Tsinghua Team Open-Sources VeriLoop E2 for Verifiable Reasoning

Since the summer of 2026, frontier large models have kept escalating on parameter scale, context length, test-time compute, and tool use. But the question raised by the source is more fundamental: computing more does not equal doing more correctly. A code edit may fix the main test yet break a regression test; a step of mathematical derivation may reduce local error yet invalidate another constraint; a physics approximation may improve the fit yet violate a conservation relation.

The Tsinghua team pinpoints this gap very narrowly: a standard Transformer's hidden state updates continuously along the inter-layer residual path, and recurrent-depth Transformers, Universal Transformers, Mixture-of-Depths, and looped Transformers further allow shared blocks to act repeatedly, dynamically allocate depth, or add test-time compute—they answer "how computation continues, where it continues, and how many steps it continues," but they do not answer "on what grounds the added computation counts as progress."

The source explicitly distinguishes two classes of signals: stop signals decide whether to continue computing, routing scores decide which module receives the computation, depth attention weights decide which historical representations to read, and prediction-distribution stability reflects whether the internals are converging. These internal control signals can decide "how to compute," but they cannot prove that the program, proof, or physical solution corresponding to a candidate state has made real progress on external task obligations.

Thus the target of VeriLoop E2 is not a generalized proposition like "Transformers cannot reason," but a verifiable structural gap: after recursion, dynamic depth, or test-time compute produces a candidate state, the system lacks a state-commit rule that is separate from the candidate generator and can prevent regression on protected obligations. In other words, "another step was computed" and "this step is eligible to become the next state" are not the same question.

The evidence-based convergent recursion (VeriLoop-Governed Recurrence, VGR) mechanism proposed by Wang Libo has as its core action the division of "generating candidates" and "earning persistent eligibility" into two different permissions, bringing externally verifiable evidence into state commitment, recursion control, and post-training data construction.

Runtime permissions are redivided: each run begins by fixing the task identity, model contract, Verifier identity, Verifier contract, and evidence compiler contract; after an ordinary forward pass yields a baseline latent state, it is immediately externalized into a task artifact by a fixed decoder, and an initial evidence rank is obtained from an external Verifier. The first recursion round does not start from the model's self-assessed score, but from a baseline that has already undergone external inspection.

In the t-th attempt, the learned proposer holds only proposal authority and outputs a bounded displacement; state write authority remains with the controller. The controller first checks shape, dtype, device, finiteness, and per-token radius, and only after all pass does it construct the candidate state itself. The model itself has no write permission to directly overwrite the currently retained state. The candidate then enters a single fixed and replayable decode, producing output, witness, and metadata, which are bound together with the candidate latent into a candidate artifact. The Verifier receives only the task and the bound artifact, not the model's internal scores.

This permission chain can be compressed as: ordinary forward pass → external verification → bounded candidate proposal → controller constructs candidate state → fixed decoding → external verification again → protected evidence comparison → atomic commit/reject. The source emphasizes that VGR does not replace the Transformer's Attention or FFN; it only adds a layer of external evidence adjudication before a candidate state enters the persistent state chain.

Fixed decoding cannot be omitted, because if the same task-model-latent-state key could yield different artifacts due to temperature, top-p, random Dropout, or cache drift, then even "which state exactly is being verified" could not be stably defined. Therefore the decode configuration, stopping conditions, tie-breaking rules, and related model identities are incorporated into the run contract; if repeated verification of the same candidate_id yields different results, it fails closed as a contract conflict, rather than being downgraded to an ordinary failure and continuing to run.