Mizzle: A Complete Concurrent Incorrectness Logic for Preventing False Alarms in Agentic Bug Finding

2026-07-13

AI Summary

This work addresses the high false positive rate of large language models (LLMs) in detecting concurrency bugs, which often wastes developer effort. To mitigate this, the authors propose Mizzle—the first complete incorrectness separation logic tailored to a concurrent subset of OCaml—that mandates every LLM-generated bug report be accompanied by a machine-checkable proof certifying the error’s actual reachability. Mechanized in the Rocq proof assistant using the Iris framework, Mizzle supports multiple error semantics, including deadlocks, non-linearizability, and race conditions, and comes with rigorous formal guarantees of soundness (no false positives) and completeness (all genuine errors are provable). A case study demonstrates that LLMs can effectively leverage this logic to produce verifiable bug reports.

Abstract

Large language models are increasingly used to find bugs in real-world programs, but they also produce a flood of false alarms that waste developers' time. We propose a method to prevent these false alarms by requiring an LLM to accompany each bug report with a machine-checked proof, in a program logic, that the reported bug is real. We follow the approach of incorrectness logics, whose under-approximate reasoning establishes that a claimed behavior is genuinely reachable, and hence a true positive. In our case, however, the logic must model a realistic programming language, have a mechanization so that proofs can be checked, and be complete, so that no real bug is ruled out for want of a derivation. We present Mizzle, an incorrectness separation logic for concurrent programs written in a substantial subset of OCaml, parametric in the notion of incorrectness. We mechanize Mizzle in the Rocq proof assistant on top of the Iris framework, and we prove that it is both sound (that is, it never justifies a false alarm) and complete (that is, every incorrect execution admits a derivation). We instantiate Mizzle with three notions of incorrectness: stuckness (triggering undefined behavior), the non-linearizability of a data structure, and the presence of a race. As a proof of concept, we illustrate how an LLM can use Mizzle in order to certify the existence of a bug.

Problem

• false alarms
• bug finding
• incorrectness logic
• large language models
• program verification

Innovation

• incorrectness logic
• concurrent programs
• mechanized verification
• false alarm prevention
• separation logic