modification is restricted to a single asset, a single alternative path per date and an arbitrarily small $\delta$. It is a statement about which functions of the model the realized record determines. Figure 3 shows how the gap grows with the horizon.

Figure 3. The gap opened by Theorem 1, on trees in which every non-terminal node branches, so that $\kappa =T$. The number of distinct nonempty patterns of measurability failure, $2^T-1$ (labeled at each horizon), is compared with the number of observational records they produce, which is one: an audit that reads the record sees the same record for all of them. Circles mark horizons at which the family was enumerated exhaustively and the count confirmed.

The dual question is how large a certificate must be in order to refute predictability. Two paths are necessary, and two always suffice.

Theorem 2

(Optimal refutation size). For every strategy H and every $\omega \in \Omega$ there exists a predictable strategy $H^{♭}$ with $H_{t+1}^{♭}\left(\omega \right)=H_{t+1}\left(\omega \right)$ for all $t<T$. Consequently, if R is a predicate of the restriction of H to a single path and R implies that H is not predictable, then R is never satisfied: no single-path certificate can refute predictability.

Proof. 

Define $H_{t+1}^{♭}\left({\omega }^{\prime }\right)=H_{t+1}\left(\omega \right)$ if $C_t\left({\omega }^{\prime }\right)=C_t\left(\omega \right)$ and $H_{t+1}^{♭}\left({\omega }^{\prime }\right)=0$ otherwise. If $C_t\left({\omega }_1\right)=C_t\left({\omega }_2\right)$ then either both cells equal $C_t\left(\omega \right)$ or neither does, so $H_{t+1}^{♭}$ takes the same value at ${\omega }_1$ and ${\omega }_2$; hence, $H^{♭}$ is predictable. Taking ${\omega }^{\prime }=\omega$ gives $H_{t+1}^{♭}\left(\omega \right)=H_{t+1}\left(\omega \right)$. For the second claim, suppose R held for some H at $\omega$. Since R depends only on the restriction to $\omega$, it would also hold for $H^{♭}$, and would then imply that the predictable strategy $H^{♭}$ is not predictable, a contradiction.    □

A pair $({\omega }_1,{\omega }_2)$ with $C_t\left({\omega }_1\right)=C_t\left({\omega }_2\right)$ and $H_{t+1}\left({\omega }_1\right)\ne H_{t+1}\left({\omega }_2\right)$ refutes predictability and uses exactly two paths, and by Theorem 2 no certificate that mentions a single path can refute it. This is the sense in which the size is optimal: a two-path witness mentions the fewest terminal paths that any refutation can. The verification method of the next section produces this certificate, together with the date t, and Section 7 shows that the date it reports is the earliest one at which the model is inconsistent.

5. Information Discipline

Theorem 1 shows that the information content of a decision object cannot be recovered from what the model produces; it must be tracked while the model is built. We do so by attaching to every intermediate object the information set relative to which it is measurable, and by restricting how objects may be combined.

Objects are $\mathbb{Q}$-valued; vector-valued objects are treated componentwise. We distinguish three kinds. A model object is a description of the model itself: the tree, the transition kernel, the price functions, the payoff definitions. Such a description does not depend on which path is realized, so as a function on $\Omega$ it is constant and its scope—the date of the information it depends on—is 0; reasoning about it is legitimate at any date, because a proof quantifies over all paths. A realized object represents information disclosed along a particular history and carries as its scope the index t of the coarsest ${\mathcal{F}}_t$ that makes it measurable. Evaluating a model object along the realized path does not preserve its kind: the result is a realized object, with the scope its measurability dictates. A derived object is produced from other objects by one of the admissible operators below, and carries both its scope and the operator that produced it. The distinction between model and realized objects prevents a common conflation: that a proof may inspect the entire model does not entitle a trading rule to observe the entire model.

Five operators are admissible. The forward lift ${\mathcal{F}}_s\to {\mathcal{F}}_t$ for $s\le t$ leaves an object unchanged and only weakens its measurability claim. The conditional projection sends X to ${\mathbb{E}}_Q[X\mid {\mathcal{F}}_t]$, and the dynamic-programming step sends $(G_t,Z_{t+1})$ to $\max \{G_t,{\mathbb{E}}_Q[Z_{t+1}\mid {\mathcal{F}}_t]\}$. A join combines objects only when their measure, numeraire, date convention and node identifiers agree. Finally, a stopped process may be disclosed once the underlying random time has been shown to be a stopping time. Each operator produces an object whose scope is determined by its inputs, and the result records which operator produced it.

The compiled procedure attaches to each information state t a slice of up to three components (Figure 4); which of them are present depends on the checks the obligation requires. Three further components, for the model specification, the checking of messages and the compilation of certificates, serve all slices, and auxiliary components may be created on demand at a node where a violation is detected. A forward component $F_t$ checks the obligations that concern decisions taken at date t, such as the measurability of the position chosen at t; taken together, the forward components make a forward pass over the dates. A backward component $B_t$ computes values at date t from values at $t+1$, as in the recursions for the European value and the Snell envelope; together they make a backward pass. A reconciliation component $R_t$ compares, at date t, what the two passes have established and records the one-period identity that holds there. These one-period identities are the local certificates that Section 6 composes into global statements.

Figure 4. Information flow in the compiled procedure. Forward components $F_t$ check admissibility using only what is known at date t; backward components $B_t$ compute values from the terminal date backward; reconciliation components $R_t$ check at each date that the two agree. Model objects are readable everywhere. A realized object of scope $t+1$ is refused at date t (Proposition 1); the future influences an earlier decision only through a certified conditional projection, whose output is ${\mathcal{F}}_t$-measurable by construction. Boxes are components, and the shaded box holds the model objects. Solid black arrows are legal messages, dashed blue arrows carry values backward by conditional projection, and the red arrow marked × is a message that the rules block.

Objects move between components as messages. A message is a tuple $m=(y,\sigma ,k,\pi ,c)$ consisting of the object y, its scope $\sigma$, its kind $k\in \{\mathrm{model},\mathrm{realized},\mathrm{derived}\}$, its provenance $\pi$, and its certificate c. A message is legal for a component whose decisions are taken at date t if

$$\begin{array}{cc}\hfill k=\mathrm{realized}& :\sigma \le t;\hfill \\ \hfill k=\mathrm{derived}& :y\mathrm{carries}\mathrm{an}\mathrm{admissible}\mathrm{operator}\mathrm{and}\mathrm{its}\mathrm{certificate},\mathrm{and}\sigma \le t;\hfill \\ \hfill k=\mathrm{model}& :\mathrm{always};\mathrm{such}\mathrm{an}\mathrm{object}\mathrm{has}\sigma =0.\hfill \end{array}$$

(5)

A message is sound if y is indeed ${\mathcal{F}}_{\sigma }$-measurable. The rule that a realized object of scope $t+1$ is never legal at date t is what forbids raw information about the future from reaching an earlier decision; a backward recursion may still influence that decision, but only through a conditional projection, whose output is ${\mathcal{F}}_t$-measurable by construction.

Theorem 3

(Non-anticipativity of the protocol). Let $y_1,\dots ,y_n$ be the objects delivered to a component whose decisions are taken at date t, and suppose each corresponding message is legal in the sense of (5) and sound. If the component’s output Y is a pointwise function of its inputs, that is, if there exists $f:{\mathbb{Q}}^n\to \mathbb{Q}$ with

$$Y\left(\omega \right)=f\left(y_1\left(\omega \right),\dots ,y_n\left(\omega \right)\right)\mathrm{for}\mathrm{all}\omega \in \Omega ,$$

then Y is ${\mathcal{F}}_t$-measurable.

Proof. 

Let ${\omega }_1,{\omega }_2$ satisfy $C_t\left({\omega }_1\right)=C_t\left({\omega }_2\right)$. Fix $i\le n$ and let ${\sigma }_i$ be the scope of $y_i$. If $y_i$ is realized or derived then legality gives ${\sigma }_i\le t$, and if $y_i$ is a model object then ${\sigma }_i=0\le t$; in both cases ${\sigma }_i\le t$. Since the filtration is increasing, $C_t\left({\omega }_1\right)=C_t\left({\omega }_2\right)$ implies $C_{{\sigma }_i}\left({\omega }_1\right)=C_{{\sigma }_i}\left({\omega }_2\right)$, and soundness of the message gives $y_i\left({\omega }_1\right)=y_i\left({\omega }_2\right)$. Hence, the arguments of f agree at ${\omega }_1$ and ${\omega }_2$, so $Y\left({\omega }_1\right)=Y\left({\omega }_2\right)$. As ${\omega }_1,{\omega }_2$ were arbitrary in a common cell, Y is constant on the cells of ${\Pi }_t$ and therefore ${\mathcal{F}}_t$-measurable.    □

Theorem 3 is deliberately indifferent to what the component computes: the legality of its inputs already determines the measurability of its output. Its contrapositive is the diagnostic used in Section 10: if a decision taken at date t fails to be ${\mathcal{F}}_t$-measurable, then some input was illegal, unsound, or a model object reinterpreted as an observation.

Proposition 1.

A realized object of scope $t+1$ is never legal for a component deciding at date t, whereas an object obtained by conditional projection onto ${\mathcal{F}}_t$ is legal and sound at date t.

Proof. 

Immediate from (5), since $t+1>t$, together with the fact that ${\mathbb{E}}_Q[·\mid {\mathcal{F}}_t]$ produces an ${\mathcal{F}}_t$-measurable object, which is sound at scope t.    □

Theorem 3 covers components whose output is a pointwise function of their inputs, and Proposition 1 covers a single conditional projection. A backward component does both, and the object it projects may itself depend on the future. The next result covers every component at once.

Theorem 4

(Closure of the protocol). Consider a component deciding at date t, and suppose every message delivered to it is legal in the sense of (5) and sound. Let ${\mathcal{R}}_t$ be the smallest class of maps $\Omega \to \mathbb{Q}$ such that

(i) 

every delivered object belongs to ${\mathcal{R}}_t$;

(ii) 

if $Y_1,\dots ,Y_n\in {\mathcal{R}}_t$ and $f:{\mathbb{Q}}^n\to \mathbb{Q}$, then the map $\omega \mapsto f\left(Y_1\left(\omega \right),\dots ,Y_n\left(\omega \right)\right)$ belongs to ${\mathcal{R}}_t$;

(iii) 

${\mathbb{E}}_Q[X\mid {\mathcal{F}}_s]\in {\mathcal{R}}_t$ for every $s\le t$ and every $X:\Omega \to \mathbb{Q}$, whether or not X belongs to ${\mathcal{R}}_t$.

Then every element of ${\mathcal{R}}_t$ is ${\mathcal{F}}_t$-measurable. In particular, if $G_t$ is delivered, then $\max \{G_t,{\mathbb{E}}_Q[Z\mid {\mathcal{F}}_t]\}$ is ${\mathcal{F}}_t$-measurable for every $Z:\Omega \to \mathbb{Q}$.

Proof. 

Induction on the construction of an element of ${\mathcal{R}}_t$. A delivered object is ${\mathcal{F}}_t$-measurable by the argument in the proof of Theorem 3. If $Y_1,\dots ,Y_n$ are constant on the cells of ${\Pi }_t$, so is any pointwise function of them. For (iii), the right-hand side of (1) depends on $\omega$ only through $C_s\left(\omega \right)$, so ${\mathbb{E}}_Q[X\mid {\mathcal{F}}_s]$ is constant on the cells of ${\Pi }_s$; since $s\le t$, each cell of ${\Pi }_t$ lies inside a cell of ${\Pi }_s$, and the projection is constant on the cells of ${\Pi }_t$ as well. The final claim applies (ii) to $G_t$ and ${\mathbb{E}}_Q[Z\mid {\mathcal{F}}_t]$, which belong to ${\mathcal{R}}_t$ by (i) and (iii).    □

Forward and reconciliation components compute pointwise functions of their legal inputs, and backward components combine such functions with conditional projections; all of them therefore compute elements of ${\mathcal{R}}_t$, and Theorem 4 covers every component of the procedure.

A short example shows the rules at work. In a two-period binomial tree, consider the component that decides at date 1 whether to exercise an American put at the up node u. Its candidate inputs include the price function and the payoff map, which are model objects of scope 0 and legal; the realized price $S_1$, a realized object of scope 1 and legal; the realized terminal price $S_2$, a realized object of scope 2 and illegal at date 1; and the continuation value $\left(\frac{1}{R}{\mathbb{E}}_Q[{(K-S_2)}^{+}\mid {\mathcal{F}}_1]\right)\left(u\right)$, a derived object of scope 1 whose certificate is the one-period identity at u, and therefore legal. The last two are computed from the same terminal payoffs and are both, informally, about the future. But $S_2$ takes two values on the cell $C_1\left(u\right)$ while the projection takes one, and only the latter is a function of what is known at date 1. A procedure that admits $S_2$ makes no arithmetic error—it may well report a higher value—but it prices the claim in a market in which the next move is already known. The message rules reject that input without examining what would be done with it, and Theorem 4 guarantees that whatever the component outputs is ${\mathcal{F}}_1$-measurable. Section 12 works through the same market numerically on a four-period tree.

Finally, the assignment of dates to slices is determined by the filtration. Call an assignment $\varsigma$ of dates to slices admissible if any two dates handled by the same slice induce the same partition of $\Omega$, and say that s and t carry the same information if ${\Pi }_s={\Pi }_t$.

Theorem  5

(Minimality of the decomposition). Let ${\varsigma }^{★}\left(t\right)=\min \{s\le t:{\Pi }_s={\Pi }_t\}$. Then

(i) 

every admissible assignment separates dates carrying different information;

(ii) 

${\varsigma }^{★}$ is admissible;

(iii) 

${\varsigma }^{★}\left(s\right)={\varsigma }^{★}\left(t\right)$ whenever s and t carry the same information.

Consequently ${\varsigma }^{★}$ uses exactly one slice per distinct partition ${\Pi }_t$, which is the least number any admissible assignment can use.

Proof. 

(i) is the contrapositive of admissibility. For (ii), if ${\varsigma }^{★}\left(s\right)={\varsigma }^{★}\left(t\right)=u$ then ${\Pi }_u={\Pi }_s$ and ${\Pi }_u={\Pi }_t$, so ${\Pi }_s={\Pi }_t$. For (iii), if ${\Pi }_s={\Pi }_t$ then $\{u:{\Pi }_u={\Pi }_s\}=\{u:{\Pi }_u={\Pi }_t\}$, and the two minima coincide. The final statement follows because by (ii) and (iii) the fibers of ${\varsigma }^{★}$ are precisely the classes of the relation ${\Pi }_s={\Pi }_t$, while by (i) no admissible assignment can have fewer classes.    □

Minimal here refers to the number of slices, and hence of components: no admissible assignment uses fewer, and ${\varsigma }^{★}$ attains that number by merging dates that carry the same information. It is not a claim about computing time, which Section 10 measures separately. On a natural filtration of a branching tree the partitions ${\Pi }_0,\dots ,{\Pi }_T$ are pairwise distinct, so the number of slices equals $T+1$ and cannot be reduced; savings are available only for models with dates at which no information arrives, and there they are substantial (Section 10).

6. Composition of Local Certificates

The verification procedure emits only local statements: one identity per node or per edge. Turning these into a global assertion about a price requires the tower property, which in the present finite setting rests on the fact that each cell of ${\Pi }_t$ is the disjoint union of the cells of ${\Pi }_{t+1}$ contained in it.

Theorem 6

(Tower property). Let $t<T$, $\omega \in \Omega$, and let $C_t\left(\omega \right)=P_1\bigsqcup \dots \bigsqcup P_m$ be the decomposition of the ${\mathcal{F}}_t$-cell of ω into ${\mathcal{F}}_{t+1}$-cells. Then for every $X:\Omega \to \mathbb{Q}$,

$${\mathbb{E}}_Q\left[{\mathbb{E}}_Q[X\mid {\mathcal{F}}_{t+1}]|{\mathcal{F}}_t\right]\left(\omega \right)={\mathbb{E}}_Q[X\mid {\mathcal{F}}_t]\left(\omega \right).$$

Proof. 

Write $A_j={\sum }_{{\omega }^{\prime }\in P_j}\mu \left({\omega }^{\prime }\right)X\left({\omega }^{\prime }\right)$ and $m_j=\mu \left(P_j\right)>0$. For ${\omega }^{\prime }\in P_j$ the inner conditional expectation is constant and equal to $A_j/m_j$. Hence,

$$\sum _{{\omega }^{\prime }\in C_t\left(\omega \right)}\mu \left({\omega }^{\prime }\right){\mathbb{E}}_Q[X\mid {\mathcal{F}}_{t+1}]\left({\omega }^{\prime }\right)={\displaystyle \sum _{j=1}^m}{\displaystyle \frac{A_j}{m_j}}\sum _{{\omega }^{\prime }\in P_j}\mu \left({\omega }^{\prime }\right)={\displaystyle \sum _{j=1}^m}{A}_j=\sum _{{\omega }^{\prime }\in C_t\left(\omega \right)}\mu \left({\omega }^{\prime }\right)X\left({\omega }^{\prime }\right).$$

Dividing by $\mu \left(C_t\left(\omega \right)\right)$ gives the claim.    □

Theorem 7

(Local-to-global composition). Suppose ${\mathcal{F}}_T$ separates the points of Ω, as it does for the filtration of Section 3, and let $X=\left(X_t\right)$ satisfy the one-period identities $X_t={\mathbb{E}}_Q[X_{t+1}\mid {\mathcal{F}}_t]$ for all $t<T$. Then

$$X_t={\mathbb{E}}_Q[X_T\mid {\mathcal{F}}_t]\mathrm{for}\mathrm{every}t\le T.$$

In particular $X_0={\mathbb{E}}_Q[X_T\mid {\mathcal{F}}_0]$, so the value at the root is the expectation of the terminal value.

Proof. 

Downward induction on t. For $t=T$ the claim is $X_T={\mathbb{E}}_Q[X_T\mid {\mathcal{F}}_T]$, which holds because ${\mathcal{F}}_T$ separates points, so every function is ${\mathcal{F}}_T$-measurable and (1) returns it unchanged. Assume the claim at $t+1$. Then, using the one-period identity, the induction hypothesis inside the conditional expectation, and Theorem 6,

$$X_t={\mathbb{E}}_Q[X_{t+1}\mid {\mathcal{F}}_t]={\mathbb{E}}_Q\left[{\mathbb{E}}_Q[X_T\mid {\mathcal{F}}_{t+1}]|{\mathcal{F}}_t\right]={\mathbb{E}}_Q[X_T\mid {\mathcal{F}}_t].$$

   □

The next result is the composition step for the financial obligations themselves. It uses the elementary pull-out property of (1): if c is ${\mathcal{F}}_t$-measurable then ${\mathbb{E}}_Q[cX\mid {\mathcal{F}}_t]=c{\mathbb{E}}_Q[X\mid {\mathcal{F}}_t]$, which is immediate because c is constant on the cell over which the average is taken.

Theorem 8

(Certified self-financing wealth). Let H be predictable, let S be adapted and a Q-martingale, and let V be adapted and self-financing for H in the sense of (2). Then V is a Q-martingale.

Proof. 

Fix $t<T$ and $\omega$. By (2) and linearity of (1),

$${\mathbb{E}}_Q[V_{t+1}\mid {\mathcal{F}}_t]={\mathbb{E}}_Q[V_t\mid {\mathcal{F}}_t]+{\displaystyle \sum _{a=1}^d}{\mathbb{E}}_Q\left[H_{t+1}^a\left(S_{t+1}^a-S_t^a\right)|{\mathcal{F}}_t\right].$$

Since $V_t$ is ${\mathcal{F}}_t$-measurable, ${\mathbb{E}}_Q[V_t\mid {\mathcal{F}}_t]=V_t$. For each a, $H_{t+1}^a$ is ${\mathcal{F}}_t$-measurable by predictability, so it factors out, and $S_t^a$ is ${\mathcal{F}}_t$-measurable while ${\mathbb{E}}_Q[S_{t+1}^a\mid {\mathcal{F}}_t]=S_t^a$ by the martingale property. Hence, each summand equals $H_{t+1}^a\left(S_t^a-S_t^a\right)=0$, and ${\mathbb{E}}_Q[V_{t+1}\mid {\mathcal{F}}_t]=V_t$.    □

The indexing in this proof follows the convention of Section 3. $H_{t+1}^a$ is the number of units of asset a held over $(t,t+1]$; the subscript names that interval, and the position is chosen at date t, before $S_{t+1}^a$ is known. Predictability is exactly the statement that $H_{t+1}^a$ is ${\mathcal{F}}_t$-measurable, and it is what allows $H_{t+1}^a$ to be taken outside the conditional expectation given ${\mathcal{F}}_t$. If the position were instead fixed at date $t+1$, after the move, it would be ${\mathcal{F}}_{t+1}$-measurable only, it could not be factored out, and the wealth process would in general fail to be a martingale.

Proposition 2

(Snell envelope). Let Z be the Snell envelope of $\left(G_t\right)$. Then for every $t<T$ and every ω,

$$G_t\left(\omega \right)\le Z_t\left(\omega \right),{\mathbb{E}}_Q[Z_{t+1}\mid {\mathcal{F}}_t]\left(\omega \right)\le Z_t\left(\omega \right),$$

and $Z_t\left(\omega \right)$ equals one of the two numbers $G_t\left(\omega \right)$ and ${\mathbb{E}}_Q[Z_{t+1}\mid {\mathcal{F}}_t]\left(\omega \right)$, namely the larger.

Proof. 

All three statements are properties of the maximum of two rationals, applied to Definition 1(vi).    □

7. Finite Witnesses and Earliest Inconsistency

Soundness alone would permit a verifier to remain silent indefinitely. On a finite tree completeness holds too: every violation admits a finite witness, and the location reported is canonical.

Theorem 9

(Finite witness completeness). If H is not predictable, then there exist $t<T$, an asset index a, and paths ${\omega }_1,{\omega }_2\in \Omega$ with $C_t\left({\omega }_1\right)=C_t\left({\omega }_2\right)$ and $H_{t+1}^a\left({\omega }_1\right)\ne H_{t+1}^a\left({\omega }_2\right)$. Consequently, predictability is decidable, with a certificate in each direction.

Proof. 

Negating Definition 1(ii) gives a date $t<T$ at which $H_{t+1}$ is not ${\mathcal{F}}_t$-measurable, that is, not constant on some cell of ${\Pi }_t$; choosing two points of that cell at which it differs and a coordinate in which they differ yields the witness. All quantifiers range over finite sets, so exhaustive search terminates and returns either a witness or a proof of measurability.    □

Theorem 10

(Earliest inconsistency). Let $t^{★}=\min \{t<T:H_{t+1}\mathrm{is}\mathrm{not}{\mathcal{F}}_t-\mathrm{measurable}\}$ when the set is nonempty. Then $H_{s+1}$ is ${\mathcal{F}}_s$-measurable for every $s<t^{★}$, and there is a two-path witness at $t^{★}$.

Proof. 

Minimality of $t^{★}$ gives the first claim, and Theorem 9 applied at $t^{★}$ gives the second.    □

Reporting $t^{★}$ rather than an arbitrary violating date matters for diagnosis: it is the first date at which the model, as written, is already inconsistent, so it is the first place a correction can be applied.

8. Machine-Checked Formalization

The development is written in Lean 4 (de Moura & Ullrich, 2021), version 4.32.0, and uses only the core library: it does not depend on mathlib, and the rational numbers are those of the core library. It defines finite filtered models by their cell maps, defines (1) as an exact rational quantity, and proves the obligations of Definition 1 together with Lemma 1, Theorems 1–10, and Propositions 1 and 2, in a total of 152 theorems. Both assertions of Theorem 2 are included, the construction of the predictable strategy and the consequence drawn from it. Corollaries 1 and 2 are counting consequences of Theorem 1 and are argued here rather than formalized. The development contains no unproved assertions.

• Exact arithmetic inside the kernel.

Individual instances are discharged by kernel evaluation of executable checkers whose soundness is proved once and for all, so that a family of instance proofs reduces to computation plus a general theorem. Arithmetic on the core rational type normalizes every result by a greatest common divisor and does not reduce well inside the kernel. Instance data are therefore carried as pairs $a=(n,m)$ of integers, read as the rational $\left[\right[a\left]\right]=n/m$, and called well-formed when $m\ne 0$. For $b=(n^{\prime },m^{\prime })$ the operations are

$$\begin{array}{cccc}\hfill a\oplus b& =(n{m}^{\prime }+n^{\prime }m,m{m}^{\prime }),\hfill & \hfill a\otimes b& =(n{n}^{\prime },m{m}^{\prime }),\hfill \\ \hfill a\ominus b& =(n{m}^{\prime }-n^{\prime }m,m{m}^{\prime }),\hfill & \hfill a\oslash b& =(n{m}^{\prime },m{n}^{\prime }),\hfill \end{array}$$

and equality and order are tested by $n{m}^{\prime }=n^{\prime }m$ and $n{m}^{\prime }\le n^{\prime }m$. Every one of these is integer arithmetic and reduces in the kernel. The map $\left[\right[·\left]\right]$ is a single division in the rational field, and the bridge lemmas state that it carries each operation to its rational counterpart: for well-formed a and b,

$$\begin{array}{cccc}\hfill \left[\right[a\oplus b\left]\right]& =\left[\right[a\left]\right]+\left[\right[b\left]\right],\hfill & \hfill \left[\right[a\otimes b\left]\right]& =\left[\right[a\left]\right]\left[\right[b\left]\right],\hfill \\ \hfill [a\ominus b]]& =\left[\right[a\left]\right]-\left[\right[b\left]\right],\hfill & \hfill \left[\right[a\oslash b\left]\right]& =\left[\left[a\right]\right]/\left[\left[b\right]\right]\mathrm{if}{n}^{\prime }\ne 0,\hfill \end{array}$$

the equality test succeeds exactly when $\left[\right[a\left]\right]=\left[\right[b\left]\right]$, and, for positive denominators, the order test implies $\left[\right[a\left]\right]\le \left[\right[b\left]\right]$ and the maximum is carried to the maximum. These statements lift to finite sums and then to the model: if every transition weight of an exact model is well-formed, the exact conditional expectation computed on pairs denotes (1) for the corresponding rational model, at every date and on every path, and the same holds for the cell masses. Positive weights are well-formed. Table 1 gives the statements as they appear in the development.

Table 1. The bridge between the integer-pair representation and the rational numbers, as stated in the Lean development. QQ is the type of integer pairs, a.ok means that the denominator is nonzero, EModel is a model with integer-pair weights and E.toModel the rational model it denotes.

Result	Statement
QQ.toRat	def toRat (a : QQ) : Rat := (a.num : Rat) / (a.den : Rat)
QQ.toRat_add	a.ok → b.ok → (a.add b).toRat = a.toRat + b.toRat
QQ.toRat_mul	a.ok → b.ok → (a.mul b).toRat = a.toRat * b.toRat
QQ.toRat_sub	a.ok → b.ok → (a.sub b).toRat = a.toRat - b.toRat
QQ.toRat_divq	a.ok → b.ok → b.num ≠ 0 → (a.divq b).toRat = a.toRat / b.toRat
QQ.toRat_eq	a.ok → b.ok → a.eqb b = true → a.toRat = b.toRat
QQ.eqb_of_toRat_eq	a.ok → b.ok → a.toRat = b.toRat → a.eqb b = true
QQ.toRat_le	0 < a.den → 0 < b.den → a.leb b = true → a.toRat ≤ b.toRat
QQ.toRat_rmaxq	0 < a.den → 0 < b.den → (a.rmaxq b).toRat = rmax a.toRat b.toRat
toRat_qsum	(∀ a ∈ l, a.ok) → (qsum l).toRat = rsum (l.map QQ.toRat)
toRat_eCellMass	EOk E → (eCellMass E t i).toRat = cellMass E.toModel t i
toRat_eCondExp	EOk E → (∀ j < E.n, (X j).ok) → t ≤ E.T → i < E.n → (eCondExp E t X i).toRat = condExp E.toModel t (toRV X) i
eok_of_positive	EPositive E → EOk E

No evaluation outside the kernel is used at any point, so the Lean kernel is the only part of the procedure that checks proofs. What it checks are the definitions given above, which carry the usual burden of rendering the objects of Section 3 faithfully; the bridge removes the integer-pair representation from that burden, since every statement about pairs is transferred to a statement about rationals by a proved lemma. Every other part of the procedure is untrusted: it may propose candidates, but it cannot certify.

• Axioms.

Lean’s kernel admits three standard axioms: propositional extensionality (propext), the axiom of choice (Classical.choice) and the soundness of quotients (Quot.sound). Of the 152 theorems, 9 depend on none of them and 51 do not use the axiom of choice. Table 2 lists the dependencies of the results stated in this paper. The results that carry the information discipline—Theorems 2, 3 and 5 and Proposition 1—do not use the axiom of choice, and the legality of a projected message depends on no axiom at all. The axiom of choice enters the other results in two ways. The core library’s lemmas on rational numbers depend on it—already the lemma that a sum over the empty list is zero does—so every result that manipulates rational sums inherits it. In addition, two of our own arguments use the law of excluded middle explicitly: the existence of a finite witness (Theorem 9) and the contrapositive form of Theorem 3. Both quantify over finite sets, where excluded middle can be replaced by exhaustive search, so constructivity is not at stake in this finite setting.

Table 2. Axioms used by the results stated in the paper, as reported by Lean’s #print axioms. P, Q and C stand for propext, Quot.sound and Classical.choice; a mark indicates that the result depends on the axiom.

Result	Lean Name	P	Q	C
Lemma 1	wealth_along_path_eq	✔	✔	✔
Theorem 1	twin_family	✔	✔	✔
Theorem 2	single_path_cannot_refute	✔	✔
Theorem 3	decision_non_anticipative	✔	✔
Proposition 1, first part	raw_future_illegal	✔
Proposition 1, second part	projected_msg_legal
Theorem 4	reachable_measurable	✔	✔	✔
Theorem 5	compiler_slicing_optimal	✔	✔
Theorem 6	condExp_tower	✔	✔	✔
Theorem 7	martingale_global	✔	✔	✔
Theorem 8	selfFinancing_wealth_martingale	✔	✔	✔
Proposition 2	snell_dominates, snell_supermartingale, snell_exercise_or_continue	✔	✔	✔
Theorem 9	predictable_complete	✔	✔	✔
Theorem 10	earliestPredictabilityCut_spec	✔	✔	✔
Bridge (Table 1)	toRat_eCondExp and the others	✔	✔	✔

The distinction between the kernel and everything else matters for the problem at hand. A proof assistant certifies the model it is given; it cannot detect that the model was formalized with an enlarged information set, a mismatched pricing measure or a shifted date convention. Theorems 3 and 4 supply the missing guarantee, and they are proved in the same system.

9. Experimental Design

9.1. Benchmark

We generated 2960 synthetic instances over 2586 distinct base markets with exact rational data from the single random seed 20,260,820. Horizons range over $T\in \{2,\dots ,6,8\}$, the number of successors of a node between two and six, and the number of risky assets between one and five. Markets satisfying the martingale property are constructed either by backward conditional averaging from sampled terminal prices or, for readability of the natural-language renderings, by integer increments with zero conditional mean. Ground truth is assigned by the exact core rather than by hand.

The benchmark covers eleven families. Seven are the obligations of Definition 1. The remaining four test the information discipline directly. Pairs of observationally identical rules instantiate Theorem 1: both members share the realized wealth path, the realized returns and the terminal wealth, and differ only in legality. Filtration-mutation pairs present the same strategy under a coarsened and under the natural filtration, so that legality changes while the strategy does not. Information-stagnant markets contain dates at which no information arrives, so that the merging of Theorem 5 can occur. Under-determined specifications record which interval each position covers but not the date on which it was fixed; the two readings disagree, so the correct response is to abstain and state what is missing rather than to supply a default.

Table 3 gives the composition. Negative instances are not sampled: each is obtained from a positive one by a single localized perturbation—a holding made to depend on the next move at one node, a probability displaced by a rational amount at one edge, a maximum omitted at one node of a Snell recursion—so the earliest inconsistent date and the responsible cell are known in advance and are recomputed independently by the exact core. The localization measures are meaningful for this reason: the target is fixed by the construction, not by the procedure being evaluated.

Table 3. Composition of the benchmark. The first seven families instantiate the obligations of Definition 1; the last four stress the information discipline directly. Positive instances satisfy the obligation, negative ones fail it at a known earliest date, and the under-determined family admits no verdict by construction.

Family	Positive	Negative	Total
Predictability of a strategy	180	170	350
Self-financing wealth	139	161	300
Risk-neutral martingale property	145	155	300
European value process	139	161	300
Replication of a terminal payoff	161	89	250
Snell envelope	132	118	250
Stopping-time validity	149	51	200
Observationally identical pairs	250	250	500
Filtration-mutation pairs	105	105	210
Information-stagnant markets	79	81	160
Under-determined specifications	140 (no verdict)		140
Total	1479	1341	2960

The stopping-time family is the most unbalanced. Of its 200 instances, 102 are candidate negatives, 51 built in each of two ways: a rule that stops at a node only on the paths whose next move is favorable, and a rule that stops at the last date at which the payoff meets the Snell envelope. The second rule is always a stopping time: because $Z_T=G_T$ on every path, it stops at the horizon T. Since labels are assigned by the exact core, these 51 instances are correctly labeled positive, which leaves 149 positive and 51 negative instances. For this family we therefore also report balanced accuracy, the average of the rates of correct verdicts on positive and on negative instances.

The observationally identical pairs are built by the argument of Theorem 1, so the whole family is by construction invisible to any procedure that reads the realized record; the filtration-mutation pairs instead hold the strategy fixed and change the filtration. Between them they vary each argument of the predicate “H is predictable with respect to $\mathcal{F}$” while holding the other fixed.

Each base market is assigned to one of eight splits. Three are drawn from the same setting (horizons two to four, two or three successors per node, one or two assets): a development split, a reserve split and the in-distribution test split. No part of any method is trained or fitted, so all three serve as in-distribution samples and all eight splits are scored in the same way. The other five each shift one feature: longer horizons (five, six or eight), higher branching (four successors), more assets (three to five), a coarsened or enlarged filtration, and unseen presentations of the same mathematics.

9.2. Methods and Input Levels

The model is supplied at one of three levels. At the first it is supplied directly as a formal object, which isolates the verification procedure from the language model entirely. At the second it is supplied in a complete but non-canonical structured form, and at the third as prose, so that the language model must recover the market, the conventions and the obligation from text before anything can be verified. Section 10 uses the first level; Section 11 uses the second and third.

We compare eleven methods. Three are built on the exact core: the full method; a centralized variant that applies the same checks without the decomposition into slices and recovers the model from text in a single step, without first resolving the conventions; and an oracle that receives the model directly. Two isolate the information discipline: the full method with only the information rules removed, holding the number of components, the execution order and the computational budget fixed, and a variant that keeps the same components but rewires the assignment of components to information states at equal budget. Five are language-model reasoning architectures that reach their verdicts without an exact core: a single agent that revises a malformed answer, a planner with a prover and a critic, a proposer with a corrector, one agent per date with unrestricted communication, and a dynamically chosen set of subtasks. The last method generates a proof directly from prose with no intermediate representation. A further eleven variants remove individual mechanisms one at a time.

The exact core can play three roles, and the methods differ in which of them they use. When a verdict is produced, it decides the verdict for the methods built on it, but not for the five reasoning architectures, which is what distinguishes them. When a claimed violation is certified, it turns the claim into a witness the kernel can accept; every method that localizes a violation has its witness completed in the same way, so the kernel-acceptance rate measures the claim rather than the way it was completed. When methods are scored, it supplies the ground truth for all of them. Beyond this, every method shares the same language model, decoding settings, output budget, retry allowance and proof-assistant templates; only the architecture differs.

The prose level uses two draws from the benchmark, both balanced across the eleven families. The larger, of 265 instances with at most sixteen terminal paths, is used for the full method, the centralized variant, the variant without information rules and the single iterative agent. The remaining four reasoning architectures, which need up to three times as many language-model requests per instance, and the method that produces a proof directly from text, which needs about one and a half times as many tokens, were run on a second draw of 102 instances with at most twelve terminal paths. The two draws are independent rather than nested, and the smaller trees may make the second draw somewhat less demanding. Every confidence interval reported below compares methods run on the same instances.

9.3. Language Models

The prose-level experiments use five language models. The comparison of all methods uses deepseek-reasoner; on the larger draw it is repeated with deepseek-chat, gpt-4.1-mini, deepseek-v4-pro with extended reasoning enabled, and deepseek-flash with it disabled. Decoding used temperature zero, an output budget of 16,000 tokens for the reasoning models and 4000 for the others, up to five retries after a failed request and up to two repair turns after a malformed answer. Because deepseek-v4-pro does not decode deterministically with extended reasoning enabled, it was run twice to measure the variation between runs. Appendix A lists the prompts and settings.

Comparisons use a paired cluster bootstrap over base markets with 4000 resamples and exact McNemar tests on the discordant instances. We report unadjusted p-values; every difference reported as significant remains significant at the 5% level after Holm correction across the comparisons made on the same language model.

9.4. Measures

The primary measure, certified success, requires four conditions simultaneously: the recovered model must be semantically identical to the intended one, the obligations on information scopes must be satisfied, the certificate must be valid, and the Lean kernel must accept the emitted instance. Kernel checking is applied to every instance that carries a claim to certify and has at most 64 terminal paths, which covers 2523 of the 2960; the under-determined family has nothing to certify by construction, and larger instances are scored on the first three conditions and reported separately rather than counted as failures. On the under-determined family, success means abstaining and naming the missing convention.

Scope validity, the second condition, is reported only on instances whose model was recovered: when the recovered model differs from the intended one, a scope check on it says nothing about the intended model. A look-ahead instance is a negative instance in which a decision object uses information that is not yet available. The look-ahead false-certification rate (LAFCR) is the fraction of look-ahead instances, outside the under-determined family, on which a method declares the obligation satisfied; at the prose level, where the denominators are small, we report it as a count such as 0/54. LAFCR counts verdicts: the kernel may still reject the certificate that accompanies a false verdict, as discussed in Section 10. Abstention is the number of under-determined specifications on which a method declines to certify and states what is missing.

10. Verification of Formal Financial Models

In this section the formal model is supplied directly. No language model is involved, so every difference between methods is a difference in the verification procedure.

10.1. Correctness and the Contribution of the Information Rules

Table 4 reports the results. Given a correct model, the full method, the centralized variant and the oracle reach 100% on every condition across all eleven families and all eight splits, and the kernel accepted no false claim in 12,615 checks (the 2523 kernel-checked instances, checked for each of the five methods). Soundness is carried by the exact core and the kernel, neither of which depends on the decomposition, so equal performance is the expected outcome; an advantage for the decomposed method would indicate that correctness depended on an untrusted part of the procedure.

Table 4. Model supplied directly; 2960 instances. Model recovery is exact for every method at this level and is therefore omitted. LAFCR is the fraction of look-ahead instances declared valid, and the last column is the fraction of failing instances whose earliest inconsistent date is identified correctly.

Method	Scope	Cert.	Success	Kernel	LAFCR	Earliest
Full method	1.000	1.000	1.000	1.000	0.000	1.000
Oracle	1.000	1.000	1.000	1.000	0.000	1.000
Centralized exact	1.000	1.000	1.000	1.000	0.000	1.000
Rules removed	0.815	0.802	0.802	0.786	0.915	0.562
Scopes rewired	0.833	0.687	0.687	0.695	0.198	0.728

The contribution of the information rules is quantified by two comparisons that keep the number of components, the execution order and the budget fixed and change only the message rules. Removing the rules lowers certified success by $19.8$ percentage points (95% CI $[18.5,21.1]$; exact McNemar $p<{10}^{-170}$ on 587 discordant instances, none in favor of the variant) and raises the fraction of look-ahead instances declared valid from $0.0\%$ to $91.5\%$. Of the certificates accompanying these false verdicts, the kernel rejected every one it checked, because it re-checks the obligation against the model it is given; the errors therefore appear as lost certified success rather than as false certificates. A kernel check offers no such protection when the model itself has been formalized with the wrong filtration (Section 11.4). Rewiring the assignment of components to information states lowers certified success by $31.3$ points (95% CI $[29.6,33.1]$; 926 discordant instances). On the 250 observationally identical pairs, which by Corollary 1 no outcome-based procedure can separate, the full method separates all 250, the variant without information rules 12 and the rewired variant 55; on the 105 filtration-mutation pairs the counts are 105, 35 and 25. The full method identifies the earliest inconsistent date and the responsible cell of every single-point perturbation, in agreement with Theorem 10; without the information rules these rates fall to $56.2\%$ and $55.3\%$.

Table 5 breaks the results down by family. The loss of certified success is concentrated in the families in which the legality of an object depends on information: predictability, stopping times, the two families of paired rules and the information-stagnant markets. For obligations that are identities between values—self-financing, the martingale property, the European value, replication and the Snell recursion—removing the rules has no effect, as expected, since these obligations are verified through local numerical identities and involve no decision that could use future information. Rewiring the components also affects self-financing and replication, because their local identities are then checked against the wrong cells. On the stopping-time family the variant without information rules accepts every candidate stopping rule: its success rate of $74.5\%$ equals the share of positive instances, and its balanced accuracy is $50.0\%$, against $100\%$ for the full method.

Table 5. Certified success by family, model supplied directly. The full method, the centralized variant and the oracle score 1.000 on every family. For the stopping-time family the balanced accuracy is given in parentheses.

Family	n	Rules Removed	Scopes Rewired
Predictability of a strategy	350	0.517	0.443
Self-financing wealth	300	1.000	0.517
Risk-neutral martingale property	300	1.000	1.000
European value process	300	1.000	1.000
Replication of a terminal payoff	250	1.000	0.628
Snell envelope	250	1.000	1.000
Stopping-time validity	200	0.745 (0.500)	0.695 (0.679)
Observationally identical pairs	500	0.524	0.460
Filtration-mutation pairs	210	0.500	0.433
Information-stagnant markets	160	0.850	0.731
Under-determined specifications	140	1.000	1.000

10.2. Necessary Mechanisms and Robustness

Removing the mechanisms of the full method one at a time, on a fixed subset of 1003 instances, shows which of them are needed for correct verdicts (Table A2). Only four removals change a verdict. Two are the distinction between model and realized objects and the prohibition on reading a realized object of a later scope. They produce identical results, because the distinction has a single operative use, which is to make the prohibition expressible; removing either lowers certified core success by $20.9$ points and admits $89.2\%$ of look-ahead instances. The other two are the forward and backward passes, the computation itself, whose removal lowers success by $64.4$ and $35.6$ points. The remaining seven removals leave every verdict unchanged. Without witness construction the earliest inconsistent date is still found but the responsible cell is lost; without the date-wise reconciliation the global pricing identity is asserted instead of being composed from local certificates; without kernel checking the conclusions stand but are no longer machine-confirmed. Merging dates that carry the same information, and creating auxiliary components on demand at nodes where a violation is detected, change only the number of components, and replacing exact arithmetic by double precision changes nothing at the perturbation sizes of the benchmark. Apart from the two passes, the information rules are therefore the only part of the design whose removal turns correct verdicts into incorrect ones.

The full method and the centralized variant are also exact on every split (Table A3), including markets whose horizon, branching and number of assets exceed the in-distribution setting and markets with a coarsened or enlarged filtration. Without the information rules, certified core success (certified success without the kernel condition) falls by $16.2$ to $23.4$ points depending on the split. With rewired components it falls by $24.3$ to $48.5$ points, most on the longer-horizon split, where the most dates can be misaligned.

10.3. Exact Arithmetic and Computational Cost

On perturbations of the size used in the benchmark, double-precision arithmetic reproduces the exact verdicts. A controlled sweep identifies where exactness matters (Figure 5b). For self-financing, the martingale property and the Snell envelope, we injected a residual of size ${10}^{-k}$, $k=2,\dots ,16$, at one node of each of 30 markets per obligation. The exact core detects every residual. A double-precision checker misses a residual exactly when it falls below its tolerance: with the tolerance of ${10}^{-9}$ used in the ablation of Table A2 it begins to miss at $k=9$ and detects none from $k=10$, and the boundary shifts by three orders of magnitude with each change of tolerance. The breakdown is therefore set by the tolerance rather than by accumulated rounding error, which is much smaller: on the unperturbed markets the largest floating-point residual was $1.1\times {10}^{-13}$ for self-financing, $2.8\times {10}^{-14}$ for the martingale property and $7.1\times {10}^{-15}$ for the Snell envelope. The maximum of two floating-point numbers is computed without rounding, so the maxima of the backward recursion contribute nothing to these residuals; they arise from additions and from divisions by transition weights. Lowering the tolerance toward this floor does not help: with an exact zero test, 93% of the correct models are reported as violations. A floating-point checker must trade missed violations against false alarms; the exact core faces neither, and its residual is itself a certificate.

Figure 5. (a) Cost of the exact core against the number of terminal paths on binary trees of horizon $T=2,\dots ,16$ (up to 65,536 paths), on logarithmic axes. The curves for the measurability check and the two backward recursions are straight with the slope of the path count, so the cost per node is roughly constant; the full verification run carries a fixed overhead of about $0.3$ ms that dominates on small trees. (b) Detection of an injected residual of size ${10}^{-k}$ by the exact core (labeled exact rational) and by a double-precision checker with the tolerance shown next to each dashed curve, pooled over self-financing, the martingale property and the Snell envelope. The shaded band marks the residual sizes at which floating-point rounding on correct models is of the same order.

The cost of the exact core grows linearly with the size of the tree (Figure 5a). Up to $T=16$, that is, 65,536 terminal paths and 131,071 nodes, the measurability check costs between $0.3$ and 0.7 μs per path and date and the backward recursions between $0.55$ and 1.04 μs per node; a full verification run on the largest tree takes $0.16$ s and $9.4$ MB of memory. The dominant cost is kernel checking, which takes on average $0.23$ s per instance for trees with at most 8 terminal paths and $1.7$ s (at most $9.2$ s) for trees with 33 to 64, because numerators and denominators grow in the unnormalized representation. Kernel checking was therefore limited to 64 terminal paths.

Merging dates that carry the same information (Theorem 5) reduces the size of the procedure without changing any verdict. On the information-stagnant markets of the benchmark it reduces the number of components by $30.0\%$ and the number of messages by $26.4\%$. On a binary tree of horizon 12 whose information arrives only every m dates, it reduces the number of slices from 13 to 7, 5, 4 and 3 for $m=2,3,4,6$. Since each slice of this predictability check has a forward and a reconciliation component and three components serve all slices, the number of components falls from 29 to 17, 13, 11 and 9, and the number of messages from 50 to between 38 and 30. The verdicts are unchanged, both on a legal strategy and on one that uses information before it arrives. At this size the running time did not decrease (about 2 ms with merging against 1 ms without). The number of information cells summed over dates, which bounds the state space of a recursion indexed by cells, falls to $83\%$, $71\%$, $63\%$ and $55\%$ of the number of nodes. Section 13 discusses what this implies for larger models.

11. Autoformalization from Natural Language

This section asks whether the procedure certifies the intended model when a language model must first recover it from prose. We report the comparison of all methods on deepseek-reasoner, analyze where recovery fails, evaluate a constraint designed in response to that analysis, and test whether the conclusions hold on four further language models.

11.1. Comparison of Methods

Table 6 reports the results. Once the model must be recovered from text, recovery becomes the limiting factor. The variant without information rules recovers the model exactly as often as the full method, yet declares 51 of the 54 look-ahead instances valid, against none for the full method. The five reasoning architectures recover the model about as well but fall short at certification: each declares violations it cannot exhibit, on $2.9\%$ to $4.9\%$ of its instances, whereas the methods built on the exact core never do. Results by family are given in Appendix C.

Table 6. Model supplied as prose, deepseek-reasoner. The column n gives the draw on which each method was run: 265 instances with at most sixteen terminal paths, or an independent family-balanced draw of 102 instances with at most twelve. Rates from the two draws are not paired, and no confidence interval in the text compares methods across the two draws. Recovery is exact semantic agreement with the intended model. Scope validity is computed on the instances whose model was recovered. LAFCR counts look-ahead instances declared valid, of 54 and 24 in the two draws. Abstention counts under-determined specifications on which the method declined to certify and named the missing convention, of 21 and 8. Direct text to proof recovers no model and returns no verdict, so scope validity and abstention are not defined for it.

Method	n	Recovery	Scope	Certified Success	LAFCR	Abstention
Full method	265	0.962	1.000	0.962	0/54	15/21
Centralized exact	265	0.940	1.000	0.940	1/54	12/21
Fully connected date agents	102	0.961	0.939	0.833	0/24	0/8
Single iterative agent	265	0.940	0.948	0.830	1/54	0/21
Proposer and corrector	102	0.941	0.938	0.824	0/24	0/8
Planner, prover and critic	102	0.951	0.928	0.814	1/24	0/8
Dynamic task decomposition	102	0.951	0.938	0.814	0/24	0/8
Rules removed	265	0.962	0.800	0.770	51/54	15/21
Direct text to proof	102	0.000	–	0.000	0/24	–

Against the centralized variant the full method’s advantage is $2.3$ percentage points (95% CI $[0.4,4.5]$). Seven discordant instances favor the full method and one the centralized variant; the bootstrap interval excludes zero, but the exact McNemar test gives $p=0.070$, so the difference is not significant at the 5% level. Against the variant without information rules the advantage is $19.2$ points (95% CI $[15.1,23.2]$; 51 discordant instances, all in favor of the full method; $p<{10}^{-15}$). Supplying the model in structured form instead of prose removes the first difference entirely ($0.0$ points, 95% CI $[-1.1,1.1]$), which places it in the reading of conventions from text rather than in the verification architecture. The gap to the single iterative agent in that setting is $18.1$ points (95% CI $[13.4,23.2]$) and is not a recovery gap: that method recovers the model from the structured input on $98.5\%$ of instances.

The full method uses 2.2 language-model requests and about 11,200 tokens per instance, against 1.1 requests and 7700 tokens for the centralized variant and between 2.1 and 6.0 requests and 10,500 to 16,900 tokens for the reasoning architectures (Table A7 gives the distributions). Adding agents increases cost without improving certified success. The full method’s messages are small and structured: a median of 200 bytes between components per instance, against medians of 1.0 to 2.2 kilobytes of free text for the reasoning architectures.

11.2. Where Recovery Fails

Market extraction is highly accurate in both input formats: from structured input every method recovers the intended model on $98.5\%$ of instances, and from prose the full method does so on $96.2\%$ and the centralized variant on $94.0\%$. Prices, transition probabilities and payoff tables are transcribed almost without error.

Table 7 classifies every failure; Figure A1 in Appendix C shows the same counts graphically. A failure is assigned to the first category that applies, in the order of the table: no verdict; a default supplied for a convention that the source leaves unstated; a model not recovered; a look-ahead rule declared valid; a wrong verdict on a correctly recovered model; a violation declared but not exhibited. Under this rule the single look-ahead instance that the centralized variant declares valid (Table 6) counts as a recovery failure, because its model was not recovered.

Table 7. Failures at the prose level by kind, deepseek-reasoner. Each failure is assigned to the first category that applies, from left to right. “Default” is a default supplied for a convention that the source leaves unstated; “Not recovered” covers any other difference between the recovered and the intended model (information structure, a numerical datum, or no usable model); “Look-ahead” is a look-ahead rule declared valid; “Wrong” is a wrong verdict on a correctly recovered model; “Not exhibited” is a violation declared without a valid witness. Totals agree with the certified success rates of Table 6.

Method	n	No Verdict	Default	Not Recov.	Look-Ahead	Wrong	Not Exhib.	Total
Full method	265	0	6	4	0	0	0	10
Centralized exact	265	0	9	7	0	0	0	16
Rules removed	265	0	6	4	51	0	0	61
Single iterative agent	265	1	21	7	1	4	11	45
Planner, prover and critic	102	0	8	3	1	2	5	19
Proposer and corrector	102	0	8	4	0	2	4	18
Fully connected date agents	102	1	8	2	0	3	3	17
Dynamic task decomposition	102	0	8	3	0	4	4	19
Direct text to proof	102	94	0	8	0	0	0	102

The difficult part of the text is the timing convention that fixes when a position is chosen, and every error in it occurred on an under-determined specification; no method misread a convention that the source stated. The errors arise where the source records which interval each position covers but not the date on which it was fixed: the two readings then disagree and no verdict is warranted, yet the language model supplies one of them. The prompt instructs the language model to answer “unstated” in this case. It nevertheless supplied a default on 6 of the 21 under-determined specifications in the full method and on 9 in the centralized variant, and the five reasoning architectures supplied a default on every one they were given. A default invented at this point turns a sound proof into a financially inadmissible conclusion: the exact core then correctly verifies a model that the source does not determine.

The methods built on the exact core never produce an invalid witness and never return a wrong verdict on a model they recovered; all of their failures arise in the reading of the text. Each reasoning architecture, by contrast, declares violations it cannot exhibit, on $2.9\%$ (date agents) to $4.9\%$ (planner) of its instances, and returns wrong verdicts on correctly recovered models on $1.5\%$ to $3.9\%$. A declared violation without a witness is of little use for model risk, since there is no pair of paths, node or residual to check and nothing to repair. The variant without information rules has the same ten reading failures as the full method and 51 additional failures, each a look-ahead rule declared valid: better reading of the text cannot substitute for an explicit information constraint.

Generating a proof directly from prose, with no intermediate representation, failed on every one of the 102 instances attempted: it never produced a usable model, and on the 94 instances that carried a claim to certify the kernel accepted nothing. The difficulty therefore lies upstream of proof search: a financial model has to exist as a mathematical object, with its definitions, tables and conventions in agreement, before there is anything to prove about it.

11.3. A Grounding Constraint for Timing Conventions

The failure analysis isolates one error precisely enough to target it: a timing convention supplied where the source states none. To address it, we evaluated a grounding constraint for timing conventions on deepseek-v4-pro and deepseek-flash. Since the constraint is motivated by the analysis above, we report it as an exploratory experiment rather than as part of the comparison of methods.

The constraint admits a convention only if the language model can show where the source states it, and it works in two steps. First, the language model is asked to copy the one sentence that states on which date each position is decided; the quotation is accepted only if it occurs verbatim in the source, after whitespace and quotation marks are normalized. Second, a separate request shows the language model that sentence alone and asks which convention it states. If either step fails, the convention is marked unstated, whatever value the extraction proposed, and the exact core evaluates the obligation under both readings. If the two verdicts agree, the convention does not matter and the verdict stands; if they differ, the procedure abstains and reports that the decision date of the positions is not specified. An under-determined specification is thus stopped at the reading stage, with an explicit report, instead of receiving a default, and the outcome no longer depends on the language model following an instruction.

On deepseek-v4-pro the constraint admitted the convention on all 117 instances whose source states it and rejected it on all 21 under-determined specifications. The full method then abstains on every under-determined specification, against 13 of 21 without the constraint, and its certified success rises from $95.8\%$ to $98.9\%$ (from 254 to 262 of 265 instances, 3.0 points, 95% CI $[1.1,5.3]$; eight discordant instances, all in favor of the constraint; $p=0.008$). An independent second run gives 2.6 points (seven discordant instances, all in favor; $p=0.016$), and the centralized variant gains as much. The three remaining failures are misreadings of the information structure, which the constraint does not address. On deepseek-flash the constraint also rejected the convention on all 21 under-determined specifications, but it rejected 7 conventions that the source did state, because the language model failed to quote the sentence stating them; the net change was $0.4$ points (eight instances gained, seven lost; not significant). The constraint is thus only as reliable as the language model’s ability to quote, but its failures are conservative: a rejected quotation yields an abstention or an unrecovered model, never a certified wrong answer. It costs about one additional request and 900 tokens per instance on average. Table A4 gives the complete results.

11.4. Robustness Across Language Models

Table 8 summarizes the two comparisons on all five language models, on the larger draw. The effect of the information rules is stable: between $16.9$ and $19.2$ points, with $92.6\%$ to $98.1\%$ of look-ahead instances declared valid once the rules are removed. The advantage over the centralized variant, which at the prose level reflects the staged recovery of conventions, is not: $19.8$ points on gpt-4.1-mini, $2.3$ on deepseek-reasoner, and between $0.0$ and $0.4$ on deepseek-chat, deepseek-v4-pro and deepseek-flash. The staged recovery compensates for weaknesses of particular language models, whereas the information discipline, which assumes nothing about the language model, is unaffected by the choice of model.

Table 8. The two effects across language models, prose level. Values are differences in certified success, in percentage points, between the full method and the indicated variant; the last column gives LAFCR for the full method and for the variant without information rules. The DeepSeek rows use the same 265 instances; the gpt-4.1-mini row uses different prompts and is not paired with them, so its entries should be compared only within the row.

Language Model	vs. Centralized Exact	vs. Rules Removed	LAFCR, Full/Removed
gpt-4.1-mini	$+19.8$	$+16.9$	$0.145$/$0.935$
deepseek-chat	$+0.0$	$+18.5$	$0.037$/$0.926$
deepseek-reasoner	$+2.3$	$+19.2$	$0.000$/$0.944$
deepseek-v4-pro	$+0.0$	$+19.2$	$0.000$/$0.944$
deepseek-flash	$+0.4$	$+18.5$	$0.056$/$0.981$

The methods built on the exact core are also stable in absolute terms. Without the grounding constraint, the certified success of the full method lies between $92.8\%$ (deepseek-chat) and $96.2\%$ (deepseek-reasoner) on the four DeepSeek models, whereas that of the single iterative agent ranges from $34.3\%$ to $86.4\%$ (Table A4). A reasoning architecture inherits the strengths and weaknesses of its language model; the exact core does not. The two runs on deepseek-v4-pro agree on the verdict for $99.6\%$ of instances with the full method and $98.1\%$ with the single iterative agent, and no method’s certified success differs between them by more than $0.7$ points. Across sampling seeds 0, 1 and 2 on deepseek-chat (the first decoded at temperature zero, the other two at $0.3$), the certified success of the full method varies by at most $3.1$ points and the ordering of methods never changes.

With the DeepSeek models, look-ahead instances declared valid by the full method are rare: they occurred only on deepseek-chat (2 of 54) and deepseek-flash (3 of 54), against a rate of $0.145$ on gpt-4.1-mini. Each of the five DeepSeek cases is the coarsened member of a filtration-mutation pair whose information structure the language model misread; the procedure then enforced the filtration it had been given, under which the strategy is legal, and the kernel, which checks the recovered model, accepted the certificate. This is the limit stated in Section 3.3: the guarantees are relative to the recovered model, and the information rules cannot protect against a wrongly recovered filtration.

12. Case Studies

We illustrate the method on the market of the example in Section 5, extended to four periods: a binomial model with $T=4$, $S_0=100$, $u=6/5$, $d=5/6$ and gross one-period rate $R=21/20$, so that the risk-neutral probability is $q=(R-d)/(u-d)=13/22$ exactly (Cox et al., 1979).

For a European call with strike $K=100$ the risk-neutral price is

$${\displaystyle \frac{5,951,233,600}{258,854,211}}\approx 22.9907.$$

A replicating strategy is constructed node by node; it is predictable and self-financing, and its terminal replication error is exactly zero on every path. The initial position holds 343,408/456,533 units of the risky asset, financed by a cash holding of

$$-{\displaystyle \frac{13,520,000,000}{258,854,211}}\approx -52.2302.$$

For an American put with strike $K=110$ on the same tree, the Snell value, the European value of the same payoff, and the early-exercise premium are

$${\displaystyle \frac{479,106,400}{35,153,041}}\approx 13.6292,{\displaystyle \frac{341,237,500}{35,153,041}}\approx 9.7072,{\displaystyle \frac{137,868,900}{35,153,041}}\approx 3.9220,$$

the premium being a strictly positive rational. The exercise region is shown in Figure 6. The first hitting time of the exercise region is verified to be a stopping time and to attain the Snell value. Three defective exercise rules are each rejected at its earliest inconsistent date: one that consults the next move before deciding, one computed under the physical rather than the pricing measure, and one in which the maximum is omitted at a single node. For the first, the shortfall against the Snell value is exactly $485/77$.

Figure 6. The exercise region of the American put of Section 12, computed in exact rational arithmetic; the line marks the boundary between the two regions. Nodes at which the immediate payoff and the continuation value are both zero are shown separately, since the Snell recursion is indifferent there.

The third case is the one Theorem 1 describes. On a three-period version of the same tree, a rule whose position depends only on the current price level is compared with a rule that differs from it only on the successor subtree that the realized path does not enter. Both produce the same realized wealth at every date and the same terminal wealth $432/5$; every quantity available to an audit of the realized history is identical. The scope check separates them at date 1 and returns the two paths on which the holdings differ, and both the admissibility of the first rule and the inadmissibility of the second are machine-checked.

Finally, to show that the exact treatment is compatible with estimated inputs, the same analysis is run on a tree parameterized from a public daily equity index series: an annualized volatility of $15.9\%$ and a three-month rate of $3.67\%$ at a monthly step give, after rational approximation, $u=89/85$, $d=85/89$ and $R=328/327$, values that satisfy $d<R<u$, so the tree is arbitrage-free by construction. No conclusion of this paper depends on the estimates.

13. Discussion

A proof assistant makes a language model’s mathematics checkable; it does not make the model’s reading of a financial problem faithful. The results separate what closes that second gap from what does not.

The information discipline provides a guarantee that does not depend on inspecting the computation. Theorems 3 and 4 make non-anticipativity a property of the message relation, and the experiments measure the cost of abandoning it while holding everything else fixed: $19.8$ percentage points of certified success when the model is supplied directly, with a rise from $0.0\%$ to $91.5\%$ in look-ahead errors declared valid, and between $16.9$ and $19.2$ points at the prose level on each of five language models. On pairs that Corollary 1 shows no outcome-based procedure can separate, the method separates all of them.

The exact core also makes every verdict checkable. Every violation the method reports comes with the earliest inconsistent date and a finite witness—for predictability, a two-path witness of the smallest possible size (Theorem 2)—whereas each reasoning architecture declares violations it cannot exhibit on $3\%$ to $5\%$ of instances and supplies a convention wherever the source leaves one open. For model risk the difference matters: a claim that cannot be checked cannot be acted on.

The decomposition into slices, by contrast, adds no accuracy of its own: given a correct model, the full method is as reliable as the same exact core applied centrally, which is the expected consequence of placing soundness in the exact core and the kernel. At the prose level, the full method’s advantage over the centralized variant, which reflects the staged recovery of conventions, is $2.3$ points on deepseek-reasoner, which is not significant, and between $0.0$ and $0.4$ points on deepseek-chat, deepseek-v4-pro and deepseek-flash. What remains of the gap between a specification and its formalization lies upstream, in the reading of the text, and it can be reduced by constraints on that reading. Requiring a verbatim quotation for each timing convention removed every invented default in the three runs in which it was evaluated and raised certified success on deepseek-v4-pro to $98.9\%$; there, the errors that remain are misreadings of the information structure, and because the procedure enforces whatever filtration it is given, they are the ones that matter most. A constraint of the same kind could be applied to the information structure itself, by requiring the sentence that says which states are indistinguishable at which date; we have not tested this.

The guarantees are also relative to the pricing measure stated in the model, which raises the question of model risk in the choice of Q. Two cases should be distinguished. If the stated measure does not make discounted prices martingales, the model is internally inconsistent: obligation (iv) of Definition 1 fails, and the procedure returns the earliest node at which it fails together with the exact residual, as it did for every perturbed transition kernel in the benchmark. If the stated measure does make prices martingales but is the wrong one for the market—because it was estimated badly, or because the market is incomplete and many measures are consistent with the prices—the procedure cannot detect it, since nothing in the model contradicts it. The verdicts are then correct for the stated measure, and the values are arbitrage-free prices in the model as written. What the discipline does catch is the confusion of measures: a join requires the measures of its inputs to agree, so a value computed under the physical measure cannot be combined with one computed under the pricing measure, and the case study of Section 12 rejects an exercise rule computed under the physical measure. Robustness to the choice of measure can be studied within the same framework. On a finite tree the set of equivalent martingale measures is a polytope, and running the verification under each of its extreme points yields the range of values consistent with the prices, each with its own certificate.

Scale is the other open question. The exact core is linear in the size of the tree, and runs with up to 65,536 terminal paths took a fraction of a second; kernel checking dominates the cost, at $1.7$ s per instance on average for trees with 33 to 64 terminal paths. Trees, however, grow exponentially with the horizon, and realistic strategies are defined on trees that cannot be enumerated. Merging dates that carry the same information is the exact form of abstraction: it replaces the dates by the classes of the relation ${\Pi }_s={\Pi }_t$, preserves every verdict, and by Theorem 5 cannot be taken further without combining dates whose information differs. Its natural generalization indexes the recursion by information cells rather than by nodes, which reduces the state space to the information quotient measured in Section 10, $55\%$ of the nodes when information arrives every sixth date. On a natural filtration, however, every node is its own information cell, so the quotient is the whole tree, and no exact abstraction can be coarser: identifying two cells that the filtration separates would misjudge any strategy that takes different values on them. Large problems therefore need abstractions that are sound but not complete. The most promising one for finance exploits recombination. If a strategy is specified as a function of the date and the current state, $H_{t+1}=h_t\left(S_t\right)$, it is ${\mathcal{F}}_t$-measurable because $S_t$ is, so its predictability can be certified on a recombining lattice with $O\left(T^2\right)$ nodes instead of a tree with exponentially many. The reduction sacrifices completeness: a predictable strategy that depends on the path, and not only on the current price, cannot be expressed on the lattice at all. In the same spirit, subtrees on which the model is homogeneous can be checked once and their certificate reused. Abstractions of this kind, each with a soundness theorem proved in the same development, are the main route to realistic horizons.

Several limitations bound the scope of these conclusions. The benchmark is synthetic: its instances are generated with known answers, its prose is produced by a generator in a small number of surface forms, and its trees have at most 729 terminal paths. The results therefore show what the procedure does on well-posed problems of controlled difficulty. They do not measure performance on specifications written by practitioners, which are longer, less regular and ambiguous in more ways than the one the under-determined family captures. The setting is finite throughout: finite horizon, finitely branching trees and rational data, and the formal development is self-contained rather than built on a general measure-theoretic library; connecting the two would strengthen the claim of generality without changing any statement proved here. Optimality of the first hitting time, and minimality of the Snell envelope among dominating supermartingales (a different sense of minimal from that of Theorem 5), are verified per instance as exact rational identities rather than proved in general. Kernel checking is applied to instances with at most 64 terminal paths; the remainder are verified by the exact core and reported separately. Finally, four of the five language models come from a single provider.

Natural extensions include transaction costs and solvency cones, which turn admissibility into a conic rather than a linear condition; partially observed markets, which replace the natural filtration by an observation filtration; and the time-consistency of dynamic risk measures, an information-flow property of the kind the present discipline is designed to express.

14. Conclusions

We have shown that the filtration of a discrete-time financial model can be treated as a specification for a verification procedure rather than as a hypothesis of its theorems. The central obstruction is that realized data do not determine informational admissibility. A single observational record is compatible with $2^{\kappa }-1$ distinct patterns of violation, so every audit that reads only realized outcomes errs on at least one member of each observationally identical pair, and a refutation requires two terminal paths, never fewer. Against this obstruction, restricting communication to messages that record their information date makes non-anticipativity a property of the protocol that holds for every computation a component can perform; the tower property lets one-period identities compose into global pricing identities; and the induced decomposition uses the fewest slices possible. All of this is machine-checked in Lean 4, with the kernel as the only part that checks proofs. On 2960 synthetic instances the method attains perfect certified success when the model is supplied directly, separates every observationally identical pair and localizes every injected error at the earliest inconsistent date, while removing only the information rules costs 19.8 percentage points, after which the procedure declares 91.5% of look-ahead errors valid. When the model must be read from prose, the remaining errors lie in the reading of the text, chiefly in timing conventions that the source leaves open; in an exploratory experiment, requiring a verbatim quotation for each convention turned every such case into an explicit abstention.