[Paper Review] Neuro-Symbolic Execution: The Feasibility of an Inductive Approach to Symbolic Execution

Shiqi Shen, Soundarya Ramesh+3 more|arXiv (Cornell University)|Jul 2, 2018

Software Testing and Debugging Techniques79 references4 citations

TL;DR

This paper introduces Neuro-Symbolic Execution (NeuEx), a novel approach that combines symbolic execution with neural networks to overcome limitations in constraint expressiveness and scalability. By learning complex variable relationships via differentiable neural constraints and solving mixed symbolic-neural constraints using SMT and gradient optimization, NeuEx successfully generates exploits for 13 out of 14 buffer overflow programs with complex constraints and solves 100% of neuro-symbolic constraints in 73 benchmark programs.

ABSTRACT

Symbolic execution is a powerful technique for program analysis. However, it has many limitations in practical applicability: the path explosion problem encumbers scalability, the need for language-specific implementation, the inability to handle complex dependencies, and the limited expressiveness of theories supported by underlying satisfiability checkers. Often, relationships between variables of interest are not expressible directly as purely symbolic constraints. To this end, we present a new approach -- neuro-symbolic execution -- which learns an approximation of the relationship as a neural net. It features a constraint solver that can solve mixed constraints, involving both symbolic expressions and neural network representation. To do so, we envision such constraint solving as procedure combining SMT solving and gradient-based optimization. We demonstrate the utility of neuro-symbolic execution in constructing exploits for buffer overflows. We report success on 13/14 programs which have difficult constraints, known to require specialized extensions to symbolic execution. In addition, our technique solves $100$\% of the given neuro-symbolic constraints in $73$ programs from standard verification and invariant synthesis benchmarks.

Motivation & Objective

• To address the limitations of symbolic execution in handling complex, non-expressible relationships between program variables.
• To overcome the scalability and expressiveness constraints of SMT solvers in symbolic execution, especially for non-linear or string-heavy operations.
• To enable analysis of code components not natively supported by symbolic execution, such as black-box or proprietary functions.
• To develop a general-purpose constraint-solving framework that integrates inductive learning with deductive reasoning for program analysis.
• To demonstrate the feasibility of using neural networks to approximate complex program behaviors in symbolic execution without requiring pre-defined constraint templates.

Proposed method

• Neuro-Symbolic Execution learns neural network representations of variable relationships from concrete test executions using a learn interface.
• It formulates constraints as a conjunction of symbolic expressions (from SMT) and neural network outputs (from learned models).
• A hybrid constraint solver combines SMT solving with gradient-based optimization to check satisfiability of mixed symbolic-neural constraints.
• The framework uses differentiable neural networks to enable backpropagation and gradient computation for constraint satisfaction and input optimization.
• The approach supports both white-box and black-box analysis by learning from observed program behavior without requiring source code or language-specific rules.
• It leverages the universal approximation property of neural networks to model complex, non-linear relationships that are infeasible to express in standard SMT theories.

Experimental results

Research questions

• RQ1 Can neural networks effectively learn and represent complex, non-linear relationships between program variables that are infeasible to express as symbolic constraints?
• RQ2 Can a hybrid constraint solver combining SMT and gradient-based optimization efficiently solve mixed symbolic-neural constraints?
• RQ3 Can neuro-symbolic execution outperform traditional symbolic execution in generating exploits for buffer overflow vulnerabilities with complex constraints?
• RQ4 To what extent can the framework generalize to standard verification and invariant synthesis benchmarks?
• RQ5 Does the absence of pre-defined constraint templates improve the flexibility and applicability of constraint inference in program analysis?

Key findings

• Neuro-Symbolic Execution successfully generated working exploits for 13 out of 14 buffer overflow programs that are known to be challenging for traditional symbolic execution due to complex constraints.
• The framework solved 100% of the neuro-symbolic constraints in 73 standard benchmarks from verification and invariant synthesis, demonstrating high reliability and coverage.
• The hybrid solver effectively combines SMT solving with gradient-based optimization, enabling efficient search in high-dimensional input spaces with complex constraints.
• The approach achieves better expressiveness than traditional symbolic execution by learning relationships that are not representable in standard SMT theories, such as non-linear or string-based functions.
• The method does not require pre-defined constraint templates, allowing it to learn arbitrary functional relationships from test data, increasing flexibility and applicability.
• The use of differentiable neural networks enables gradient computation, allowing for efficient optimization of inputs to satisfy complex constraint combinations.