Analyzing the Analyzers: Model Counting Meets Abstract Interpretation

2026-06-20

AI Summary

This work addresses the lack of client-agnostic precision metrics for abstract domains in static analysis. It proposes the MCAI framework, which introduces model counting into abstract interpretation for the first time, enabling quantitative precision evaluation independent of specific analysis tasks. By encoding concrete semantics and abstract values as logical formulas, MCAI systematically assesses widely used abstract domains such as Interval, Octagon, and KnownBit. The evaluation reveals that Interval often matches the precision of Octagon—suggesting that many octagonal constraints are redundant—and that bit-level KnownBit significantly outperforms word-level abstractions. These findings provide both empirical evidence and theoretical grounding to inform the selection of abstract domains in practice.

Abstract

Abstract interpretation offers a principled foundation for static analysis by approximating concrete program semantics via abstract domains. However, quantitatively comparing the precision of different domains remains a longstanding challenge. We present MCAI (Model Counting meets Abstract Interpretation), a new methodology that employs model counting to measure the precision of abstract domains. Unlike prior approaches that assess precision relative to specific analysis queries, MCAI encodes both concrete semantics and abstract values as logical formulas, enabling a client-independent, quantitative metric of imprecision that captures the inherent semantic loss in the abstractions. We apply MCAI to four abstract domains and evaluate the precision of their best abstract transformers via symbolic abstraction. Our results yield several insights: the Interval domain, despite its simplicity, often achieves precision comparable to that of Octagon; many octagonal constraints are semantically redundant; and the bit-level KnownBit domains consistently outperform the word-level domains. MCAI offers both theoretical insights into the precision of abstract domains and practical guidance for selecting suitable abstractions.

Problem

• abstract interpretation
• model counting
• precision comparison
• abstract domains
• static analysis

Innovation

• model counting
• abstract interpretation
• precision measurement
• abstract domains
• symbolic abstraction