arXiv:2606.20969cs.AIcs.SE2026-06

用代码图分析增强大模型,自动生成可验证的C语言规范。

AutoACSL: Synthesizing ACSL Specifications by Integrating LLMs with CPG-Based Static Analysis

论文配图:AutoACSL: Synthesizing ACSL Specifications by Integrating LLMs with CPG-Based Static Analysis
图 1 · 摘自论文原文
  • 结合代码属性图提取语义特征,构造结构化提示引导大模型生成规范。
  • 在604个程序上达到98%生成成功率,与Gemini-3配合时全证明率96%。
  • 适合做形式化验证的开发者,尤其关注自动化契约生成的场景。

为C程序生成形式化规格仍是形式化验证中的难题,主要源于人工投入大、专业知识要求高以及语义精确性不足。尽管大语言模型(LLMs)在自动化规格合成方面展现出潜力,但现有方法常缺乏语义深度,生成的契约不可验证或不完整。为此,我们提出AutoACSL,一个将大模型提示与基于代码属性图(CPG)的静态分析相结合的新框架。AutoACSL通过静态分析提取算术运算、循环与递归结构、返回值传播等关键语义元素,并将其编码为结构化提示。这些提示使大模型不仅能生成常规行为规格,还能包含防止引发运行时错误的约束条件。AutoACSL采用反馈驱动的合成循环:候选规格由Frama-C/WP验证,失败则迭代优化,直至验证成功或达到终止条件。在来自多个数据集的604个程序上评估显示,AutoACSL在与Gemini-3搭配时,规格生成成功率达98%,全证明率达到96%。相比仅使用代码的基线,该框架在四个LLM(GPT-o4 Mini、GPT-5.2、Grok-4.1、Gemini-3)上将全证明率提升24.7%至51.7%,表明融合大模型与基于CPG的静态分析显著提升了自动化ACSL规格合成的鲁棒性与验证效果。

原文摘要 · Abstract (English)

Generating formal specifications for C programs remains a challenge in formal verification due to the manual effort, expertise, and semantic precision required. While recent advancements in large language models (LLMs) offer promise in automating specification synthesis, current approaches often lack semantic depth and produce unverifiable or incomplete contracts. To address these limitations, we introduce AutoACSL, a novel framework that integrates LLM prompting with semantic features extracted from Code Property Graphs (CPGs). AutoACSL performs static analyses to extract key semantic elements, including arithmetic operations, loop and recursion structures, and return value propagation, which are encoded into structured prompts. These prompts enable the LLM not only to generate normal behavioral specifications but also to include constraints that prevent inputs leading to runtime errors. AutoACSL employs a feedback-driven synthesis loop, where candidate specifications are verified using Frama-C/WP and refined iteratively until verification succeeds or a termination condition is met. Evaluated on 604 programs drawn from diverse datasets, AutoACSL achieves a 98% specification generation success ratio and a 96% full proof ratio when paired with Gemini-3. Compared to a code-only baseline, AutoACSL improves the full proof ratio by 24.7% to 51.7% across four LLMs (GPT-o4 Mini, GPT-5.2, Grok-4.1, and Gemini-3), demonstrating that integrating large language models with CPG-based static analysis substantially enhances both generation robustness and verification effectiveness for automated ACSL specification synthesis.

形式验证大模型代码分析自动化

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。