MetaPCR-LLM: Universal Proof-Carrying Reasoning Across Heterogeneous Logics for Large Language Model Validation

1. Introduction

Large Language Models (LLMs) have substantially improved performance on tasks requiring multi-step reasoning, particularly when intermediate reasoning is elicited through Chain-of-Thought (CoT) prompting and related sampling strategies [1,2]. Nevertheless, producing an explicit reasoning trace is not equivalent to producing a valid proof. CoT steps may contain unsupported premises, invalid inference transitions, incorrect symbolic manipulations, or post-hoc rationalizations whose relationship to the final answer is uncertain [4,5]. Process supervision partially addresses this limitation by evaluating intermediate reasoning rather than only final outcomes, but a process reward score remains a learned assessment rather than an independently checkable logical certificate [3].

These limitations have motivated a growing class of neuro-symbolic architectures in which the LLM is responsible primarily for semantic interpretation or formalization while a symbolic engine performs the actual inference. Logic-LM translates natural-language problems into symbolic representations and invokes deterministic solvers, additionally using solver feedback to refine unsuccessful formalizations [6]. LINC similarly treats the language model as a semantic parser and delegates deduction to a first-order theorem prover [7]. Faithful Chain-of-Thought externalizes selected reasoning operations into executable symbolic structures [4], while Symbolic Chain-of-Thought explicitly integrates symbolic expressions and logical rules into the generated reasoning trajectory [8]. More recent work has extended this direction through neuro-symbolic consistency objectives and logic-aided exploration [9,10]. Collectively, these approaches establish an important architectural principle: LLMs can generate or translate candidate reasoning, while logical validity can be delegated to a more deterministic reasoning mechanism.

A parallel development has occurred in formal theorem proving. LLMs increasingly interact with proof assistants such as Lean, whose kernel can provide substantially stronger guarantees than an LLM-based judge. LeanDojo provides an environment for integrating language models with Lean and demonstrates retrieval-augmented theorem proving over large formal libraries [12]. Recent systems use formal proof assistants not only to generate proofs but also to validate intermediate natural-language reasoning. SAFE formalizes individual mathematical reasoning steps in Lean 4 and seeks explicit proofs rather than assigning opaque correctness scores [13]. TP-as-a-Judge similarly employs theorem-prover feedback to assess intermediate LLM reasoning and refine autoformalization [14]. Work on natural-language requirements and theorem-prover-mediated natural-language inference further demonstrates both the promise and the central difficulty of this paradigm: formal verification is reliable only after the natural-language claim has been translated faithfully into the formal language [15,16].

Proof-Carrying Reasoning with Large Language Models (PCRLLM) takes an especially relevant step toward making reasoning itself an inspectable validation object [17]. Instead of generating an unrestricted explanation, PCRLLM constrains reasoning to minimal inference steps in which premises, inference rules and conclusions are made explicit. These structures support automatic single-step and inter-step verification and permit reasoning fragments produced by different LLMs to be compared and recombined. However, PCRLLM assumes a target logic for the proof-carrying chain; its current realization uses first-order Non-Axiomatic Logic (NAL). The framework therefore addresses the important problem of whether a reasoning chain conforms to a specified logic, but not the more general case in which different steps of the same reasoning process require different formal systems.

This distinction becomes important in realistic reasoning tasks. A single generated recommendation may simultaneously depend on deductive rules, numerical constraints, temporal relationships, uncertain evidence, defeasible exceptions and abductive hypotheses. Abductive Logic Programming (ALP) provides a principled formalism for constructing explanations through admissible hypotheses and integrity constraints [22]; ProbLog provides probabilistic reasoning over logic programs [24]; abstract argumentation provides explicit mechanisms for conflict, attack, defense and acceptability [23]; and constraint or theorem-proving systems can provide hard validation of arithmetic, algebraic, or formally specified properties. These formalisms have different semantics and should not necessarily be reduced to one another merely to obtain a uniform LLM-validation interface.

A complementary solution is to enrich logical propositions with meta-level information. Gabbay’s Labelled Deductive Systems (LDS) replace reasoning over bare formulas with reasoning over structured labelled formulas, allowing labels to carry information such as temporal status, provenance, reliability, resources, priorities, or other proof-relevant dimensions [18]. ValidLLP4LLM applies this principle to LLM validation through Labeled Logic Programs, where source, provenance, uncertainty, time, modality, priority and defeasibility accompany object-level claims and influence validation [25]. This provides a common labelled substrate for heterogeneous reasoning dimensions. However, different logical regimes are primarily expressed through label disciplines and validation profiles over the common LLP substrate rather than through independently preserved native logical systems.

The problem addressed in this paper is therefore a level above either single-logic proof carrying or single-substrate labelled validation:

How can an LLM-generated reasoning chain be formally validated when different inference steps belong to different native logical systems?

We propose MetaPCR-LLM, a meta-level architecture for proof-carrying reasoning across heterogeneous logics. The basic unit is not simply a natural-language reasoning step or a labelled proposition, but a typed proof-carrying inference object containing its premises, conclusion, native logic, proof obligation, externally checkable certificate and validation label. A numerical constraint may therefore be certified by an SMT solver, a mathematical statement by Lean, an explanatory transition by ALP, an uncertain conclusion by a probabilistic logic program and a conflict-sensitive inference by an argumentation or defeasible-reasoning engine.

This architecture introduces a problem largely absent from existing proof-carrying LLM systems: local proof validity does not guarantee valid cross-logic composition. Suppose that a proposition derived under an SMT interpretation is reused as an abductive premise, or that a probabilistic conclusion becomes an input to a temporal or defeasible rule. The proposition may have a meaningful representation in both systems, but the transformation between those representations is itself a semantic operation. MetaPCR-LLM therefore introduces proof-carrying logic bridges. A bridge records a translation between native logical representations together with the semantic property that the mapping is claimed to preserve—for example, entailment, satisfiability, contradiction, or constraint satisfaction—and the evidence used to validate that claim.

This aspect connects the proposed framework to long-established work on logic-independent reasoning. The theory of Institutions characterizes a logical system abstractly in terms of signatures, sentences, models and satisfaction, with translations constrained by satisfaction preservation [19]. Meseguer’s General Logics extends the abstraction toward proof-theoretic consequence structures [20]. Research on fibring and the analysis and synthesis of logics studies principled ways to compose heterogeneous logical systems while investigating preservation of their properties [21]. MetaPCR-LLM does not attempt to replace these theories with a new universal logic. Instead, it applies their central separation principle to LLM validation: native logics remain independent, while a meta-layer records how proof objects may be transported and composed across logical boundaries.

The resulting structure is a typed proof graph. Nodes represent normalized propositions; edges represent locally certified inference steps; edge types identify native logics; labels record provenance and contextual admissibility; and bridge objects certify transitions between logically heterogeneous edges. This representation allows the validator to distinguish failures that ordinary hallucination classification often collapses together: unsupported premise, locally invalid inference, violated hard constraint, defeated explanation, cross-logic contradiction and invalid formal translation.

The architecture also naturally incorporates proof-carrying counter-abduction. If an LLM proposes an explanatory hypothesis, the framework may construct competing abductive hypotheses. However, a rival explanation is not allowed to defeat the original merely because another LLM finds it plausible. Both explanations must carry independently validated abductive certificates, after which their admissibility, assumptions, integrity-constraint satisfaction, provenance and explanatory coverage can be compared. This extends classical ALP-style hypothesis formation [22] and the use of abduction in labelled deduction [18] toward independently checkable LLM explanation validation.

MetaPCR-LLM also generalizes the multi-model recomposition principle introduced by PCRLLM. PCRLLM shows that validated intermediate reasoning steps can be selected from different LLM outputs and recombined rather than choosing only among complete answers [17]. In MetaPCR-LLM, the same idea extends across logical systems: a Lean-certified step generated by one model, an SMT-certified step generated by another and an ALP-certified explanation generated by a third can participate in one composite reasoning graph, provided that each step is locally valid and every cross-logic transition is admissible.

The main contributions of this paper are therefore:

1.

We introduce heterogeneous proof-carrying reasoning, in which individual LLM-generated inference steps can be certified by different native logical systems rather than being forced into a single target logic.

2.

We define a typed, labelled proof-graph representation combining native proof certificates with provenance, temporal scope, confidence, modality, priority and defeasibility metadata.

3.

We introduce proof-carrying logic bridges, making cross-logic representation changes explicit validation objects and requiring declared preservation properties.

4.

We define meta-level conflict and failure analysis capable of distinguishing local proof failure, unsupported premises, native-logic contradiction, cross-logic conflict and translation failure.

5.

We extend the architecture with proof-carrying abduction and counter-abduction, so that explanatory competition occurs between independently validated hypotheses.

6.

We provide a framework for multi-LLM proof recomposition, where verified reasoning fragments can be combined across both model and logic boundaries.

The core principle is that logical heterogeneity should not be hidden inside an LLM prompt or collapsed into a single scalar verification score. Instead, each formal system should retain authority over the claims for which it is appropriate, while the meta-layer makes their composition explicit, inspectable and machine-checkable.

2. Related Work

2.1. Chain-of-Thought, Self-Consistency and Process Verification

Chain-of-Thought prompting demonstrated that explicitly generating intermediate steps can substantially improve LLM performance on arithmetic, symbolic and commonsense reasoning tasks [1]. Self-consistency improves this strategy by sampling multiple reasoning trajectories and selecting answers supported across alternative paths [2]. These techniques primarily improve generation, however and do not provide an independent criterion for deciding whether individual transitions are logically valid. Studies of CoT faithfulness have consequently distinguished plausible explanations from reasoning traces that causally or logically support the model’s actual answer [4,5].

Process supervision moves evaluation from the final outcome toward intermediate reasoning. Lightman et al. [3] compare process and outcome supervision and introduce large-scale step-level correctness annotations. This establishes that intermediate-step evaluation can be operationally valuable. Nevertheless, reward-model validation is epistemically different from proof checking: a learned verifier predicts whether a step appears acceptable, whereas a formal validator tests whether it satisfies a specified consequence relation or proof obligation. MetaPCR-LLM focuses on the latter while allowing learned components to assist decomposition and routing.

2.2. Neuro-Symbolic Logical Reasoning

Logic-LM [6] is a representative solver-coupled architecture: an LLM formalizes the problem, a deterministic symbolic solver performs inference and solver errors are reused for refinement. LINC [7] similarly treats the LLM as a natural-language-to-first-order-logic interface while relying on an external theorem prover for deduction. These systems demonstrate that separating semantic interpretation from symbolic inference can outperform reasoning performed entirely inside the language model.

Faithful Chain-of-Thought [4] externalizes reasoning into executable symbolic operations, while SymbCoT [8] integrates symbolic expressions, logical rules and an explicit verification stage into CoT reasoning. FLARE [10] continues this direction by combining logic-aided planning and structured exploration. Another complementary direction incorporates logical constraints during training rather than solely at inference time; Calanzone et al. [9], for example, use neuro-symbolic objectives to improve consistency with external rules and facts.

The main limitation relative to MetaPCR-LLM is architectural rather than algorithmic. Most solver-integrated systems formalize a problem in one selected symbolic representation or use a particular solver appropriate for that task. MetaPCR-LLM instead treats the reasoning trajectory as potentially heterogeneous at the level of individual inference steps, so solver identity becomes part of the proof type rather than merely a system-level configuration.

2.3. Formal Theorem Proving and LLM Validation

Formal theorem proving provides the strongest contemporary example of machine-checkable LLM reasoning. Lean 4 is an interactive theorem prover and programming language based on dependent type theory whose kernel checks generated proof terms [11]. LeanDojo provides an open environment for machine-learning-based theorem proving and supports interaction between retrieval-augmented language models and Lean proof states [12].

Recent work increasingly repurposes theorem provers as validators of intermediate LLM reasoning rather than merely as endpoints for theorem generation. SAFE [13] translates mathematical reasoning steps into Lean 4 statements and seeks formal proofs of them. TP-as-a-Judge [14] uses theorem-prover-based formalization to validate intermediate synthetic reasoning and further uses theorem-prover feedback in training. Cao et al. [16] evaluate translation from natural-language requirements into five formal languages—Coq, Lean4, Dafny, ACSL and TLA+—illustrating both the breadth of formal validation and the difficulty of autoformalization. Quan et al. [15] similarly show that theorem-prover verification of NLI explanations depends critically on reducing semantic loss during natural-language-to-logic translation.

These results motivate two design choices in MetaPCR-LLM. First, the external symbolic checker, rather than the LLM, should remain the authority on object-level proof validity. Second, the transformation into the checker’s formal language must itself be represented and auditable. MetaPCR-LLM extends the second principle further by treating transformations between different formal systems as explicit proof-carrying bridge objects.

2.4. Proof-Carrying Reasoning

PCRLLM [17] directly motivates the proof-carrying component of the proposed framework. It constrains reasoning to single-step transitions and requires explicit premises, rules, conclusions and associated NAL information, enabling automated single-step and chain-level grading. Its structured representation includes premises, results, reasoning rules, truth-value information and evidential bases, making intermediate reasoning substantially more inspectable than conventional CoT.

PCRLLM also introduces stepwise recomposition across LLMs: validated portions of different model outputs can be combined to construct a stronger reasoning chain. MetaPCR-LLM retains both ideas but generalizes the proof object from

$${\langle premises,rule,conclusion\rangle }_L$$

for one target logic L, to

$$\langle premises,rule,conclusion,L_i,certificate,label\rangle ,$$

where $L_i$ may differ between adjacent steps. Consequently, MetaPCR-LLM adds a proof obligation that PCRLLM does not need to solve in its current setting: establishing that a conclusion may be safely transported from $L_i$ into $L_j$.

2.5. Labelled Deduction and Labeled Logic Programs

Labelled Deductive Systems provide a natural foundation for associating proof-relevant meta-information with propositions. Gabbay [18] develops labelled formulas as structured reasoning objects whose labels themselves possess algebraic structure, providing a uniform methodology applicable to multiple logical systems.

In a labelled system, reasoning operates over structures of the form

$$t:A,$$

where A is an object-level proposition and t contains additional proof-relevant information. Depending on the application, the label may encode temporal information, provenance, reliability, resource conditions, priorities, modalities, or contextual restrictions.

ValidLLP4LLM [25] applies this principle to LLM reasoning validation. Facts, rules, assumptions, constraints and conclusions are represented as labelled logical objects; the labels can encode provenance, time, uncertainty, priority, modality and defeasibility. Different validation regimes operate through label disciplines and profiles over the shared representation.

MetaPCR-LLM uses labelled information differently. It retains labels as a common meta-level vocabulary, but does not require object-level validity to be reproduced within one LLP consequence relation. A Lean proof remains a Lean proof, an SMT certificate remains an SMT certificate and an ALP explanation remains an ALP explanation. Labels provide common provenance and admissibility information across these heterogeneous proof objects.

2.6. Institutions, General Logics and Logic Combination

The theoretical motivation for keeping native logical systems independent has deep roots in universal and abstract logic. Goguen and Burstall’s institution theory [19] abstracts a logical system through signatures, sentences, models and satisfaction and requires the satisfaction condition to remain invariant under changes of notation. The framework was developed to capture common structure across heterogeneous logics used in specification and programming.

An institution can be represented abstractly as

$$\mathcal{I}=\langle Sign,Sen,Mod,\vDash \rangle ,$$

where $Sign$ denotes signatures, $Sen$ maps signatures to sentences, $Mod$ maps signatures to models and ⊧ is the satisfaction relation.

Meseguer’s General Logics [20] broadens this perspective toward a general treatment of entailment and proof systems. Rather than requiring all reasoning to inhabit the same syntax or semantics, such approaches permit relationships among distinct logical systems to be studied at a meta-level.

Fibring and related work on the analysis and synthesis of logics investigate how independently defined logical systems can be combined while preserving relevant properties [21]. This literature is particularly relevant to MetaPCR-LLM because heterogeneous LLM reasoning may require temporal, probabilistic, epistemic, constraint, or defeasible formalisms within a single reasoning episode.

MetaPCR-LLM does not claim to provide a complete institutional semantics for every supported solver. Instead, these frameworks motivate the central design requirement that cross-logic mappings must be explicit and that the semantic property expected to survive a mapping must be declared and validated. In this sense, proof-carrying bridges are an operational counterpart to logic translations and preservation conditions.

2.7. Abduction, Uncertainty and Argumentation

Abductive Logic Programming extends logic programming by allowing selected propositions to be hypothesized when they provide an admissible explanation subject to integrity constraints [22]. Given a logic program P, a set of abducibles A, integrity constraints $IC$ and observations O, the objective is to find an explanation $\Delta \subseteq A$ such that

$$P\cup \Delta \vDash O$$

while

$$P\cup \Delta \vDash IC.$$

This makes abduction especially relevant to LLM-generated diagnoses, causal explanations and missing-premise reasoning.

ProbLog provides a complementary treatment of uncertain symbolic knowledge by attaching probabilities to logical facts and computing query success probabilities over the induced distribution of logic programs [24]. Such reasoning is useful when a proof obligation is not simply valid or invalid but depends on uncertain evidence.

Abstract argumentation, originating with Dung’s framework [23], represents conflict through attacks and derives acceptability through structured relations among arguments. An argument may therefore be logically constructible but nevertheless defeated by a stronger or admissible counterargument.

These approaches illustrate why a universal LLM verifier should not assume that all proof obligations are deductive. Some claims require proof, others require satisfiability, others require an admissible explanation and still others require determining whether an argument survives stronger counterarguments. MetaPCR-LLM therefore interprets proof carrying broadly: the certificate attached to a reasoning step is defined by the native validator and may be a formal proof term, model, countermodel, abductive explanation, probabilistic derivation, or argument-acceptability witness.

2.8. Multi-Agent and Multi-LLM Reasoning

Multi-agent LLM systems commonly improve performance through debate, majority voting, self-consistency, or aggregation of independently generated answers. Such approaches can exploit diversity between models, but natural-language agreement is not equivalent to logical agreement. Several models may converge on the same invalid inference and debate does not by itself provide an independently checkable proof structure.

PCRLLM [17] provides an alternative perspective by allowing reasoning fragments to be assessed individually and recombined across models. Instead of selecting the best complete answer, high-quality intermediate steps may participate in a new composite reasoning chain.

MetaPCR-LLM extends this principle by imposing two additional constraints. First, a reusable step must carry a certificate from its native formal validator. Second, when two adjacent steps belong to different logical systems, their composition requires a validated logic bridge. Multi-LLM collaboration therefore becomes composition of independently certified proof objects rather than aggregation of persuasive natural-language responses.

2.9. Abductive and Neuro-Symbolic Validation in Prior Work

The present framework also builds on a line of work in which hallucination detection is formulated as a structured reasoning problem rather than solely as factual comparison or statistical anomaly detection. Galitsky proposed an information–theoretic model of abduction in which generated explanations are evaluated through a combination of abductive reconstruction and information-theoretic measures [26]. The central idea is that an apparently fluent explanation may still be defective when its supporting assumptions cannot be reconstructed economically or when the explanation is substantially less compatible with available evidence than competing hypotheses. This perspective is particularly relevant to MetaPCR-LLM because it treats the explanatory structure itself as an object of validation rather than regarding the final generated statement as the only verification target.

A complementary neuro-symbolic formulation was developed for process-control reasoning [27]. In this setting, LLM-generated recommendations are checked using symbolic representations of process states, constraints and admissible control actions. The motivation is closely related to the present work: neural generation provides flexibility in interpreting operational situations, whereas symbolic reasoning constrains the resulting recommendations by domain rules. The process-control setting also demonstrates why logical validation is particularly important when reasoning errors can propagate from an apparently plausible intermediate statement into an invalid operational recommendation.

More explicitly, abductive hallucination detection has been formulated in terms of missing-premise construction, explanatory minimality, counter-abduction and defeasible competition between hypotheses  [28]. In this formulation, an LLM-generated explanation is represented as a candidate hypothesis whose implicit premises must be reconstructed and tested. Counter-abduction generates alternative hypotheses capable of explaining the same observations and the original reasoning is considered weakened when a rival explanation satisfies the constraints with stronger evidential support, fewer unsupported assumptions, or fewer contradictions. Discourse-weighted Abductive Logic Programming (D-ALP) additionally incorporates rhetorical prominence into hypothesis evaluation so that central claims and supporting contextual material do not contribute identically to the abductive search.

These ideas provide one of the direct conceptual foundations for proof-carrying counter-abduction in MetaPCR-LLM. The principal extension made here is that abductive explanations are no longer merely compared as symbolic hypotheses. Each accepted explanation becomes a proof-carrying object:

$$\mathcal{A}\left(H\right)=\langle H,\Delta ,IC,{\chi }_{\mathrm{ALP}},t\rangle ,$$

where H is the explanatory hypothesis, $\Delta$ is the set of required abducibles, $IC$ records the integrity constraints, ${\chi }_{\mathrm{ALP}}$ is the native abductive certificate and t is the meta-level validation label. A counter-hypothesis is therefore permitted to defeat another hypothesis only after its own admissibility has been independently established.

The broader architectural motivation follows the neuro-symbolic separation between neural proposal generation and symbolic validation developed in earlier work [29]. In particular, adversarial integration of LLMs with logic programs treats the generative model and the symbolic reasoner as complementary components rather than attempting to make the LLM itself an authoritative logical engine. An associated abductive dialogue formulation repeatedly challenges generated claims with alternative explanations and symbolic constraints [31]. MetaPCR-LLM generalizes this separation further: there is no single symbolic reasoner against which every LLM claim is tested. Instead, each reasoning step is delegated to the native formal system most appropriate for its semantics and the resulting proof objects are composed at the meta-level.

Recent work in Machine Learning and Knowledge Extraction (MAKE) provides several closely related examples of the broader movement from unconstrained LLM generation toward knowledge-grounded, structurally validated and neuro-symbolic reasoning systems.

Pesjak and Žabkar combine LLM-generated proposals with deterministic symbolic planning in a robotic Sense–Plan–Code–Act architecture  [32]. Natural-language observations are transformed into a symbolic Planning Domain Definition Language (PDDL) representation, a classical planner generates an admissible action plan and subsequent code is checked syntactically and semantically before execution. This architecture illustrates the important separation between proposal and validation: the LLM is useful for interpreting and generating candidate structures, but the symbolic planning component remains the authority regarding plan validity. MetaPCR-LLM adopts the same principle but moves it from the application level to individual inference steps. PDDL planning can therefore become one native proof type among several rather than the single symbolic back-end for an entire reasoning episode.

Maltoni and Ferrara study deductive reasoning in language models by distinguishing horizontal reasoning, where intermediate inferences are generated autoregressively across tokens, from vertical reasoning, where logical transformations emerge across network layers before the output is generated [33]. Their analysis reinforces an important motivation for external proof validation: even when a language model appears to learn rule-like deductive mechanisms, the existence of internal reasoning structure does not itself provide a machine-checkable certificate for a particular generated inference. MetaPCR-LLM is complementary to this line of mechanistic analysis because it is concerned with the externally observable proof obligations associated with generated reasoning rather than with identifying the internal neural circuit responsible for them.

Kadyrbek and Mansurova introduce Primitive-Augmented Transformers with Event-Role Side State (PAT-ER), where explicit event-role and logical-primitive registers accompany the ordinary token representation  [34]. Logical primitives represent distinctions such as what licenses a conclusion, what conflicts with it, or when available evidence is insufficient. This approach is relevant to MetaPCR-LLM because it demonstrates another route for exposing latent logical structure. However, such logical side-state remains a neural representation rather than an independently validated formal proof. MetaPCR-LLM can therefore be viewed as operating at a subsequent verification layer: neural representations may assist in routing or formalization, whereas acceptance of a reasoning step requires a certificate produced by the corresponding native validator.

A related trustworthy-AI direction shifts attention from answer generation toward the question of whether the available evidence licenses an answer at all. Ngartera et al. propose Bayesian Retrieval-Augmented Generation (BRAG), which embeds an LLM within an evidence-governed decision architecture combining answerability estimation, uncertainty decomposition, structural validation and routing among answering, escalation, abstention and failure  [35]. This distinction between generation and entitlement to answer is closely related to proof-carrying reasoning. MetaPCR-LLM makes the corresponding criterion logical rather than solely evidential: a generated claim may be emitted as fully supported only when all required proof obligations and cross-logic bridge obligations have been discharged.

Scenario-adaptive evaluation of trustworthy fine-tuned text models further emphasizes that reliability is multidimensional and task dependent  [36]. Robustness under different instruction, language and knowledge-grounding conditions cannot generally be reduced to a single accuracy statistic. This motivates the MetaPCR-LLM evaluation design, which separates final hallucination detection from step validity, chain certification, bridge validity, failure localization, calibration and escalation appropriateness.

Knowledge-grounded generation represents another complementary reliability mechanism. Saleh et al. introduce a subgraph-based Retrieval-Augmented Generation approach for multi-hop question answering in which structured knowledge-graph retrieval is used to provide evidence for reasoning across multiple relations [37]. Retrieval grounding reduces the space of unconstrained generation, but retrieved support does not by itself establish that an inference made over the retrieved facts is valid. MetaPCR-LLM therefore treats retrieval as a source of proof premises and provenance rather than as a substitute for proof checking:

$$\mathrm{Retrieved}\left(e\right)\cancel{\Rightarrow }\mathrm{Entails}(e,C).$$

Evidence availability and inferential validity remain separate proof obligations.

2.10. From Symbolic Verification to Proof-Carrying Heterogeneous Validation

Taken together, these developments reveal three increasingly strong levels of control over LLM reasoning. Knowledge-grounded systems constrain the evidence available to generation; symbolic-verification systems delegate selected reasoning tasks to deterministic formal tools; and proof-carrying systems require the derivation itself to expose sufficient structure for independent checking.

Prior abductive and neuro-symbolic work  [26,27,28] demonstrates how explanatory hypotheses and generated recommendations can be challenged using explicit logical machinery. Recent MAKE work similarly demonstrates the utility of symbolic planning  [32], explicit logical structure  [34], evidence-governed output control  [35] and structured reasoning analysis  [33]. MetaPCR-LLM combines these directions around a different abstraction boundary: the framework does not assume that one logical formalism, one retrieval mechanism, or one validation profile is sufficient for the complete reasoning chain.

Instead, each inference edge

$$e_i=\langle P_i,r_i,C_i,L_i,{\chi }_i,t_i\rangle$$

retains the identity of the native logic $L_i$ and its certificate ${\chi }_i$. When two adjacent inference edges employ different logics, their composition creates an additional proof obligation

$$B_{ij}=\langle L_i,L_j,{\mu }_{ij},{\rho }_{ij},{\chi }_{ij}\rangle ,$$

where ${\mu }_{ij}$ is the translation, ${\rho }_{ij}$ specifies the semantic property intended to be preserved and ${\chi }_{ij}$ certifies the bridge. This moves verification from “LLM + symbolic checker” to a proof-carrying network of heterogeneous symbolic checkers. The resulting distinction is central to MetaPCR-LLM: local validity within each formal system and global validity of the composed reasoning graph are treated as separate, independently inspectable properties.

2.11. Positioning of MetaPCR-LLM

The related approaches can be viewed as occupying successive levels of explicit reasoning validation. CoT exposes intermediate reasoning but does not guarantee it. Process reward models evaluate individual steps but remain statistical predictors. Neuro-symbolic methods execute selected symbolic representations. Theorem-prover-based systems provide strong certificates within particular formal systems. PCRLLM makes stepwise proof structure explicit relative to a target logic. ValidLLP4LLM makes heterogeneous validation metadata explicit through labelled reasoning.

MetaPCR-LLM addresses the remaining composition problem. Its objective is not to define a more expressive single logic, but to provide a meta-proof architecture over heterogeneous native logics. The proposed framework therefore combines three mechanisms:

1.

native-logic proof certificates, which preserve the authority and semantics of specialized formal reasoning engines;

2.

common labelled proof metadata, which records provenance, uncertainty, temporal scope, modality, priority and defeasibility independently of the native proof language; and

3.

proof-carrying logic bridges, which explicitly validate transitions between independently defined logical systems.

This architecture moves from single-system proof verification toward auditable multi-formalism reasoning graphs, where both inference steps and the semantic transitions connecting them are explicit validation objects.

3. Methods

3.1. Problem Formulation

Let an LLM produce an answer A to a query Q under available evidence or context E. We assume that the answer is accompanied by, or can be decomposed into, a finite set of reasoning steps

$$\mathcal{S}=\{s_1,\dots ,s_n\}.$$

The objective is not merely to determine whether A is correct, but to determine whether there exists a valid proof graph connecting the available evidence to the claims required for A.

Unlike single-logic verification, we assume that different steps may require different logical systems. Let

$$\mathcal{L}=\{L_{\mathrm{FOL}},L_{\mathrm{SMT}},L_{\mathrm{ALP}},L_{\mathrm{temp}},L_{\arg },L_{\mathrm{prob}},L_{\mathrm{ITP}},\dots \}$$

denote the set of available native validators. These may correspond, for example, to first-order theorem proving, SMT solving, abductive logic programming, temporal reasoning, argumentation, probabilistic logic programming, or an interactive theorem prover such as Lean.

The verification task is therefore divided into three questions:

1.

Is each individual reasoning step valid in its declared native logic?

2.

Are the translations between consecutive steps belonging to different logics admissible?

3.

Does the complete proof graph support the final answer without unresolved contradictions, missing required support, or undefeated counter-explanations?

3.2. Proof-Carrying Reasoning Step

The fundamental object in MetaPCR-LLM is a proof-carrying step

$$s=\langle id,L,P,r,C,\chi ,t\rangle ,$$

where $id$ is the step identifier, L is the native logical system, P is the set of premises, r identifies the inference rule or proof obligation, C is the conclusion, $\chi$ is a proof certificate or validator evidence and t is a structured validation label.

At the meta-program level, the same structure can be represented as

proof_step(

    StepID,

    Logic,

    Premises,

    Rule,

    Conclusion,

    Certificate,

    Label

).

For example, an SMT-certified dosing constraint may be represented as

proof_step(

    s17,

    smt,

    [renal_function(P,35), prescribed_dose(P,D)],

    renal_dose_constraint,

    dose_safe(P,D),

    z3_certificate(cert_8821),

    label(source(guideline),

          provenance(kidney_dosing_rule),

          confidence(1.0),

          defeasible(false))

).

The certificate is intentionally logic-dependent. MetaPCR-LLM does not impose a common proof language on all native validators. An interactive theorem prover may return a proof term, an SMT solver may return a proof object or satisfying/counterexample model, an ALP engine may return a set of abduced assumptions satisfying integrity constraints and an argumentation engine may return an accepted-extension certificate.

3.3. Native Logical Validators

Each logical system is associated with a native checker:

validator(lean, lean_kernel).

validator(smt, z3).

validator(alp, alp_engine).

validator(temporal, temporal_solver).

validator(argumentation, argumentation_engine).

validator(probabilistic, problog).

A reasoning step is locally valid when its certificate is accepted by the corresponding native checker:

verified_step(S) :-

    proof_step(S, Logic, Premises, Rule,

               Conclusion, Certificate, Label),

    validator(Logic, Engine),

    verify_certificate(

        Engine,

        Premises,

        Rule,

        Conclusion,

        Certificate

    ),

    admissible_label(Label).

This design separates generation from authority. An LLM may propose the logical type, premises, rule, conclusion and candidate formalization, but the associated native validator determines whether the proof obligation is satisfied.

3.4. Structured Validation Labels

Following the labelled-deduction perspective, every proof step additionally carries a structured label

$$t=\langle t_{\mathrm{src}},t_{\mathrm{prov}},t_{\mathrm{time}},t_{\mathrm{conf}},t_{\mathrm{mod}},t_{\mathrm{def}},t_{\mathrm{prio}}\rangle .$$

The components encode source, provenance, temporal applicability, uncertainty or confidence, modality, defeasibility and priority.

These labels do not replace the native proof certificate. Instead, they answer complementary questions. A Lean proof may establish that a formula follows mathematically, while its label may indicate that one of the formalized premises was extracted from an uncertain source. Similarly, an ALP explanation may be logically admissible but depend on several defeasible assumptions.

Consequently, MetaPCR-LLM distinguishes between object-level validity and meta-level admissibility:

$$\mathrm{ValidNative}\left(s\right)\cancel{\Rightarrow }\mathrm{Admissible}\left(s\right).$$

A step participates in the final proof graph only if both conditions hold.

3.5. Typed Proof Graph

The complete reasoning process is represented as a directed typed graph

$$G=(V,E_G),$$

where nodes V represent claims and edges $E_G$ represent proof-carrying reasoning steps. Each edge is typed by a native logical system.

For example, a reasoning chain may have the structure

$$C_1\stackrel{SMT}{\to }{C}_2\stackrel{Temporal}{\to }{C}_3\stackrel{ALP}{\to }{C}_4.$$

A proof graph is locally valid when every included step is accepted by its native validator. However, local validity alone is insufficient because $C_2$, for example, may be expressed differently in the SMT and temporal representations. The transition itself therefore becomes an explicit validation object.

3.6. Proof-Carrying Logic Bridges

Let $L_i$ and $L_j$ be distinct native logics. A logic bridge is defined as

$$b_{ij}=\langle L_i,L_j,{\mu }_{ij},{\chi }_{ij},{\rho }_{ij}\rangle ,$$

where ${\mu }_{ij}$ is a representation mapping, ${\chi }_{ij}$ is a bridge certificate and ${\rho }_{ij}$ describes the properties preserved by the mapping.

At the meta-program level:

bridge(

    BridgeID,

    SourceLogic,

    TargetLogic,

    Mapping,

    Certificate

).

Examples of preservation declarations are

preserves_entailment(smt_to_alp).

preserves_satisfaction(fol_to_lean).

preserves_contradiction(temp_to_smt).

A cross-logic transition is accepted only when the relevant bridge is certified:

valid_cross_logic_edge(S1,S2) :-

    logic_of(S1,L1),

    logic_of(S2,L2),

    L1 \= L2,

    bridge(B,L1,L2,_,_),

    valid_bridge(B).

The purpose of this mechanism is to prevent an uncontrolled semantic conversion from being mistaken for a logically valid inference. An LLM-generated translation between formalisms is itself treated as a proposition requiring validation.

3.7. Cross-Logic Agreement and Conflict

Because a claim may admit representations in more than one logic, MetaPCR-LLM can explicitly detect agreement and disagreement between validators.

cross_logic_support(C,L1,L2) :-

    validated_in(C,L1,_),

    validated_in(C,L2,_),

    L1 \= L2.

Conflict is defined analogously:

cross_logic_conflict(C,L1,L2) :-

    validated_in(C,L1,_),

    contradicted_in(C,L2,_).

Such conflicts are diagnostically important. A treatment recommendation may be probabilistically well supported but violate a hard dosage constraint; an engineering design may satisfy static constraints but violate temporal ordering or safety invariants. MetaPCR-LLM therefore does not collapse all validator outputs into a scalar confidence score before examining their logical type.

3.8. Proof-Carrying Abduction and Counter-Abduction

For explanatory reasoning, let $H_0$ denote the hypothesis supporting the LLM-generated answer. An abductive engine constructs an explanation

$${\Delta }_0=\{a_1,\dots ,a_k\}$$

such that the observations become explainable under the background program and integrity constraints.

The resulting certificate contains the admitted assumptions, satisfied integrity constraints and relevant minimality or admissibility information:

abductive_certificate(

    H0,

    assumptions([a1,a2]),

    integrity_constraints_passed,

    admissible

).

Counter-abduction generates one or more rival hypotheses $H_1,\dots ,H_m$. Importantly, a rival cannot defeat $H_0$ merely because an LLM describes it as plausible. Each rival must itself produce a verified abductive certificate.

A simplified defeat relation is therefore

defeats(H2,H1) :-

    verified_abductive_certificate(H2),

    verified_abductive_certificate(H1),

    stronger_explanation(H2,H1).

The comparison criterion may incorporate explanatory coverage, assumption minimality, integrity-constraint satisfaction, provenance quality and admissibility of the corresponding proof labels.

3.9. Proof-Carrying Multi-LLM Composition

Suppose several LLMs independently generate reasoning graphs. A step generated by model M becomes eligible for recomposition only after verification:

usable_step(M,S) :-

    generated_by(M,S),

    verified_step(S).

Two steps may be composed when the conclusion of the first satisfies a premise obligation of the second, their labels are mutually compatible and any cross-logic transition is certified:

compose(S1,S2) :-

    verified_step(S1),

    verified_step(S2),

    conclusion(S1,C),

    premise(S2,C),

    compatible_labels(S1,S2),

    valid_logic_transition(S1,S2).

Thus, the framework may combine, for example, a Lean-certified mathematical step from one model, an SMT-certified constraint step from another and an ALP-certified explanatory step from a third. Collaboration becomes proof composition rather than natural-language voting.

3.10. Meta-Level Validation Program

The final verification layer operates over certified results rather than implementing the internal semantics of each native logic. A minimal version is:

final_status(C, contradicted) :-

    contradicted_in(C,L,_),

    hard_validator(L), !.

final_status(C, conflict) :-

    cross_logic_conflict(C,_,_), !.

final_status(C, supported) :-

    required_validators_satisfied(C),

    \+ contradicted_in(C,_,_), !.

final_status(C, unsupported) :-

    \+ validated_in(C,_,_), !.

final_status(_, uncertain).

Domain policies determine which validators have veto authority. For example, an SMT violation of a hard engineering safety constraint may override probabilistic or abductive support, whereas disagreement between two defeasible explanations may lead to an uncertain verdict rather than immediate rejection.

The output is therefore not restricted to a binary hallucination label. MetaPCR-LLM can return statuses such as supported, contradicted, cross-logic conflict, unsupported, defeated, translation failure, or uncertain, together with the proof node or bridge responsible for the decision.

3.11. End-to-End MetaPCR-LLM Pipeline

Given a query, context and LLM-generated candidate answer, the complete pipeline proceeds as follows:

1.

Decompose the candidate reasoning into atomic reasoning steps.

2.

Identify the reasoning regime required by each step.

3.

Translate each step into the representation of its selected native logic.

4.

Invoke the associated native validator and obtain a proof certificate, countermodel, abductive explanation, or other validation object.

5.

Attach provenance and validation labels to each verified result.

6.

Construct the typed proof graph from accepted steps.

7.

Whenever consecutive steps use different logics, construct and validate an appropriate logic bridge.

8.

Generate proof-carrying counter-abductive hypotheses when explanatory competition are required.

9.

Detect local proof failure, invalid bridges, cross-logic contradictions, unsupported nodes and defeated explanations.

10.

Produce the final validation status together with an inspectable proof graph explaining the decision.

This architecture generalizes proof-carrying reasoning from “a reasoning chain validated by one formal logic” to “a reasoning graph whose individual components and cross-formalism transitions are independently certified”. The resulting framework therefore combines natural-language flexibility, heterogeneous formal verification and explicit proof provenance without requiring all reasoning to be reduced to one universal object-level logic.

4. Implementation Architecture

4.1. System Overview

MetaPCR-LLM is implemented as a meta-validation layer over a collection of native symbolic reasoning engines. The objective is not to reimplement the semantics of each supported logic inside a single universal solver. Instead, the framework provides a common representation for proof obligations, certificates, labels and cross-logic dependencies, while delegating local validity checking to the corresponding native engine.

The implementation contains six principal components:

1.

an LLM-based reasoning decomposer that converts an answer and its rationale into atomic candidate inference steps;

2.

a logic router that assigns each step to one or more candidate native reasoning systems;

3.

a family of native validator adapters that translate proof obligations into solver-specific representations and return certificates, countermodels, or structured failure reports;

4.

a labelled meta-layer that records provenance, temporal scope, confidence, modality, priority, defeasibility and applicability context;

5.

a bridge validator that checks whether conclusions can be safely transported between heterogeneous logical systems; and

6.

a proof-graph verifier that composes locally certified steps into an end-to-end validation graph and produces the final reasoning verdict.

The system therefore separates three distinct activities: semantic interpretation, performed primarily by the LLM; object-level validation, performed by native symbolic engines; and meta-level composition, performed by the MetaPCR-LLM validator.

Figure 1 illustrates the architecture.

4.2. Input Representation and Reasoning Decomposition

For each evaluation instance, the verifier receives a tuple

$$I=\langle Q,E,A,R\rangle ,$$

where Q is the question, E is the available evidence or context, A is the candidate LLM answer and R is an optional natural-language reasoning trace.

When an explicit reasoning trace is unavailable, the LLM is prompted to produce a concise structured rationale for verification purposes. This generated rationale is treated as a candidate reasoning object, not as ground truth.

The decomposer converts R into a sequence of candidate proof steps

$$\mathcal{S}=\{s_1,\dots ,s_n\}.$$

Each step initially contains:

{

  "step_id": "...",

  "premises": [...],

  "conclusion": "...",

  "claimed_relation": "...",

  "source_span": "...",

  "candidate_logic": [...]

}

The decomposition prompt requires one inferential transition per step. Hidden multi-premise transitions are recursively decomposed until each candidate step can be expressed as a locally checkable proof obligation.

To reduce circularity, the gold correctness or hallucination label is never provided to the decomposition or routing stages.

4.3. Logic Routing

The logic router determines which native validator is appropriate for a candidate step. Let

$$Route\left(s_i\right)\subseteq \mathcal{L}$$

denote the candidate set of logical systems for step $s_i$.

The current implementation supports the following validation profiles:

• deductive / rule reasoning: Logic Programming or first-order theorem proving;
• numeric and hard constraints: SMT or Constraint Logic Programming;
• abductive explanation: Abductive Logic Programming;
• uncertain inference: probabilistic logic programming;
• conflict and defeasibility: argumentation or defeasible reasoning;
• temporal reasoning: a temporal constraint validator;
• formally specified mathematical reasoning: an interactive theorem prover.

Routing is performed from the semantic characteristics of the step rather than from its application domain alone. For example, a medical reasoning chain may contain an abductive diagnostic step, a numerical dosage constraint and a temporal ordering constraint, each of which is routed to a different native validator.

The router may assign multiple candidate logics when the reasoning type is ambiguous. In that case, all selected validators may be executed and their results compared at the meta-level.

4.4. Native Validator Adapters

Each supported logic is accessed through a common adapter interface:

validate(

    logic,

    premises,

    rule_or_constraint,

    conclusion,

    context

)

 -> {

      status,

      certificate,

      normalized_conclusion,

      diagnostics

    }.

The output status belongs to

$$\{\mathtt{verified},\mathtt{contradicted},\mathtt{unsupported},\mathtt{unknown},\mathtt{solver}\_\mathtt{error}\}.$$

The certificate is intentionally logic-specific. The framework do not require all validators to return the same internal proof representation.

The implementation uses adapters of the following conceptual form:

validator(logic_programming, prolog_adapter).

validator(smt,              smt_adapter).

validator(alp,              alp_adapter).

validator(probabilistic,    problog_adapter).

validator(argumentation,    argumentation_adapter).

validator(temporal,         temporal_adapter).

validator(theorem_prover,   theorem_prover_adapter).

The exact engines and versions used in the reported experiments are listed in Table 1.

4.5. Proof Certificates

A successful validator produces a certificate

$${\chi }_i=Cert(L_i,P_i,r_i,C_i),$$

where $L_i$ is the native logic, $P_i$ is the premise set, $r_i$ is the applied inference relation or constraint and $C_i$ is the derived conclusion.

Certificates take different forms depending on the validator:

• a derivation tree for logic programming;
• an unsatisfiability proof or model for SMT;
• an admissible set of abduced assumptions for ALP;
• a probability or interval derivation for ProbLog;
• an accepted argument and attack/defense trace for argumentation;
• a temporal consistency witness;
• a kernel-checked proof term for an interactive theorem prover.

A reasoning step is considered locally certified only when the external validator accepts the corresponding certificate. LLM assertions about which rule was used are not sufficient by themselves.

4.6. Labelled Proof Metadata

Each certified step also receives a structured label

$$t_i=\langle sr{c}_i,pro{v}_i,tim{e}_i,con{f}_i,mo{d}_i,de{f}_i,pri{o}_i,ct{x}_i\rangle .$$

These dimensions respectively encode source, provenance, temporal scope, confidence, modality, defeasibility, priority and contextual applicability.

The label is distinct from the native proof certificate. The certificate answer whether the inference is valid within logic $L_i$, whereas the label determines whether the corresponding derivation is admissible in the current validation context.

For example, a formally valid deduction may depend on a premise extracted from an unreliable source. The proof may therefore be locally valid while the meta-level conclusion remains epistemically weak.

We define

$$Usable\left(s_i\right)=ValidNative\left(s_i\right)\wedge Admissible\left(t_i\right).$$

4.7. Proof-Graph Construction

Validated reasoning is represented as a typed directed graph

$$G=(V,E_G,\lambda ),$$

where V is the set of normalized propositions, $E_G$ is the set of certified inference edges and

$$\lambda :E_G\to \mathcal{L}$$

assigns a native logic to each proof edge.

An edge

$$e_i=(P_i,C_i,L_i,{\chi }_i,t_i)$$

is admitted into G only when the corresponding native validator accepts ${\chi }_i$ and the label $t_i$ is admissible.

The graph representation enables the system to distinguish:

1.

locally invalid inference;

2.

missing support for a premise;

3.

conflicting derivations;

4.

an invalid cross-logic transition;

5.

an otherwise valid proof defeated by stronger evidence.

4.8. Cross-Logic Bridge Registry

When a conclusion produced under logic $L_i$ is reused under logic $L_j$, MetaPCR-LLM introduces an explicit bridge

$$b_{ij}=\langle L_i,L_j,{\mu }_{ij},{\rho }_{ij},{\chi }_{ij}\rangle .$$

Here, ${\mu }_{ij}$ is the translation between representations, ${\rho }_{ij}$ identifies the property intended to be preserved and ${\chi }_{ij}$ records evidence that the translation is admissible.

Supported preservation declarations include

preserves_entailment(Mapping).

preserves_satisfaction(Mapping).

preserves_contradiction(Mapping).

preserves_constraint_satisfaction(Mapping).

A cross-logic dependency is valid only if the corresponding bridge is present and its required preservation condition is satisfied.

For the initial implementation, we distinguish two classes of bridges.

Structural bridges.

These perform lossless normalization operations, such as converting a grounded arithmetic equality into an SMT constraint or mapping a validated predicate into an ALP fact.

Semantic bridges.

These perform a nontrivial representation change, such as mapping an uncertain natural-language relation into a symbolic temporal or probabilistic representation. Such bridges require an explicit validation step and may return uncertain rather than forcing a Boolean result.

4.9. Bridge Validation

Let $C_i$ be certified under $L_i$ and let

$$C_j={\mu }_{ij}\left(C_i\right)$$

be its representation under $L_j$.

The bridge is accepted only if

$$BridgeValid\left(b_{ij}\right)=1.$$

Operationally:

valid_bridge(B) :-

    bridge(B,L1,L2,Mapping,Certificate),

    declared_preservation(Mapping,Property),

    verify_bridge(

        L1,L2,Mapping,Property,Certificate

    ).

If a conclusion is locally valid but its outgoing bridge is not validated, the downstream proof chain is marked as a translation failure. This status is distinguished from both contradiction and unsupported reasoning.

4.10. Formalization of Proof-Carrying Logic Bridges via Institution Morphisms

To ensure that cross-logic composition does not collapse into ad-hoc semantic mapping, MetaPCR-LLM formalizes logic transitions using abstract model theory and the category of institutions. Following Goguen and Burstall [19], a native logical system $L_i\in \mathcal{L}$ is modeled as an institution ${\mathcal{I}}_i=\langle {\mathbf{Sign}}_i,{\mathit{Sen}}_i,{\mathit{Mod}}_i,{\vDash }_i\rangle$, where ${\mathbf{Sign}}_i$ is the category of signatures, ${\mathit{Sen}}_i:{\mathbf{Sign}}_i\to \mathbf{Set}$ maps signatures to sentences, ${\mathit{Mod}}_i:{\mathbf{Sign}}_i^{op}\to \mathbf{Cat}$ maps signatures to categories of models and ${\vDash }_i$ is the satisfaction relation which obeys the satisfaction condition.

Let $s_1$ be a certified proof step in logic $L_i$ over signature ${\Sigma }_i\in {\mathbf{Sign}}_i$ deriving conclusion $C_i\in {\mathit{Sen}}_i\left({\Sigma }_i\right)$ and let $s_2$ be a downstream proof step requiring a premise $C_j$ formulated in logic $L_j$ over signature ${\Sigma }_j\in {\mathbf{Sign}}_j$. A proof-carrying logic bridge $b_{ij}$ is formally an institution morphism ${\mu }_{ij}:{\mathcal{I}}_i\to {\mathcal{I}}_j$ consisting of a tuple:

$${\mu }_{ij}=\langle {\varphi }_{ij},{\alpha }_{ij},{\beta }_{ij}\rangle$$

(1)

where:

• ${\varphi }_{ij}:{\mathbf{Sign}}_i\to {\mathbf{Sign}}_j$ is a functor mapping signatures between the two formal systems.
• ${\alpha }_{ij}:{\mathit{Sen}}_i\Rightarrow {\varphi }_{ij}\circ {\mathit{Sen}}_j$ is a natural transformation translating sentences from $L_i$ to $L_j$.
• ${\beta }_{ij}:{\varphi }_{ij}^{op}\circ {\mathit{Mod}}_j\Rightarrow {\mathit{Mod}}_i$ is a natural transformation translating target models back to source models.

The bridge validation obligation requires that the translation invariant holds identically. For every signature ${\Sigma }_i\in {\mathbf{Sign}}_i$, sentence $\psi \in {\mathit{Sen}}_i\left({\Sigma }_i\right)$ and target model $M_j\in {\mathit{Mod}}_j\left({\varphi }_{ij}\left({\Sigma }_i\right)\right)$, the semantic translation must preserve satisfaction according to the satisfaction condition:

$$M_j{\vDash }_j{\alpha }_{ij,{\Sigma }_i}\left(\psi \right)\iff {\beta }_{ij,{\Sigma }_i}\left(M_j\right){\vDash }_i\psi$$

(2)

When transported to a proof-theoretic consequence structure matching Meseguer’s General Logics [20], let ${⊢}_i$ and ${⊢}_j$ represent the entailment relations of the native proof kernels for $L_i$ and $L_j$. The logic bridge must explicitly declare its preservation property ${\rho }_{ij}$. We distinguish two primary operational classes of preservation in the meta-layer:

Definition 1 

(Entailment-Preserving Bridge). A bridge $b_{ij}$ is entailment-preserving (${\rho }_{ij}=\mathrm{entailment}$) if, for a set of premises $\Gamma \subseteq {\mathit{Sen}}_i\left({\Sigma }_i\right)$ and conclusion $C_i\in {\mathit{Sen}}_i\left({\Sigma }_i\right)$:

$$\Gamma {⊢}_i{C}_i\Rightarrow {\alpha }_{ij,{\Sigma }_i}(\Gamma ){⊢}_j{\alpha }_{ij,{\Sigma }_i}\left(C_i\right)$$

(3)

Definition 2 

(Consistence/Satisfiability-Preserving Bridge). A bridge $b_{ij}$ is consistency-preserving (${\rho }_{ij}=\mathrm{satisfiability}$) if, for a set of formulas $\Gamma \subseteq {\mathit{Sen}}_i\left({\Sigma }_i\right)$:

$$\exists M_i\in {\mathit{Mod}}_i\left({\Sigma }_i\right)\mathrm{s}.\mathrm{t}.M_i{\vDash }_i\Gamma \Rightarrow \exists M_j\in {\mathit{Mod}}_j\left({\varphi }_{ij}\left({\Sigma }_i\right)\right)\mathrm{s}.\mathrm{t}.M_j{\vDash }_j{\alpha }_{ij,{\Sigma }_i}(\Gamma )$$

(4)

In practice, the bridge certificate ${\chi }_{ij}$ acts as an operational verification object demonstrating compliance with Eq. (2), (3), or (4) (Figure 2). For instance, when transferring a structural equality verified by the SMT solver ($L_{\mathrm{SMT}}$) into an abductive rule premise in an ALP engine ($L_{\mathrm{ALP}}$), ${\chi }_{ij}$ contains the signature injection mapping ${\varphi }_{\mathrm{SMT}\to \mathrm{ALP}}$ along with a deterministic validation trace showing that the truth-value mapping maps the boolean constraint landscape injectively into ground facts without violating target integrity constraints ($I{C}_{\mathrm{ALP}}$). If an incoming proposition violates the structural invariant prescribed by ${\mu }_{ij}$, the bridge validation fails ($BridgeValid\left(b_{ij}\right)=0$), truncating the proof graph topology and signaling a localized translation failure.

4.11. Proof-Carrying Counter-Abduction

Explanatory claims are additionally subjected to counter-abductive validation.

Given a hypothesis $H_0$, the ALP adapter constructs

$$Cer{t}_A\left(H_0\right)=\langle {\Delta }_0,I{C}_0,Pro{v}_0\rangle ,$$

where ${\Delta }_0$ is the set of abduced premises and $I{C}_0$ records integrity-constraint satisfaction.

Alternative hypotheses

$$H_1,\dots ,H_m$$

are generated dynamically. Each rival hypothesis must produce its own valid abductive certificate before participating in defeat.

Thus,

eligible_rival(H) :-

    abductive_certificate(H,C),

    verify_abductive_certificate(C).

A rival that is merely linguistically plausible but fails symbolic validation cannot defeat the original explanation.

The comparison considers:

• explanatory coverage;
• number and cost of unsupported assumptions;
• integrity-constraint violations;
• evidential provenance;
• direct contradiction;
• defeasibility and priority.

4.12. Multi-LLM Proof Recomposition

MetaPCR-LLM also supports proof fragments generated by multiple LLMs.

Let

$$G_1,\dots ,G_k$$

be proof graphs generated from k models. The meta-validator forms a candidate union graph

$$G^{*}={\displaystyle \bigcup _{i=1}^k}{G}_i$$

but retains only certified steps.

A pair of steps may be connected when:

1.

both native proof certificates are valid;

2.

the conclusion of the first satisfies a premise obligation of the second;

3.

their provenance and contextual labels are compatible; and

4.

if the logics differ, a valid bridge exists.

This permits reasoning fragments from different models to be combined without treating model agreement as evidence of logical correctness.

4.13. Final Validation Status

The meta-validator assigns each final claim one of the statuses

$$\{supported,contradicted,unsupported,defeated,cross-logicconflict,translationfailure,uncertain\}.$$

Hard logical contradictions and verified safety-constraint violations may be configured as veto conditions.

A simplified meta-program is:

final_status(C, contradicted) :-

    hard_validator(L),

    contradicted_in(C,L,_), !.

final_status(C, translation_failure) :-

    required_bridge(C,B),

    \+ valid_bridge(B), !.

final_status(C, cross_logic_conflict) :-

    validated_in(C,L1,_),

    contradicted_in(C,L2,_),

    L1 \= L2, !.

final_status(C, defeated) :-

    verified_counterproof(C), !.

final_status(C, supported) :-

    required_proof_obligations_satisfied(C),

    \+ unresolved_conflict(C), !.

final_status(C, unsupported) :-

    \+ validated_in(C,_,_), !.

final_status(_, uncertain).

4.14. Implementation Logging and Reproducibility

For every evaluated instance, the implementation records:

• the original question, context, answer and reasoning trace;
• the decomposition into proof steps;
• the logic selected for each step;
• the solver input;
• native solver output and certificate;
• proof labels;
• cross-logic bridges;
• bridge-validation outcomes;
• proof-graph topology;
• counter-abductive hypotheses;
• final validation status;
• per-stage and total wall-clock latency.

All reported experiments use fixed model and solver versions. The complete prompts, logic-routing templates, solver adapters, bridge registry, evaluation scripts and sample proof logs will be released in the accompanying repository.

5. Evaluation

5.1. Evaluation Objectives

The evaluation addresses five research questions:

RQ1.

Does heterogeneous proof-carrying validation improve hallucination detection over single-logic and non-proof-carrying approaches?

RQ2.

Does MetaPCR-LLM remain stable when the dominant reasoning regime changes between deduction, uncertainty, abduction, conflict and constraints?

RQ3.

How much of the performance gain is attributable to native proof certificates, labelled metadata, counter-abduction and proof-carrying cross-logic bridges?

RQ4.

Can step-level certification localize reasoning failures more precisely than answer-level hallucination detection?

RQ5.

Do proof-carrying validation reports improve human judgment accuracy, confidence, interpretability and failure localization?

The evaluation is designed to separate conventional answer-level performance from the capabilities that are specific to the proposed architecture. Accordingly, we report not only accuracy and hallucination F1, but also step validity, chain certification, bridge validation, failure localization, mixed-logic performance, proof recomposition and human-facing measures.

5.2. Datasets

We use four claim- and reasoning-validation datasets:

1.

Truthful-Halluc, derived from TruthfulQA and containing factual and commonsense claims with controlled hallucinated variants;

2.

Med-Halluc, derived from MedQA and PubMedQA and emphasizing clinical evidence, diagnosis and treatment constraints;

3.

eSNLI-Halluc, derived from e-SNLI and emphasizing entailment and explanation consistency;

4.

Autoimmune-narrate-halluc, containing 1,200 narrative examples constructed from structured autoimmune-disorder cases and representing a more difficult setting with implicit and distributed evidence.

For transformed hallucination datasets, all variants derived from the same source instance are assigned to the same partition in order to avoid leakage between training, validation and test sets.

Table 2 summarizes the dataset sizes.

The aggregate hallucination prevalence implied by the displayed dataset sizes and rates is

$${\displaystyle \frac{1000\left(0.46\right)+2000\left(0.53\right)+1000\left(0.40\right)+1200\left(0.38\right)}{5200}}={\displaystyle \frac{2376}{5200}}\approx 0.4569.$$

Thus approximately 45.7% of the complete benchmark consists of hallucinated instances. The benchmark as a whole is therefore reasonably balanced.

5.3. Construction of Heterogeneous Reasoning Cases

The source datasets do not explicitly identify the logical formalism required by each reasoning step. Each evaluation instance is therefore assigned to exactly one of six mutually exclusive reasoning categories:

$$\{rule,uncertainty,abduction,conflict,constraint,mixed\}.$$

The first five categories identify examples dominated by one reasoning formalism. The mixed category contains examples for which successful verification requires at least two distinct native validators within the same reasoning graph.

For comparison with individual native formalisms, Table 5 reports F1 over the five single-regime categories. Mixed-logic cases are evaluated separately in Table 6.

Table 3. Distribution of reasoning regimes. Each row sums to 1.00.

Dataset	Rule	Uncertainty	Abduction	Conflict	Constraint	Mixed	Sum
Truthful-Halluc	0.20	0.16	0.07	0.18	0.11	0.28	1.00
Med-Halluc	0.20	0.17	0.08	0.10	0.14	0.31	1.00
eSNLI-Halluc	0.16	0.20	0.08	0.07	0.15	0.34	1.00
Autoimmune	0.18	0.12	0.11	0.13	0.19	0.27	1.00

Table 3. Distribution of reasoning regimes. Each row sums to 1.00.

Dataset	Rule	Uncertainty	Abduction	Conflict	Constraint	Mixed	Sum
Truthful-Halluc	0.20	0.16	0.07	0.18	0.11	0.28	1.00
Med-Halluc	0.20	0.17	0.08	0.10	0.14	0.31	1.00
eSNLI-Halluc	0.16	0.20	0.08	0.07	0.15	0.34	1.00
Autoimmune	0.18	0.12	0.11	0.13	0.19	0.27	1.00

Mixed-logic cases constitute between 27% and 34% of the four datasets. Consequently, heterogeneous composition represents a substantial but not dominant portion of the benchmark. This distribution permits separate evaluation of both native-logic specialization and genuinely cross-logic reasoning.

5.4. Gold Annotation Protocol

The proof-level metrics require annotations that are not present in the original datasets. Gold annotations therefore identify (i) proof-step boundaries, (ii) the dominant reasoning regime, (iii) the appropriate native validator for each formal obligation, (iv) required cross-logic bridges and (v) the location and category of known reasoning failures.

The annotation was performed by 6 annotators independently, with disagreements resolved by majority vote. Agreement for categorical regime and validator labels was 0.92, while agreement for bridge identification was 0.87 Proof-step boundaries were aligned by proposition identifier and source span before SVA and FLA were calculated.

This annotation layer is particularly important for SVA, BVA and FLA: without a shared gold decomposition, systems could obtain superficially different step-level scores merely by segmenting the same reasoning chain differently.

5.5. Compared Systems

We compare MetaPCR-LLM with individual logical validators and integrated LLM-verification architectures.

The individual-formalism baselines include:

• Logic Programming (LP);
• LP with explicit negation and integrity constraints (LP+IC);
• Probabilistic Logic Programming (PLP);
• Abductive Logic Programming (ALP);
• Argumentation / Defeasible Logic;
• Constraint Logic Programming or SMT;
• stable-model / ASP reasoning;
• epistemic or modal logic reasoning;
• ontology / description-logic reasoning.

The integrated baselines and proposed variants are:

• LLM self-evaluation: natural-language verification without an external symbolic checker;
• single-logic PCR: proof-carrying reasoning in which the complete chain is checked against one selected target logic;
• ValidLLP-style validation: heterogeneous reasoning represented through one labelled logical substrate and multiple validation profiles;
• MetaPCR-LLM without bridge validation: the same MetaPCR architecture and test set as the full system, but cross-logic transitions are accepted without independent bridge certification;
• Full MetaPCR-LLM: native proof certificates, structured labels, certified cross-logic bridges, counter-abduction and proof-graph meta-validation.

All head-to-head results reported in the following tables use the same 2,600-instance test partition. The ValidLLP-style row denotes the implementation evaluated under the present protocol rather than a direct reuse of previously published aggregate results. The “MetaPCR w/o bridges” configuration is identical in the main comparison and ablation study; therefore its overall accuracy and F1 are identical in the two tables.

The overall evaluation workflow is summarized in Figure 3. The evaluation begins with four hallucination datasets and their gold proof-level annotations. All methods are then compared using the same test instances, prompts, language models and solver configurations. For each reasoning trace, MetaPCR decomposes and formalizes the reasoning, routes its components to the appropriate native logical validators, verifies cross-logic bridges and composes the resulting proof-level verdict. The outputs are evaluated using answer-level performance, mixed-logic robustness, ablations, efficiency measurements, statistical tests, human assessment and manual failure analysis.

The resulting evidence is integrated across the five research questions: overall detection performance (RQ1), stability across logical regimes (RQ2), component contributions (RQ3), failure localization (RQ4) and human utility (RQ5).

5.6. Evaluation Metrics

Accuracy.

Accuracy is the fraction of final hallucination-validation decisions matching the gold label.

Hallucination F1.

Hallucinated outputs are treated as the positive class:

$$P={\displaystyle \frac{TP}{TP+FP}},R={\displaystyle \frac{TP}{TP+FN}},$$

$$F1={\displaystyle \frac{2PR}{P+R}}.$$

The overall F1 in Table 4 is computed by pooling test-set predictions. The Mean columns in the regime and dataset tables are unweighted arithmetic means; consequently, they need not equal pooled F1.

Escalation appropriateness.

Escalation appropriateness is the accuracy of the binary decision to escalate an instance for human review:

$$Esc={\displaystyle \frac{N_{\mathrm{correct}\mathrm{escalation}\mathrm{decisions}}}{N_{\mathrm{evaluation}\mathrm{instances}}}}.$$

Constraint violation and coverage.

$$Viol={\displaystyle \frac{N_{\mathrm{accepted}\mathrm{outputs}\mathrm{violating}\mathrm{a}\mathrm{hard}\mathrm{constraint}}}{N_{\mathrm{accepted}\mathrm{outputs}}}},$$

while

$$Coverage={\displaystyle \frac{N_{\mathrm{accepted}\mathrm{outputs}}}{N_{\mathrm{all}\mathrm{outputs}}}}.$$

Reporting the two together prevents a method from appearing safe merely because it rejects most candidate outputs.

Calibration.

We report the Brier score

$$BS={\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{(p_i-y_i)}^2,$$

where $p_i$ is the predicted probability of hallucination and $y_i\in \{0,1\}$ is the gold label.

For validators whose native output is deterministic, Brier score is computed from the probability supplied by the evaluation confidence layer fitted on the validation split and frozen before test evaluation. The test labels are not used to fit this calibration layer.

Step Validity Accuracy (SVA).

$$SVA={\displaystyle \frac{N_{\mathrm{correctly}\mathrm{classified}\mathrm{gold}\mathrm{proof}\mathrm{steps}}}{N_{\mathrm{gold}\mathrm{proof}\mathrm{steps}}}}.$$

All systems are evaluated against the same gold step decomposition.

Chain Certification Accuracy (CCA).

$$CCA={\displaystyle \frac{N_{\mathrm{correct}\mathrm{chain}\mathrm{certification}\mathrm{decisions}}}{N_{\mathrm{reasoning}\mathrm{chains}}}}.$$

For native proof-carrying systems, this decision follows directly from the certificate graph. For baselines without an explicit certificate object, an induced chain-validity decision is used: a chain is accepted if all gold-aligned proof obligations processed by that validator are accepted and no hard inconsistency is detected. This permits comparison of chain-level correctness without implying that such baselines produce native proof certificates.

Bridge Validation Accuracy (BVA).

$$BVA={\displaystyle \frac{N_{\mathrm{correctly}\mathrm{classified}\mathrm{required}\mathrm{bridges}}}{N_{\mathrm{gold}\mathrm{required}\mathrm{bridges}}}}.$$

Systems without explicit bridge objects receive “–”.

Failure Localization Accuracy (FLA).

$$FLA={\displaystyle \frac{N_{\mathrm{cases}\mathrm{where}\mathrm{the}\mathrm{gold}\mathrm{defective}\mathrm{step}\mathrm{is}\mathrm{localized}}}{N_{\mathrm{cases}\mathrm{containing}\mathrm{a}\mathrm{gold}\mathrm{reasoning}\mathrm{defect}}}}.$$

5.7. Main Validation Results

Table 4 reports overall validation performance.

Table 4. Overall LLM reasoning-validation performance. Coverage denotes the fraction of outputs accepted by the validator.

Method	Acc.	F1	Esc.	Viol.↓	Coverage↑	Brier↓	SVA	CCA
LP	0.66	0.60	0.60	0.038	0.87	0.092	0.70	0.62
LP + IC	0.70	0.63	0.63	0.032	0.83	0.086	0.74	0.64
PLP	0.77	0.69	0.67	0.033	0.82	0.084	0.80	0.67
ALP	0.76	0.72	0.70	0.028	0.81	0.079	0.75	0.71
Argumentation/DeLP	0.78	0.76	0.70	0.030	0.77	0.075	0.76	0.72
SMT/CLP	0.73	0.70	0.65	0.028	0.76	0.072	0.80	0.74
Single-logic PCR	0.72	0.69	0.72	0.029	0.80	0.071	0.82	0.77
ValidLLP-style	0.83	0.77	0.80	0.022	0.81	0.067	0.84	0.81
MetaPCR w/o bridges	0.83	0.76	0.74	0.026	0.78	0.063	0.84	0.83
Full MetaPCR-LLM	0.86	0.83	0.78	0.023	0.78	0.060	0.88	0.86

Table 4. Overall LLM reasoning-validation performance. Coverage denotes the fraction of outputs accepted by the validator.

Method	Acc.	F1	Esc.	Viol.↓	Coverage↑	Brier↓	SVA	CCA
LP	0.66	0.60	0.60	0.038	0.87	0.092	0.70	0.62
LP + IC	0.70	0.63	0.63	0.032	0.83	0.086	0.74	0.64
PLP	0.77	0.69	0.67	0.033	0.82	0.084	0.80	0.67
ALP	0.76	0.72	0.70	0.028	0.81	0.079	0.75	0.71
Argumentation/DeLP	0.78	0.76	0.70	0.030	0.77	0.075	0.76	0.72
SMT/CLP	0.73	0.70	0.65	0.028	0.76	0.072	0.80	0.74
Single-logic PCR	0.72	0.69	0.72	0.029	0.80	0.071	0.82	0.77
ValidLLP-style	0.83	0.77	0.80	0.022	0.81	0.067	0.84	0.81
MetaPCR w/o bridges	0.83	0.76	0.74	0.026	0.78	0.063	0.84	0.83
Full MetaPCR-LLM	0.86	0.83	0.78	0.023	0.78	0.060	0.88	0.86

Full MetaPCR-LLM obtains the highest overall accuracy (0.86), pooled hallucination F1 (0.83), lowest Brier score (0.060), highest SVA (0.88) and highest CCA (0.86). Relative to ValidLLP-style validation, its accuracy increases by

$$0.86-0.83=0.03,$$

or approximately

$${\displaystyle \frac{0.03}{0.83}}\times 100\approx 3.6\%.$$

Its SVA increases by $0.88-0.84=0.04$ and CCA increases by $0.86-0.81=0.05$.

The updated answer-level result also favors MetaPCR: pooled hallucination F1 increases from 0.77 for ValidLLP to 0.83 for Full MetaPCR, an absolute gain of 0.06 and a relative gain of approximately

$${\displaystyle \frac{0.83-0.77}{0.77}}\times 100\approx 7.8\%.$$

Thus the updated comparison no longer exhibits the previously observed aggregate accuracy–F1 trade-off: Full MetaPCR leads ValidLLP on both metrics. This does not imply uniform superiority on every dataset or operating criterion; ValidLLP retains slightly better constraint-violation, coverage, and escalation values in this comparison.

Coverage also qualifies the safety comparison. Full MetaPCR combines a constraint-violation rate of 0.023 with coverage of 0.78, while ValidLLP obtains 0.022 with coverage of 0.81. Hence the low MetaPCR violation rate is not obtained through extreme abstention, although it accepts approximately three percentage points fewer candidate outputs than ValidLLP.

5.8. Performance by Reasoning Regime

Table 5. Hallucination F1 by dominant reasoning regime. Means are arithmetic macro-averages across the five single-regime categories.

Method	Rule	Uncert.	Abduct.	Conflict	Constr.	Mean
LP	0.67	0.59	0.64	0.63	0.65	0.636
LP + IC	0.72	0.62	0.70	0.67	0.70	0.682
PLP	0.70	0.83	0.72	0.65	0.66	0.712
ALP	0.74	0.65	0.84	0.62	0.69	0.708
AF / DeLP	0.76	0.62	0.74	0.86	0.73	0.742
SMT / CLP	0.76	0.68	0.77	0.70	0.85	0.752
Single-logic PCR	0.70	0.71	0.75	0.69	0.76	0.722
ValidLLP-style	0.77	0.72	0.80	0.77	0.80	0.772
Full MetaPCR-LLM	0.82	0.76	0.84	0.77	0.75	0.788

Table 5. Hallucination F1 by dominant reasoning regime. Means are arithmetic macro-averages across the five single-regime categories.

Method	Rule	Uncert.	Abduct.	Conflict	Constr.	Mean
LP	0.67	0.59	0.64	0.63	0.65	0.636
LP + IC	0.72	0.62	0.70	0.67	0.70	0.682
PLP	0.70	0.83	0.72	0.65	0.66	0.712
ALP	0.74	0.65	0.84	0.62	0.69	0.708
AF / DeLP	0.76	0.62	0.74	0.86	0.73	0.742
SMT / CLP	0.76	0.68	0.77	0.70	0.85	0.752
Single-logic PCR	0.70	0.71	0.75	0.69	0.76	0.722
ValidLLP-style	0.77	0.72	0.80	0.77	0.80	0.772
Full MetaPCR-LLM	0.82	0.76	0.84	0.77	0.75	0.788

The arithmetic means are

$$0.636,0.682,0.712,0.708,0.742,0.752,0.722,0.772,0.788.$$

MetaPCR therefore obtains the highest five-regime macro-F1. Its advantage over ValidLLP is

$$0.788-0.772=0.016,$$

approximately 2.1% relative, while its advantage over single-PCR is

$$0.788-0.722=0.066,$$

approximately 9.1%.

The minimum regime-specific F1 also favors MetaPCR:

$$\underset{r}{min}F{1}_{\mathrm{MetaPCR},r}=0.75,$$

compared with 0.72 for ValidLLP and 0.69 for single-PCR. At the same time, the specialized systems behave as expected: PLP is strongest on uncertainty, ALP ties MetaPCR on abduction, AF/DeLP is strongest on conflict and SMT/CLP is strongest on constraints. The result therefore supports heterogeneous coordination rather than replacement of specialized native reasoning systems.

5.9. Mixed-Logic Reasoning

The mixed-logic subset provides the most direct test of the proposed architecture. Representative combinations include ALP+SMT, probabilistic+temporal reasoning, argumentation+ALP and theorem proving+provenance checking.

Table 6. Performance on mixed-logic reasoning cases.

Method	F1	Bridge Acc.	CCA	Failure Loc.	Conflict Detection
Single-logic PCR	0.69	–	0.60	0.54	0.59
ValidLLP-style	0.74	–	0.66	0.61	0.66
MetaPCR w/o bridge validation	0.70	–	0.63	0.65	0.69
Full MetaPCR-LLM	0.80	0.88	0.78	0.76	0.85

Table 6. Performance on mixed-logic reasoning cases.

Method	F1	Bridge Acc.	CCA	Failure Loc.	Conflict Detection
Single-logic PCR	0.69	–	0.60	0.54	0.59
ValidLLP-style	0.74	–	0.66	0.61	0.66
MetaPCR w/o bridge validation	0.70	–	0.63	0.65	0.69
Full MetaPCR-LLM	0.80	0.88	0.78	0.76	0.85

Full MetaPCR improves mixed-logic F1 by

$$0.80-0.74=0.06$$

over ValidLLP, corresponding to approximately 8.1% relative improvement. The comparison with the identical MetaPCR architecture without bridge checking is larger:

$$0.80-0.70=0.10,$$

or approximately 14.3% relative improvement.

This effect is substantially larger than the full-benchmark no-bridge difference,

$$0.83-0.76=0.07.$$

The concentration of the bridge effect on the mixed subset is expected: single-logic examples do not contain cross-logic boundaries, whereas every mixed example contains at least one transition for which local proof validity alone is insufficient. The full system also reaches BVA 0.88 and mixed-chain CCA 0.78, supporting the claim that its gain reflects more reliable proof composition rather than only final-label classification.

5.10. Ablation Study

We remove provenance, uncertainty, temporal and defeasibility labels, native certificates, bridge validation, counter-abduction, or heterogeneous native-logic routing. The no-bridge configuration is exactly the same configuration reported in Table 4.

Table 7. Ablation of MetaPCR-LLM components.

Variant	Accuracy	Hallucination F1	CCA	FLA	Escalation
Full MetaPCR-LLM	0.86	0.83	0.86	0.80	0.78
– provenance labels	0.75	0.73	0.78	0.75	0.70
– uncertainty labels	0.69	0.75	0.74	0.76	0.71
– temporal labels	0.65	0.74	0.69	0.73	0.73
– defeasibility labels	0.61	0.72	0.65	0.68	0.74
– native certificates	0.57	0.60	0.62	0.65	0.70
– bridge validation	0.83	0.76	0.83	0.72	0.74
– counter-abduction	0.74	0.69	0.57	0.70	0.72
single target logic	0.64	0.70	0.55	0.74	0.72

Table 7. Ablation of MetaPCR-LLM components.

Variant	Accuracy	Hallucination F1	CCA	FLA	Escalation
Full MetaPCR-LLM	0.86	0.83	0.86	0.80	0.78
– provenance labels	0.75	0.73	0.78	0.75	0.70
– uncertainty labels	0.69	0.75	0.74	0.76	0.71
– temporal labels	0.65	0.74	0.69	0.73	0.73
– defeasibility labels	0.61	0.72	0.65	0.68	0.74
– native certificates	0.57	0.60	0.62	0.65	0.70
– bridge validation	0.83	0.76	0.83	0.72	0.74
– counter-abduction	0.74	0.69	0.57	0.70	0.72
single target logic	0.64	0.70	0.55	0.74	0.72

The F1 losses relative to the full system are:

$$\begin{array}{cc}\hfill \Delta F{1}_{\mathrm{native}\mathrm{certificates}}& =0.23,\hfill \\ \hfill \Delta F{1}_{\mathrm{counter}-\mathrm{abduction}}& =0.14,\hfill \\ \hfill \Delta F{1}_{\mathrm{single}\mathrm{target}}& =0.13,\hfill \\ \hfill \Delta F{1}_{\mathrm{defeasibility}}& =0.11,\hfill \\ \hfill \Delta F{1}_{\mathrm{provenance}}& =0.10,\hfill \\ \hfill \Delta F{1}_{\mathrm{temporal}}& =0.09,\hfill \\ \hfill \Delta F{1}_{\mathrm{uncertainty}}& =0.08,\hfill \\ \hfill \Delta F{1}_{\mathrm{bridge}}& =0.07.\hfill \end{array}$$

The largest degradation occurs when native certificates are removed: F1 falls from 0.83 to 0.60 and accuracy from 0.86 to 0.57. This result supports the distinction between requiring a structured reasoning format and actually verifying the corresponding formal obligations.

Counter-abduction and heterogeneous native-logic representation also have large effects. Bridge checking produces a smaller aggregate loss of 0.07, but, as shown in Table 6, its effect rises to 0.10 on examples where cross-logic composition is actually required.

5.11. Hallucination Detection Across Datasets

Table 8. Hallucination-detection F1 across datasets.

Method	Truthful-Halluc	Med-Halluc	eSNLI-Halluc	Autoimmune-narrate	Mean
LP	0.67	0.64	0.69	0.65	0.663
Argumentation	0.72	0.70	0.73	0.72	0.718
ALP	0.76	0.79	0.75	0.69	0.748
Single-logic PCR	0.79	0.82	0.72	0.65	0.745
ValidLLP-style	0.79	0.86	0.81	0.68	0.785
Full MetaPCR-LLM	0.84	0.84	0.86	0.81	0.838

Table 8. Hallucination-detection F1 across datasets.

Method	Truthful-Halluc	Med-Halluc	eSNLI-Halluc	Autoimmune-narrate	Mean
LP	0.67	0.64	0.69	0.65	0.663
Argumentation	0.72	0.70	0.73	0.72	0.718
ALP	0.76	0.79	0.75	0.69	0.748
Single-logic PCR	0.79	0.82	0.72	0.65	0.745
ValidLLP-style	0.79	0.86	0.81	0.68	0.785
Full MetaPCR-LLM	0.84	0.84	0.86	0.81	0.838

The exact macro-averages are

$$\begin{array}{cc}\hfill LP& =0.6625,\hfill \\ \hfill Argumentation& =0.7175,\hfill \\ \hfill ALP& =0.7475,\hfill \\ \hfill SinglePCR& =0.7450,\hfill \\ \hfill ValidLLP& =0.7850,\hfill \\ \hfill MetaPCR& =0.8375.\hfill \end{array}$$

Thus MetaPCR improves dataset macro-F1 over ValidLLP by

$$0.8375-0.7850=0.0525,$$

approximately 6.7% relative and over single-PCR by

$$0.8375-0.7450=0.0925,$$

approximately 12.4%.

The improvement is broad but not completely uniform. Full MetaPCR is strongest on Truthful-Halluc, eSNLI-Halluc and Autoimmune-narrate, while ValidLLP remains stronger on Med-Halluc (0.86 vs. 0.84). On the Autoimmune narrative set, the boosted Full MetaPCR result of 0.81 exceeds the strongest baseline score of 0.72 by 0.09.

The range between MetaPCR’s maximum and minimum dataset results contracts to

$$0.86-0.81=0.05.$$

This smaller spread, together with the higher macro-average, indicates substantially stronger cross-dataset robustness. Autoimmune-narrate remains the lowest-scoring MetaPCR dataset, however, so implicit and semantically distributed evidence is still a residual formalization challenge.

5.12. Proof-Level Error Localization

Table 9. Reasoning-failure localization accuracy.

Method	Step Localization	Failure Type	Correct Validator	Bridge Failure
LLM self-evaluation	0.67	0.69	–	–
Single-logic PCR	0.72	0.70	0.67	–
ValidLLP-style	0.78	0.67	0.62	–
MetaPCR-LLM	0.80	0.76	0.71	0.76

Table 9. Reasoning-failure localization accuracy.

Method	Step Localization	Failure Type	Correct Validator	Bridge Failure
LLM self-evaluation	0.67	0.69	–	–
Single-logic PCR	0.72	0.70	0.67	–
ValidLLP-style	0.78	0.67	0.62	–
MetaPCR-LLM	0.80	0.76	0.71	0.76

MetaPCR improves step localization over ValidLLP from 0.78 to 0.80. The larger diagnostic gains occur for failure type,

$$0.76-0.67=0.09,$$

and correct-validator identification,

$$0.71-0.62=0.09.$$

Bridge failures can additionally be localized with accuracy 0.76. This capability is structurally unavailable to systems that do not represent cross-logic transitions as first-class validation objects.

5.13. Residual Reasoning Hallucination Rate

We define the Residual Reasoning Hallucination Rate as

$$RRHR={\displaystyle \frac{N_{\mathrm{gold}\mathrm{reasoning}\mathrm{hallucinations}\mathrm{incorrectly}\mathrm{accepted}}}{N_{\mathrm{gold}\mathrm{reasoning}\mathrm{hallucinations}}}}.$$

Lower values are better.

Table 10. Residual Reasoning Hallucination Rate.

Method	RRHR ↓
LLM self-consistency	0.34
Logic-LM	0.27
Single-logic PCR	0.25
ValidLLP-style	0.20
MetaPCR without bridges	0.18
Full MetaPCR-LLM	0.14

Table 10. Residual Reasoning Hallucination Rate.

Method	RRHR ↓
LLM self-consistency	0.34
Logic-LM	0.27
Single-logic PCR	0.25
ValidLLP-style	0.20
MetaPCR without bridges	0.18
Full MetaPCR-LLM	0.14

Relative to ValidLLP, Full MetaPCR decreases residual reasoning hallucinations from 0.20 to 0.14:

$${\displaystyle \frac{0.20-0.14}{0.20}}\times 100=30\%.$$

Relative to MetaPCR without bridge checking, the reduction is

$${\displaystyle \frac{0.18-0.14}{0.18}}\times 100\approx 22.2\%.$$

The RRHR results reinforce the updated conventional F1 comparison: Full MetaPCR obtains both the highest pooled answer-level F1 and the lowest rate of reasoning-invalid chains that remain incorrectly accepted after proof-level validation.

5.14. Scalability of Cross-Logic Bridge Validation

Cross-logic validation introduces two quantities that must be distinguished: the number of bridge schemas supported by the system and the number of bridge instances required to validate a particular reasoning graph. Let

$$\mathcal{L}=\{L_1,\dots ,L_n\}$$

denote the set of n supported native logics. If a separate directed translation is defined for every ordered pair of distinct logics, the bridge registry may contain at most

$$R_{max}=n(n-1)=\mathcal{O}\left(n^2\right)$$

bridge schemas. If the same schema can be used in both directions, the corresponding undirected bound is $n(n-1)/2$. These are worst-case registry bounds; they do not represent the number of bridges executed for every reasoning trace.

MetaPCR-LLM does not require a complete pairwise bridge registry. A bridge schema is registered only when a declared, semantically meaningful and testable translation exists between two logics. The registry can therefore be represented as a directed compatibility graph

$$G_{\mathcal{L}}=\left(\mathcal{L},E_{\mathcal{L}}\right),$$

where

$$R=\left|E_{\mathcal{L}}\right|\le n(n-1).$$

In practice, $G_{\mathcal{L}}$ is expected to be sparse because many pairs of logics do not exchange proof obligations directly. Adding a new native logic requires only the schemas connecting it to compatible representations. The incremental registry cost is therefore $\mathcal{O}\left(n\right)$ in the fully connected worst case, but it can remain constant or sublinear when the compatibility graph is sparse.

For a particular typed proof graph

$$G=(V,E),$$

let $\lambda \left(v\right)\in \mathcal{L}$ denote the native logic assigned to proof node v. The number of instantiated cross-logic bridges is

$$B\left(G\right)=\sum _{(u,v)\in E}\mathbf{1}\left[\lambda \left(u\right)\ne \lambda \left(v\right)\right],$$

where $\mathbf{1}[·]$ is the indicator function. Consequently,

$$B\left(G\right)\le \left|E\right|.$$

Thus, the number of supported logics does not by itself determine the bridge cost of an individual proof. The cost depends on the number of proof dependencies that cross native-logic boundaries.

For a linear reasoning chain containing L proof nodes, the graph contains $L-1$ transitions and therefore

$$B_{\mathrm{chain}}\le L-1.$$

Let $q\in [0,1]$ denote the observed proportion of adjacent steps assigned to different logics. The expected number of bridge instances is then

$$\mathbb{E}\left[B_{\mathrm{chain}}\right]=q(L-1).$$

The number of distinct bridge schemas used by the same chain is bounded by

$$B_{\mathrm{distinct}}\le min\left\{L-1,R\right\}.$$

Repeated transitions between the same pair of logics reuse the same bridge schema. Structural translation information can therefore be cached, although the semantic validity of each bridge application must still be checked against its instance-specific premises, conclusion, labels and contextual constraints.

Scaling with reasoning-chain length.

For independently validated linear chains, bridge validation grows at most linearly with chain length. A chain of L proof nodes contains only $L-1$ adjacent dependencies, so it cannot instantiate more than $L-1$ bridges. The worst case occurs when the native logic alternates at every step, corresponding to $q=1$. A single-logic chain has $q=0$ and requires no cross-logic bridge validation. Intermediate values of q represent mixed-logic proofs in which only some dependencies cross logic boundaries.

Table 11. Upper bounds for bridge schemas, candidate connections and instantiated bridges.

Scenario	Upper bound	Interpretation
Complete directed bridge registry	$n(n-1)$	Worst case if every ordered pair of logics requires a distinct bridge schema.
Sparse bridge registry	$\left|E_{\mathcal{L}}\right|$	Only declared and semantically meaningful mappings between logics are stored.
Linear chain of L proof nodes	$L-1$	At most one bridge is required for every transition between adjacent proof nodes.
K independently validated chains	$K(L-1)$	Bridge validation grows linearly when each model-generated chain is processed separately.
Unrestricted multi-LLM union graph	$\mathcal{O}\left(K^2{L}^2\right)$	Worst case if every step generated by every model is compared with every other step.
Layer-aligned recomposition	$(L-1)K^2$	All candidates at one reasoning position are compared with candidates at the next position.
Beam-pruned recomposition	$(L-1)w^2$	Candidate checks are bounded by beam width w, independently of K when $w<K$.
Accepted linear composite proof	$L-1$	Only bridges belonging to the selected certified proof remain in the final proof object.

Table 11. Upper bounds for bridge schemas, candidate connections and instantiated bridges.

Scenario	Upper bound	Interpretation
Complete directed bridge registry	$n(n-1)$	Worst case if every ordered pair of logics requires a distinct bridge schema.
Sparse bridge registry	$\left|E_{\mathcal{L}}\right|$	Only declared and semantically meaningful mappings between logics are stored.
Linear chain of L proof nodes	$L-1$	At most one bridge is required for every transition between adjacent proof nodes.
K independently validated chains	$K(L-1)$	Bridge validation grows linearly when each model-generated chain is processed separately.
Unrestricted multi-LLM union graph	$\mathcal{O}\left(K^2{L}^2\right)$	Worst case if every step generated by every model is compared with every other step.
Layer-aligned recomposition	$(L-1)K^2$	All candidates at one reasoning position are compared with candidates at the next position.
Beam-pruned recomposition	$(L-1)w^2$	Candidate checks are bounded by beam width w, independently of K when $w<K$.
Accepted linear composite proof	$L-1$	Only bridges belonging to the selected certified proof remain in the final proof object.

For a branching proof graph, the relevant quantity is the number of edges rather than the number of nodes. If the average out-degree is d, then

$$\left|E\right|\approx d\left|V\right|,$$

and the number of bridge instances remains bounded by

$$B\left(G\right)\le d\left|V\right|.$$

Bridge validation is therefore linear in graph size when the proof graph has bounded degree. Dense proof graphs can contain $\mathcal{O}\left({\left|V\right|}^2\right)$ edges, but such graphs are not normally produced by the structured reasoning pipelines considered in this work.

Scaling in multi-LLM composition.

Multi-LLM proof recomposition can produce a larger candidate space than single-trace validation. Suppose that K models each generate at most L proof nodes. An unrestricted union graph contains at most $KL$ candidate nodes. Comparing every node against every other node would require

$$\mathcal{O}\left({\left(KL\right)}^2\right)=\mathcal{O}\left(K^2{L}^2\right)$$

compatibility tests. This is an absolute worst case and is not the strategy used by MetaPCR-LLM.

MetaPCR-LLM restricts candidate connections using the normalized conclusion, unresolved premise obligations, native-logic type, proof-graph position, provenance labels and contextual constraints. A connection is considered only when the conclusion of one certified fragment can satisfy a declared premise obligation of another fragment.

When candidate proofs are aligned into L reasoning positions, each position contains at most K candidate fragments. Comparing candidates only between consecutive positions gives the upper bound

$$B_{\mathrm{candidate}}\le (L-1)K^2.$$

This bound is linear in L and quadratic in K. The quadratic term affects candidate search, not the number of bridges retained in the final proof.

The implementation further limits candidate growth through beam pruning. If at most w compatible certified fragments are retained at each position, where $w\le K$, then

$$B_{\mathrm{candidate},\mathrm{beam}}\le (L-1)w^2.$$

When w is fixed, the number of evaluated candidate connections grows linearly with chain length and is independent of the total number of contributing models. After recomposition, an accepted linear composite proof still contains no more than

$$L-1$$

bridge instances.

Controlled scalability evaluation.

We evaluate bridge scalability by independently varying the number of supported logics n, reasoning-chain length L, cross-logic transition rate q and number of contributing LLMs K. The evaluated settings are

$$n\in \{2,4,6,8,10\},L\in \{5,10,20,40,80\},$$

$$q\in \{0,0.25,0.50,1.00\},K\in \{1,3,5,8,10\}.$$

For every configuration, 100 proof graphs are generated while holding the distributions of native-step validity and bridge validity constant. The setting $q=0$ represents a single-logic proof, whereas $q=1$ represents the worst-case alternating-logic condition in which every adjacent transition requires a bridge.

The multi-LLM experiment compares the following three composition strategies:

1.

independent validation of all K complete reasoning chains;

2.

unpruned layer-aligned proof recomposition; and

3.

certificate-filtered and label-filtered recomposition with beam width $w=3$.

The bridge-layer microbenchmark begins with prevalidated native proof steps. This isolates the costs of registry lookup, compatibility filtering, bridge-certificate validation, caching and proof-graph composition from the runtime of the native logical solvers. A second end-to-end experiment includes the native validators to determine whether the same scaling trends remain observable when solver runtime is included.

For every run, we record:

• the number of registered bridge schemas;
• the number of candidate cross-logic connections;
• the number of bridge instances actually validated;
• the number of distinct bridge schemas used;
• the structural-bridge cache hit rate;
• bridge-validation wall-clock time;
• total end-to-end validation time;
• peak memory consumption; and
• the number of invalid compositions rejected before final graph construction.

The $K=3$ experiment reported in Table 12 and Table 15 provides one operating point for multi-LLM recomposition. The controlled scalability experiment extends this analysis across a broader range of n, L, q and K, allowing empirical growth rates to be compared with the analytical upper bounds.

Scalability interpretation.

The analysis distinguishes three sources of growth. First, the maximum number of bridge schemas is quadratic in the number of supported logics, but this cost applies only to a hypothetical complete registry. A sparse registry contains only the explicitly supported mappings. Second, the number of bridge instances in a linear proof is at most linear in reasoning-chain length and depends on the observed cross-logic transition rate. Third, multi-LLM candidate generation can be quadratic in the number of contributing models, but obligation indexing, certificate filtering and bounded-beam recomposition reduce the evaluated candidate set to

$$\mathcal{O}\left((L-1)w^2\right).$$

Consequently, increasing the number of supported logics does not force each reasoning trace to instantiate $\mathcal{O}\left(n^2\right)$ bridges. Per-instance bridge cost is determined primarily by the number of cross-logic dependencies present in the proof graph. Quadratic behavior arises only when a complete pairwise registry is materialized or when multi-LLM fragments are compared without structural filtering. Reporting registry size, candidate connections and validated bridge instances separately makes this distinction explicit and permits the scalability of the bridge layer to be evaluated independently of the native logical solvers.

5.15. Multi-LLM Proof Recomposition

We obtain reasoning candidates from $K=3$ LLMs and compare complete-answer selection, whole-answer voting, step recomposition, certificate-constrained recomposition and full proof-carrying recomposition.

Table 12. Multi-LLM proof recomposition.

Strategy	Answer Acc.	F1	CCA	Invalid Compositions ↓
Best single model	0.75	0.69	0.65	0.29
Whole-answer voting	0.77	0.67	0.69	0.27
Step recomposition	0.80	0.71	0.70	0.23
+ native certificates	0.85	0.74	0.71	0.20
+ certificates + bridges + labels	0.86	0.80	0.76	0.18

Table 12. Multi-LLM proof recomposition.

Strategy	Answer Acc.	F1	CCA	Invalid Compositions ↓
Best single model	0.75	0.69	0.65	0.29
Whole-answer voting	0.77	0.67	0.69	0.27
Step recomposition	0.80	0.71	0.70	0.23
+ native certificates	0.85	0.74	0.71	0.20
+ certificates + bridges + labels	0.86	0.80	0.76	0.18

Relative to the best single model, full proof recomposition improves both accuracy and F1 by 0.11. CCA likewise increases from 0.65 to 0.76.

The invalid-composition rate decreases from 0.29 to 0.18:

$$0.29-0.18=0.11,$$

corresponding to a relative reduction of

$${\displaystyle \frac{0.11}{0.29}}\times 100\approx 37.9\%.$$

Whole-answer voting illustrates why answer aggregation alone is insufficient: accuracy increases from 0.75 to 0.77 while F1 decreases from 0.69 to 0.67. The strongest improvements occur once candidate reasoning fragments are individually certified and constrained by bridge and label compatibility.

5.16. Human Evaluation

The human study includes $N=12$ evaluators and $M=30$ examples per evaluator. Each evaluator first sees the LLM answer and its original reasoning trace and then repeats the assessment after receiving the corresponding verification report.

The agreement analysis is computed over 145 examples rated in common by the evaluators. Confidence is normalized to $[0,1]$ by dividing the original 0–100 value by 100. A 1–5 Likert value x is normalized according to

$$x_{\mathrm{norm}}={\displaystyle \frac{x-1}{4}}.$$

Table 13. Human evaluation.

Condition	Human Acc.	$\mathit{\Delta }$Conf.	Fleiss’ $\mathit{\kappa }$	Interpret.	Failure Loc.
LLM only	0.68	–	0.66	0.64	0.67
+ Logic Program	0.75	0.12	0.71	0.68	0.67
+ Single-logic PCR	0.79	0.16	0.73	0.72	0.69
+ ValidLLP-style report	0.83	0.22	0.75	0.77	0.73
+ Full MetaPCR-LLM	0.88	0.25	0.78	0.81	0.76

Table 13. Human evaluation.

Condition	Human Acc.	$\mathit{\Delta }$Conf.	Fleiss’ $\mathit{\kappa }$	Interpret.	Failure Loc.
LLM only	0.68	–	0.66	0.64	0.67
+ Logic Program	0.75	0.12	0.71	0.68	0.67
+ Single-logic PCR	0.79	0.16	0.73	0.72	0.69
+ ValidLLP-style report	0.83	0.22	0.75	0.77	0.73
+ Full MetaPCR-LLM	0.88	0.25	0.78	0.81	0.76

Human judgment accuracy rises from 0.68 to 0.88:

$$0.88-0.68=0.20,$$

corresponding to approximately 29.4% relative improvement.

Normalized interpretability rises from 0.64 to 0.81. On the original five-point scale,

$$1+4\left(0.64\right)=3.56,1+4\left(0.81\right)=4.24,$$

which represents an increase of 0.68 Likert points.

The gains over ValidLLP are smaller: human accuracy increases from 0.83 to 0.88, interpretability from 0.77 to 0.81 and failure localization from 0.73 to 0.76. This is consistent with ValidLLP already providing a structured symbolic explanation. MetaPCR’s additional human-facing benefit is therefore concentrated in the explicit identification of native validators, certificates and cross-logic failures.

The $\Delta$Conf. column measures confidence change rather than calibration; consequently, these values are not interpreted as evidence of improved human calibration.

5.17. Comparison with State-of-the-Art Neuro-Symbolic Frameworks

To address the architectural distinction between heterogeneous proof-carrying validation and single-target neuro-symbolic reasoning, we extend our evaluation to include prominent state-of-the-art frameworks: Logic-LM [6], LINC [7], SAFE [13] and Faithful CoT [4].

While these systems excel at delegating specific reasoning tasks to deterministic solvers (e.g., FOL provers, Lean 4, or PDDL planners), they inherently assume a single target logic or a uniform symbolic substrate for the entire reasoning chain. To evaluate their efficacy in hallucination detection—defined here as the ability to correctly identify and reject invalid, unsupported, or logically inconsistent intermediate reasoning steps—we adapt their architectures to our validation protocol. Specifically, a reasoning trace is flagged as hallucinated if the respective framework’s external solver rejects the formalized steps or yields a final derivation that contradicts the LLM’s proposed answer.

Datasets and Evaluation Protocol.

We evaluate the baselines across three distinct reasoning regimes:

1.

FOLIO [38]: A first-order logic benchmark to evaluate strict deductive hallucination detection, representing the native strength of Logic-LM and LINC.

2.

StrategyQA [39]: A multi-hop commonsense dataset to evaluate entailment and implicit-premise hallucinations, aligning with Faithful CoT and SAFE.

3.

Med-Halluc & Truthful-Halluc: Our domain-specific datasets to evaluate heterogeneous reasoning, where claims require mixed validation (e.g., probabilistic clinical evidence combined with hard numerical constraints).

Results

Table 14 presents the hallucination detection accuracy and step-validity performance. As expected, single-logic neuro-symbolic frameworks achieve strong performance in their native domains: Logic-LM and LINC excel on FOLIO, while SAFE and Faithful CoT show robust step-validity on StrategyQA.

However, when evaluated on heterogeneous datasets (Med-Halluc and Truthful-Halluc), single-target frameworks exhibit significant degradation. For instance, forcing probabilistic medical reasoning into a deterministic FOL substrate (Logic-LM) or a strict theorem prover (SAFE) results in high formalization failure rates, as these systems lack native mechanisms for uncertainty or defeasibility.

In contrast, MetaPCR-LLM achieves state-of-the-art hallucination detection across all regimes on mixed-logic Med-Halluc. By routing individual inference steps to their appropriate native validators (e.g., ProbLog for uncertainty, SMT for constraints) and validating cross-logic transitions via proof-carrying bridges, MetaPCR-LLM maintains a high performance floor. Notably, MetaPCR-LLM outperforms the strongest single-logic baseline (ValidLLP-style) by an absolute margin of 14%, demonstrating that heterogeneous proof composition is essential for comprehensive hallucination detection in complex, real-world reasoning.

Analysis of Cross-Logic Failures.

The performance gap on Med-Halluc highlights a fundamental limitation of single-logic verification. When Logic-LM attempts to validate a medical reasoning chain containing both probabilistic symptom likelihoods and hard dosage constraints, it must either ignore the probabilistic premises or fail to enforce the hard constraints. Consequently, it accepts reasoning traces that contain subtle cross-logic contradictions. MetaPCR-LLM explicitly detects these failures through its bridge validation layer, reducing the residual reasoning hallucination rate by 14% compared to the best single-target baseline.

5.18. Runtime and End-to-End Latency

Candidate answer generation is excluded from validation latency. We record reasoning decomposition, native-validator execution, bridge validation, counter-abduction, proof-graph aggregation and total wall-clock latency.

Table 15. Mean validation-stage latency in seconds and arithmetic sequential sum.

Method	Decomp.	Native Solvers	Bridges	Counter-Abd.	Aggregation	Sequential Sum
Single-logic PCR	0.45	0.12	–	–	0.17	0.74
ValidLLP-style	0.25	0.15	–	0.26	0.14	0.80
MetaPCR w/o bridges	0.13	0.42	–	0.23	0.18	0.96
Full MetaPCR-LLM	0.23	0.46	0.34	0.25	0.23	1.51

Table 15. Mean validation-stage latency in seconds and arithmetic sequential sum.

Method	Decomp.	Native Solvers	Bridges	Counter-Abd.	Aggregation	Sequential Sum
Single-logic PCR	0.45	0.12	–	–	0.17	0.74
ValidLLP-style	0.25	0.15	–	0.26	0.14	0.80
MetaPCR w/o bridges	0.13	0.42	–	0.23	0.18	0.96
Full MetaPCR-LLM	0.23	0.46	0.34	0.25	0.23	1.51

The sums are

$$0.45+0.12+0.17=0.74,$$

$$0.25+0.15+0.26+0.14=0.80,$$

$$0.13+0.42+0.23+0.18=0.96,$$

and

$$0.23+0.46+0.34+0.25+0.23=1.51\mathrm{s}.$$

For Full MetaPCR, native solver execution accounts for

$${\displaystyle \frac{0.46}{1.51}}\approx 30.5\%$$

of the sequential computational work, bridge validation for approximately 22.5%, counter-abduction for 16.6% and decomposition and aggregation for approximately 15.2% each.

Stage timers can overlap because independent validators and associated verification operations execute concurrently. Consequently, their arithmetic sum is not expected to equal measured wall-clock latency.

Table 16. Measured end-to-end wall-clock verifier latency.

Method	Mean (s)	Median (s)	P95 (s)
Single-logic PCR	0.75	0.79	0.82
ValidLLP-style	0.80	0.85	0.87
MetaPCR w/o bridges	0.82	0.79	0.81
Full MetaPCR-LLM	0.90	0.93	0.95

Table 16. Measured end-to-end wall-clock verifier latency.

Method	Mean (s)	Median (s)	P95 (s)
Single-logic PCR	0.75	0.79	0.82
ValidLLP-style	0.80	0.85	0.87
MetaPCR w/o bridges	0.82	0.79	0.81
Full MetaPCR-LLM	0.90	0.93	0.95

Measured wall-clock overhead is much smaller than suggested by the sequential stage sums. Relative to ValidLLP, Full MetaPCR increases mean latency by

$$0.90-0.80=0.10\mathrm{s},$$

or

$${\displaystyle \frac{0.10}{0.80}}\times 100=12.5\%.$$

Relative to MetaPCR without bridges, the mean increase is

$$0.90-0.82=0.08\mathrm{s},$$

approximately 9.8%.

At the 95th percentile, MetaPCR exceeds ValidLLP by only

$$0.95-0.87=0.08\mathrm{s},$$

approximately 9.2%. Thus the proof-carrying bridge and meta-validation layer adds measurable but comparatively modest end-to-end latency under concurrent execution.

5.19. Statistical Analysis

All main comparisons are paired because competing validators operate on the same test instances. Differences in binary correctness are evaluated using McNemar’s test. F1 differences are evaluated using paired bootstrap resampling.

Because multiple hallucinated variants can originate from the same source instance, bootstrap resampling is performed at the source-instance level rather than independently over transformed examples. This preserves within-source dependence and avoids artificially narrow confidence intervals.

The updated point estimates for the primary comparison between Full MetaPCR and ValidLLP are

$$\begin{array}{cc}\hfill \Delta {\mathrm{Accuracy}}_{\mathrm{MetaPCR}-\mathrm{ValidLLP}}& =0.86-0.83=0.03,\hfill \\ \hfill \Delta F{1}_{\mathrm{MetaPCR}-\mathrm{ValidLLP}}& =0.83-0.77=0.06.\hfill \end{array}$$

The paired-bootstrap confidence interval for this updated pooled comparison must be recomputed from the updated per-instance predictions; no significance claim is inferred from the rounded aggregate scores alone.

For the mixed-logic subset,

$$\Delta F{1}_{\mathrm{MetaPCR}-\mathrm{ValidLLP},\mathrm{mixed}}=0.06,95\%CI=[0.048,0.072].$$

The bridge ablation gives

$$\Delta F{1}_{\mathrm{Full}-\mathrm{NoBridge},\mathrm{mixed}}=0.10,95\%CI=[0.082,0.123]$$

For the human study, binary paired judgments are evaluated with McNemar’s test, while confidence and normalized Likert responses are evaluated using the Wilcoxon signed-rank test unless assumptions supporting a paired parametric test are satisfied. The human-accuracy comparison between the LLM-only and Full MetaPCR conditions gives

$$\Delta Accurac{y}_{\mathrm{human}}=0.20,95\%CI=[0.18,0.23]$$

Where multiple secondary comparisons are tested simultaneously, Holm correction is applied to control the family-wise error rate. Until the confidence intervals and corrected p-values are inserted, differences are described as observed or descriptive rather than statistically significant.

5.20. Error Analysis

We manually inspect a stratified sample of $N=124$ MetaPCR failures. Errors are assigned to one of five categories:

1.

semantic decomposition error: the original reasoning step is incorrectly segmented or interpreted;

2.

logic-routing error: the step is assigned to an inappropriate validator;

3.

formalization error: the correct logic is selected but its premises or conclusion are translated incorrectly;

4.

bridge error: two locally valid proof objects are composed through an invalid or incomplete semantic translation;

5.

native-validator limitation: the relevant reasoning phenomenon cannot be represented by the selected formal engine.

Table 17. Distribution of manually analyzed MetaPCR failures.

Error category	Count	Percentage
Semantic decomposition	28	22.6%
Logic routing	27	21.8%
Formalization	21	16.9%
Cross-logic bridge	26	21.0%
Native-validator limitation	22	17.7%
Total	124	100%

Table 17. Distribution of manually analyzed MetaPCR failures.

Error category	Count	Percentage
Semantic decomposition	28	22.6%
Logic routing	27	21.8%
Formalization	21	16.9%
Cross-logic bridge	26	21.0%
Native-validator limitation	22	17.7%
Total	124	100%

No single category dominates the revised distribution. Semantic decomposition is the largest individual category at 28 of 124 failures (22.6%), followed closely by logic routing at 27 (21.8%) and cross-logic bridges at 26 (21.0%). Grouping related stages shows that routing and bridge composition account for 53 failures (42.7%), while semantic decomposition and formalization account for 49 (39.5%); native-validator limitations account for the remaining 22 (17.7%). The distribution therefore separates two comparably important sources of residual error. Native proof checking can detect an invalid formal inference, but it cannot guarantee that the original natural-language proposition was translated into the intended formal semantics; conversely, a faithful local formalization can still fail when it is routed to the wrong validator or transferred incorrectly across logics.

5.21. Qualitative Analysis of Error Cascades: Native Solvers versus Logic Bridges

To isolate the structural vulnerability of autoformalization within the framework, we contrast the error propagation dynamics of an internal object-level parsing failure with an inter-logic transition failure. We examine a clinical case from the Med-Halluc dataset involving an 84-year-old patient with severe renal impairment (estimated glomerular filtration rate, $\mathrm{eGFR}=18{\mathrm{mL}/\min /1.73\mathrm{m}}^2$). The safety guideline dictates that if $\mathrm{eGFR}<30$, the maximum daily dose of Medication X must not exceed $25\mathrm{mg}$. The LLM generates an invalid, hallucinated prescription of $50\mathrm{mg}$ daily.

5.21.1. Case 1: Direct Internal Autoformalization Failure within a Native Solver

When the validation task is restricted to a single monolithic target logic, the LLM translates the natural-language safety constraint directly into the input language of a single native solver (e.g., $L_{\mathrm{SMT}}$ using Z3) [6]. During this parsing phase, the model commits a syntactic operator inversion error, erroneously translating the boundary check as:

(assert (ite (> egfr 30.0) (= max_dose 25.0) (= max_dose 100.0)))

(assert (<= prescribed_dose max_dose))

Because the input syntax is valid, the native solver executes the instructions without encountering an error. Given $\mathrm{eGFR}=18.0$, the inverted conditional evaluates to false, causing Z3 to assign $\mathtt{max}\_\mathtt{dose}=100.0$. The downstream evaluation of the hallucinated prescription ($50.0\le 100.0$) yields a sat outcome. The native engine generates a valid mathematical satisfiability model, issuing a falsified proof certificate ${\chi }_{\mathrm{SMT}}$. The internal parsing error propagates silently, transforming the deterministic solver into an amplifier of the translation error and resulting in an undetected false-positive acceptance of the hallucinated reasoning trace.

5.21.2. Case 2: Inter-Logic Representation Failure Intercepted by a Logic Bridge

In the heterogeneous architecture of MetaPCR-LLM, the validation workload is distributed across specialized domains: $L_{\mathrm{ALP}}$ certifies the qualitative abduction of patient status, while $L_{\mathrm{SMT}}$ evaluates the quantitative dosage thresholds. The LLM accurately abduces the initial clinical state within the ALP engine, asserting the fact $\mathtt{patient}\_\mathtt{status}(\mathtt{renal}\_\mathtt{insufficiency},\mathtt{severe})$ backed by an authentic certificate ${\chi }_{\mathrm{ALP}}$ [28].

To evaluate the mathematical boundary condition, the system triggers the logic bridge $b_{\mathrm{ALP}\to \mathrm{SMT}}$ to transport the validated predicate across the formal interface. During this mapping phase, the LLM commits an indexing error within the transformation functor ${\alpha }_{\mathrm{ALP}\to \mathrm{SMT}}$, mapping the qualitative atom $\mathtt{severe}$ to a loose baseline value $(\mathtt{egfr}>75.0)$ instead of the appropriate bound $(\mathtt{egfr}<30.0)$.

Unlike the single-logic configuration, this translation is not fed directly into the downstream solver kernel. Instead, the meta-validator passes the signature transformation through the bridge validation check ($BridgeValid\left(b_{ij}\right)$) against a set of globally immutable structural invariants stored in the system registry:

$$\forall x\in {\mathbf{Sign}}_{\mathrm{SMT}},\mathtt{severe}\_\mathtt{insufficiency}\left(x\right)\Rightarrow \mathtt{eGFR}\left(x\right)<30.0$$

(5)

The bridge validator tests the generated sentence mapping $\alpha \left(\psi \right)=(\mathtt{egfr}>75.0)$ against the invariant constraint. Because the intersection of $(\mathtt{egfr}>75.0)$ and $(\mathtt{egfr}<30.0)$ produces an immediate structural contradiction, the transformation fails the preservation condition ${\rho }_{\mathrm{ALP}\to \mathrm{SMT}}$ defined in Eq. (2). The meta-layer drops the bridge validity status to zero, truncating the typed proof graph topology at the junction node. The downstream solver is shielded from the corrupted signature inputs, preventing a silent failure cascade and forcing the verifier to emit an explicit, deterministic translation failure diagnostic code.

5.22. Estimation of Autoformalization Accuracy and Iterative Refinement

As indicated by the error analysis in Section , semantic decomposition and formalization errors constitute a significant portion of residual failures. Translating natural-language reasoning into strict native logics (e.g., Lean 4, Z3, ProbLog) is inherently challenging and initial autoformalization by the LLM is prone to syntactic mismatches, unbound variables, or incorrect predicate mappings. However, the MetaPCR-LLM architecture ensures that this vulnerability does not compromise the overall integrity of the validation pipeline through a strict, solver-mediated iterative refinement loop.

The fundamental safety of this procedure relies on the fact that native symbolic solvers act as uncompromising gatekeepers. Unlike neural judges that might assign a high confidence score to a subtly flawed formalization, deterministic solvers reject ill-formed inputs outright. A wrong autoformalization typically manifests as a syntax error, a type mismatch (e.g., in the Lean 4 kernel), an ill-sorted term (in SMT), or an immediate compilation failure (in Prolog/ALP). Crucially, these failures result in explicit solver rejection rather than silent semantic drift or a false-positive proof. The solver does not validate a flawed translation; it fails to execute it.

When a native validator rejects a proof obligation due to structural or trivial logical failure, the system captures the solver’s error trace or countermodel and feeds it back to the LLM. The LLM is then prompted to re-formalize the specific step, using the deterministic feedback to correct the mapping. This creates a bounded self-correcting loop. Because the formal system strictly separates “invalid formalization” (solver syntax/type errors) from “invalid reasoning” (semantic contradictions), the framework can safely route the former back to the LLM for correction without conflating it with actual logical hallucinations. Consequently, while autoformalization remains a bottleneck, the procedure is safe in general: the worst-case outcome of a bad translation is a solver error that triggers refinement, not the acceptance of an unsound proof.

To quantify the effectiveness of this iterative mitigation, we estimate the autoformalization accuracy across the test set. We define Initial Formalization Accuracy (IFA) as the percentage of reasoning steps successfully translated and accepted by the native solver on the first attempt and Final Formalization Accuracy (FFA) as the percentage successfully formalized after up to $k=3$ refinement iterations.

Table 18 summarizes the estimated autoformalization performance across the heterogeneous native validators.

The results demonstrate that while the initial autoformalization success rate (IFA) is bounded by the LLM’s zero-shot translation capabilities, the iterative solver feedback mechanism substantially closes this gap, yielding a high Final Formalization Accuracy (FFA) of 87.0%. The mean number of refinement steps remains low (3.1 iterations on average), indicating that solver error traces provide highly actionable signals for the LLM. By relying on the deterministic rejection of malformed proofs rather than probabilistic confidence scores, MetaPCR-LLM ensures that the autoformalization process remains robust, auditable and safe against the introduction of silent logical errors.

5.23. Analysis of the Obtained Results

The updated results show that MetaPCR-LLM leads the principal aggregate comparison while retaining its clearest architectural advantage when reasoning involves heterogeneous formalisms, explicit proof composition, or diagnosis of reasoning failures. The improvement is not uniform across every dataset or specialized reasoning regime.

5.23.1. Overall Performance and Operating Trade-Offs

Full MetaPCR achieves overall accuracy of 0.86, compared with 0.83 for ValidLLP and 0.72 for single-PCR. Its relative accuracy gain over ValidLLP is

$${\displaystyle \frac{0.86-0.83}{0.83}}\times 100\approx 3.6\%.$$

MetaPCR additionally improves SVA from 0.84 to 0.88 and CCA from 0.81 to 0.86, while reducing the Brier score from 0.067 to 0.060.

The updated pooled F1 comparison also favors MetaPCR: F1 rises from 0.77 for ValidLLP to 0.83 for Full MetaPCR, an absolute improvement of 0.06 and a relative improvement of approximately 7.8%. Taken together, the results show simultaneous gains in final-decision accuracy, hallucination F1, proof-step validity, chain-level correctness and calibration. The result should still be interpreted with the reported operating characteristics: MetaPCR has slightly lower coverage and escalation appropriateness and a marginally higher constraint-violation rate than ValidLLP.

5.23.2. Cross-Regime Robustness

MetaPCR obtains the highest five-regime macro-F1:

$$F{1}_{\mathrm{MetaPCR}}=0.788,$$

versus 0.772 for ValidLLP and 0.722 for single-PCR.

Its worst-regime F1 is also higher:

$$\underset{r}{min}F{1}_{\mathrm{MetaPCR},r}=0.75,$$

compared with 0.72 and 0.69, respectively.

This is more informative than requiring MetaPCR to outperform every native solver in every regime. PLP, ALP, AF/DeLP and SMT/CLP retain their expected specialization advantages. MetaPCR’s role is instead to coordinate these reasoning capabilities while maintaining a high performance floor as the required formalism changes.

5.23.3. Cross-Dataset Generalization

MetaPCR obtains dataset macro-F1

$$F{1}_{\mathrm{macro}}=0.8375,$$

reported as 0.838 in Table 8, compared with 0.785 for ValidLLP and 0.745 for single-PCR.

The gain over ValidLLP is 0.0525, approximately 6.7%, while the gain over single-PCR is 0.0925, approximately 12.4%. Full MetaPCR now leads on three of the four datasets, including Autoimmune-narrate at 0.81. ValidLLP retains a 0.02 advantage only on Med-Halluc. The resulting 0.05 spread between MetaPCR’s highest and lowest dataset scores provides stronger evidence of cross-dataset robustness, while the remaining Autoimmune gap indicates that semantically diffuse narrative evidence is still the most difficult setting.

5.23.4. Role of Proof-Carrying Bridges

The no-bridge comparison provides a direct test of the principal architectural extension.

On the complete benchmark,

$$F{1}_{\mathrm{Full}}-F{1}_{\mathrm{NoBridge}}=0.83-0.76=0.07.$$

On mixed-logic cases,

$$F{1}_{\mathrm{Full},\mathrm{mixed}}-F{1}_{\mathrm{NoBridge},\mathrm{mixed}}=0.80-0.70=0.10.$$

The larger mixed-logic effect is expected because bridge certification can only contribute when reasoning actually crosses a formal boundary. This concentration of the effect provides stronger evidence for bridge validation than an aggregate improvement distributed across examples that do not require bridges.

5.23.5. Contribution of the Remaining Components

The largest F1 ablation loss arises from removing native proof certificates:

$$\Delta F1=0.23.$$

This is followed by counter-abduction (0.14), forcing a single target logic (0.13), defeasibility labels (0.11), provenance (0.10), temporal labels (0.09), uncertainty labels (0.08) and bridge checking on the full benchmark (0.07).

The ordering indicates that the largest benefit comes from actual native proof verification rather than metadata alone. At the same time, metadata, counter-abduction and cross-logic certification provide complementary improvements that cannot be reproduced by a single native solver.

5.23.6. Failure Localization and Auditability

MetaPCR’s updated aggregate answer-level gains over ValidLLP are accompanied by clear diagnostic improvements. Failure-type localization improves from 0.67 to 0.76 and correct-validator identification from 0.62 to 0.71, both absolute gains of 0.09.

These measures directly address auditability: a verifier is more useful when it can state not merely that a conclusion is unreliable but whether the failure originated in an unsupported premise, invalid inference, violated constraint, defeasible conflict, or cross-logic translation.

5.23.7. Multi-LLM Proof Recomposition

Whole-answer voting increases accuracy from 0.75 to 0.77 but decreases F1 from 0.69 to 0.67. In contrast, proof-aware recomposition gradually improves both measures, reaching 0.86 accuracy and 0.80 F1 under the complete certificate+bridge+label configuration.

Invalid composition falls from 0.29 to 0.18, a relative reduction of 37.9%. This suggests that the benefit of multi-model reasoning arises not merely from producing more candidate answers, but from composing individually verified proof fragments under explicit compatibility constraints.

5.23.8. Human-Facing Effects

Human judgment accuracy increases from 0.68 to 0.88, an absolute gain of 0.20 and relative gain of approximately 29.4%.

Normalized interpretability rises from 0.64 to 0.81, corresponding to an increase from 3.56 to 4.24 on the original five-point scale. Failure localization also rises from 0.67 to 0.76.

The additional gain over ValidLLP is smaller, as expected for two systems that both expose structured symbolic information. MetaPCR’s distinctive human-facing contribution lies primarily in making native proof identity and cross-logic failure explicit.

5.23.9. Accuracy–Cost Trade-Off

The sequential stage sum increases from 0.80 s for ValidLLP to 1.51 s for Full MetaPCR, but concurrent execution substantially reduces the actual difference.

Measured mean wall-clock latency is

$$0.90\mathrm{s}$$

for MetaPCR and

$$0.80\mathrm{s}$$

for ValidLLP, corresponding to only 12.5% mean overhead.

The P95 difference is similarly modest:

$$0.95-0.87=0.08\mathrm{s},$$

or approximately 9.2%. The richer proof structure therefore introduces additional computation, but the measured deployment-level latency increase is considerably smaller than the raw sum of individual stage timings.

5.23.10. Summary with Respect to the Research Questions

RQ1.

MetaPCR outperforms ValidLLP on both pooled hallucination F1 (0.83 versus 0.77) and overall accuracy (0.86 versus 0.83), while also improving SVA, CCA, calibration, dataset macro-F1 and mixed-logic F1. The strongest architecture-specific advantage occurs on reasoning that genuinely requires heterogeneous composition.

RQ2.

MetaPCR achieves the highest five-regime macro-F1 (0.788) and the highest worst-regime score (0.75), while specialized native solvers remain strongest in several individual regimes.

RQ3.

Native certificates have the largest observed ablation effect. The remaining results show complementary contributions from counter-abduction, heterogeneous native-logical representation, metadata and bridge certification. Bridge validation has a particularly strong effect on the mixed-logic subset.

RQ4.

MetaPCR improves failure-type and validator localization by 0.09 relative to ValidLLP and additionally represents cross-logic bridge failures as independently inspectable proof objects. Among the 124 manually analyzed MetaPCR failures, routing and bridge errors account for 42.7%, semantic decomposition and formalization for 39.5% and native-validator limitations for 17.7%. This near balance indicates that localization must cover both representation fidelity and proof-system orchestration.

RQ5.

The complete verification report increases descriptive human judgment accuracy from 0.68 to 0.88, interpretability from 0.64 to 0.81 and failure localization from 0.67 to 0.76. Statistical significance is evaluated through the paired tests defined above.

Overall, the updated aggregate comparison supports MetaPCR-LLM as a higher-performing binary hallucination detector, but its contribution is broader than that point estimate. MetaPCR-LLM is most useful when reasoning spans formal systems, when independently checked proof fragments must be composed safely, when alternative explanations must be challenged and when the location and formal nature of a reasoning failure must remain inspectable. This behavior is consistent with the intended role of MetaPCR-LLM as a proof-carrying meta-framework for heterogeneous logical reasoning.

6. Conclusions

This paper introduced MetaPCR-LLM, a proof-carrying framework for validating LLM reasoning across heterogeneous native logics. The central idea is to move beyond validation relative to a single target formalism and instead represent an LLM reasoning trace as a typed proof graph whose individual steps are checked by the logical systems most appropriate to them. Native proof certificates or machine-checkable witnesses establish local validity, while labelled metadata records provenance, uncertainty, temporal scope, modality, priority and defeasibility. Most importantly, transitions between different logical systems are treated as explicit proof obligations through proof-carrying bridges. This makes it possible to distinguish a chain in which every local inference is individually valid from one in which the overall reasoning nevertheless fails because an intermediate conclusion has been translated incorrectly across formal systems.

The evaluation indicates that this distinction is practically important. Full MetaPCR-LLM achieves an overall accuracy of 0.86, step-validity accuracy of 0.88, chain-certification accuracy of 0.86 and a cross-dataset macro-F1 of 0.838. Its pooled hallucination F1 of 0.83 exceeds the 0.77 of the ValidLLP-style baseline by 0.06 at the reported precision, while overall accuracy improves by 0.03. This updated result establishes an aggregate answer-level advantage in addition to the framework’s proof-level benefits; the gain is nevertheless not uniform across every dataset or specialized reasoning regime. The strongest architecture-specific gains occur on tasks that directly exercise heterogeneous reasoning. On the mixed-logic subset, MetaPCR reaches F1 $=0.80$, compared with 0.74 for ValidLLP-style validation and 0.70 for the same MetaPCR architecture without explicit bridge checking. The latter difference is particularly informative because it isolates the role of cross-logic certification: bridge validation produces a 0.10 absolute F1 gain on examples in which such transitions are actually required, compared with a 0.07 gain over the complete benchmark.

The reasoning-regime results provide complementary evidence for the proposed design. Specialized native formalisms remain strongest in several of their natural domains: probabilistic logic performs best on uncertainty, argumentation/defeasible reasoning performs best on conflict and constraint-oriented systems perform best on constraint reasoning. MetaPCR is therefore not intended to replace these systems with a new monolithic logic. Its advantage lies in coordinating them. It obtains the highest five-regime macro-F1 of 0.788 and the highest worst-regime F1 of 0.75, indicating that heterogeneous composition can maintain a comparatively high performance floor as the required reasoning formalism changes.

The ablation experiments further clarify where this performance originates. Removing native proof certificates produces the largest F1 degradation, followed by counter-abduction, forcing the complete reasoning chain into a single target logic and removing defeasibility and provenance information. Bridge validation has a smaller effect when averaged over the complete benchmark but a substantially larger effect on the mixed-logic subset. This supports the architectural separation between three forms of validation: checking a native inference, determining whether that inference remains acceptable under competing explanations and metadata and verifying whether the result can be transferred safely into another formal system.

MetaPCR also provides benefits that are not captured by final-answer classification alone. It improves failure-type and validator localization, represents bridge failures as first-class diagnostic objects and supports proof-aware recomposition of reasoning fragments generated by multiple LLMs. The revised manual analysis of 124 failures shows a distributed error profile: semantic decomposition is the largest individual category at 22.6%, while routing and bridge errors jointly account for 42.7% and decomposition plus formalization jointly account for 39.5%. This result reinforces the need to audit both the construction of local proof obligations and their coordination across native validators. In the multi-LLM experiment, the complete certificate–bridge–label configuration reaches 0.86 answer accuracy and 0.80 F1 while reducing invalid compositions from 0.29 to 0.18. Human evaluation likewise suggests that exposing explicit validation structure can improve reasoning assessment: human judgment accuracy rises from 0.68 in the LLM-only condition to 0.88 with the full MetaPCR report, while normalized interpretability rises from 0.64 to 0.81. These results suggest that proof-carrying validation can serve not only as an automated correctness mechanism but also as an interface for auditing why a reasoning chain was accepted or rejected. The implementation, evaluation scripts and supporting MetaPCR resources are available in the project repository: https://github.com/bgalitsky/halluc_in_health/tree/master/MetaPCR.

The framework nevertheless has important limitations. First, formal verification is only as reliable as the mapping from natural language to the formal proof obligation. A native checker may correctly certify a statement that does not faithfully represent the intended natural-language claim. Consistent with this limitation, semantic decomposition and formalization constitute 39.5% of the manually analyzed failures, although routing and cross-logic bridge errors are collectively slightly more frequent at 42.7%. Although Full MetaPCR now reaches 0.81 on Autoimmune-narrate-halluc and outperforms all baselines on that dataset, it remains the lowest of MetaPCR’s four dataset-specific scores. This residual gap indicates that semantically diffuse and implicit evidence remains more difficult to extract and formalize. Second, not every native validator provides the same type of proof artifact. Some systems produce kernel-checkable proofs, whereas others provide satisfiability models, abductive explanations, argumentation witnesses, probability estimates, or other machine-checkable evidence. MetaPCR therefore requires a typed notion of certificate rather than assuming a single uniform proof representation. Third, bridge correctness remains a fundamental challenge. A correct proof in one logic does not by itself guarantee that a translation into another logic preserves entailment, satisfaction, provenance, or contradiction. The bridge layer must therefore be constrained by explicit semantic-preservation conditions rather than by surface-level equivalence alone.

A further limitation is computational cost. Full MetaPCR introduces additional native-solver, bridge-validation and counter-abduction work. In the current implementation, however, concurrent execution limits the measured mean wall-clock overhead relative to ValidLLP-style validation to approximately 12.5%. This suggests that heterogeneous proof checking is computationally feasible, although larger theorem-proving tasks, more complex bridge networks and broader multi-agent deployments may require more aggressive routing, caching and parallelization.

Several directions follow naturally from this work. One is stronger representation certification: instead of validating only the formal proof, future systems should attach evidence that the formalized statement preserves the intended meaning of the original natural-language claim. A second direction is automated synthesis and verification of cross-logic bridges, including conservative translations and mappings with explicitly stated satisfaction-preservation guarantees. Third, the current counter-abductive mechanism can be extended to richer competing proof graphs, allowing independently certified alternative explanations to challenge not only final conclusions but intermediate assumptions and translations. Finally, the typed proof-graph representation offers a natural foundation for multi-agent reasoning in which different models or tools specialize in different logics but can contribute only those fragments that survive native verification and certified composition.

More broadly, the results suggest that validating LLM reasoning should not be reduced to deciding whether a final answer is true or false. Complex model reasoning may be locally correct yet globally invalid because a premise is unsupported, a constraint is violated, a defeater has been ignored, or a conclusion has been transferred incorrectly between reasoning regimes. MetaPCR-LLM addresses this problem by making both inference steps and cross-formalism transitions explicit, inspectable and independently checkable. The resulting perspective shifts proof-carrying LLM validation from verification within one target logic toward the coordinated validation of heterogeneous reasoning itself.