Abstract:Despite the crucial need for formal safety and security verification of programs, discovering loop invariants remains a significant challenge. Static analysis is a primary technique for inferring loop invariants but often relies on substantial assumptions about underlying theories. Data-driven methods supported by dynamic analysis and machine learning algorithms have shown impressive performance in inferring loop invariants for some challenging programs. However, state-of-the-art data-driven techniques do not offer theoretical guarantees for finding loop invariants. We present a novel technique that leverages the simulated annealing (SA) search algorithm combined with SMT solvers and computational geometry to provide probabilistic guarantees for inferring loop invariants using data-driven methods. Our approach enhances the SA search with real analysis to define the search space and employs parallelism to increase the probability of success. To ensure the convergence of our algorithm, we adapt e-nets, a key concept from computational geometry. Our tool, DLIA2, implements these algorithms and demonstrates competitive performance against state-of-the-art techniques. We also identify a subclass of programs, on which we outperform the current state-of-the-art tool GSpacer.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: **How to provide probabilistic guarantees when automatically discovering linear integer arithmetic (LIA) loop invariants in program verification?** Specifically, the author proposes a new technique that uses the Simulated Annealing (SA) search algorithm, SMT solvers, and computational geometry methods to provide probabilistic guarantees for data - driven methods to find linear loop invariants. ### Problem Background 1. **Requirements for Formal Verification** - Formal verification of programs is crucial for ensuring the safety and security of software. - Hoare Logic is a commonly used formal verification method, but it requires special propositions - loop invariants when dealing with loops. 2. **Limitations of Existing Methods** - Static analysis methods rely on assumptions about the underlying theory and usually can only handle very restricted first - order theories. - Data - driven methods, although performing well on some complex programs, lack theoretical completeness guarantees, especially when dealing with linear loop invariants. ### Core Contributions of the Paper 1. **Providing Probabilistic Guarantees** - The author proposes the first data - driven method with probabilistic guarantees for discovering linear loop invariants with integer variables. 2. **Combining Multiple Techniques** - **Simulated Annealing Search Algorithm**: Used to search in the invariant space. - **SMT Solver**: Used to verify whether the guessed invariants are correct. - **𝜖 - nets in Computational Geometry**: Used to define the search space and ensure algorithm convergence. 3. **Improved Convergence Guarantees** - The convergence guarantee is improved from \(O(|D_{state}|^{1/n})\) to \(O(\log^2|D_{state}|)\), and it can be extended to all CEGIS methods. 4. **Introducing New Concepts and Techniques** - **Scattered Counter - Example Generation**: A new counter - example generation technique is introduced in the SMT solver. - **Iterative Implication Pairs**: Ensure local progress of the invariant search algorithm. - **Compact Approximation of the Distance Function of a Polyhedron Set**: Serves as the cost function for invariant search. ### Experimental Results - The tool DLIA2 developed by the author performs well in multiple benchmark tests and outperforms the current state - of - the - art tool GSpacer on some sub - classes of programs. ### Summary The main goal of the paper is to provide probabilistic guarantees for data - driven linear loop invariant discovery by combining simulated annealing, SMT solvers, and computational geometry methods. This not only improves the reliability and efficiency of the algorithm but also provides a new research direction in the field of formal verification.

Probabilistic Guarantees for Practical LIA Loop Invariant Automation

Learning Likely Invariants to Explain Why a Program Fails

A Novel Data-Driven Approach for Generating Verified Loop Invariants *

Towards General Loop Invariant Generation: A Benchmark of Programs with Memory Manipulation

Post-condition-Directed Invariant Inference for Loops over Data Structures.

A novel data-driven approach on inferring loop invariants for C programs

Loop invariant synthesis in a combined abstract domain

LLM Meets Bounded Model Checking: Neuro-symbolic Loop Invariant Inference

(Un)Solvable Loop Analysis

SLING: using dynamic analysis to infer program invariants in separation logic

Probabilistic Program Verification Via Inductive Synthesis of Inductive Invariants.

Ranking LLM-Generated Loop Invariants for Program Verification

Simple Linear Loops: Algebraic Invariants and Applications

Ilinva: Using Abduction to Generate Loop Invariants

PBLInv: Postcondition-based Loop Invariant Learning for C Programs.

Synthesizing invariants by solving solvable loops

Latticed K-Induction with an Application to Probabilistic Programs

Guaranteed Bounds on Posterior Distributions of Discrete Probabilistic Programs with Loops

Model Checking C Programs with Loops via k-Induction and Invariants

Finding Polynomial Loop Invariants for Probabilistic Programs