arXiv:2603.13414cs.SEcs.AI2026-03

用神经符号方法自动生成带内存状态的函数规范,提升系统级代码验证效率。

Neuro-Symbolic Generation and Validation of Memory-Aware Formal Function Specifications

  • 结合自然语言与函数签名,通过上下文学习生成候选规范。
  • 迭代优化后语法正确率显著提升,错误规范被符号证明器有效过滤。
  • 适合关注内存安全、形式化验证的系统软件开发者和研究者。

内存操作程序的形式化验证高度依赖专家编写的精确函数规范,但随着大语言模型(LLMs)生成越来越多底层系统代码,这一要求已成为主要瓶颈。为实现可扩展的形式化验证,本文聚焦于函数规范生成,跳过传统验证流程中的复杂循环不变量合成。提出一种神经符号框架,从自然语言问题描述和函数签名自动生成适用于C程序的内存感知形式化函数规范。该流程首先通过上下文学习生成候选规范,再利用符号证明器和验证工具链的编译诊断进行迭代精炼。特别地,通过构造规范否定的可证伪反例,实现机器可验证的错误规范排除。为支持系统评估,引入LeetCode-C-Spec基准,包含200个需生成内存感知规范的C编程问题。实验表明,迭代精炼显著提升语法有效性,而基于符号证明器的反驳机制大幅改善正确性评估,有效过滤了仅靠LLM判断常误认的假阳性结果。结果表明,神经生成与符号反馈结合是内存安全系统软件形式化规范合成的有效路径。

原文摘要 · Abstract (English)

Formal verification of memory-manipulating programs critically depends on precise function specifications that capture memory states written by experts. This requirement has become a major bottleneck as large language models (LLMs) increasingly generate low-level systems code whose correctness cannot be assumed. To enable scalable formal verification, we focus exclusively on function specification generation, deliberately avoiding the synthesis of complex loop invariants that are central to traditional verification pipelines. We propose a neuro-symbolic framework for automatically generating memory-aware formal function specifications for C programs from natural language problem descriptions and function signatures. The pipeline first produces candidate specifications via in-context learning, and then iteratively refines them using compiler diagnostics from symbolic provers and the verification toolchain. In particular, we validate candidate specifications by constructing a proof for the negation of the specification with concrete examples, enabling machine-checked rejection of plausible-but-incorrect specifications. To support systematic evaluation, we introduce LeetCode-C-Spec, a new benchmark of 200 C programming problems for generating memory-aware formal function specifications. Experiments show that iterative refinement substantially improves syntactic validity, while symbolic prover-based refutation significantly enhances correctness assessment by filtering false positives that LLM-only judges frequently accept. Our results demonstrate that combining neural generation with symbolic feedback provides an effective approach to formal specification synthesis for memory-safe systems software.

形式化验证神经符号内存安全LLM应用

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。