POVGEN, a low-cost neuro-symbolic framework that makes PoV generation cost-effective via semantic focusing and LLM-guided constraint reasoning using open-weight models, and fine-tuned open-weight models match frontier commercial LLMs on key sub-tasks while running locally at no per-sample API cost.
Abstract
Software vulnerabilities are persistent, but validating them remains difficult: a Proof-of-Vulnerability (PoV) requires a concrete input that triggers the vulnerable behavior, yet public triggering inputs are often unavailable for disclosed vulnerabilities. Existing techniques make different tradeoffs in effectiveness, scalability, cost, and controllability, leaving room for complementary designs. To complement them, we present POVGEN, a low-cost neuro-symbolic framework that makes PoV generation cost-effective via semantic focusing and LLM-guided constraint reasoning using open-weight models. POVGEN first localizes vulnerability-relevant regions (utilizing patch information if available), then performs path-sensitive reachability analysis, and finally generates PoVs by extracting and solving constraints with LLM-guided reasoning backed by an SMT solver. POVGEN successfully generates PoVs for 78.98% of vulnerabilities in a recent benchmark, outperforming fuzzing (up to 50.20%) and symbolic execution (2.45%). On 250 real-world CVEs without public PoVs, it generates valid PoVs for 74.80% of cases and reproduces 65.1% when without patch information. The fine-tuned open-weight models match frontier commercial LLMs on key sub-tasks (i.e., the core constraint-reasoning steps) while running locally at no per-sample API cost. Applying the generated PoVs revealed six flawed patches in disclosed CVEs (all subsequently fixed) and five previously unreported vulnerabilities (of which four have been confirmed and fixed by the developers).
NeuroAssertion is presented, a coverage-driven assertion generation framework that combines formal trace generation, syntax-guided synthesis (SyGuS), and an agent-inspired refinement process within a unified framework that delivers around 2X more assertions and about 2X higher mutation coverage than traditional assertion mining methods.
The results show that build integration, not candidate generation or fuzzing, is the primary barrier to reliable LLM-assisted dynamic analysis of full autonomous-vehicle software stacks.
This work presents PROGRESS (PROperty-Guided REgression Search for Semantic Falsification), integrating intent-driven properties into coverage-guided, search-based evolutionary test generation to reach deep program states and detect violations of intended behavior.
D. Mo, Noshin Ulfat, Matthew B. Dwyer et al.· arXiv.org· 0 citations
Falsification searches for counterexamples to formal specifications in cyber-physical systems (CPS). With specifications written in Signal Temporal Logic (STL), falsification can be formulated as a robustness optimization problem, traditionally tackled with black-box search algorithms. In parallel, large language models (LLMs) have recently emerged as surprisingly effective optimizers when coupled with iterative prompting. In this work, we connect these ideas and introduce LLM-Falsifier, an LLM-based approach that falsifies specifications by minimizing the STL robustness degree. Beyond generic prompt-based optimization, our key idea is to expose the LLM to semantic information that is natural for language models but absent from standard numerical optimizers, including natural-language input and output names, output trajectories, and critical-time witnesses for the minimum robustness value. These additions enable smarter and more sample-efficient robustness search. On the ARCH-COMP falsification benchmarks, LLM-Falsifier is shown to outperform existing falsification tools based on a range of optimization paradigms, from surrogate-based and Bayesian optimization to search-based testing, on 14 of 21 specifications when measured by the average number of simulations required to find a counterexample.
Ali ArjomandBigdeli, Jia-Wei Zhou, Stanley Bak· 0 citations
Directed Greybox Fuzzing (DGF) aims to efficiently test specific code locations, but its effectiveness is often hampered by its reliance on a syntax-driven strategy. This approach leads to an intractable search space during exploration and inefficient, semantically unaware mutations during exploitation. To address these limitations, we introduce HGFuzzer, an automated framework that augments DGF with predicate-guided execution synthesis. HGFuzzer first infers the execution predicates required to traverse a feasible call chain to the target, and then uses these predicates as a shared specification for generating coordinated fuzzing components. Through semantic analysis of the code, it constructs a purpose-built harness to govern control flow, a target-reachable seed generator to materialize the required data constraints, and a constraint-aware mutator that preserves reachability conditions while mutating bug-triggering fields. Our evaluation of HGFuzzer on 23 real-world bugs demonstrates its superior performance. It successfully triggered 19 bugs, with 11 of them discovered in under 1,000 seconds, and achieved a speedup of at most 24.1 \(\times\) over state-of-the-art fuzzers. Furthermore, HGFuzzer unearthed 9 previously unknown, CVE-assigned bugs, confirming its efficacy in real-world security auditing.
Hanxiang Xu, Yanjie Zhao, Junqing Yu et al.· ACM Transactions on Software...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
