Secret Ninja Formal Methods