Outrunning Big KATs: Efficient Decision Procedures for Variants of GKAT

2026-01-15

AI Summary

This work addresses the inefficiency and limited scalability of existing methods for trace equivalence checking in Guarded Kleene Algebra with Tests (GKAT), particularly their inability to support practical control-flow verification. To overcome these limitations, we propose a novel online symbolic approach that integrates symbolic derivatives with modern SAT solving techniques for the first time, enabling efficient trace equivalence verification for both GKAT and its control-flow variant, CF-GKAT. Implemented in Rust, our method combines symbolic execution with automata derivatives and achieves over an order-of-magnitude speedup compared to state-of-the-art KAT/CF-GKAT tools on both synthetic and real-world control-flow transformation benchmarks. Furthermore, it successfully uncovers previously unknown bugs in Ghidra, a widely used industrial decompiler.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving
• Cognitive Modeling & Cognitive Systems: Symbolic Representations

Application Category

• Security and Privacy: Large-scale security measurements
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

This paper presents several efficient decision procedures for trace equivalence of GKAT automata, which make use of on-the-fly symbolic techniques via SAT solvers. To demonstrate applicability of our algorithms, we designed symbolic derivatives for CF-GKAT, a practical system based on GKAT designed to validate control-flow transformations. We implemented the algorithms in Rust and evaluated them on both randomly generated benchmarks and real-world control-flow transformations. Indeed, we observed order-of-magnitude performance improvements against existing implementations for both KAT and CF-GKAT. Notably, our experiments also revealed a bug in Ghidra, an industry-standard decompiler, highlighting the practical viability of these systems.

Problem

• GKAT
• trace equivalence
• decision procedures
• control-flow transformations
• automata

Innovation

• GKAT
• trace equivalence
• symbolic derivatives
• SAT solvers
• control-flow validation