Selected work

Representative Papers

Carnap Ten Years Later: Lessons Learned and Next Steps

Jul 04, 2026

This work addresses performance bottlenecks, development friction, and limited scalability that have emerged in the long-term use of the Carnap proof-assistant framework. To overcome these challenges, we propose a bottom-up redesign centered on a high-performance verification kernel, mm0-zig, implemented in Zig and based on the Metamath Zero format, coupled with a newly developed bytecode compiler for the Aufbau language (abc). This integrated architecture substantially enhances system performance and maintainability while enabling rich interactive capabilities on the web. A functional prototype has been successfully deployed, delivering a more efficient, stable, and interactive online theorem-proving experience to over 45,000 students worldwide.

0 citationsRead paper

Finding a Crab in the C: Assured Translation via Comparative Symbolic Execution

May 12, 2026

Automated code translation—such as from C to memory-safe languages—often introduces semantic discrepancies that can lead to security vulnerabilities, yet manual verification is prohibitively expensive. To address this challenge, this work proposes Cozy, the first tool to perform post-translation, binary-level differential symbolic execution that simultaneously analyzes the source program and its translated binary to automatically detect behavioral divergences. Cozy incorporates developer feedback to exempt changes deemed semantically acceptable, while providing formal equivalence guarantees for all other behaviors. This human-in-the-loop approach achieves a strong consistency guarantee: the translated binary is formally equivalent to the original except for explicitly approved modifications. Consequently, Cozy enables secure, reliable code migration, vulnerability patching, and auditing with high assurance.

0 citationsRead paper

cozy: Comparative Symbolic Execution for Binary Programs

Mar 31, 2025

This paper addresses the challenge of verifying micropatches in binary code. We propose an automated, binary-level differential analysis method for comparing two program versions. Leveraging angr-based symbolic execution, our approach identifies reachable final states under identical inputs, enabling fine-grained matching and root-cause attribution of differences in register states, memory contents, and side effects. We introduce a novel compatibility-aware state alignment mechanism to overcome mismatches arising from control- and data-flow inconsistencies at the binary level. An interactive web visualization interface—built with React and TypeScript—supports dynamic difference pruning, multi-dimensional filtering, and provenance exploration. Evaluated on real-world firmware and application binaries, our method demonstrates strong capability in verifying functional equivalence and security preservation of micropatches, significantly improving verification efficiency, precision, and interpretability.

0 citationsRead paper

An Iterative Feedback Mechanism for Improving Natural Language Class Descriptions in Open-Vocabulary Object Detection

Mar 21, 2025

This work addresses the challenge faced by non-technical users in formulating accurate natural language category descriptions for open-vocabulary object detection. We propose the first iterative human-in-the-loop feedback mechanism specifically designed for refining such textual class descriptions. Our method integrates text embedding analysis with contrastive example embedding synthesis, enabling users to dynamically define novel categories and iteratively improve description quality *in situ*, without retraining the detector. Evaluated across multiple state-of-the-art open-vocabulary detectors—including GLIP and GroundingDINO—the approach consistently improves detection accuracy (mAP gains of +3.2–5.7), while ensuring interpretability of outputs. Our key contributions are: (1) the first integration of human-AI iterative feedback into textual prompt engineering for open-vocabulary detection; (2) a novel description optimization paradigm grounded in contrastive embedding synthesis; and (3) empirical validation of the mechanism’s cross-model generalizability and robustness.

0 citationsRead paper

LLM-Supported Natural Language to Bash Translation

Feb 07, 2025

Existing NL2SH (natural language to Bash command) evaluation is severely hindered by low-quality test data and unreliable heuristic-based functional equivalence judgments. To address these limitations, this work proposes: (1) the first functional equivalence assessment framework integrating command execution verification with LLM-powered semantic judgment, achieving 95% accuracy; (2) the largest human-annotated NL2SH benchmark to date—comprising 600 high-quality test instances and 40,939 training samples; and (3) a model enhancement strategy combining instruction tuning, in-context learning, constrained decoding, and weight-intrinsic learning to improve generalization. Experiments demonstrate up to a 32% absolute improvement in NL2SH translation accuracy and a 16% increase in evaluation confidence over state-of-the-art methods. All data and code are publicly released.

0 citationsRead paper

Recent publications

Latest Papers

Carnap Ten Years Later: Lessons Learned and Next Steps

Jul 04, 2026

This work addresses performance bottlenecks, development friction, and limited scalability that have emerged in the long-term use of the Carnap proof-assistant framework. To overcome these challenges, we propose a bottom-up redesign centered on a high-performance verification kernel, mm0-zig, implemented in Zig and based on the Metamath Zero format, coupled with a newly developed bytecode compiler for the Aufbau language (abc). This integrated architecture substantially enhances system performance and maintainability while enabling rich interactive capabilities on the web. A functional prototype has been successfully deployed, delivering a more efficient, stable, and interactive online theorem-proving experience to over 45,000 students worldwide.

0 citationsRead paper

Finding a Crab in the C: Assured Translation via Comparative Symbolic Execution

May 12, 2026

Automated code translation—such as from C to memory-safe languages—often introduces semantic discrepancies that can lead to security vulnerabilities, yet manual verification is prohibitively expensive. To address this challenge, this work proposes Cozy, the first tool to perform post-translation, binary-level differential symbolic execution that simultaneously analyzes the source program and its translated binary to automatically detect behavioral divergences. Cozy incorporates developer feedback to exempt changes deemed semantically acceptable, while providing formal equivalence guarantees for all other behaviors. This human-in-the-loop approach achieves a strong consistency guarantee: the translated binary is formally equivalent to the original except for explicitly approved modifications. Consequently, Cozy enables secure, reliable code migration, vulnerability patching, and auditing with high assurance.

0 citationsRead paper

cozy: Comparative Symbolic Execution for Binary Programs

Mar 31, 2025

This paper addresses the challenge of verifying micropatches in binary code. We propose an automated, binary-level differential analysis method for comparing two program versions. Leveraging angr-based symbolic execution, our approach identifies reachable final states under identical inputs, enabling fine-grained matching and root-cause attribution of differences in register states, memory contents, and side effects. We introduce a novel compatibility-aware state alignment mechanism to overcome mismatches arising from control- and data-flow inconsistencies at the binary level. An interactive web visualization interface—built with React and TypeScript—supports dynamic difference pruning, multi-dimensional filtering, and provenance exploration. Evaluated on real-world firmware and application binaries, our method demonstrates strong capability in verifying functional equivalence and security preservation of micropatches, significantly improving verification efficiency, precision, and interpretability.

0 citationsRead paper

An Iterative Feedback Mechanism for Improving Natural Language Class Descriptions in Open-Vocabulary Object Detection

Mar 21, 2025

This work addresses the challenge faced by non-technical users in formulating accurate natural language category descriptions for open-vocabulary object detection. We propose the first iterative human-in-the-loop feedback mechanism specifically designed for refining such textual class descriptions. Our method integrates text embedding analysis with contrastive example embedding synthesis, enabling users to dynamically define novel categories and iteratively improve description quality *in situ*, without retraining the detector. Evaluated across multiple state-of-the-art open-vocabulary detectors—including GLIP and GroundingDINO—the approach consistently improves detection accuracy (mAP gains of +3.2–5.7), while ensuring interpretability of outputs. Our key contributions are: (1) the first integration of human-AI iterative feedback into textual prompt engineering for open-vocabulary detection; (2) a novel description optimization paradigm grounded in contrastive embedding synthesis; and (3) empirical validation of the mechanism’s cross-model generalizability and robustness.

0 citationsRead paper

LLM-Supported Natural Language to Bash Translation

Feb 07, 2025

Existing NL2SH (natural language to Bash command) evaluation is severely hindered by low-quality test data and unreliable heuristic-based functional equivalence judgments. To address these limitations, this work proposes: (1) the first functional equivalence assessment framework integrating command execution verification with LLM-powered semantic judgment, achieving 95% accuracy; (2) the largest human-annotated NL2SH benchmark to date—comprising 600 high-quality test instances and 40,939 training samples; and (3) a model enhancement strategy combining instruction tuning, in-context learning, constrained decoding, and weight-intrinsic learning to improve generalization. Experiments demonstrate up to a 32% absolute improvement in NL2SH translation accuracy and a 16% increase in evaluation confidence over state-of-the-art methods. All data and code are publicly released.

0 citationsRead paper