Formalizing US Tax Code (Using Lean)

by Riki Setiawan 14 November 2026 15 min read 230x views

Yesterday, we verified that known tax loopholes could be identified using a Lean search. Today, we set out to formalize the complete Internal Revenue Code to hunt for unidentified loopholes (bugs).

Pointing a evidence checker at statutes

Lean is a programming tongue whose category checker can additionally inspect mathematical proofs: if Lean accepts a proof, all stage follows from the definitions, alongside nothing taken on trust. An before article discussed how far that benevolent of formalisation can attain in law,^[1] and yesterday we used it on the retirement-account rules, anywhere a blind hunt rediscovered the backdoor Roth.^[2]

This activity is part of global-law, a CC0 repository of versioned law and case law.^[3] Our disagreement is that pointing AI and a evidence checker at a versioned document of the law finds the contradictions and mechanical mistakes that group miss. In particular, we can capture mistakes in the text, and see what the rules allow, including what they authorize by accident. To do so, we translated all division of the law into Lean, staying near to the statute’s own words, and tested it against the worked examples the IRS prints in its forms and instructions.

1. The tax law’s content has 138 example mistakes

The tax law is Title 26 of the US Code. Its authoritative content is published as organized data by the Office of the Law Revision Counsel, the agency of the House of Representatives that compiles the Code.^[4] We used the publish current to 3 November 2026.

A parser afterward says all cross-reference, including the ones written in words (“paragraph (2) of subsection (b)”, “such subparagraph”, “sections 922 through 927”), which transport no hyperlink. Lean checks all one. Does the provision it points to exist? Is it motionless in force? (verifiable via our versioned history) The checks run as a test suite, which fails whenever a new publish adds a error the final one did not have.

The suite reports 257 findings, all checked by an AI delegate against the authoritative content and its editorial notes: 98 intended (rules for former periods, and provisions enacted but not yet in effect), 21 false alarms in the editors’ own hyperlinks, and 138 genuine faults:

Each of the 138 has a certificate: a abbreviated Lean declaration that carries its evidence from the authoritative XML and proves the fault. For a deceased reference, the evidence is the complete catalog of what does be under the cited provision. Lean re-checks all 138 in concerning two and a fractional minutes.

Our document of the US Code is a git history, one commit per community law,^[5] so all error can be traced to the law that wrote it. For Title 26 the document reaches rear to the 1994 edition.

This inspect is cheap to repeat. Run against all new publish of the Code, it flags a new error as shortly as it appears, and names the law that caused it.

2. Rewriting the earnings tax as code that can be checked

Next we wrote downward what the law calculates: the 2025 national earnings tax for one household, definition the numbers on Form 1040, including the changes made by the One Big Beautiful Bill Act in July 2025.^[6],[7] We did it in four parts:

Income, downward to adjusted income earnings (AGI). AGI is total earnings minus a few items, specified as IRA contributions and student-loan interest. Most another tax rules depend on it.
Deductions: the norm conclusion or itemized deductions, and the new deductions for tips, overtime, car-loan involvement and group complete 65.
The tax itself, including the substitute minimum tax (AMT), a second calculation that stops elevated earners from cutting their tax too far alongside deductions.
Credits, specified as the kid tax credit and the earned earnings tax credit (EITC), a credit for group on low and average wages.

We used AI to translate the statute into Lean. This is the lossy step, hence we fortify it alongside the following measures:

Each part is tested against figures the IRS publishes (the Tax Table, the EITC table, the worksheets and the examples in its publications), and checked against three autonomous tax programs on 5,000 households (section 3).
A second agent, which did not compose that part, reviews it adversarially, looking for errors and for cheating, specified as code written to continue the tests fairly than to prosecute the statute.

What Lean ultimately adds is proofs that shield all input alternatively of a sample. For example, it proves that the SALT cap and the car-loan and overtime deductions never develop whenever earnings rises, at all earnings and for all filing status.

The difference alongside another tax application helps us capture logical errors. That is how we caught two mistakes in our own model. It is additionally how we established bugs in the another tools that were logical fairly than arithmetic: Tax-Calculator gives the EITC to distinct filers without checking whether the spouses lived apart, and UsTaxes never attaches Schedule C to the 2025 return, so self-employment earnings disappears.

example checks and certificates, the 2025 earnings tax, and the loophole searches

Writing the example turned up five things:

The published Code mixes 2025 and 2026 law. In six places the consolidated Code already shows the 2025 Act’s amendments that commencement in 2026. Read without the effective-date notes, it gives the incorrect 2025 tax: the AMT phase-out at 50% alternatively of 25%, a philanthropy flat and a cap on itemized deductions that do not yet apply.
The identical Act rounds in contrary directions. The new tips and overtime deductions shrink by $100 for all complete $1,000 of earnings complete the limit, so one additional dollar of earnings can disbursal $100 of deduction. The new car-loan conclusion shrinks by $200 for all $1,000 “or part thereof”, which rounds the another way, so it runs out $999 sooner than the circular numbers suggest.
A wed brace can deduct additional province and local tax by filing separately. The conclusion for province and local taxes (SALT) is capped, and the cap shrinks as earnings rises: by 30 cents for all dollar complete $500,000 on a shared return. On a distinct return, the law halves the cap following shrinking it, so it shrinks by lone 15 cents a dollar. A brace earning $300,000 all can deduct up to $25,000 on two distinct returns, but lone $10,000 on one shared return.
The Tax Table is not the tax formula. Most group alongside subject earnings under $100,000 appearance up their tax in the IRS Tax Table alternatively of operating it out. The array differs from the equation in the law by between −$5 and +$6, and Lean proves that range for all earnings under $100,000 and all filing status.
One dollar can disbursal $8,046. Some benefits toggle off at a row alternatively of fading out. A family alongside three children can endure its entire EITC, up to $8,046, since its funding earnings is one dollar complete $11,950. The saver’s credit, a credit for withdrawal saving, plant the identical way: a brace who all put $2,000 into withdrawal accounts gets $2,000 at an earnings of $47,500, and $800 at $47,501.

3. Testing it against tax application group already use

A example is lone helpful if it gives the correct answers. To inspect ours, we built 5,000 example households and worked out all one’s 2025 tax four ways: alongside our model, and alongside three tools built by another teams, independently of all another and of us:

PolicyEngine-US, an open-source example that researchers and policymakers use to evaluation how tax and advantage changes power households;^[8]
Tax-Calculator, the Policy Simulation Library’s open-source example of the national earnings tax;^[9]
UsTaxes, a free, open-source app for preparing your own tax return.^[10]

Two thousand households were ordinary. The another 3,000 were deliberately awkward: couples filing separately, widows and widowers, students, group alongside tips or overtime, IRAs and health funds accounts, learning and saver’s credits, and incomes complete $1 myriad alongside ample funding gains.

Our example and PolicyEngine-US accepted on all fig for 4,993 of the 5,000 households. The another seven differ by at most $11, all in the EITC: our example says the IRS’s printed EITC table, during PolicyEngine-US uses the equation rearward it.^[11]

Tax-Calculator gave the EITC and the kid and reliant attention credit to wed group filing separately without checking that the spouses lived apart, which the law requires. It additionally computed no AMT for one high-earning distinct filer, anywhere two another calculators computed $14,881.

UsTaxes had 14 bugs, all confirmed by recalculating an affected household. It drops self-employment earnings without a warning, since its 2025 come back never attaches Schedule C, the form for endeavor income. Its child-care credit never reaches the return. Its age test for the EITC continually passes. And its self-employment tax counts a spouse’s wages against the cap on Social Security tax. Together, these bugs power concerning one average family in six.

The difference caught two mistakes in our own example too. We had not counted self-employment gain toward the 20% conclusion for small-business income. And we continually took the larger of the norm and itemized deductions, although the law lets you choose to itemize a smaller amount, which can pay whenever it lowers the AMT. With that fixed, one family due $2,070 less. Both mistakes showed up since two autonomous tools accepted alongside all another and not alongside us.

4. A hunt established the loopholes tax advisers already use

With a example that matches the citation software, we used it as we had used the withdrawal rules: as the oracle for a hunt that knows no tax planning. The archetypal hunt tried average choices for all of the 5,000 households, 195,787 returns in all:

file separately, and which partner holds which investments, pays which bills and claims which children;
contribute to an IRA;
earn a small less;
realize additional or small gain.

The second hunt used a multi-year family model, which adds the kiddie tax, rely taxation, Roth conversions, required withdrawals, gifts and death. It tried concerning 30,000 plans for four families complete 34 to 47 years. Everything ample that the two searches established is already in the preparedness literature:

What the hunt found	Best case	Already described by
A endeavor owner records separately to get under the §199A threshold	$6,317 a year	Kitces^[12]
The lesser earner claims the children on a distinct return	$3,090 a year	practitioner guides^[13]
Realize small acquire to remain under the EITC funding limit	$6,798 for $5,000 deferred	IRS Publication 596^[11]
Itemize a smaller amount to cut the AMT	$2,070 a year	Form 1040 instructions
Roth conversions in the gap years before Social Security	+$0.84M complete a lifetime	Kitces
Pay your children wages, and open Roth IRAs for them	+$0.46M	Kitces^[14]
Convert so the heirs do not stack ten-year withdrawals	+$0.43M–0.57M	Journal of Accountancy^[15]

As alongside the backdoor Roth, none of these was described to the search. It established them since the rules, written downward plainly, authorize them.

5. Novel loopholes we found

Three results did not rotate up in practitioner sources, IRS direction or tax-software forums.

Filing separately can cut tax on Social Security, equal for a brace living together. The norm direction is that a brace living together should never document separately whenever one draws Social Security.^[16] A distinct filer who lived alongside their partner gets no basis amount at all. But subject benefits are capped at the lesser of 85% of benefits or 85% of provisional income,^[17],[18] and the hunt established couples for whom that cap makes distinct returns cheaper. On a shared come back the operating spouse’s pay counts in provisional income, so a average pay already pushes the benefits to the 85% maximum. On a distinct come back the retiree’s benefits are measured against the retiree’s earnings alone. With $48,000 of benefits and a $60,000 wage, the brace owes $7,050 jointly and $5,568 separately, $1,482 less. A second reviewer recomputed it by hand and got the identical answer. At a $100,000 pay the outcome flips, so the opening is genuine but narrow.

Wages on one return, investments on the other. The 3.8% tax on funding earnings applies to the smaller of the funding earnings and the excess of earnings complete $250,000 jointly, or $125,000 on a distinct return.^[19] On a shared return, wages use up that threshold first. On distinct returns the investing spouse’s earnings excludes the other’s wages, and their gains commencement in their own 0% band. With concerning $200,000 of each, that saves $1,621. Every explainer gives the threshold. We established none that describes the divided or anywhere it pays.

Schedule 8812 pays additional than the statute allows. This is a gap between the IRS form and the law, not a plan. The statute caps the refundable kid credit per qualifying child, computed without the $500 credit for another dependents. The form caps the blended credit instead, so in the phase-out range, alongside no tax remaining to assimilate it, it refunds the $500 credits in cash.^[20],[21] Example: one kid and one another dependent, $240,000 of income, no tax left. The statute gives $200, the form $700. Lean proves the form is never below the statute and agrees alongside it exactly whenever there are no another dependents.

6. Why one twelvemonth of the tax code holds no big loopholes

The backdoor Roth is big since two provisions merge to eliminate an earnings bounds entirely, and the prosperity afterward compounds tax-free for decades. A sole twelvemonth of the idiosyncratic earnings tax is complete of cliffs and per-return thresholds, but all is bounded: the largest sway we established was a few thousand dollars. Over decades, the ample gains arrive from moves that are already published. The one blend we could not discover written up was paying the children in the identical years as Roth conversions, which adds concerning 0.5%. Our conjecture is that item Roth-sized and unpublished lives anywhere value moves between entities and their owners: partnerships, S corporations and C corporations.

7. Most of this can now run automatically

“The long-term issue is how this benevolent of bug-hunting can be done routinely, e.g. as part of a test suite. Some approaches aren’t really automatable, since they necessitate a lot of the two individual and AI delegate work.”

What motionless needs a individual is deciding what a finding means. Some cliffs are deliberate. Others are in the IRS’s forms, not in the law, whilst others arrive from the way the authoritative content is compiled, yet:

The content checks are routine. A new publish is one download and one command, which fails on any error the final publish did not have, and git accuse names the Act responsible.
The example is a one-off cost. Once written and proved, it is a build: if a afterward alter breaks a proved property, the build fails. When the law changes, lone the changed provisions need rewriting.
The difference is routine formerly the input mappings are right. Getting them correct was the difficult part, and the identical difference established all mapping error.

Limits

Coverage. The example covers the 2025 idiosyncratic earnings tax for a family record. It leaves out the kiddie tax on the single-year return, 28% and §1250 gain, abroad income, passive action rules, and most AMT preferences. The multi-year example holds 2025 law constant.
Who checked what. The example triage and the reviews were done by AI agents against the authoritative text, and have not been checked by a attorney or CPA.
Agreement is not truth. Where all four calculators concur they may portion a misreading. The theorems and the IRS-example tests are the inspect on the example itself.

The code, the certificates, the difference and the searches are in the lean-proofs directory of global-law.^[3]