Using dynamic analysis to discover polynomial and array invariants

Nguyen, Nguyen; Kapur,; Weimer,; Forrest,

doi:10.1109/icse.2012.6227149

Cited by 67 publications

(83 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, researchers have also applied these techniques to the generation of non-linear loop invariants [23,17,21,22,18]. These techniques discover algebraic invariants, that is, invariants of the form ∧ i f i (x 1 , .…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Data Driven Approach for Algebraic Loop Invariants

Sharma

Gupta

Hariharan

et al. 2013

Lecture Notes in Computer Science

114

View full text Add to dashboard Cite

Abstract. We describe a Guess-and-Check algorithm for computing algebraic equation invariants of the form ∧ifi(x1, . . . , xn) = 0, where each fi is a polynomial over the variables x1, . . . , xn of the program. The "guess" phase is data driven and derives a candidate invariant from data generated from concrete executions of the program. This candidate invariant is subsequently validated in a "check" phase by an off-the-shelf SMT solver. Iterating between the two phases leads to a sound algorithm. Moreover, we are able to prove a bound on the number of decision procedure queries which Guess-and-Check requires to obtain a sound invariant. We show how Guess-and-Check can be extended to generate arbitrary boolean combinations of linear equalities as invariants, which enables us to generate expressive invariants to be consumed by tools that cannot handle non-linear arithmetic. We have evaluated our technique on a number of benchmark programs from recent papers on invariant generation. Our results are encouraging -we are able to efficiently compute algebraic invariants in all cases, with only a few tests.

show abstract

Section: Introductionmentioning

confidence: 99%

“…Therefore, there has been recent interest in techniques for generating algebraic invariants that do not use Gröbner bases [4,18] (see Section 7). In this paper, we address the problem of invariant generation from a data driven perspective.…”

Section: Introductionmentioning

confidence: 99%

A Data Driven Approach for Algebraic Loop Invariants

Sharma

Gupta

Hariharan

et al. 2013

Lecture Notes in Computer Science

114

View full text Add to dashboard Cite

show abstract

“…We are not aware of any symbolic inference technique that has been successfully demonstrated to infer invariants for the various types of programs that we consider (numeric, array, string, and list). Daikon [17] and Houdini [18] use conjunctive learning, [45,41] use equation solving, and [47] uses SVMs: these fail to infer disjunctive invariants over inequalities. The underlying machine learning algorithm of [46] uses geometry and hence is applicable to numerical predicates only.…”

Section: Related Workmentioning

confidence: 99%

From invariant checking to invariant inference using randomized search

Sharma

Aiken

2016

Form Methods Syst Des

View full text Add to dashboard Cite

Abstract. We describe a general framework c2i for generating an invariant inference procedure from an invariant checking procedure. Given a checker and a language of possible invariants, c2i generates an inference procedure that iteratively invokes two phases. The search phase uses randomized search to discover candidate invariants and the validate phase uses the checker to either prove or refute that the candidate is an actual invariant. To demonstrate the applicability of c2i, we use it to generate inference procedures that prove safety properties of numerical programs, prove non-termination of numerical programs, prove functional specifications of array manipulating programs, prove safety properties of string manipulating programs, and prove functional specifications of heap manipulating programs that use linked list data structures.

show abstract

“…Nguyen et al [48] give an unsound algorithm for generation of likely invariants that are conjunctions of polynomial equalities or inequalities. For equalities, they compute the null space of good samples (obtained from tests) in the higher dimensional space described in Section 4.2, that is also one of the steps of our technique.…”

Section: Comparison With Tools For Non-linear Invariantsmentioning

confidence: 99%

“…In addition to limiting the expressiveness to just conjunction of polynomial inequalities, this step is computationally very expensive. In a related work, we ran [48] in a guess-and-check loop to obtain an algorithm [54], with soundness and termination guarantees, for generating polynomial equalities as invariants. A termination proof was possible as [54] can return the trivial invariant true: it is not required to find invariants strong enough to prove some property of interest.…”

Section: Comparison With Tools For Non-linear Invariantsmentioning

confidence: 99%

Verification as Learning Geometric Concepts

et al. 2013

View full text Add to dashboard Cite

Abstract. We formalize the problem of program verification as a learning problem, showing that invariants in program verification can be regarded as geometric concepts in machine learning. Safety properties define bad states: states a program should not reach. Program verification explains why a program's set of reachable states is disjoint from the set of bad states. In Hoare Logic, these explanations are predicates that form inductive assertions. Using samples for reachable and bad states and by applying well known machine learning algorithms for classification, we are able to generate inductive assertions. By relaxing the search for an exact proof to classifiers, we obtain complexity theoretic improvements. Further, we extend the learning algorithm to obtain a sound procedure that can generate proofs containing invariants that are arbitrary boolean combinations of polynomial inequalities. We have evaluated our approach on a number of challenging benchmarks and the results are promising.

show abstract

Using dynamic analysis to discover polynomial and array invariants

Cited by 67 publications

References 30 publications

A Data Driven Approach for Algebraic Loop Invariants

A Data Driven Approach for Algebraic Loop Invariants

From invariant checking to invariant inference using randomized search

Verification as Learning Geometric Concepts

Contact Info

Product

Resources

About