CLN2INV: L EARNING L OOP I NVARIANTS WITH C ONTINUOUS L OGIC N ETWORKS
A
BSTRACT
Program veriﬁcation offers a framework for ensuring program correctness and therefore systematically eliminating different classes of bugs.
Inferring loop invariants is one of the main challenges behind automated veriﬁcation of real-world programs, which often contain many loops.
In this paper, we present the Continuous Logic Network (CLN), a novel neural architecture for automatically learning loop invariants directly from program execution traces.
Unlike existing neural networks, CLNs can learn precise and explicit representations of formulas in Satisﬁability Modulo Theories (SMT) for loop invariants from program execution traces.
We develop a new sound and complete semantic mapping for assigning SMT formulas to continuous truth values that allows CLNs to be trained efﬁciently.
We use
CLNs to implement a new inference system for loop invariants, CLN2INV, that signiﬁcantly outperforms existing approaches on the popular Code2Inv dataset.
CLN2INV is the ﬁrst tool to solve all 124 theoretically solvable problems in the
Code2Inv dataset.
Moreover
CLN2INV takes only 1.1 second on average for each problem, which is 40 × faster than existing approaches.
We further demonstrate that CLN2INV can even learn 12 signiﬁcantly more complex loop invariants than the ones required for the Code2Inv dataset.
I NTRODUCTION
Program veriﬁcation offers a principled approach for systematically eliminating different classes of bugs and proving the correctness of programs.
However, as programs have become increasingly complex, real-world program veriﬁcation often requires prohibitively expensive manual effort (Wilcox et al., 2015; Gu et al., 2016; Chajed et al., 2019).
Recent efforts have focused on automating the program veriﬁcation process, but automated veriﬁcation of general programs with unbounded loops remains an open problem (Nelson et al., 2017; 2019).
Verifying programs with loops requires determining loop invariants , which captures the effect of the loop on the program state irrespective of the actual number of loop iterations.
Automatically inferring correct loop invariants is a challenging problem that is undecidable in general and difﬁcult to solve in practice (Blass & Gurevich, 2001; Furia et al., 2014).
Existing approaches use stochastic search (Sharma & Aiken, 2016), heurstics-based search (Galeotti et al., 2015), PAC learning based on counterexamples (Padhi & Millstein, 2017), or reinforcement learning (Si et al., 2018).
However, these approaches often struggle to learn complex, real-world loop invariants.
In this paper, we introduce a novel approach to learning loop invariants by modeling the loop behavior from program execution traces with a new type of neural architecture.
We note that inferring loop invariants can be posed as learning formulas in Satisﬁability Modulo Theories (SMT)
(Biere et al., 2009) over program variables collected from program execution traces (Nguyen et al., 2017).
In principle, neural networks are well suited to this task because they can act as universal function approximators and have been successfully applied in various domains that require modeling of arbitrary functions (Hornik et al., 1989; Goodfellow et al., 2016).
However, loop invariants must be represented as explicit SMT formulas to be usable for program veriﬁcation.
Unfortunately, existing methods for extracting logical rules from general neural architectures lack sufﬁcient precision (Augasta & Kathirvalavakumar, 2012), while inductive logic learning lacks sufﬁcient expressiveness for use in veriﬁcation (Evans & Grefenstette, 2018).
We address this issue by developing a novel neural architecture, Continuous Logic Network (CLN), which is able to efﬁciently learn explicit and precise representations of SMT formulas by using continuous truth values.
Unlike existing neural architectures, CLNs can represent a learned SMT formula explicitly in its structure and thus allow us to precisely extract the exact formula from a trained model.
In order to train CLNs, we introduce a new semantic mapping for SMT formulas to continuous truth values.
Our semantic mapping builds on BL, or basic fuzzy logic (H´ajek, 2013), to support general
SMT formulas in a continuous logic setting.
We further prove that our semantic model is sound (i.e., truth assignments for the formulas are consistent with their discrete counterparts) and complete (i.e., all formulas can be represented) with regard to the discrete SMT formula space.
These properties allow CLNs to represent any quantiﬁer-free SMT formula operating on mixed integer-real arithmetic as an end-to-end differentiable series of operations.
We use CLNs to implement a new inference system for loop invariants, CLN2INV, that signiﬁcantly outperforms state-of-the-art tools on the Code2Inv dataset by solving all 124 theoretically solvable problems in the dataset.
This is 20 problems more than LoopInvGen, the winner of the SyGuscompetition loop invariant track (Padhi & Millstein, 2017).
Moreover, CLN2INV ﬁnds invariants for each program in 1.1 second on average, more than 40 times faster than LoopInvGen.
We also demonstrate that CLN2INV is able to learn complex, real-world loop invariants with combinations of conjunctions and disjunctions of multivariable constraints.
Our source code and benchmarks are publicly available on Github 1 .
Our main contributions are:
• We introduce a new semantic mapping for assigning continuous truth values to SMT formulas that is theoretically grounded and enables learning formulas through backpropagation.
We further prove that our semantic model is sound and complete.
• We develop a novel neural architecture, Continuous Logic Networks (CLNs), that to the best of our knowledge is the ﬁrst to efﬁciently learn precise and explicit SMT formulas by construction.
• We use CLNs to implement a new loop invariant inference system, CLN2INV, that is the ﬁrst to solve all 124 theoretically solvable problems in the Code2Inv dataset, 20 more than the existing methods.
CLN2INV is able to ﬁnd invariants for each problem in 1.1 second on average, 40 × faster than existing systems.
• We further show that CLN2INV is able to learn 12 more complex loop invariants than the ones present in the Code2Inv dataset with combinations of multivariable constraints.
Related Work.
Traditionally, loop invariant learning relies on stochastic or heuristics-guided search (Sharma & Aiken, 2016; Galeotti et al., 2015).
Other approaches like NumInv analyze traces and discover conjunctions of equalities by solving a system of linear equations (Sharma et al., 2013;
Nguyen et al., 2017).
LoopInvGen uses PAC learning of CNF using counterexamples (Padhi et al., 2016; Padhi & Millstein, 2017).
By contrast, Code2Inv learns to guess loop invariants using reinforcement learning with recurrent and graph neural networks (Si et al., 2018).
However, these approaches struggle to learn complex invariants.
Unlike these works, CLN2INV efﬁciently learns complex invariants directly from execution traces.
There is extensive work on PAC learning of boolean formulas, but learning precise formulas requires a prohibitively large number of samples (Kearns et al., 1994).
Several recent works use differentiable logic to learn boolean logic formulas from noisy data (Kimmig et al., 2012; Evans & Grefenstette, 2018; Payani & Fekri, 2019) or improving adversarial robustness by applying logical rules to training
(Fischer et al., 2019).
By contrast, our work learns precise SMT formulas directly by construction, allowing us to learn richer predicates with compact representation in a noiseless setting.
A variety of numerical relaxations have been applied to SAT and SMT solving.
Application-speciﬁc approximations using methods such as interval overapproximation and slack variables have been developed for different classes of SMT (Eggers et al., 2008; Nuzzo et al., 2010).
More recent work has applied recurrent and graph neural networks to Circuit SAT problems and unsat core detection (Amizadeh et al., 2019;
Selsam et al., 2019; Selsam & Bjørner, 2019).
FastSMT uses embeddings from natural language processing like skip-gram and bag-of-words to represent formulas for search strategy optimization (Balunovic et al., 2018).
Unlike these approaches, we relax the SMT semantics directly to generate a differentiable representation of SMT.
B ACKGROUND
In this section, we introduce the problem of inferring loop invariants and provide a brief overview of Satisﬁability Modulo Theories (SMT), which are used to represent loop invariants.
We provide background into fuzzy logic, which we extend with our new continuous semantic mapping for SMT.
2. L OOP I NVARIANTS
Loop invariants capture loop behavior irrespective of number of iterations, which is crucial for verifying programs with loops.
Given a loop, while( LC ) { C } , a precondition P , and a postcondition Q , the veriﬁcation task involves ﬁnding a loop invariant I that can be concluded from the precondition and implies the post-condition (Hoare, 1969).
Formally, it must satisfy the following three conditions, in which the second is a Hoare triple describing the loop:
[Equation]
Example of Loop Invariant.
Consider the example loop in Fig.1.
For a loop invariant to be usable, it must be valid for the precondition ( t = 10 ∧ u = 0) , the inductive step when t (cid:54) = 0 , and the post-condition ( u = 20) when the loop condition is no longer satisﬁed, i.e., t = 0 .
The correct and precise invariant I for the program is (2 t + u = 20) .
//pre: t=10 /\ u=0 while (t !=
0){ t = t - 1; u = u + 2; } //post: u= (a) Example loop
The desired loop invariant I for the left program is a boolean function over program variables t, u such that:
[Equation]
[Figure]
[Equation]
[Figure]
2. S ATISFIABILITY M ODULO T HEORIES
Satisﬁability Modulo Theories (SMT) are an extension of Boolean Satisﬁability that allow solvers to reason about complex problems efﬁciently.
Loop invariants and other formulas in program veriﬁcation are usually encoded with quantiﬁer-free SMT.
A formula F in quantiﬁer-free SMT can be inductively deﬁned as below:
[Equation]
where E 1 and E 2 are expressions of terms.
The loop invariant (2 t + u = 20) in Fig.
1 is an SMT formula.
Nonlinear arithmetic theories admit higher-order terms such as t 2 and t ∗ u , allowing them to express more complex constraints.
For example, ( ¬ (2 ≥ t 2 )) is an SMT formula that is true when the value of the high-order
2. B ASIC F UZZY L OGIC (BL)
Basic fuzzy logic (BL) is a class of logic that uses continuous truth values in the range [0 , 1] and is differentiable almost everywhere 2 (H´ajek, 2013).
BL deﬁnes logical conjunction with functions called t-norms , which must satisfy speciﬁc conditions to ensure that the behavior of the logic is consistent with boolean First Order Logic.
Formally, a t-norm (denoted ⊗ ) in BL is a binary operator over truth values in the interval [0 , 1] satisfying the following conditions:
1. associativity and commutativity : the order in which a set of t-norms on continuous truth values are evaluated should not change the result: x ⊗ ( y ⊗ z )
=
( x ⊗ y )
⊗ z and x ⊗ y =
y ⊗ x . 2.
monotonicity : increasing any input value to a t-norm operation should not cause the result to decrease: x 1 ≤ x 2 = ⇒ x 1 ⊗ y ≤ x 2 ⊗ y 3.
consistency : the result of any t-norm applied to a truth value and 1 should be 1, and the result of any truth value and 0 should be 0: 1 ⊗ x = x and 0 ⊗ x =
Besides these conditions, BL also requires that t-norms be continuous.
Given a t-norm ⊗ , its associated t-conorm (denoted ⊕ ) is deﬁned with DeMorgan’s law: t ⊕ u (cid:44) ¬ ( ¬ t ⊗ ¬ u ) , which can be considered as logical disjunction.
A common t-norm is the product t-norm x ⊗ y = x · y with its associated t-conorm x ⊕ y =
x + y − x · y .
C ONTINUOUS S ATISFIABILITY M ODULO T HEORIES
We introduce a continuous semantic mapping , S , for SMT on BL that is end-to-end differentiable.
The mapping S associates SMT formulas with continuous truth values while preserving each formula’s semantics.
In this paper, we only consider quantiﬁer-free formulas.
This process is analogous to constructing t-norms for BL, where a t-norm operates on continuous logical inputs.
We deﬁne three desirable properties for continuous semantic mapping S that will preserve formula semantics while facilitating parameter training with gradient descent:
S ( F ) should be consistent with BL.
For any two formulas F and F (cid:48) , where F ( x ) is satisﬁed and F (cid:48)
( x ) is unsatisﬁed with an assignment x of formula terms, we should have S ( F (cid:48) )
( x ) < S ( F )( x ) .
This will ensure the semantics of SMT formulas are preserved.
S ( F ) should be differentiable almost everywhere.
This will facilitate training with gradient descent through backpropogation.
S ( F ) should be increasing everywhere as the terms in the formula approach constraint satisfaction, and decreasing everywhere as the terms in the formula approach constraint violation.
This ensures there is always a nonzero gradient for training.
Continuous semantic mapping.
We ﬁrst deﬁne the mapping for “ > ” (greater-than) and “ ≥ ” (greater-than-or-equal-to) as well as adopting deﬁnitions for “ ¬ ”, “ ∧ ”, and “ ∨ ” from BL.
All other operators can be derived from these.
For example, “ ≤ ” (less-than-or-equal-to) is derived using “ ≥ ” and “ ¬ ”, while “ = ” (equality) is then deﬁned as the conjunction of formulas using “ ≤ ” and “ ≥ .”
Given constants B > 0 and (cid:15) > 0 , we ﬁrst deﬁne the the mapping S on “ > ” and “ ≥ ” using shifted and scaled sigmoid functions:
[Equation]
We illustrate these functions in Figure 2.
The validity of our semantic mapping lie in the following facts, which can be proven with basic algebra.
[Equation]
[Figure]
n t
i
[Figure]
t
[Figure]
u
[Figure]
UnshiftedSigmoid
[Figure]
[Figure]
When (cid:15) goes to zero and B ∗ (cid:15) goes to inﬁnity, our continuous mapping of “ > ” and “ ≥ ” will preserve their original semantics.
Under these conditions, our mapping satisﬁes all three desirable properties.
In practice, for small (cid:15) and large B , the properties are also satisﬁed if | t − u | > (cid:15) .
Next we deﬁne the mapping S for boolean operators “ ∧ ”, “ ∨ ” and “ ¬ ” using BL.
Given a speciﬁc t-norm ⊗ and its corresponding t-conorm ⊕ , it is straightforward to deﬁne mappings of “ ∧ ”, “ ∨ ” and “ ¬ ”:
[Equation]
Based on the above deﬁnitions, the mapping for other operators can be derived as follows:
[Equation] [Equation]
[Equation]
The mapping for other operators shares similar behavior in the limit, and also fulﬁll our desired properties under the same conditions.
Using our semantic mapping S , most of the standard operations of integer and real arithmetic, including addition, subtraction, multiplication, division, and exponentiation, can be used normally and mapped to continuous truth values while keeping the entire formula differentiable.
Moreover, any expression in SMT that has an integer or real-valued result can be mapped to continuous logical values via these formulas, although end-to-end differentiability may not be maintained in cases where speciﬁc operations are nondifferentiable.
C ONTINUOUS L OGIC N ETWORKS
In this section, we describe the construction of Continuous Logic Networks (CLNs) based on our continuous semantic mapping for SMT on BL.
CLN Construction.
CLNs use our semantic mapping to provide a general neural architecture for learning SMT formulas.
In a CLN, the learnable coefﬁcients and smoothing parameters correspond to the learnable parameters in a standard feedforward network, and the continuous predicates, tnorms, and t-conorms operate as activation functions like ReLUs in a standard network.
In this paper, we focus on shallow networks to address the loop invariant inference problem, but we envision deeper general purpose CLNs that can learn arbitrary SMT formulas.
When constructing a CLN, we work from an SMT Formula Template , in which every value is marked as either an input term, a constant, or a learnable parameter.
Given an SMT Formula Template, we dynamically construct a
CLN as a computational graph.
Figure 3 shows a simple formula template and the constructed CLN.
We denote the CLN model constructed from the formula template S ( F ) as M F .
CLN Training.
Once the CLN has been constructed based on a formula template, it is trained with the following optimization.
Given a CLN model M constructed from an SMT template with learnable parameters W , and a set X of valid assignments for the terms in the SMT template, the expected value of the CLN is maximized by minimizing a loss function L that penalizes model outputs that are less than one.
A minimum scaling factor β is selected, and a hinge loss is applied to the scaling factors ( B ) to force the differentiable predicates to approach sharp cutoffs.
The offset (cid:15) is also regularized to ensure precision.
The overall optimization is formulated as:
[Equation]
where λ and γ are hyperparameters respectively governing the weight assigned to the scaling factor and offset regularization.
L hinge ( β, B ) is deﬁned as max (0 , β − B ) , and L is any loss function strictly decreasing in domain [0 , 1] .
Given a CLN that has been trained to a loss approaching 0 on a given set of valid assignments, we show that the resulting continuous SMT formula learned by the CLN is consistent with an equivalent discrete SMT formula.
In particular, we prove that such a formula is sound , (i.e., a CLN will learn a correct SMT formula with respect to the training data), and that our continuous mapping is complete , (i.e., CLNs can represent any SMT formula that can be represented in discrete logic), where these properties are deﬁned for CLNs as follows:
Soundness.
Given the SMT formula F , the CLN model M F constructed from S ( F ) always preserves the truth value of F .
It indicates that given a valid assignment to the terms x in F , F ( x ) =
True ⇐⇒ M F ( x ) = 1 and F ( x ) =
False ⇐⇒ M F ( x ) = 0 .
Completeness.
For any SMT formula F , a CLN model M can be constructed representing that
formula
In other
words
CLNs
can express all SMT formulas on integers and reals.
We further prove that CLNs are guaranteed to converge to a globally optimal solution for formulas, which can be expressed as the conjunction of linear equalities.
We provide formal deﬁnitions and proofs for soundness and completeness in Appendix B and optimality in Appendix C.
L OOP I NVARIANT L EARNING
We use CLNs to implement a new inference system for loop invariants, CLN2INV, which learns invariants directly from execution traces.
CLN2INV follows the same overall process as other loop invariant inference systems such as LoopInvGen and Code2Inv – it iterates through likely candidate invariants and checks its validity with an SMT solver.
The key difference between our method and other systems is that it learns a loop invariant formula directly from trace data.
Figure 3 provides an overview of the architecture.
Preprocessing.
We ﬁrst perform static analysis and instrument the program to prepare for training data generation.
In addition to collecting the given precondition and post-condition, the static analysis extracts all constants in the program, along with the loop termination condition.
We then instrument the program to record all program variables before each loop execution and after the loop termination.
We also restrict the loop to terminate after a set number of iterations to prevent loops running indeﬁnitely (for experiments in this paper, we set the max loop iterations to 50).
We also strengthen the precondition to ensure loop execution (see Appendix D).
Training Data Generation.
We generate training data by running the program repeatedly on a set of randomly initialized inputs that satisfy the preconditions.
Unconstrained variables are initialized from a uniform distribution centered on 0 with width r , where r is a hyperparameter of the sampling
[Figure]
* * * * + + ⊕
[Figure]
=   (  )
SourceCode
SMTChecks
SMT
[Figure]
Generation (  +  = 0) ∨ (  −  = 0)
[Figure]
Training Data and Template Generation
[Figure]
and
[Figure]
process.
Variables with either upper or lower bound precondition constraints are initialized from a uniform distribution adjacent to their constraints with width r , while variables with both upper and lower bounds in the precondition are sampled uniformly within their bounds.
For all of our experiments in this paper, we set r to 10 .
When the number of uninitialized variables is small (i.e., less than 3 ), we perform this sampling exhaustively.
An example of training data generation is provided in Appendix E.
Template Generation.
We generate templates in three stages with increasing expressiveness:
We ﬁrst generate templates directly from the pre-condition and post-condition.
We next extract the individual clauses from the pre- and post-condition as well as the loop condition, and generate templates from conjunctions and disjunctions of each possible pair of clauses.
We ﬁnally generate more generic templates of increasing complexity with a combination of one or more equality constraints on all variables combined with conjunctions of inequality constraints, which are based on the loop condition and individual variables.
We describe the template generation in detail in Appendix E. To detect when higher order terms may be present in the invariant, we perform a log-log linear regression on each variable relative to the loop iteration, similarly to Sharma et al.
If the loop contains one or more variables that grow superlinearly relative to the loop iteration, we add higher order polynomial terms to the equality constraints in the template, up to the highest degree detected among the loop variables.
CLN Construction and Training.
Once a template formula has been generated, a CLN is constructed from the template using the formulation in § 4.
As an optimization, we represent equality constraints as Gaussian-like functions that retain a global maximum when the constraint is satisﬁed as discussed in Appendix F.
We then train the model using the collected execution traces.
Invariant Checking.
Invariant checking is performed using SMT solvers such as Z3 (De Moura &
Bjørner, 2008).
After the CLN for a formula template has been trained, the SMT formula for the loop invariant is recovered by normalizing the learned parameters.
The invariant is checked against the pre, post, and inductive conditions as described in § 2.1.
If the correct invariant is not found, we return to the template generation phase to continue the search with a more expressive template.
E XPERIMENTS
We compare the performance of CLN2INV with two existing methods and demonstrate the efﬁcacy of the method on several more difﬁcult problems.
Finally, we conduct two ablation studies to justify our design choices.
Test Environment.
All experiments are performed on an Ubuntu 18.04 server with an Intel Xeon
E5-2623 v4 2.60GHz CPU, 256Gb of memory, and an Nvidia GTX 1080Ti GPU.
System Conﬁguration.
We implement CLNs in PyTorch and use the Adam optimizer for training with learning rate 0 .
(Paszke et al., 2017; Kingma & Ba, 2014).
Because the performance of CLN is dependent on weight initialization, the CLN training randomly restart if the model does not reach termination within 2 , 000 epochs.
Learnable parameters are initialized from a uniform distribution in the range [-1, 1], which we found works well in practice.
Test Dataset.
We use the same benchmark used in the evaluation of Code2Inv.
We have removed nine invalid programs from Code2Inv’s benchmark and test on the remaining 124.
The removed programs are invalid because there are inputs which satisfy the precondition but result in a violation of the post-condition.
See Appendix G for details on the removed problems.
The benchmark consists of loops expressed as C code and corresponding SMT ﬁles.
Each loop can have nested if-then-else blocks (without nested loops).
Programs in the benchmark may also have uninterpreted functions with boolean return values (emulating external function calls) in branches or loop termination conditions.
6. C OMPARISON TO EXISTING SOLVERS
[Figure]
Performance Comparison.
We compare CLN2INV to two state-of-the-art methods: Code2Inv (based on neural code representation and reinforcement learning) and LoopInvGen (PAC learning over synthesized CNF formulas)
(Si et al., 2018; Padhi & Millstein, 2017).
We limit each method to one hour per problem in the same format as the SyGuS Competition (Alur et al., 2019).
CLN2INV is able to solve all 124 problems in the benchmark.
LoopInvGen solves 104 problems while Code2inv solves 90 .
Figure 4a shows the measured runtime on each evaluated system.
CLN2INV solves problems in 1.1 second on average, which is over 40 × faster than LoopInvGen, the second fastest system in the evaluation.
It spends the most time on solver calls (0.6s avg.) and CLN training (0.5s avg.), with negligible time spent on preprocessing, data generation, and template generation on each problem ( less than 20ms ea.)
In Table 1 we provide a more detailed analysis of how much time is spent on each stage of the invariant inference pipeline in CLN2INV.
Measurements are averaged over 5 runs.
The system spends most time on solver calls (0.6s avg.) and CLN training (0.5s on avg.) with negligible time spent on preprocessing, sampling, and template generation.
For most problems in the Code2Inv benchmark, CLN2INV completes CLN training quickly (less than 0.2s) and spends most of its time performing solver checks, but it requires more epochs to train on some complex problems with many variables.
[Table]
In general, CLN2INV has similar performance to LoopInvGen on simple problems but is able to scale efﬁciently to complex problems.
Figure 4b shows the number of Z3 calls made by each method.
[Table]
For almost all problems, CLN2INV requires fewer Z3 calls than the other systems, although for some difﬁcult problems it uses more Z3 calls than Code2Inv.
Table 2 summarizes results of the performance evaluation.
Code2Inv require much more time on average per problem, but minimizes the number of calls made to an SMT solver.
In contrast, LoopInvGen is efﬁcient at generating a large volume of guessed candidate invariants, but is much less accurate for each individual invariant.
CLN2INV can be seen as balance between the two approaches: it searches over candidate invariants more quickly than Code2Inv, but generates more accurate invariants than LoopInvGen, resulting in lower overall runtime.
6. M ORE D IFFICULT L OOP I NVARIANTS
We consider two classes of more difﬁcult loop invariant inference problems that are not present in the Code2Inv dataset.
The ﬁrst require conjunctions and disjunctions of multivariable constraints, and the second require polynomials with many higher order terms.
Both of these classes of problems are signiﬁcantly more challenging because they are more complex and cause the space of possible invariants to grow much more quickly.
To evaluate on problems that require invariants with conjunctions and disjunctions of multivariable constraints, we construct 12 additional problems.
We speciﬁcally design these problems to contain loops with invariants that cannot be easily inferred with pre- and post-condition based heuristics.
In this section Figure 5, we show one of these problems.
By plotting the trace as shown in Figure 5b, it is easy to see that the points lie on one of the two lines expressible as linear equality constraints.
The correct loop invariant for the program is (( t + u = 0) ∨ ( t − u = 0))
∧ ( u ≤ 0) .
Appendix H describes these problems in more detail and provides an additional example.
CLN2INV is able to ﬁnd correct invariants for all 12 problems in less than 20 seconds, while Code2Inv and LoopInvGen time out after an hour.
//pre: t=-20/\u=-20 while (u != 0) { u++; if (t > 0) t = -t + 1; else t = -t - 1; } //post: t= (
[Figure]
) Example Pseudocode
[Figure]
To evaluate on problems with higher order polynomial invariants, we test CLN2INV on the power summation problems in the form u = (cid:80) kt =
t d for a given degree d , which have been used in evaluation for polyonomial loop invariant inference (Sharma et al., 2013; Nguyen et al., 2017).
We discuss these problems in more detail in Appendix H. CLN2INV can correctly learn the invariant for 1st and 2nd order power summations, but cannot learn correct invariants for 3rd, 4th or 5th order summations, which have many more higher order terms.
We do not evaluate the other methods on these problems because they are not conﬁgured for nonlinear arithmetic by default.
6. A BLATION S TUDIES
Effect of CLN Training on Performance.
CLN2INV relies on a combination of heuristics using static analysis and learning formulas from execution traces to correctly infer loop invariants.
In this ablation we disable model training and limit CLN2INV to static models with no learnable parameters.
Static CLN2INV solves 91 problems in the dataset.
Figure 6 shows a comparison of full
CLN2INV with one limited to static models.
CLN2INV’s performance with training disabled shows that a large number of problems in the dataset are relatively simple and can be inferred from basic heuristics.
However, for more difﬁcult problems, CLN learning is key to inferring correct invariants.
[Figure]
CONCLUSION
We develop a novel neural architecture that explicitly and precisely learns SMT formulas by construction.
We achieve this by introducing a new sound and complete semantic mapping for SMT that enables learning formulas through backpropagation.
We use CLNs to implement a loop invariant inference system, CLN2INV, that is the ﬁrst to solve all theoretically solvable problems in the
Code2Inv benchmark and takes only 1.1 second on average.
We believe that the CLN architecture will also be beneﬁcial for other domains that require learning SMT formulas.
A CKNOWLEDGMENTS
This work is sponsored in part by NSF grants CNS-18-42456, CNS-18-01426, CNS-16-17670,
CCF-1918400; ONR grant N00014-17-1-2010; an ARL Young Investigator (YIP) award; an NSF
CAREER award; a Google Faculty Fellowship; a Capital One Research Grant; a J.P. Morgan Faculty Award; a Columbia-IBM Center Seed Grant Award; and a Qtum Foundation Research Gift.
Any opinions, ﬁndings, conclusions, or recommendations expressed herein are those of the authors, and do not necessarily reﬂect those of the US Government, ONR, ARL, NSF, Google, Capital One
J.P. Morgan, IBM, or Qtum.
A P ROOF OF LIMIT OF S ( t = u )
[Equation]
Proof.
Let f ( t, u ; B, (cid:15) )
=
[Equation]
and g ( t, u ; B, (cid:15) ) =
[Equation]
Then what we want to prove becomes
[Equation]
Because all f
[Equation]
g, ⊗ are continuous in their domain
[Equation]
we have
[Equation]
Using basic algebra
[Equation]
we get
[Equation]
Combing these results, we have
[Equation]
For any t-norm, we have 0 ⊗ 1 = 0 , 1 ⊗ 1 = 1 , and 1 ⊗ 0 = 0 .
Put it altogether, we have
[Equation]
which concludes the proof.
B S OUNDNESS AND C OMPLETENESS OF CLN S
In this section we provide formal descriptions and proofs of CLN soundness and completeness when trained to 0 loss.
These properties are deﬁned for CLNs as follows:
Soundness.
Given the SMT formula F , the CLN model M F constructed from S ( F ) always preserves the truth value of F .
It indicates that given a valid assignment to the terms x in F ,
F ( x ) =
True ⇐⇒ M F ( x ) = 1 and F ( x ) =
False ⇐⇒ M F ( x ) = 0 .
Completeness.
For any SMT formula F , a CLN model M can be constructed representing that formula.
In other words, CLNs can express all SMT formulas on integers and reals.
We formally state these properties in Theorem 1.
Before that we need to deﬁne a property for t-norms.
Property 1.
∀ t u, ( t > 0) and ( u > 0) implies ( t ⊗ u > 0) .
The product t-norm and Godel t-norm have this property, while the Lukasiewicz t-norm does not.
Theorem 1.
For any quantiﬁer-free linear SMT formula F , there exists CLN model M , such that
[Equation]
as long as the t-norm used in building M satisﬁes Property 1.
Proof.
For convenience of the proof, we ﬁrst remove all < , ≤ , = and (cid:54) = in F , by transforming t < u into ¬ ( t ≥ u ) , t ≤ u into ¬ ( t > u ) , t = u into ( t ≥ u ) ∧ ¬ ( t > u ) , and t (cid:54) =
u into ( t > u ) ∨ ¬ ( t ≥ u ) .
Now the only operators that F may contain are >, ≥ , ∧ , ∨ , ¬ .
We prove
Theorem 1 by induction on the constructor of formula F .
In the following proof, we construct model M given F and show that it satisﬁed Eq.(1)(2).
We leave the proof for why M also satisﬁed
Eq.(3) to readers.
Atomic Case.
When F is an atomic clause, then F will be in the form of x ∗ W + b > 0 or x ∗ W + b ≥ 0 .
For the ﬁrst case, we construct a linear layer with weight W and bias b followed by a sigmoid function scaled with factor B and right-shifted with distance (cid:15) .
For the second case, we construct the same linear layer followed by a sigmoid function scaled with factor B and left-shifted with distance (cid:15) .
Simply evaluating the limits for each we arrive at
[Equation]
And from the deﬁnition of sigmoid function we know 0 ≤ M ( x ; B, (cid:15) ) ≤ 1 .
Negation Case.
If F = ¬ F (cid:48) , from the induction hypothesis, F (cid:48) can be represented by models M (cid:48) satisfying Eq.(1)(2)(3).
Let p (cid:48) output node of M (cid:48) .
We add a ﬁnal output node p = 1 − p (cid:48) .
So
M ( x ; B, (cid:15) )
= 1 − M (cid:48)
( x ; B, (cid:15) ) .
Using the induction hypothesis 0 ≤ M (cid:48) ( x ; B, (cid:15) ) ≤ 1 , we conclude
Eq.(1)
≤ M ( x ; B, (cid:15) ) ≤ 1 .
Now we prove the “ = ⇒ ” side of Eq.(2).
If F ( x ) =
True , then F (cid:48)
( x ) =
False .
From the induction hypothesis, we know lim (cid:15) → 0 + B · (cid:15) →∞ M (cid:48)
( x ; B, (cid:15) )
= 0 .
So
[Equation] [Equation]
Next we prove the “ ⇐ = ” side.
If lim (cid:15) → 0 + B · (cid:15) →∞ M ( x ; B, (cid:15) ) = 1 , we have
[Equation]
From the induction hypothesis we know that F (cid:48)
( x ) =
False .
So F ( x ) = ¬ F (cid:48)
( x ) =
True .
Conjunction Case.
If F = F 1 ∧ F 2 , from the induction hypothesis, F 1 and F 2 can be represented by models M 1 and M 2 , such that both ( F 1 , M 1 ) and ( F 2 , M 2 ) satisfy Eq.(1)(2)(3).
Let p 1 and pbe the output nodes of M 1 and M 2 .
We add a ﬁnal output node p =
p 1 ⊗ p 2 .
So M ( x ; B, (cid:15) ) =
M 1 ( x ; B, (cid:15) ) ⊗ M 2 ( x ; B, (cid:15) ) .
Since ( ⊗ ) is continuous and so are M 1 ( x ; B, (cid:15) ) and M 2 ( x ; B, (cid:15) ) , we know their composition M ( x ; B, (cid:15) ) is also continuous.
(Readers may wonder why M 1( x ; B, (cid:15) ) is continuous.
Actually the continuity of M ( x ; B, (cid:15) ) should be proved inductively like this proof itself, and we omit it for brevity.)
From the deﬁnition of ( ⊗ ) , we have Eq.(1)
≤ M ( x ; B, (cid:15) ) ≤ 1 .
Now we prove the = ⇒ side of Eq.(2).
For any x , if F ( x ) =
True which means both F 1 ( x ) =
True and F 2 ( x )
=
True , from the induction hypothesis we know that lim (cid:15)
→ 0 + B · (cid:15) →∞ M 1 ( x ; B, (cid:15) ) =
and lim (cid:15) →
0 + B · (cid:15) →∞ M 2 ( x ; B, (cid:15) ) = 1 .
Then
[Equation]
Then we prove the ⇐ = side.
From the induction hypothesis we know that M 1 ( x ; B, (cid:15) ) ≤ 1 and
M 2 ( x ; B, (cid:15) ) ≤ 1 .
From the non-decreasing property of t-norms (see § 2.3), we have
[Equation]
Then from the consistency property and the commutative property, we have
[Equation]
1 ( x ; B,
[Equation]
) ⊗
[Equation] [Equation]
Put them altogether we get
[Equation]
Because we know lim (cid:15) → 0 + B · (cid:15) →∞ M ( x ; B, (cid:15) )
= 1 , according to the squeeze theorem in calculus, we get
[Equation]
From the induction hypothesis, we know that F 1 ( x ) =
True .
We can prove F 2 ( x ) =
True in the same manner.
Finally we have F ( x ) =
F 1 ( x ) ∧ F 2 ( x )
=
True .
Disjunction Case.
For the case F = F 1 ∨ F 2 , we construct M from M 1 and M 2 as we did in the conjunctive case.
This time we let the ﬁnal output node be p = p 1 ⊕ p 2 .
From the continuity of ( ⊗ ) and the deﬁnition of ( ⊕ ) ( t ⊕ u = 1 − (1 − t ) ⊗ (1 − u ) ), ( ⊕ ) is also continuous.
We conclude
M ( x ; B, (cid:15) ) is also continuous and 0 ≤ M ( x ; B, (cid:15) ) ≤ 1 by the same argument as F = F 1 ∧ F 2 .
Now we prove the “ = ⇒ ” side of Eq.(2).
For any assignment x , if F ( x ) =
True which means
F 1 ( x ) =
True or F 2 ( x )
=
True .
Without loss of generality, we assume F 1 ( x ) =
True .
From the induction hypothesis, we know lim (cid:15) → 0 + B · (cid:15) →∞ M 1 ( x ; B, (cid:15) )
= 1 .
For any ( ⊕ ) and any 0 ≤ t, t (cid:48) ≤ 1 , if t ≤ t (cid:48) , then
[Equation]
Using this property and the induction hypothesis M 2 ( x ; B, (cid:15) ) ≥ 0 , we have
[Equation]
From the induction hypothesis we also have M 1 ( x ; B, (cid:15) ) ≤ 1 .
Using the deﬁnition of ( ⊕ ) and the consistency of ( ⊗ ) ( 0 ⊗ x = 0 ), we get M 1 ( x ; B, (cid:15) )
⊕
= M 1 ( x ; B, (cid:15) ) .
Put them altogether we get
[Equation]
Because we know lim (cid:15) → 0 + B · (cid:15)
[Equation]
M 1 ( x ; B, (cid:15) )
= 1 , according to the squeeze theorem in calculus, we get
[Equation]
Then we prove the “ ⇐ = ” side.
Here we need to use the existence of limit:
[Equation]
This property can be proved by induction like this proof itself, thus omitted for brevity.
Let
[Equation]
Then
[Equation]
Since we have lim (cid:15)
[Equation]
+
[Equation] [Equation]
M ( x ; B, (cid:15) ) = 1 , we get
[Equation]
Using Property 1 of ( ⊗ ) (deﬁned in § 4), we have c 1 = 1 ∨ c 2 = 1 .
Without loss of generality, we assume c 1 = 1 .
From the induction hypothesis, we know that F 1 ( x ) =
True .
Finally, F ( x ) =
F 1 ( x ) ∨ F 2 ( x )
=
True .
Careful readers may have found that if we use the continuous mapping function S in § 3, then we have another perspective of the proof above, which can be viewed as two interwoven parts.
The ﬁrst part is that we proved the following lemma.
Corollary 1.
For any quantiﬁer-free linear SMT formula F ,
[Equation]
Corollary 1 indicates the soundness of S .
The second part is that we construct a CLN model given
S ( F ) .
In other words, we translate S ( F ) into vertices in a computational graph composed of differentiable operations on continuous truth values.
C O PTIMALITY OF CLN S
Optimality.
For a subset of SMT formulas (conjunctions of multiple linear equalities), CLNs are guaranteed to converge at the global minumum.
We formally state this in Theorem 2.
We ﬁrst deﬁne another property similar to strict monotonicity.
Property 2.
∀ t 1 t 2 t 3 , ( t 1 < t 2 ) and ( t 3 > 0) implies ( t 1 ⊗ t 3 < t 2 ⊗ t 3 ).
Theorem 2.
For any CLN model M F constructed from a formula, F , by the procedure shown in the proof of Theorem 1, if F is the conjunction of multiple linear equalities then any local minimum of
M F is the global minimum, as long as the t-norm used in building M F satisﬁes Property 2.
Proof.
Since F is the conjunction of linear equalities, it has the form
[Equation]
Here W = { w ij } are the learnable weights, and { t ij } are terms (variables).
We omit the bias b i in the linear equalities, as the bias can always be transformed into a weight by adding a constant ofas a term.
For convenience, we deﬁne f
[Equation]
x
[Equation]
Given an assignment x of the terms { t ij } , if we construct our CLN model M F following the procedure shown in the proof of Theorem 1, the output of the model will be
[Equation]
When we train our CLN model, we have a collection of m data points { t ij 1 } , { t ij 2 } , ..., { t ijm } , which satisfy formula F .
If B and (cid:15) are ﬁxed (unlearnable), then the loss function will be
[Equation]
Suppose W ∗ = { w ∗ ij } is a local minima of L ( W ) .
We need to prove W ∗ is also the global minima.
To prove this, we use the deﬁnition of a local minima.
That is,
[Equation]
For convenience, we denote u ik = (cid:80) l i j =1 w ij t ijk .
Then we rewrite Eq.(4) as
[Equation]
If we can prove at W ∗ , ∀ 1 ≤ i ≤ n, 1 ≤ k ≤ m, u ik = 0 .
Then because (i) f reaches its global maximum at 0 , (ii) the t-norm ( ⊗ ) is monotonically increasing, (iii) L is monotonically decreasing, we can conclude that W ∗ is the global minima.
Now we prove ∀ 1 ≤ i ≤ n, 1 ≤ k ≤ m, u ik = 0 .
Here we just show the case i = 1 .
The proof for i > 1 can be directly derived using the associativity of ( ⊗ ) .
Let α k = (cid:78) ni
=
f ( u ik ) .
Since f ( x ) > 0 for all x ∈ R , using Property 2 of our t-norm ( ⊗ ) , we know that α k > 0 .
Now the loss function becomes
[Equation]
From Eq.(5), we have
[Equation]
Because (i) f
( x ) is an even function decreasing on x > 0 (which can be easily proved), (ii) ( ⊗ ) is monotonically increasing, (iii) L is monotonically decreasing, for − δ (cid:48) <
γ < 0 , we have
[Equation]
Combing Eq.(6) and Eq.(7), we have
[Equation]
Now we look back on Eq.(7).
Since (i) L is strictly decreasing, (ii) the t-norm we used here has
Property 2 (see § 4 for deﬁnition), (iii) α k > 0 , the only case when ( = ) holds is that for all 1 ≤ k ≤ m , we have f ( | u ik (1 + γ ) | ) =
f ( | u ik | ) .
Since f ( x ) is strictly decreasing for x ≥ 0 , we have | u ik (1 + γ ) | = | u ik | .
Finally because − 1 < − δ (cid:48) < γ < 0 , we have u ik = 0 .
D P RECONDITION S TRENGTHENING
Theorem 3.
Given a program C : assume( P ); while ( LC ) { C } assert( Q );
If we can ﬁnd a loop invariant I (cid:48) for program C (cid:48) : assume( P ∧ LC ); while ( LC ) { C } assert( Q ); and P ∧ ¬ LC = ⇒ Q , then I (cid:48) ∨ ( P ∧ ¬ LC ) is a correct loop invariant for program C .
Proof.
Since I (cid:48) is a loop invariant of C (cid:48) , we have
[Equation]
We want to prove I (cid:48) ∨ ( P ∧ ¬ LC ) is a valid loop invariant of C, which means
[Equation]
We prove the three propositions separately.
To prove P ∧ LC = ⇒ I (cid:48) ∨ ( P ∧ ¬ LC ) , we transform it into a stronger proposition P ∧ LC = ⇒ I (cid:48) , which directly comes from (a).
For { ( I (cid:48) ∨ ( P ∧¬ LC ))
∧ LC } C { I (cid:48) ∨ ( P ∧¬ LC ) } , after simpliﬁcation it becomes { I (cid:48)
∧ LC } C { I (cid:48)
∨ ( P ∧ ¬ LC ) } , which is a direct corollary of (b).
For ( I (cid:48) ∨ ( P ∧¬ LC ))
∧¬ LC = ⇒ Q , after simpliﬁcation it will become two separate propositions,
I (cid:48)
∧ ¬ LC = ⇒ Q and P ∧ ¬ LC = ⇒ Q .
The former is exactly (c), and the latter is a known condition in the theorem.
E I MPLEMENTATION D ETAILS
Training Data Generation Example.
Figure 7 provides an example of our training data generation procedure.
The uninitialized variable k is sampled according to the precondition k ≤ 8 within the predeﬁned width r = 10 .
So we end up enumerating k = 8 , 7 , ..., − 2 .
For each k , the loop is executed repeatedly until termination, thus generating a small set of samples.
The ﬁnal training set is the union of these small sets.
[Equation]
while (t !=
k){ t = t - 1; u = u + 2; } //post: u=20-2k (a) The original loop program.
// run with k={-2..8} k = atoi(argv[1]); t=10; u=0; while (t !=
k){ log(t, u, k); t = t - 1; u = u + 2; } log(t, u, k); (
[Figure]
The sampling procedure.
Template Generation.
Templates are ﬁrst generated from the pre- and post-conditions, followed by every pair of clauses extracted from the precondition, post-condition, and loop condition.
Generic templates are then constructed consisting of one or more general equality constraints containing all variables conjoined with inequality constraints.
Three iterations of the generic template generation are shown here:
[Equation]
Algorithm 1 summarizes the template generation process.
In it the following functions are deﬁned: learnable
Note that templates are generated on demand, so each template is used to infer a possible invariant before the next is generated.
Input :
Pre ← precondition
Post ← post-condition
LC ← loop condition
Max Template Len ← max template eq clauses vars ← vars in program
X ← training data 1: construct template( Post ) 2: construct template( Pre ) 3: clauses ← extract clauses( Pre , Post , LC ) 4: for ( c 1 , c 2 ) in all pairs( clauses ) do 5: construct template( c 1 ∧ c 2 ) 6: construct template( c 1 ∨ c 2 ) 7: end for 8: max degree ← estimate degrees( X ) 9: if max degree > 1 then 10: vars ← polynomial kernel( vars , max degree ) 11: end if 12: bound constraints ← () 13: for var in vars do 14: bound constraints ← bound contraints ∧ ( var ≤ u var ) 15: bound constraints ← bound contraints ∧ ( var ≥ l var ) 16: end for 17: if is single constraint( LC ) then 18: bound constraints ← bound contraints ∧ extract loop constraint( LC ) 19: end if 20: construct template( ( W · vars = b ))
∧ bound constraints ) 21: eq clauses ← [( W · vars = b )] 22: template len ←23: while template len ≤ Max Template Len do 24: for eq clause in eq clauses do 25: construct template( ( eq clause ∧ ( W · vars = b ))
∧ bound constraints ) 26: eq clauses ← [ eq clauses, eq clause ∧ ( W · vars = b )] 27: construct template( ( eq clause ∨ ( W · vars = b ))
∧ bound constraints ) 28: eq clauses ← [ eq clauses, eq clause ∨ ( W · vars = b )] 29: end for 30: template len ← template len +31: end while
F P ROPERTIES OF G AUSSIAN F UNCTION
We use a Gaussian-like function S ( t = u ) = exp( − ( t − u ) 2 2 σ 2 ) to represent equalities in our experiments.
It has the following two properties.
First, it preserves the original semantic of = when σ → 0 , similar to the mapping S ( t = u ) = {+1 
 + e [Equation] B ( t+}
[Equation]
u
[Equation]
(cid:15)
[Equation]
B ( t
[Equation]
u − (cid:15) )
we deﬁned in § 3.
[Equation]
Second, if we view S ( t = u ) as a function over t − u , then it reaches its only local maximum at t − u = 0 , which means the equality is satisﬁed.
G I NVALID P ROBLEMS FROM C ODE 2I NV D ATASET
Here we provide an example which is Problem 106 in the dataset.
The post-condition a ≥ m is wrong if we start from a = 0 , m = 1 , and k = 0 .
[Equation]
assume(a <= m); while (k < 1) { if (m < a) m = a; k = k + 1; }assert(a >= m);
Executing the program with these inputs results in a = 0 , m = 1 , and k = 1 as the if condition is never satisﬁed.
But clearly, the post condition a ≥ m is violated.
Below we tabulate the counterexamples invalidating the nine removed problems from the dataset:
[Table]
H M ORE D IFFICULT L OOP I NVARIANTS
Multivariable Conjunction/Disjunction Invariants.
In this subsection, we discuss in detail two of the 12 more difﬁcult loop invariant problems we have created.
In Section 6, we have shown a problem with multivariable disjunction.
Here another problem with multivariable conjunction is shown in Figure 8.
In this program, we use unknown to denote an external function call that returns either true or false, which can be considered as sampling from a Bernoulli distribution with success probability 0 .
Although the branching behavior is not deterministic, we know ( t + u = 0)
∧ ( v + w = 0) ∧ ( u + w ≥ 0) is a correct invariant as it holds regardless of which branch is taken.
Our CLN2INV can learn this invariant within 20 seconds, while both Code2inv and LoopInvGen time out after one hour without ﬁnding a solution. [Figure]
Polynomial Invariants.
Here we provide results and an example of the higher order polynomial problems; more precisely, the power summation problems in the form u
= (cid:80) kt =
0 t d for a given degree d .
We found that CLN2INV was able to learn invariants for programs which computes the sum of consecutive integers, which has 10 monomial terms and a maximum degree of 2.
Since
CLN2INV simply uses the polynomial kernel the number of terms quickly become unwieldy.
We observe that CLN2INV struggles beginning with sum of squares, which has 20 monomial terms up to degree 3.
Table 4 summarizes these results.
Number Terms
Highest Degree
Solved?  (cid:51)  (cid:51)  (cid:55)  (cid:55)  (cid:55)
For further illustration, we describe in detail the case where d is 3, i.e. sum of cubes. [Figure] [Equation] [Figure]
[Equation]
[Figure]
The example loop in Figure 9 computes the sum of the ﬁrst k cubes.
We know this sum has a closed form solution:
[Equation]
For this problem, we would hope to extract the invariant:
[Equation]
However, by naively using the polynomial kernel just as methods like NumInv suggest (Nguyen et al., 2017), we will have 35 monomials of degree at most four over three variables as candidate terms ( t 3 u, t 2 k 2 , tu 2 k, ... ), and the model must learn to ignore all the terms except u, t 4 , t 3 , and t 2 .
We observe our model ﬁnds far more accurate coefﬁcient for t 4 but than for lower ordered terms.
We hypothesize that by nature of polynomials the highest order term is a good approximation for the whole polynomial.
Thus, u = t 4 is a good approximation based on the data.
The difﬁculty of learning polynomial invariants using CLN is an interesting direction for future studies.