AutoACSL: Synthesizing ACSL Specifications by Integrating LLMs with CPG-Based Static Analysis

2026-06-18

AI Summary

Automatically generating ACSL formal specifications for C programs is often hindered by insufficient semantic precision, heavy reliance on expert knowledge, and verification challenges. This work proposes a novel approach that integrates static analysis via Code Property Graphs (CPGs) with large language models (LLMs). By leveraging CPGs to extract key semantic features—such as arithmetic operations and loop structures—the method constructs structured prompts that deeply embed static analysis into LLM prompt engineering, enabling the generation of verifiable specifications enriched with runtime error prevention constraints. A closed-loop feedback mechanism with the Frama-C/WP verifier iteratively refines specification quality. Experiments on 604 C programs demonstrate a 98% specification generation success rate and a 96% complete proof rate, representing a 24.7%–51.7% improvement in complete proof rates over a pure code-prompting baseline across four mainstream LLMs.

Abstract

Generating formal specifications for C programs remains a challenge in formal verification due to the manual effort, expertise, and semantic precision required. While recent advancements in large language models (LLMs) offer promise in automating specification synthesis, current approaches often lack semantic depth and produce unverifiable or incomplete contracts. To address these limitations, we introduce AutoACSL, a novel framework that integrates LLM prompting with semantic features extracted from Code Property Graphs (CPGs). AutoACSL performs static analyses to extract key semantic elements, including arithmetic operations, loop and recursion structures, and return value propagation, which are encoded into structured prompts. These prompts enable the LLM not only to generate normal behavioral specifications but also to include constraints that prevent inputs leading to runtime errors. AutoACSL employs a feedback-driven synthesis loop, where candidate specifications are verified using Frama-C/WP and refined iteratively until verification succeeds or a termination condition is met. Evaluated on 604 programs drawn from diverse datasets, AutoACSL achieves a 98% specification generation success ratio and a 96% full proof ratio when paired with Gemini-3. Compared to a code-only baseline, AutoACSL improves the full proof ratio by 24.7% to 51.7% across four LLMs (GPT-o4 Mini, GPT-5.2, Grok-4.1, and Gemini-3), demonstrating that integrating large language models with CPG-based static analysis substantially enhances both generation robustness and verification effectiveness for automated ACSL specification synthesis.

Problem

• formal specification
• ACSL
• C programs
• semantic precision
• automated verification

Innovation

• LLM-guided specification synthesis
• Code Property Graph (CPG)
• static analysis
• ACSL
• feedback-driven verification