Searcharxiv⌕ Search

arXiv subjects

Peisen Yao

Publications and source records attributed to Peisen Yao.

18 recordsLinked to original sources

DatalogBench: Evaluating Large Language Models on Text-to-Datalog Synthesis

Datalog underpins reasoning tasks such as program analysis, but its programs are hard to write. Existing synthesizers automate this task but require users to state their intent as input-output examples. Large language models (LLMs) suggest a more natural route, text-to-Datalog synthesis from a natural-language question, yet how well they do so has not been systematically evaluated. We present DatalogBench, a benchmark of 136 text-to-Datalog synthesis tasks curated from existing Datalog-based artifacts. Synthesized programs are graded by execution on held-out inputs against an oracle validated by mutation analysis. Across six LLMs and four prompting configurations, exact match peaks at 68.4%, and relation descriptions or an input-output example have only modest, model-dependent effects. Under direct prompting, most failures occur at compile time, typically because a model invents auxiliary predicates that it never declares or types consistently. Two coding agents reach up to 83.8% and eliminate nearly all such failures, leaving mostly semantic errors concentrated in recursive tasks. DatalogBench thus identifies recursive reasoning and decomposition as open challenges for current LLMs and agents, and offers a reliable, execution-grounded measure of both.

cs.PL↗

Dense Interprocedural Dominance in Acyclic Graphs: Context Bounds and Compact Queries

Interprocedural dominance asks which program points every matched call-and-return execution must pass on its way to a target. An analysis that writes out immediate dominance pays for the transitive reduction of this order, the minimal dominator graph. Measured instances of that graph look near-linear, with edge-to-node ratios around 1.1--1.26~\cite{DeSutter2007}, but no program property is known to force this: it is unclear which structural restrictions imply sparse output, and whether dense output also rules out cheap queries. This paper answers both through calling contexts. A static node stands for the group of its reachable configurations; write $κ$ for the largest group size and $α$ for how many nodes have more than one configuration. One context per node keeps the tree with $n-1$ edges. Two already allow $Θ(n^2)$ cover edges in a sparse, loop-free, recursion-free ICFG with total degree three, constant-size procedures, and logarithmic stack depth, while the reachable configuration graph itself stays linear, so the blowup comes from grouping, not from many configurations. Three keep $Θ(n^2)$ covers even when the explicit call/return graph is acyclic: all target-reaching runs visit the mandatory procedures in the same order, and extra runs that stop short of any target remove the comparabilities that would otherwise kill the covers. Complementing the lower bounds, $α$ ambiguous nodes admit at most $\min\{\floor{n^2/4},(α+1)(n-1)\}$ cover edges, with $Ω(αn)$ attainable at stack depth one. And for every ICFG with at most two contexts per node, deleting a context group reduces dominance to dual-failure reachability, giving $O(n)$-word, $O(1)$-query representation after polynomial preprocessing. Explicit cover size, context ambiguity, and query-space cost are three separate quantities.

cs.DS↗

PyFlow: An Inter-procedural Static Analysis Framework for Python

Static program analysis infers program properties automatically. Yet precise interprocedural analysis remains challenging, and dynamically typed languages amplify the difficulty. Python is particularly problematic: dynamic dispatch, first-class functions, metaprogramming, pervasive exceptions, and an object model based on descriptors and attribute-driven lookup collectively impede precise reasoning. We present PyFlow, a generic IFDS-based static-analysis framework for Python. PyFlow provides a multi-stage intermediate-representation pipeline and a generic IFDS solver parameterized by abstract domains. Analysis developers implement only the dataflow semantics; the framework constructs the supergraph, performs fixed-point iteration, and caches summaries. We implement a taint analysis in \pyflow and evaluate it against eight Python SAST tools (DevSkim, Dlint, Bandit, Bearer, CodeQL, Pysa, Semgrep, and Snyk) on the synthetic and real-world benchmarks from a recent ICSE~'26 study. On the synthetic benchmark, PyFlow achieves the best aggregate recall and F1 score among all nine tools. On the real-world benchmark, it attains the highest recall and F1 score while maintaining precision competitive with taint-based engines. We conclude with lessons learned from building IFDS analyses for Python.

cs.PL↗

Accelerating C/C++ Pointer Analysis via Compiler-Based Offline Simplifications

Pointer analysis is a cornerstone of numerous static analysis applications, including compiler optimizations, slicing, bug detection, and verification. While offline simplification is a common approach to boosting performance, existing methods are often tightly coupled to specific analysis algorithms and limited to a set of simplification rules. This paper explores a new perspective: applying semantic-preserving compiler optimizations directly to intermediate representation (IR) before pointer analysis. This strategy is modular, analysis-agnostic, and easily integrates with existing tools. We conduct an empirical study using diverse programs and three pointer analyses. The results show substantial performance gains---up to 3.14x speedup and 1.94x memory reduction---while precision remains largely unchanged. We also analyze the trade-offs between optimization overhead and analysis speedup, quantify changes in IR structure, assess the characteristics of optimization configurations, and identify promising directions for future research.

cs.PL↗

Phoenix: A Modular and Versatile Framework for C/C++ Pointer Analysis

We present Phoenix, a modular pointer analysis framework for C/C++ that unifies multiple alias analysis algorithms behind a single, stable interface. Phoenix addresses the fragmentation of today's C/C++ pointer analysis ecosystem by cleanly separating IR construction, constraint generation, solver backends, and client-facing queries-making analyses easy to compare, swap, and compose while exposing explicit precision-performance trade-offs. We evaluate two comparisons on 28 GNU coreutils programs: Phoenix-FICI versus SVF-FICI, where both analyses are flow-insensitive and context-insensitive, and Phoenix-FSCS versus SVF-FSCI, where the former is flow- and context-sensitive and the latter is flow-sensitive but context-insensitive. Phoenix-FICI is faster on all benchmarks, with a maximum speedup of 2.88x. For the second comparison, Phoenix-FSCS is faster on 13 benchmarks, slower on 14, and tied on one, with a maximum speedup of 2.91x. In production, Phoenix serves as the analysis substrate for static analysis and fuzzing tools that have uncovered hundreds of new bugs in open-source software and industrial deployments.

cs.PL↗

A Fresh Look at Best Inductive Loop Invariant Synthesis for Bit-Vector Relations

Synthesizing best inductive invariants (BII) is fundamental to program analysis and verification, yet existing approaches face significant efficiency challenges. We introduce a new formulation for the problem through the lens of mathematical optimization over quantified constraints in first-order theories. The formulation offers a constructive and operational perspective on the BII problem and opens new algorithmic avenues. Building on this formulation, we present two new algorithms for bit-vector programs: a strategically guided linear search that exploits the lattice structure and a bitwise greedy approach that resolves bound bits from high to low with a solver-call count linear in bit-width. We evaluate our approach on a comprehensive benchmark suite, demonstrating significant performance improvements over conventional methods based on symbolic abstraction and chaotic iteration. Experimental results demonstrate our approach solves up to 86\% more benchmarks than baseline methods, with improved scaling in solver-call count for high bit-widths and improved verification effectiveness when integrated with k-induction.

cs.PL↗

Sharp Two-Round Adaptivity and Round Hierarchies for Semantic Regular Expressions

Semantic regular expressions (SemREs) attach external Boolean predicates to matched spans, making both the number and the sequentiality of oracle calls central resources. For a fixed expression and word, we represent membership by a polynomial-size monotone span circuit and identify optimal semantic evaluation with Boolean decision-tree evaluation. We determine the extremal power of adaptivity asymptotically sharply. For every $E\ge2$, there is a unary, star-free, semantic-depth-one instance of syntax size $Θ(E)$ with $E$ essential oracle keys and only unit-length semantic spans whose one-round cost is $E$, whereas its exact two-round and unrestricted deterministic costs are \[ \log_2 E+\tfrac12\log_2\log_2 E+O(1). \] Consequently, the largest nonadaptive-to-adaptive ratio is $(1+o(1))E/\log_2E$, including the optimal leading constant. A second restricted family exhibits a complete round hierarchy: its optimal $R$-round cost is $Θ(R E^{1/R})$. Thus the maximal gap already appears in two rounds, while other instances interpolate smoothly across all round budgets. Both constructions admit one-predicate realizations over the fixed alphabet $\{0,1,\#\}$ with logarithmic-length semantic spans and $O(E\log^2 E)$ total representation size. Under pointwise error $δ<1/2$ and worst-case expected cost, randomized nonadaptive complexity is exactly $(1-2δ)E$ for every instance with $E$ essential keys. Finally, for a fixed word $w$ and $h$ predicate names, the exact randomized minimax value is $(1-2δ)h sd(w)$, where $sd(w)$ counts distinct substring values; a span bound $s$ replaces $sd(w)$ by $sd_s(w)$. These results separate semantic information acquisition, parallel latency, and local symbolic matching cost.

cs.FL↗

Shared-Context Batched Satisfiability

Program analyzers often issue batches of SMT queries that share a large symbolic context and differ only in a small predicate. We formalize this recurring pattern as \emph{Shared-Context Batched Satisfiability}: given a formula $φ$ and predicates $P$, determine whether $φ\land p$ is satisfiable for each $p \in P$. We study three theory-agnostic strategies for this problem: predicate-by-predicate checking, disjunctive over-approximation, and Core-Literal Filter (CLF), a new algorithm that learns literals inconsistent with $φ$ and uses them to reject later predicates. Our evaluation on symbolic abstraction and active property checking shows that no strategy dominates universally: over-approximation is fastest on solved symbolic-abstraction queries, while CLF increases the number of solved hard instances and is fastest on active property checking. We advocate treating shared-context batched satisfiability as a first-class primitive in design program analyzers and exploring the algorithmic design space more systematically.

cs.PL↗

Analyzing the Analyzers: Model Counting Meets Abstract Interpretation

Abstract interpretation offers a principled foundation for static analysis by approximating concrete program semantics via abstract domains. However, quantitatively comparing the precision of different domains remains a longstanding challenge. We present MCAI (Model Counting meets Abstract Interpretation), a new methodology that employs model counting to measure the precision of abstract domains. Unlike prior approaches that assess precision relative to specific analysis queries, MCAI encodes both concrete semantics and abstract values as logical formulas, enabling a client-independent, quantitative metric of imprecision that captures the inherent semantic loss in the abstractions. We apply MCAI to four abstract domains and evaluate the precision of their best abstract transformers via symbolic abstraction. Our results yield several insights: the Interval domain, despite its simplicity, often achieves precision comparable to that of Octagon; many octagonal constraints are semantically redundant; and the bit-level KnownBit domains consistently outperform the word-level domains. MCAI offers both theoretical insights into the precision of abstract domains and practical guidance for selecting suitable abstractions.

cs.PL↗

Synthesizing Best Abstract Transformers via Parallel Bit-Vector Optimization

Abstract interpretation provides a principled foundation for constructing sound static analyses through systematic abstraction. A central challenge is synthesizing the best abstract transformers that achieve optimal precision within a given abstract domain. This paper addresses this problem for low-level code modeled with fixed-size bit-vectors. Recent approaches formulate the synthesis task as a multi-objective Optimization Modulo Theories (OMT) problem, but suffer from limited scalability. We introduce Spear, a parallel synthesis framework that exploits a key structural insight: while the bits within each objective must be processed sequentially, the objectives themselves are independent. Spear leverages the independence of inter-objective bits to better parallelize the synthesis. Experimental results on benchmarks across two binary analysis domains show that Spear consistently outperforms state-of-the-art OMT solvers, solving more instances and achieving significantly improved runtimes. To our knowledge, this is the first approach to apply parallelism to accelerate the synthesis of optimal abstract transformers.

cs.PL↗

Learning Splitting Heuristics for Parallel String Solvers

String constraint solvers are crucial for reasoning about string-manipulating programs. However, many practical string constraints are undecidable, and real-world applications often present complex constraints that challenge current solvers. The rise of multi-core architectures offers an opportunity for parallel solving. A key parallel solving method is \emph{cube-and-conquer}, in which the quality of splitting heuristics is critical to effectively dividing the search space. Unfortunately, manually designing the heuristics is labor-intensive, and handcrafted heuristics are often sub-optimal. This paper introduces a data-driven approach to automatically generating splitting heuristics. We frame the problem of selecting a splitting atom as a learning task, using features from input formulas and dynamic data from solver execution. We implement this approach in two popular string solvers, Z3seq and Z3str4, demonstrating that the learned heuristics outperform manually designed ones in the number of solved formulas and the average solving time.

cs.AI↗

HintPilot: LLM-based Compiler Hint Synthesis for Code Optimization

Code optimization remains a core objective in software development, yet modern compilers struggle to navigate the enormous optimization spaces. While recent research has looked into employing large language models (LLMs) to optimize source code directly, these techniques can introduce semantic errors and miss fine-grained compiler-level optimization opportunities. We present HintPilot, which bridges LLM-based reasoning with traditional compiler infrastructures via synthesizing compiler hints, annotations that steer compiler behavior. HintPilot employs retrieval-augmented synthesis over compiler documentation and applies profiling-guided iterative refinement to synthesize semantics-preserving and effective hints. Upon PolyBench and HumanEval-CPP benchmarks, HintPilot achieves up to 6.88x geometric mean speedup over -Ofast while preserving program correctness.

cs.SE↗

KBX: Verified Model Synchronization via Formal Bidirectional Transformation

Complex safety-critical systems require multiple models for a comprehensive description, resulting in error-prone development and laborious verification. Bidirectional transformation (BX) is an approach to automatically synchronizing these models. However, existing BX frameworks lack formal verification to enforce these models' consistency rigorously. This paper introduces KBX, a formal bidirectional transformation framework for verified model synchronization. First, we present a matching logic-based BX model, providing a logical foundation for constructing BX definitions within the $\mathbb{K}$ framework. Second, we propose algorithms to synthesize formal BX definitions from unidirectional ones, which allows developers to focus on crafting the unidirectional definitions while disregarding the reverse direction and missing information recovery for synchronization. Afterward, we harness $\mathbb{K}$ to generate a formal synchronizer from the synthesized definitions for consistency maintenance and verification. To evaluate the effectiveness of KBX, we conduct a comparative analysis against existing BX frameworks. Furthermore, we demonstrate the application of KBX in constructing a BX between UML and HCSP for real-world scenarios, showcasing an 82.8\% reduction in BX development effort compared to manual specification writing in $\mathbb{K}$.

cs.SE↗

Enabling Runtime Verification of Causal Discovery Algorithms with Automated Conditional Independence Reasoning (Extended Version)

Causal discovery is a powerful technique for identifying causal relationships among variables in data. It has been widely used in various applications in software engineering. Causal discovery extensively involves conditional independence (CI) tests. Hence, its output quality highly depends on the performance of CI tests, which can often be unreliable in practice. Moreover, privacy concerns arise when excessive CI tests are performed. Despite the distinct nature between unreliable and excessive CI tests, this paper identifies a unified and principled approach to addressing both of them. Generally, CI statements, the outputs of CI tests, adhere to Pearl's axioms, which are a set of well-established integrity constraints on conditional independence. Hence, we can either detect erroneous CI statements if they violate Pearl's axioms or prune excessive CI statements if they are logically entailed by Pearl's axioms. Holistically, both problems boil down to reasoning about the consistency of CI statements under Pearl's axioms (referred to as CIR problem). We propose a runtime verification tool called CICheck, designed to harden causal discovery algorithms from reliability and privacy perspectives. CICheck employs a sound and decidable encoding scheme that translates CIR into SMT problems. To solve the CIR problem efficiently, CICheck introduces a four-stage decision procedure with three lightweight optimizations that actively prove or refute consistency, and only resort to costly SMT-based reasoning when necessary. Based on the decision procedure to CIR, CICheck includes two variants: ED-CICheck and ED-CICheck, which detect erroneous CI tests (to enhance reliability) and prune excessive CI tests (to enhance privacy), respectively. [abridged due to length limit]

cs.SE↗

Synthesizing Conjunctive Queries for Code Search

This paper presents Squid, a new conjunctive query synthesis algorithm for searching code with target patterns. Given positive and negative examples along with a natural language description, Squid analyzes the relations derived from the examples by a Datalog-based program analyzer and synthesizes a conjunctive query expressing the search intent. The synthesized query can be further used to search for desired grammatical constructs in the editor. To achieve high efficiency, we prune the huge search space by removing unnecessary relations and enumerating query candidates via refinement. We also introduce two quantitative metrics for query prioritization to select the queries from multiple candidates, yielding desired queries for code search. We have evaluated Squid on over thirty code search tasks. It is shown that Squid successfully synthesizes the conjunctive queries for all the tasks, taking only 2.56 seconds on average.

cs.PL↗

Verifying Data Constraint Equivalence in FinTech Systems

Data constraints are widely used in FinTech systems for monitoring data consistency and diagnosing anomalous data manipulations. However, many equivalent data constraints are created redundantly during the development cycle, slowing down the FinTech systems and causing unnecessary alerts. We present EqDAC, an efficient decision procedure to determine the data constraint equivalence. We first propose the symbolic representation for semantic encoding and then introduce two light-weighted analyses to refute and prove the equivalence, respectively, which are proved to achieve in polynomial time. We evaluate EqDAC upon 30,801 data constraints in a FinTech system. It is shown that EqDAC detects 11,538 equivalent data constraints in three hours. It also supports efficient equivalence searching with an average time cost of 1.22 seconds, enabling the system to check new data constraints upon submission.

cs.PL↗

Efficient Path-Sensitive Data-Dependence Analysis

This paper presents a scalable path- and context-sensitive data-dependence analysis. The key is to address the aliasing-path-explosion problem via a sparse, demand-driven, and fused approach that piggybacks the computation of pointer information with the resolution of data dependence. Specifically, our approach decomposes the computational efforts of disjunctive reasoning into 1) a context- and semi-path-sensitive analysis that concisely summarizes data dependence as the symbolic and storeless value-flow graphs, and 2) a demand-driven phase that resolves transitive data dependence over the graphs. We have applied the approach to two clients, namely thin slicing and value flow analysis. Using a suite of 16 programs ranging from 13 KLoC to 8 MLoC, we compare our techniques against a diverse group of state-of-the-art analyses, illustrating significant precision and scalability advantages of our approach.

cs.PL↗

Duplicate-sensitivity Guided Transformation Synthesis for DBMS Correctness Bug Detection

Database Management System (DBMS) plays a core role in modern software from mobile apps to online banking. It is critical that DBMS should provide correct data to all applications. When the DBMS returns incorrect data, a correctness bug is triggered. Current production-level DBMSs still suffer from insufficient testing due to the limited hand-written test cases. Recently several works proposed to automatically generate many test cases with query transformation, a process of generating an equivalent query pair and testing a DBMS by checking whether the system returns the same result set for both queries. However, all of them still heavily rely on manual work to provide a transformation which largely confines their exploration of the valid input query space. This paper introduces duplicate-sensitivity guided transformation synthesis which automatically finds new transformations by first synthesizing many candidates then filtering the nonequivalent ones. Our automated synthesis is achieved by mutating a query while keeping its duplicate sensitivity, which is a necessary condition for query equivalence. After candidate synthesis, we keep the mutant query which is equivalent to the given one by using a query equivalent checker. Furthermore, we have implemented our idea in a tool Eqsql and used it to test the production-level DBMSs. In two months, we detected in total 30 newly confirmed and unique bugs in MySQL, TiDB and CynosDB.

cs.SE↗