ConVer: Using Contracts and Loop Invariant Synthesis for Scalable Formal Software Verification
This paper introduces ConVer, a top-down compositional verification tool that leverages large language models to synthesize function contracts and iteratively refines them via a CEGAR-CEGIS loop to overcome state-space explosion in verifying large C programs and converted LF models.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are trying to prove that a massive, complex factory is running perfectly. The factory has thousands of machines, conveyor belts, and workers, all connected in a giant web. If you try to watch every single machine, every gear, and every worker at the exact same time to find a mistake, you would get overwhelmed. The sheer amount of information would cause your brain to "explode" before you could find the error. This is exactly the problem software engineers face when trying to verify large computer programs: there are too many possible states for the computer to check all at once.
This paper introduces CONVER, a new tool designed to solve this "overwhelm" problem by changing how we check the code. Instead of staring at the whole factory at once, CONVER acts like a smart, top-down manager who breaks the problem into tiny, manageable pieces.
Here is how CONVER works, using simple analogies:
1. The "Top-Down" Strategy: The Blueprint vs. The Bricks
Usually, to verify a program, you have to write a detailed rulebook (a "contract") for every single function (every little machine) before you can check the whole system. This is like trying to write a manual for every single screw in a car before you can say the car is safe. It takes forever and requires experts.
CONVER flips this script.
- The Analogy: Imagine you have a goal: "The factory must never produce a red widget."
- The Old Way: You ask every worker, "What are your rules?" and try to build a system from the bottom up.
- The CONVER Way: You start with the big goal ("No red widgets"). You then ask an AI assistant (a Large Language Model, or LLM) to guess the rules for each worker that would guarantee the big goal is met. It's like saying, "If the assembly line worker follows these simple rules, the final product will be safe." You don't need to know how the worker's brain works, just that they follow the rules.
2. The "Smart Loop": The Detective and the AI
Once the AI guesses the rules (contracts), CONVER puts them to the test using a two-step loop, like a detective and a suspect playing a game of "guess the rule."
- Step A: The System Check (The Manager): CONVER checks if the whole factory works if everyone follows the guessed rules. It doesn't look inside the machines; it just trusts the rules.
- Step B: The Function Check (The Inspector): CONVER then checks if the actual machines can actually follow those rules.
- The "CEGAR" Loop: If the machines fail to follow the rules, CONVER doesn't just give up. It takes the specific mistake (the "counterexample") and shows it to the AI.
- Analogy: The AI says, "I thought the worker could lift 50lbs." The Inspector says, "No, the worker dropped a 50lb box." The AI learns from this specific failure and writes a new, better rule: "The worker can lift up to 40lbs."
- This happens over and over until the rules are perfect.
3. The "SMART ICE" Learning: Filtering the Noise
Sometimes, the AI makes a mistake because it misunderstood the question, not because the rule is wrong. To fix this, CONVER uses a technique called SMART ICE learning.
- The Analogy: Imagine you are teaching a dog a trick. If the dog sits when you say "Stay," you know it's a good trick. But if the dog sits because it saw a squirrel, that's a false alarm.
- How it works: CONVER filters out the "false alarms" (noise) and only keeps the "real mistakes" (signal). It classifies the errors into "Positive" (this worked), "Negative" (this definitely failed), and "Implication" (if this happens, then that must happen). This helps the AI learn much faster and avoid getting confused by its own mistakes.
4. The "Pre-Abstraction" Trick: The Cartoon Version
Some parts of the code are so complex (like a factory with infinite loops) that even checking the rules is too hard.
- The Analogy: If a machine is too complicated to draw in detail, CONVER draws a simple cartoon version of it first. It checks if the cartoon works. If it does, it swaps the cartoon for the real machine and checks again.
- This allows CONVER to handle programs that would normally crash a computer's memory.
What Did They Find?
The researchers tested CONVER on four different "gymnasiums" of code, ranging from simple math puzzles to complex real-world file parsers and recursive loops.
- Simple Programs: On a set of 45 standard programs, CONVER was incredibly successful, verifying 82% to 96% of them. Most of these were solved in just one round of checking, meaning the AI guessed the rules almost perfectly the first time.
- Harder Programs: On more difficult sets (like parsing security certificates or complex recursive loops), the success rate dropped to 33% to 64%. This is expected because these programs are much harder to understand.
- The "AI" Factor: They tested three different AI models (Qwen, Claude, and GPT). The smarter the AI model, the better CONVER performed. The smartest AI (GPT-OSS 120b) solved the most problems, proving that the quality of the AI's "guesses" is the key to success.
The Bottom Line
CONVER is a tool that uses AI to write the "rulebooks" for software, then uses a smart, iterative process to fix those rulebooks until they are perfect. It turns a massive, impossible-to-solve puzzle into a series of small, solvable steps.
- It doesn't replace the need for verification; it automates the hardest part (writing the rules).
- It doesn't guarantee 100% success on every single complex program, but it solves many that were previously impossible to check automatically.
- It works by listening to failures: Every time the software fails, the tool learns exactly why and asks the AI to try again with a better guess.
In short, CONVER is like having a tireless, super-smart manager who breaks a giant problem into small tasks, learns from every mistake, and keeps refining the plan until the job is done.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.