The AI Journal

In 1976 Kenneth Appel and Wolfgang Haken announced a proof of the four-colour theorem that almost no mathematician could read in the way a proof is normally read. Their argument reduced the general claim about every planar map to a finite list of roughly 1,900 special configurations, each of which a computer then checked by brute enumeration, a task that would have taken a human referee a working lifetime to repeat by hand. The theorem was true. Within a few years almost nobody disputed that. What took much longer to settle was whether what Appel and Haken had handed the field was a proof, or something else wearing a proof’s name and doing a proof’s job only partway.

Thomas Tymoczko gave the objection its sharpest form two years later. A traditional proof, he argued, is checked by any sufficiently trained mathematician reading it line by line, and that universal readability is not incidental to what a proof is; it is part of how mathematics has always told the difference between a result and a rumour. The Appel–Haken argument broke that. No one could read the case analysis in the ordinary sense, only trust that the machine had executed it correctly, which made the theorem’s status closer to a well-attested empirical claim than to the a priori certainty proof is supposed to deliver. Richard De Millo, Richard Lipton and Alan Perlis pressed a related point from computer science the same year, arguing that a formally verified program would never earn a working programmer’s trust the way a mathematical proof earns a mathematician’s, because verification skips the social process, circulation, exposition, independent re-derivation, by which a mathematical community actually comes to believe something and make it part of its working knowledge.

It is tempting to read this as a dispute that better engineering would simply dissolve, and for a while that looked right. The worry about the four-colour proof was partly a worry about trusting one research group’s unpublished Fortran, run once, on one machine. Georges Gonthier removed that worry in 2008 by re-proving the theorem inside the Coq proof assistant, building the argument up from logical first principles rather than trusting a bespoke enumeration program, so that an independent, general-purpose checker could verify every step. This is about as strong a correctness guarantee as mathematics has ever produced for a hard combinatorial result, considerably stronger than the guarantee behind most proofs that have never been seriously doubted. And the philosophical objection, remarkably, survived it intact. Gonthier’s formalisation answers the question of whether the theorem is true without touching the question Tymoczko actually raised, which was never about reliability. It was about whether anyone, including Gonthier, holds the proof in the sense of being able to walk a colleague through why each piece must be as it is. Nobody does, and a stronger checker does not change that.

The same split appears without any four-colour baggage attached. Thomas Hales announced a proof of the Kepler conjecture, on the densest way to pack equal spheres, in 1998. The argument was long and leaned on extensive computer calculation of its own, and a panel of twelve referees spent four years on it before reporting that they were 99 per cent certain it was correct, having found no error but being unable, short of re-running the calculations themselves, to rule every line in. The Annals of Mathematics published it in 2005 on that qualified verdict. That hedge is the whole story in miniature: the paper had been checked as thoroughly as exhausted human referees could manage, and the result was still short of what mathematics normally means by settled. Hales’s response was not to argue the point but to remove the need for trust in his referees altogether. The Flyspeck project spent roughly a decade re-encoding the entire argument in two independent formal systems, and the completed formal proof was published in 2017. Nothing about the theorem’s content changed between 2005 and 2017. What changed was that a machine, rather than twelve tired mathematicians, was now the thing standing behind it, and this counted as progress precisely because referee attention is a scarcer and less trustworthy resource than most papers’ acknowledgements admit.

Put the two cases together and a distinction appears that neither dispute, taken alone, forces into view. A proof can be correct, checked, and still not understood by the community it was proved for, because checking and understanding are different operations that happen to coincide in short arguments and silently diverge in long ones. Ordinary mathematical practice has no name for a result that has cleared the first bar without clearing the second, so it reaches for the word proof for both, and the word quietly starts covering two different achievements. A bridge can be certified safe by an inspector running a load calculation nobody present can reconstruct, and a bridge can be built from a design every engineer in the room can defend from the ground up; both are safe, but only one leaves the room able to explain why, and only that one lets the next engineer extend the design rather than merely trust its verdict. Mathematics depends on that second ability more than engineering does, because a theorem’s main use is usually not standing on its own but being built on by the next proof, and a result nobody in the field can walk through is a poor foundation even when it is a sound one.

The obvious objection is that this is a complaint about mathematicians’ comfort dressed up as epistemology, and that it risks sounding like guild protectionism against a tool that is, on the evidence, more reliable than the guild’s own methods. That charge has real force. The Appel–Haken enumeration did in fact contain errors, later found and fixed; the Annals referees did in fact fail to certify Hales’s proof to their own satisfaction; human checking of long arguments is demonstrably worse at catching mistakes than a formal verifier built for exactly that purpose. Measured purely on the question verification answers, correctness, the machine’s record is better than the community’s, and no amount of nostalgia for blackboard proof should be allowed to argue otherwise.

But that concedes the point actually at issue rather than undermining it. If machine verification is simply the more reliable method of answering the correctness question, the case for treating it as interchangeable with the understanding a read proof produces gets weaker, not stronger: a community now has an excellent way to learn that a result holds and no corresponding way to learn why, and conflating the two leaves it unable to notice the gap it is standing in. Mathematics does not need to downgrade machine verification to keep this distinction. It needs a second word, and the discipline of asking, every time a result is called proved, which of the two things is actually being claimed. A citation that reads merely “proved” currently collapses a theorem checked by a thousand readers over a century into the same status as one checked once by a machine last year, and a field that cannot mark that difference in its own literature cannot see where its foundations are thick and where they are, for now, exactly one program’s width.