arXiv:2605.06184cs.SEcs.LG2026-05被引 1

用符号执行轨迹训练大模型,显著提升程序漏洞检测能力。

Teaching LLMs Program Semantics via Symbolic Execution Traces

  • 用开源C代码的符号执行轨迹微调模型,学习程序语义。
  • 漏洞检测准确率提升17个百分点,8B模型超越32B基础版。
  • 轨迹与思维链结合效果超叠加,适配多类程序验证任务。

我们构建了一个包含500个C语言验证任务的评估框架,覆盖内存安全、溢出、终止性、可达性和数据竞争五类属性,基于SV-COMP 2025。在六个系列共14个模型上进行评估发现:尽管多数模型对性质成立的判断准确,但漏洞检测能力差异大且随代码长度急剧下降。为弥补此差距,我们使用Soteria符号执行引擎在通用开源C代码上生成约3,000条缺陷轨迹,并以此对Qwen3-8B进行持续预训练。结合推理时的链式思考,漏洞检测性能提升超过17个百分点,达到评估模型中最为均衡的准确率表现。该8B模型在漏洞检测上优于4倍大的Qwen3-32B(无思维链),且整体准确率接近后者。轨迹训练与链式思考的交互呈超加性效应:单独使用均无明显收益,联合则显著提升。性能提升可跨五类属性迁移,包括训练轨迹未覆盖的类型。28组配置实验确认收益源于轨迹语义而非代码量,且轨迹的筛选与格式至关重要。

原文摘要 · Abstract (English)

We introduce an evaluation framework of 500 C verification tasks across five property types (memory safety, overflow, termination, reachability, data races) built on SV-COMP 2025, and evaluate 14 models across six families. We find that high overall accuracy masks a critical weakness: while most models reliably confirm properties hold, violation detection varies widely and degrades sharply with program length. To close this gap, we train on formal verification artifacts: running the Soteria symbolic execution engine on generic open-source C code and using the resulting traces for continued pretraining of Qwen3-8B. Just ${\sim}$3,000 bug traces combined with chain-of-thought reasoning at inference time improve violation detection by over 17 percentage points, producing one of the most balanced accuracy profiles among evaluated models. On violation detection, the trained 8B model outperforms the 4$\times$ larger Qwen3-32B without thinking and approaches it in overall accuracy. The interaction between trace training and chain-of-thought is superadditive: neither alone provides meaningful gains, but their combination does. Improvements transfer across all five property types, including ones the training traces do not target. Our 28 configurations confirm the gains stem from trace semantics, not code volume, and that trace curation and format matter.

程序验证大模型符号执行漏洞检测

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。