What Is Proof?
Keywords: proof; burden of proof; standard of proof; mathematical proof; proof-of-work; zero-knowledge proof; Agrippa’s trilemma; Gödel; falsification; framework-relative proof
Ask a man to prove something and watch him reach, without noticing, for whichever standard lets him win. The creationist wants the standard of the courtroom applied to the fossil record and the standard of the pulpit applied to his book. The conspiracist wants mathematical certainty from the historian and gullible credence for himself. The salesman wants proof to mean you couldn’t talk me out of it. Each of them is using the same word, and each of them means something different by it, and the difference is exactly the thing they are hoping you will not examine.
I want to examine it.
This is not an essay about truth. Truth is a property a claim has or lacks, quietly, whether or not anyone ever checks. A companion piece — Choosing Your Turtle — argues at length that the word “literal truth,” on which the realism debate is built, names three different things at once and therefore names no single target the debate could hit. That argument stands on its own. What follows is its sibling, and its subject is the other word, the one people actually fight over at three in the morning: proof. Because you almost never argue about whether a thing is true. You argue about whether it has been proven — and proof, unlike truth, is not a property of a claim. Proof is a transaction. It is something one party delivers to another, across a standard, inside a system, for a purpose. The moment you see that, the whole vocabulary of certainty rearranges itself.
So: what is proof?
The demagogue’s proof, dismissed first
Start by clearing the cheapest sense off the table, because it wastes the most lives.
There is a use of “proof” that means whatever produced conviction in me. The witch floated, so witchcraft is proven. The prophecy fit, so the prophet is proven. I felt it in my bones, so it is proven. This is proof as a psychological event — the arrival of the feeling of certainty — and it is worthless as a criterion for the obvious reason that the feeling of certainty is not rare. It is abundant. It is more abundant in the fanatic and the drunk than in the mathematician, who is the one person on earth entitled to it and the one person least willing to claim it. A proof is not a state of your nervous system. If it were, the surest way to prove a thing would be to believe it hard enough, and the madhouse would be our most rigorous institution.
Dismiss it, then — but notice what the dismissal already assumes. To call the demagogue’s proof no proof is to appeal to some other standard against which his feeling fails. We have not escaped the question. We have located it. Proof is going to turn out to be inseparable from the standard it is measured against, and the demagogue’s error is not that he has no standard but that he has helped himself to the loosest one available and pretended it was the tightest. Hold that thought. It is the whole essay in miniature.
The steelman: the mathematician’s proof as the last absolute
Now the strong case. If any use of “proof” is going to survive scrutiny and deliver the framework-free certainty the word promises, it is the mathematician’s. So let me make that case as well as it can be made, because a diagnosis that only defeats the weak version has proven nothing itself.
A mathematical proof is a finite object. It is a sequence of statements in which every line is either an axiom or follows from earlier lines by an explicitly stated rule of inference. It refers to nothing outside itself — no instrument, no witness, no experiment, no majority. You do not believe a proof; you check it, and checking is mechanical: line by line, does this follow from that by a permitted move, yes or no. When the checking succeeds, the proof compels. Not persuades — compels. Anyone who grants the starting points and the rules is dragged, whether he likes the conclusion or not, to the end. The theorem that there is no largest prime does not become less proven because you find it inconvenient, or because you are Greek, or because two thousand years have passed. It is settled with a completeness that no verdict, no experiment, and no election can touch.
This is the genuine article, and it is magnificent. It is why “mathematical certainty” is the phrase we reach for when we want to say beyond all possible doubt. Here, surely — if anywhere — is proof that owes nothing to anyone’s framework: impersonal, timeless, portable, coercive. Here is the bottom turtle. Here is the thing the demagogue was counterfeiting.
That is the case. It is a strong case. It is also, on inspection, not quite true — and the exact respect in which it is not true tells us what proof actually is.
The crack in the marble
The mathematician’s proof compels anyone who grants the axioms and the rules. Read that clause again, because everything hides in it.
A proof is not a proof simpliciter. It is a proof from a set of axioms, by a system of logic. Change either, and the very same conclusion may go from proven to unprovable to refuted. Euclid proved that the angles of a triangle sum to two right angles — from his fifth postulate. Drop that postulate, adopt another equally consistent with the rest, and the theorem is false; on a sphere, triangles bulge past it, and the aeroplane flying the shortest path between two cities traces the proof of its failure. Euclid was not wrong. He proved what he proved, from what he assumed. What he did not do — what no one can do — is prove the assumption without appeal to some further assumption.
The logic is no safer than the axioms. There is a way of doing mathematics — constructive, or intuitionistic — that refuses the law of the excluded middle, the principle that every statement is either true or its negation is. A classical mathematician proves that a number with a certain property exists by showing that its non-existence leads to contradiction. The constructivist shrugs: you have not shown me the number, you have only shown me that its absence is awkward, and awkwardness is not existence. A proof that compels the classicist does not compel the constructivist, and neither of them is confused. They are working in different systems, and “proof” means proof-in-a-system to both of them, even when they forget to say so.
Then comes the deepest cut, and it is Gödel’s. Take any formal system rich enough to do ordinary arithmetic, and consistent — not contradicting itself. Gödel showed that such a system cannot prove its own consistency. The one thing you would most want proven — this machine will never grind out a falsehood — is precisely the thing the machine cannot establish about itself. To prove your system consistent you must step up into a stronger system, whose own consistency is now the unproven thing, and so upward without end. The tower of proof has no ground floor it can stand on and survey. Every storey rests on one above it that it cannot see.
And there is a homelier version for anyone unmoved by metatheory. Who checks the checker? A proof compels because its steps are mechanically verifiable — but the verification is done by a mind, or lately by a machine, and both can err. The four-colour theorem was proven, in 1976, by a computer running through cases no human will ever read. Is it proven? Yes — if you trust the program, the compiler, the hardware, the absence of a cosmic ray flipping a bit at the wrong instant. The certainty did not evaporate. It relocated. It moved out of the theorem and into your confidence in the apparatus that certified it. That is not a defect peculiar to computers. It is the permanent condition of proof, made visible by silicon.
None of this makes mathematical proof weak. Within its system it is the strongest thing we have, and I will defend it against every relativist who wants to soften it into opinion. But it is not framework-free. It is the most rigorous framework-relative thing in existence. It compels absolutely — given a floor it did not lay and cannot inspect from where it stands.
The trilemma, or: there is no bottom turtle
Zoom out from mathematics and the pattern is general, and it is old. The ancient sceptics saw it clearly; it survives as Agrippa’s trilemma, later rechristened the Münchhausen trilemma after the baron who claimed to have pulled himself out of a swamp by his own hair.
You assert P. I ask you to prove it. You offer P₁. I ask you to prove that. You offer P₂. Every proof leans on a premise, and every premise is itself a claim that can be asked to justify itself. There are exactly three ways this can end, and only three.
It can never end — infinite regress, each premise propped by a prior one, the chain receding forever and reaching nothing. It can loop — circularity, the chain curving back so that P is used, somewhere upstream, to support P, which proves nothing to anyone not already convinced. Or it can stop — at a premise you decline to justify further: an axiom, a posit, a this we hold. Regress and circle deliver no proof at all. Only the third exit ever ends a proof — and it ends it on something unproven, which you chose.
This is not a scandal to be fixed. It is the structure of the thing. There is no proof that does not, somewhere, rest on an unproven stopping point. The demagogue and the mathematician differ not in whether they have such a stopping point — both do — but in whether they declare it, defend the choice of it, and refuse to smuggle in more than it grants. The mathematician writes his axioms at the top of the page. The demagogue hides his under the floor and calls the floor bedrock. The honest thinker’s whole discipline is the discipline of naming his axioms out loud and owning the fact that he chose them.
The regress of turtles, then, is not a regress of hidden proofs we can never quite reach. It is the discovery that the demand for a bottom turtle — a proof beneath all proofs that justifies itself and rests on nothing — was itself the confusion. There is no bottom turtle. Its absence is not a wound. Nothing in the practice of proof ever required one, and every field that takes proof seriously has quietly learned to work without it.
The dilemma, stated flat
Put the crack and the trilemma together and the parallel to the truth argument becomes exact.
Ask what “proof” means and you face a fork, and both prongs are lethal to the fantasy of framework-free proof.
Prong one. Perhaps by “proof” you mean a genuine, self-standing compulsion — something that forces assent from any rational being whatsoever, presupposing nothing, resting on no chosen axiom. Then you owe us the axiom that needs no axiom, the premise that proves itself, the floor beneath the floor. Nobody has it. The trilemma says nobody can have it. This sense of proof is hostage to a foundation that does not exist and, on the best current understanding, cannot.
Prong two. Or perhaps you mean only what a formal system actually delivers: a valid derivation in that system, from its axioms, by its rules. Fine — but then the word “proof” has become relative through and through. It certifies conformity to a chosen game. It cannot tell you the game is the right one; the choice of system sits outside every proof the system can produce. A proof-in-S is real, checkable, coercive — and completely silent on whether S is the system you should be reasoning in. This sense of proof is idle on precisely the question people invoke it to settle, which is always, underneath, which framework wins.
Either proof is a framework-transcendent compulsion nobody can supply, or it is a framework-relative certification that cannot referee between frameworks. There is no third thing. “Proof,” used as if it were a single, neutral, framework-free adjudicator — the proof, that settles it, full stop — names nothing. It names a fork between a certainty that is unavailable and a certainty that is real but always indexed.
What the criterion would have to be, and why nothing meets it
Make the demand explicit and its impossibility becomes a small theorem rather than a mood.
Suppose “proof” is to do the job people ask of it: to settle a dispute, once, for everyone, without appeal to anyone’s standpoint. Then whatever proof is, it must satisfy three conditions at once.
It must discriminate — the fact that something is proven has to say more than the bare fact that it was asserted, and more than that someone believes it. Otherwise “it’s proven” reduces to “I claim it” and the word is empty.
It must be world-anchored — its holding must not consist merely in someone’s confidence, some community’s agreement, some tribunal’s convenience. Otherwise the disagreement it was meant to resolve has just been swapped for a disagreement about whose confidence counts.
And it must be framework-free — its verdict must not be relativised to a chosen system of axioms, a chosen standard of stringency, a chosen purpose. Otherwise it does not settle the dispute for everyone; it settles it only for those already inside the framework, which is to say it does not settle the dispute at all, but presupposes its resolution.
The three conditions cannot be jointly met, and the reason is the trilemma wearing formal dress. Anything that discriminates and is world-anchored — the mathematician’s derivation, the physicist’s severe test, the cryptographer’s verification — does so from within a system, and so fails to be framework-free: it stops at chosen axioms, chosen test-designs, chosen security parameters. Anything you strip of all framework to make it universal ceases to discriminate: with no axioms it derives nothing, with no standard it certifies nothing, with no purpose it decides nothing. You may have any two. You cannot have three. Every real notion of proof surrenders framework-freedom and keeps its power. Every notion that keeps framework-freedom surrenders its power and idles.
That is the negative result. Now watch four disciplines, each of which spent centuries taking proof more seriously than the philosophers did, arrive at it independently and build on it.
Law: proof as a burden and a threshold
The law is the one institution that was never allowed the luxury of pretending proof is absolute, because the law has to decide — today, on this defendant, with the evidence that exists — and cannot adjourn until the universe discloses itself. So the law did the honest thing centuries ago: it stopped talking about proof as a property and started talking about it as a burden discharged to a standard.
There is no proof simpliciter in a courtroom. There is proof of an issue, borne by a party, to a standard, and the standard moves with the stakes. To take a man’s money, prove your case on the balance of probabilities — more likely than not, fifty-one against forty-nine. To take his liberty, prove it beyond reasonable doubt — because the cost of a wrongful conviction is judged to dwarf the cost of a guilty man walking free, and the standard is set to load the risk of error onto the state rather than the accused. Between them sits an intermediate rung, clear and convincing evidence, for the matters we think fall in between. Same facts, same world, three different thresholds, three different verdicts possible — and the choice among them is not a discovery about the evidence. It is a decision about who should bear the risk of being wrong, made before any evidence is heard.
This is level-indexing in its purest institutional form, and the law is not embarrassed by it. It is the design. To ask “but is he really, absolutely proven guilty?” is to ask a question the law correctly refuses, because the law knows the absolute proof does not exist and that a system waiting for it would acquit every murderer and enforce no contract. What the law supplies instead — proof to a declared standard, with the burden explicitly allocated — is not a degraded substitute for real proof. It is what proof is, made procedural, with the framework written into the rules of court where everyone can see it and argue about where the threshold should sit. The lawyer who says “burden of proof” has understood, in the working language of his trade, everything this essay is trying to say.
Science: the field that abolished proof and got stronger
Science is where the confusion does the most public damage, because the newspapers say a study “proves” things and the scientists wince. There is no proof in science. There was never supposed to be.
A universal claim about the world — all electrons carry this charge, no signal outruns light — cannot be proven by any finite pile of observations, because the next observation, or the billionth, might break it, and you never reach the last one. What you can do is test it: expose it to the harshest experiment you can devise, the one most likely to kill it if it is false, and see whether it survives. A theory that survives severe testing is corroborated — warranted, for now, more than its defeated rivals. It is not proven. It is not yet refuted, which is a different and more honest thing. The strength of science is not that it proves; it is that it exposes its claims to slaughter and keeps the survivors on probation, permanently, subject to the next test and the one after that.
Notice this is not scepticism. The corroborated theory earns real commitment; you would be a fool to bet against thermodynamics. But the commitment is indexed — to the tests passed, the domain probed, the alternatives so far conceived — and it is provisional by design, not by weakness. When a journalist writes that something is “scientifically proven,” he has imported the courtroom’s word, and the pulpit’s craving, into the one enterprise that built its entire power on doing without them. The scientist does not want your proof. He wants your best attempt to falsify him, and he thanks you when it fails and thanks you more when it succeeds. “Proven,” in the lab, is not a high compliment. It is a category error.
Cryptography, and the proof that is made of cost
Here is where the modern world quietly reinvented the whole subject, and where — full disclosure — I have spent a good part of my working life. Cryptography needed proof for a world of strangers and adversaries, where you cannot summon a witness, trust a court, or wait for corroboration, and where the counterparty is actively trying to cheat. What it built is the most instructive answer to “what is proof?” that any discipline has produced, precisely because it never once pretended to the absolute.
Consider three of its instruments.
A digital signature proves authorship. But look closely at what it proves: not that a particular human wrote a message, but that the message was signed by the holder of a particular private key. The proof is airtight — and indexed, entirely, to the custody of the key. Steal the key and you inherit the proof; lose the key and you cannot prove your own words are yours. The certainty is real and it is relative to a fact about the world (who controls the secret) that the mathematics itself cannot see. Proof to a standard, in a system, contingent on a premise the system cannot certify. The trilemma, in your pocket.
A zero-knowledge proof is stranger and more beautiful. It lets one party convince another that a statement is true while revealing nothing else — not the witness, not the reason, only that it holds. And its soundness is probabilistic: the verifier runs a challenge the cheat could pass by luck with some tiny probability, then runs it again, and again, until the chance of a fraud slipping through is smaller than the chance of the sun failing to rise. It is never zero. The proof does not deliver logical impossibility of deceit. It delivers deceit made so improbable that no rational adversary attempts it. That is not a compromise of proof. That is a definition of proof fit for the real world, and it works because it is honest about being a threshold rather than an absolute.
And then proof-of-work — the mechanism at the heart of the Bitcoin protocol, and the one that made me care about this question in the first place. Its very name is a provocation, because the “proof” it offers is nothing a philosopher of the old school would dignify with the word. It proves that a certain quantity of computation was expended — energy burned, cost incurred — to produce a result. Order among transactions is not decreed true; it is made expensive to rewrite. The security of a settled record is not a logical guarantee that it can never be altered. It is an economic and probabilistic one: to overturn history, an attacker must out-spend the honest expenditure that built it, and the probability that he succeeds decays as the honest work accumulates on top. Certainty here is not apodictic. It is a cost curve. Nakamoto’s genius was to see that for a world of adversaries, a proof made of cost — practical certainty purchased with real resources — is worth more than an absolute certainty that does not exist and could not be enforced if it did.
The convergence
Set them side by side and the punchline writes itself.
The mathematician proves from axioms, by a chosen logic, unable to prove his own floor. The lawyer proves to a standard, for a party, on an issue, with the threshold set by the stakes. The scientist does not prove at all; he corroborates, provisionally, against the tests so far conceived. The cryptographer proves to a security parameter, contingent on key custody, with soundness a probability driven near — never to — zero.
Four disciplines that took proof more seriously than anyone, working in isolation, over centuries, on completely different problems. Every one of them abandoned the framework-free absolute. Every one of them replaced it with proof indexed to a standard, a system, a purpose. Not because they gave up. Because they grew up. The framework-free proof is not the thing the serious fields are still reaching for and the sloppy ones have let slip. It is the thing all the serious fields discarded on the way to becoming serious, and the only places it still walks abroad are the pulpit, the comment section, and the mouth of the man who wants to end an argument he is losing.
Framework-relative proof, and how to use it
So here is the constructive doctrine, stated flat and without apology.
To prove is always to prove at a level, to a standard, within a system, for a purpose. There is no proof that floats free of all four. “Is it proven?” is not a complete question. It is a question with four blanks, and the man who refuses to fill them in is not appealing to a higher rigour; he is dodging the only rigour there is. The complete question is: proven from what starting points, by what rules of inference, to what standard of stringency, for what decision? Answer those and “proof” becomes the sharpest tool you own. Leave them blank and it becomes the demagogue’s cudgel.
This yields a working discipline, three rules deep.
Declare your floor. Every proof stops at something unproven. State it. Write your axioms at the top of the page, your standard in the rules of court, your test-design in the methods section, your security assumptions in the threat model. The honest man’s advantage over the charlatan is not that he has escaped the trilemma — nobody has — but that he has named his stopping point and defends the choice of it in the open, instead of pretending it is bedrock that chose itself.
Match the standard to the stakes. The law already does this and is right to. You do not demand mathematical certainty before crossing the road, and you should not accept the balance of probabilities before launching a war. The stringency of proof you require is a decision about who should bear the risk of error, and pretending it is a fixed feature of reality is how people get talked into acting on too little and paralysed by demands for too much.
Refuse the level-jump. The commonest fraud in every argument is the slide between standards: proof offered at one level, credited at another. A study corroborated to the scientist’s standard is reported as proven to the courtroom’s. A signature valid to the cryptographer’s standard is trusted as the person rather than the key. A theorem proven in one axiom system is wielded as if it constrained a world that never granted the axioms. Watch for the jump. It is where nearly every bad inference lives, and it is invisible until you have learned to ask proven to which standard? — at which point it is impossible to miss.
None of this is relativism, and I will not let it be mistaken for relativism. It does not say every standard is as good as every other; the man who proves guilt on a coin-flip is not doing law, and the constructivist and classicist are not each entitled to their private arithmetic without argument about which axioms earn their keep. Choosing your floor is a choice, and choices are defended, attacked, revised, and sometimes shown to be foolish. What framework-relative proof denies is not that some standards are better than others. It denies that there is a standard behind all standards, a proof beneath all proofs, from which the choice could be made without ever making a choice. That thing does not exist. Insisting on it is not rigour. It is the refusal of the one honest labour proof actually demands: to say what you are assuming, meet the standard you have set, and stand behind the level you chose.
The end of the regress
The image of turtles all the way down is supposed to frighten us — an endless stack, no ground, nothing to stand on. It frightens no one who has understood it. There is no bottom turtle, and there was never meant to be. Proof does not rest on a self-justifying foundation buried beneath the deepest axiom; it rests on axioms we lay, standards we set, systems we enter, and purposes we serve — declared, defended, and owned. The absence of the bottom turtle is not the failure of proof. It is the retirement of a fantasy that only ever served the people who wanted to win arguments without doing the work.
What is proof, then?
Proof is warrant delivered to someone, across a standard, inside a system, for a purpose. Nothing less, because the demagogue’s feeling is not it. Nothing more, because the framework-free absolute is not on offer and never was. The mathematician has the strongest proof there is and cannot prove his own floor. The lawyer has known for centuries that proof is a burden borne to a threshold. The scientist grew powerful by abolishing proof and keeping only its provisional cousin. The cryptographer built a civilisation of strangers on proof made of cost. They all found the same thing, coming from four directions, and it is the thing this essay has been circling: proof is real, proof is demanding, proof is the finest instrument the mind has built — and it is never framework-free, and the demand that it be is not a higher standard but the abandonment of the only standard there is.
Choose your turtle. Name it. Defend the choice. And when the next man tells you his conclusion is proven, full stop, no further questions — ask him the four blanks, and watch the floor he was standing on turn out to be a floor he laid himself, in the dark, hoping you would not look down.
State. Classify. Done.
The intellectual landmarks used here are standard and load-bearing: Sextus Empiricus and the modes of Agrippa on the regress of justification; Hans Albert's Münchhausen trilemma; Gödel's second incompleteness theorem; Popper on corroboration and falsification; the classical/intuitionistic split over the excluded middle; and, on the cryptographic side, the standard treatment of digital signatures, interactive and zero-knowledge proofs, and the proof-of-work construction of the Bitcoin protocol. Nothing here rests on an unnamed floor. That was rather the point.