Antiproof: Synthesizing Vulnerability Detectors and Proofs of Exploitability

2026-07-13

AI Summary

Existing vulnerability discovery approaches struggle to simultaneously achieve high recall, reliable automated verification, and cost efficiency. This work proposes the first end-to-end automated vulnerability discovery system that innovatively integrates neural-symbolic program analysis with static detector synthesis to enable high-recall vulnerability detection. The system further generates executable exploitability proofs to formally verify findings, establishing a high-assurance closed-loop pipeline. Experimental results demonstrate that the system detects 64 out of 66 vulnerabilities on BountyBench and KEVBench, surpassing baseline methods by over 60 percentage points in recall. Moreover, it uncovers hundreds of previously unknown vulnerabilities across 50 widely used software projects, yielding 12 assigned CVE identifiers, including multiple critical remote code execution flaws.

Abstract

Discovering vulnerabilities before attackers exploit them requires high recall and reliable automatic validation, but existing approaches struggle to achieve both without prohibitive cost. We present Antiproof, an end-to-end vulnerability discovery system that combines neuro-symbolic detector synthesis for high-recall discovery with proof-of-exploitability oracles for automatic validation. Antiproof learns and iteratively refines static detectors from vulnerability datasets, then validates candidates by verifying whether executable proofs demonstrate concrete attacker capabilities. Evaluated on BountyBench and our curated KEVBench dataset, Antiproof detects 64 of 66 vulnerabilities, improving recall by more than 60 percentage points over static-analysis and neuro-symbolic baselines. In a scan of 50 widely deployed systems, Antiproof uncovered several hundred previously unknown vulnerabilities. We are responsibly disclosing all confirmed zero-days and have received 12 CVE assignments to date, including remote code execution vulnerabilities in Ray, SGLang, vLLM, and LiteLLM that could allow attackers to take over LLM training and inference systems.

Problem

• vulnerability discovery
• high recall
• automatic validation
• proof of exploitability
• zero-day vulnerabilities

Innovation

• neuro-symbolic
• proof-of-exploitability
• vulnerability detection
• automatic validation
• zero-day discovery