U-Turn: Enhancing Incorrectness Analysis by Reversing Direction

2025-10-10

AI Summary

This work addresses the high false-positive rate and insufficient precision and automation in program bug detection. We propose a bidirectional collaborative analysis framework integrating Incorrectness Logic (IL) and Sufficient Incorrectness Logic (SIL). Our approach introduces a rule-level guidance mechanism that dynamically steers subsequent reasoning using prior analysis results, coupled with path pruning, loop unrolling, and dynamic instrumentation of proof rules to enable cross-logic information reuse. The method significantly improves joint accuracy in error reachability verification and fault-triggering input reconstruction while preserving scalability and enhancing industrial applicability. Experimental evaluation demonstrates substantial improvements over single-logic approaches in three key dimensions: (i) bug localization accuracy, (ii) causal explainability of defects, and (iii) efficiency of automated analysis. Our framework establishes a novel paradigm for scalable, automated code contract generation.

Technology Category

• Knowledge Representation and Reasoning: Logic Programming
• Reasoning under Uncertainty: Uncertainty Representations
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for incomplete, noisy, or partially observed Web-related graphs
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

O'Hearn's Incorrectness Logic (IL) has sparked renewed interest in static analyses that aim to detect program errors rather than prove their absence, thereby avoiding false alarms -- a critical factor for practical adoption in industrial settings. As new incorrectness logics emerge to capture diverse error-related properties, a key question arises: can the combination of (in)correctness techniques enhance precision, expressiveness, automation, or scalability? Notable frameworks, such as outcome logic, UNTer, local completeness logic, and exact separation logic, unify multiple analyses within a single proof system. In this work, we adopt a complementary strategy. Rather than designing a unified logic, we combine IL, which identifies reachable error states, with Sufficient Incorrectness Logic (SIL), which finds input states potentially leading to those errors. As a result, we get a more informative and effective analysis than either logic in isolation. Rather than naively sequencing them, our key innovation is reusing heuristic choices from the first analysis to steer the second. In fact, both IL and SIL rely on under-approximation and thus their automation legitimates heuristics that avoid exhaustive path enumeration (e.g., selective disjunct pruning, loop unrolling). Concretely, we instrument the second logic's proof rules with derivations coming from the first to inductively guide rule selection and application. To our knowledge, this is the first rule format enabling such inter-analysis instrumentation. This combined analysis aids debugging and testing by revealing both reachable errors and their causes, and opens new avenues for embedding incorrectness insights into (a new kind of) scalable, expressive, automated code contracts.

Problem

• Combining incorrectness logics to enhance error detection precision and automation
• Reusing heuristic choices between analyses to steer error state identification
• Revealing reachable program errors and their root causes for debugging

Innovation

• Combining incorrectness logic with sufficient incorrectness logic
• Reusing heuristic choices from first analysis to steer second
• Instrumenting proof rules with derivations for inductive guidance