Proof using.
induction xs; intros.
- auto.
- simpl. rewrite H by intuition. rewrite IHxs by intuition. auto.
Qed.

(* Specifications: *)
Lemma not_in_filter_false :
forall (f : A -> bool) l x,
In x l ->
~ In x (filter f l) ->
f x = false.
Lemma filter_length_bound :
forall f (l : list A),
length (filter f l) <= length l.
Lemma NoDup_map_injective : forall (f : A -> B) xs,
(forall x y, In x xs -> In y xs ->
f x = f y -> x = y) ->
NoDup xs -> NoDup (map f xs).