Verification as Learning Geometric Concepts

Abstract

Abstract. We formalize the problem of program verification as a learning problem, showing that invariants in program verification can be regarded as geometric concepts in machine learning. Safety properties define bad states: states a program should not reach. Program verification explains why a program's set of reachable states is disjoint from the set of bad states. In Hoare Logic, these explanations are predicates that form inductive assertions. Using samples for reachable and bad states and by applying well known machine learning algorithms for classification, we are able to generate inductive assertions. By relaxing the search for an exact proof to classifiers, we obtain complexity theoretic improvements. Further, we extend the learning algorithm to obtain a sound procedure that can generate proofs containing invariants that are arbitrary boolean combinations of polynomial inequalities. We have evaluated our approach on a number of challenging benchmarks and the results are promising.

From Invariant Checking to Invariant Inference Using Randomized Search

“…ICE shows the search-and-validate approach of [20]. The next column evaluates a geometric machine learning algorithm [46] to search for candidate invariants and the next column is InvGen [28] a symbolic invariant inference engine that uses concrete data for constraint simplification. Columns ICE, [46], and [28] have been copied verbatim from [20] and the reader is referred to [20] for details.…”

“…The next column evaluates a geometric machine learning algorithm [46] to search for candidate invariants and the next column is InvGen [28] a symbolic invariant inference engine that uses concrete data for constraint simplification. Columns ICE, [46], and [28] have been copied verbatim from [20] and the reader is referred to [20] for details. The MCMC column shows for MCMC search the total time of all the rounds including the time for both search and validation.The Templ column shows the time when we manually provide abstract domains (octagons/octahedra) to the search.…”

“…We use an approach similar to [46,19] to generate data. Let Σ k denote all states in which all numerical variables are assigned values ≤ k, all arrays have sizes ≤ k, and all elements of these arrays are also ≤ k. We generate all states in Σ 0 , then Σ 1 , and so on.…”

“…For our benchmarks, we did not need to enumerate beyond Σ 4 (at most 150 states) before an invariant was discovered. Note that [46,19] test only on reachable states. We additionally test on unreachable states to obtain bad states and pairs.…”

“…The use of a decision procedure as a checker for candidate invariants is also not novel [34,36,45,46,42,20,19]. The main contribution of this paper is a general and effective search procedure that makes a framework like c2i feasible.…”