## Program verification as probabilistic inference (2007)

Venue: | In Proc. POPL |

Citations: | 9 - 3 self |

### BibTeX

@INPROCEEDINGS{Gulwani07programverification,

author = {Sumit Gulwani},

title = {Program verification as probabilistic inference},

booktitle = {In Proc. POPL},

year = {2007},

pages = {277--289},

publisher = {ACM}

}

### OpenURL

### Abstract

In this paper, we propose a new algorithm for proving the validity or invalidity of a pre/postcondition pair for a program. The algorithm is motivated by the success of the algorithms for probabilistic inference developed in the machine learning community for reasoning in graphical models. The validity or invalidity proof consists of providing an invariant at each program point that can be locally verified. The algorithm works by iteratively randomly selecting a program point and updating the current abstract state representation to make it more locally consistent (with respect to the abstractions at the neighboring points). We show that this simple algorithm has some interesting aspects: (a) It brings together the complementary powers of forward and backward analyses; (b) The algorithm has the ability to recover itself from excessive under-approximation or over-approximation that it may make. (Because the algorithm does not distinguish between the forward and backward information, the information could get both under-approximated and overapproximated at any step.) (c) The randomness in the algorithm ensures that the correct choice of updates is eventually made as there is no single deterministic strategy that would provably work for any interesting class of programs. In our experiments we use this algorithm to produce the proof of correctness of a small (but non-trivial) example. In addition, we empirically illustrate several important properties of the algorithm.

### Citations

1899 |
Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...o get out of local minima (if the algorithm ever gets stuck there), (b) by increasing the gradient of change. (This is equivalent of widening/narrowing in standard abstract interpretation terminology =-=[3]-=-.) Hence, the choice of N should ideally be determined by performing experiments. The function L is the local inconsistency measure (as defined in Section 2), which is a function of the inconsistency ... |

1194 | Factor graphs and the sum-product algorithm
- Kschischang, Frey, et al.
- 2001
(Show Context)
Citation Context ...α(Φi) (7) where α(Φi) is defined to be sum of the inconsistencies of the elements of Φi multiplied by N. For example, Figure 2 shows how to visualize the structure of such functions as a factor graph =-=[18]-=- for the program shown in Figure 3(a). We have Φ8 = {φ5,φ7,φ8}, andα(Φ8) = N × (M(φ5,φ8) +M(φ7,φ8)). (This is because f8 is a join node, which enforces the constraint that φ5 ⇒ φ8 and φ7 ⇒ φ8.) Given ... |

606 | H.: Construction of abstract state graphs with PVS
- Graf, Saidi
- 1997
(Show Context)
Citation Context ...finement steps). However, interestingly enough, their approach is able to work well on a modification of this example, in which all constants are replaced by symbolic constants. Predicate abstraction =-=[10]-=- techniques based on counter-example driven refinement (like SLAM [1], BLAST [15], or [2]) are also able to discover such disjunctive invariants like the ones required for the example program. However... |

575 | Automatic discovery of linear restraints among variables of a program
- Cousot, Halbwachs
- 1978
(Show Context)
Citation Context ...� 3 f 8 f 1 f 2 f 3 � 6 � 7 f 9 f 6 f 7 � exit = � 9 Figure 2. Factor graph of the program shown in Figure 3(a). program since it only computes invariants that are conjunctions of linear inequalities =-=[6]-=-. Recently, Gulavani and Rajamani have proposed a technique [11] based on counterexample driven refinement for abstract interpretation that can compute disjunctive invariants like the ones required fo... |

569 | Probabilistic inference using Markov chain Monte Carlo methods
- Neal
- 1993
(Show Context)
Citation Context .... However, among the possible choices that have approximately equal benefits, the algorithm chooses randomly. Thus, our algorithm falls into the category of sampling techniques studied extensively in =-=[20]-=-. The above aspects are discussed in more detail in Section 5 with examples of parts of the proof search that we saw in our experiments. The algorithm we introduce here is a form of a Gibbs sampling t... |

450 | Lazy abstraction
- Henzinger, Jhala, et al.
(Show Context)
Citation Context ...ll on a modification of this example, in which all constants are replaced by symbolic constants. Predicate abstraction [10] techniques based on counter-example driven refinement (like SLAM [1], BLAST =-=[15]-=-, or [2]) are also able to discover such disjunctive invariants like the ones required for the example program. However, the success of these tools on a given problem is contingent on being able to fi... |

373 | The SLAM project: debugging system software via static analysis
- Ball, Rajamani
(Show Context)
Citation Context ...otion of an inconsistency measure for any abstract domain A that is equipped with a partial order ⇒. Aninconsistency measure M for A is any function from ordered pairs (φ, φ ′ ) of elements from A to =-=[0, 1]-=- that is monotonically increasing in its first argument φ, monotonically decreasing in its second argument φ ′ ,and0 iff φ ⇒ φ ′ . We use this measure to define the local inconsistency of a program po... |

287 | Abstract interpretation and application to logic programs
- Cousot, Cousot
- 1979
(Show Context)
Citation Context ...ed a technique to combine forward and backward analyses by refining the over-approximation of the intersections of precondition and negated postcondition by an iterative forward and backward analysis =-=[4, 5]-=-. Dill and Wong Toi proposed a different kind of forward-backward combination that consists of computing separate upper-approximation and lower-approximation of precondition and postcondition respecti... |

206 | Modular verification of software components in C
- Chaki, Clarke, et al.
- 2003
(Show Context)
Citation Context ...odification of this example, in which all constants are replaced by symbolic constants. Predicate abstraction [10] techniques based on counter-example driven refinement (like SLAM [1], BLAST [15], or =-=[2]-=-) are also able to discover such disjunctive invariants like the ones required for the example program. However, the success of these tools on a given problem is contingent on being able to find the r... |

57 | A practical and complete approach to predicate refinement
- Jhala, McMillan
- 2006
(Show Context)
Citation Context ...uld be 100, (and potentially infinite, if these constants were larger or were symbolic constants). 282 Recently, Jhala and McMillan have proposed a predicate refinement approach based on interpolants =-=[16]-=-, wherein the search of interpolants is restricted to a richer class of languages in successive stages of their algorithm. The choice of the languages Lk that they suggest involves all predicates that... |

51 | A comparison of algorithms for inference and learning in probabilistic graphical models
- Frey, Jojic
(Show Context)
Citation Context ...as such they are often deterministic, but may get stuck in a local minimum of the optimization criterion. For a comparison of several inference techniques on a simple visual example, see, for example =-=[9]-=-). 4.2 Gibbs sampling The algorithm described in the previous section is a form of one of the simplest probabilistic inference techniques, known as Gibbs sampling which, like many other probabilistic ... |

36 | Counterexample driven refinement for abstract interpretation
- Gulavani, Rajamani
- 2006
(Show Context)
Citation Context ...Factor graph of the program shown in Figure 3(a). program since it only computes invariants that are conjunctions of linear inequalities [6]. Recently, Gulavani and Rajamani have proposed a technique =-=[11]-=- based on counterexample driven refinement for abstract interpretation that can compute disjunctive invariants like the ones required for the example program [11]. The key idea of their technique is t... |

34 | Refining model checking by abstract interpretation
- Cousot, Cousot
- 1999
(Show Context)
Citation Context ...ed a technique to combine forward and backward analyses by refining the over-approximation of the intersections of precondition and negated postcondition by an iterative forward and backward analysis =-=[4, 5]-=-. Dill and Wong Toi proposed a different kind of forward-backward combination that consists of computing separate upper-approximation and lower-approximation of precondition and postcondition respecti... |

33 | Discovering affine equalities using random interpretation - Gulwani, Necula - 2003 |

31 |
Verification of real-time systems by successive over and under approximation
- Dill, Wong-Toi
- 1995
(Show Context)
Citation Context ...l and Wong Toi proposed a different kind of forward-backward combination that consists of computing separate upper-approximation and lower-approximation of precondition and postcondition respectively =-=[8]-=-. Leino and Logozzo also combine the forward inference procedure with the goal287 driven nature of going backward by invoking the forward analysis along infeasible error traces reported during a backw... |

25 | Loop invariants on demand
- Leino, Logozzo
- 2005
(Show Context)
Citation Context ...ng example - its structure resembles very closely to that of the program in Figure 3, but it is easier to validate, and has been used as a motivating example for some existing verification techniques =-=[11, 19]-=-. Figure 5 contains histograms of the numbers of updates over different runs of our tool on these programs. For different algorithm parameters, we ran our tool 200 times and recorded average number of... |

20 | Global value numbering using random interpretation - Gulwani, Necula - 2004 |

15 | Precise interprocedural analysis using random interpretation - Gulwani, Necula - 2005 |

4 |
Three uses of the Herbrand-Genzen theorem in relating model theory and proof theory
- Craig
- 1957
(Show Context)
Citation Context ...n theorem proving. Given a pair of formulas 〈φ1,φ3〉 such that φ1 ⇒ φ3,aninterpolant for 〈φ1,φ3〉 consists of a formula φ2 such that φ1 ⇒ φ2, φ2 ⇒ φ3, andφ2∈ L(φ1) ∩L(φ3). The Craig interpolation lemma =-=[7]-=- states that an interpolant always exists when φ1 and φ3 are formulas in first-order logic. The sandwich step in our algorithm generalizes the interpolant problem in several dimensions in the context ... |

4 |
Probabilistic inference of programs from input/output examples
- Jojic, Gulwani, et al.
- 2006
(Show Context)
Citation Context ... Related Work The idea of applying machine learning techniques in programming languages has been used recently, though for the different problem of discovering small programs given input-output pairs =-=[17]-=-. In this paper, we use machine learning techniques for the problem of program verification. Combination of Forward and Backward Analyses Cousot and Cousot proposed a technique to combine forward and ... |