paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Sound and Complete Solving for Multi-width Parametric Bitvectors via Principled Reductions

多宽度参数化位向量的可靠且完备求解:基于原则性归约
OOPSLA 10(OOPSLA2)2026匹配度 3/10 · 论文属于形式化验证与自动推理,研究参数化位向量求解及其在编译器优化验证中的应用,与用户核心关注的 LLM/Agent 改进静态分析/形式化验证、浮点程序分析、贝叶斯程序分析均无直接关联。虽涉及程序验证且兼具理论与工程实现,但缺乏 LLM/Agent 或浮点分析等交叉点。引用 0 inbox
Siddharth Bhat, Léo Stefanesco, George Rennie, John Regehr, Tobias Grosser
crossref: 2026-10-02

AI 速览

一句话:将多宽度参数化位向量归约为单宽度公式,实现可靠完备的高效求解与自动机判定。

参数化位向量(PBV)允许位宽符号化,多宽度 PBV_n 尤其难解;现有有界 PBV 完备方法需指数枚举宽度赋值并逐一调用 QF_BV 求解器,成为 Alive2、Hydra 等编译器优化验证工具的瓶颈。本文证明任意 PBV_n 公式可等价可满足地归约为规模仅线性增长的单宽度 PBV_1 公式,核心是用位掩码编码符号宽度。基于此,有界求解器仅需一次 QF_BV 调用;结合 PBV_1 自动机判定,又得到支持零/符号扩展的 PBV_n 片段完备判定过程。求解器在 Lean 中实现,无界求解器的可靠完备性已机器化证明。实验上,归约在标准基准解决 506/528 题,无界求解器解题量约为 CVC5 方法的 1.5 倍。

问题
多宽度参数化位向量(PBV_n)的求解问题,尤其是有界 PBV:现有完备方法需指数枚举宽度赋值,并对每个赋值调用 QF_BV 求解器,效率极低。
方法
证明 PBV_n 可等价可满足地归约为线性规模的单宽度 PBV_1,用位掩码编码符号宽度;构造单次 QF_BV 调用的有界求解器,并将归约与 PBV_1 自动机判定组合得到支持零/符号扩展的无界片段判定过程;Lean 实现并机器化验证无界求解器可靠性。
评估
在标准 PBV 基准上,归约求解 506/528 个问题;无界求解器解题量是 CVC5 最新方法的 1.5 倍,并能在数秒内证明枚举需数小时的 LLVM 重写。
原文摘要(Abstract)

Bitvectors are foundational for automated reasoning about programs, and fixed-width bitvector solvers (QF_BV) are fast and ubiquitous. However, the theory of parametric bitvectors (PBV), where widths are symbolic, is much less well understood. The theory of multi-width PBV, where expressions may involve n distinct symbolic widths (PBV_n), is particularly challenging. The only existing complete approach for bounded PBV (where all widths have a concrete upper bound) is exhaustive enumeration, requiring one call to a QF_BV solver for each of the exponentially many possible width assignments. This is a significant bottleneck in tools, such as Alive2 and Hydra, that formally reason about compiler optimizations. To address this problem, we first prove that any PBV_n formula can be reduced to an equisatisfiable mono-width (PBV_1) formula with only a linear increase in formula size. The key idea is to encode symbolic widths as bitmasks. This reduction lets us create two solvers for flavors of multi-width PBV. (1) A sound and complete bounded PBV solver, which instantiates the width variable in the PBV_1 formula to a concrete bound, and therefore requires only a single QF_BV solver call. In practice, this solver proves LLVM rewrites in seconds that enumeration fails to prove in hours. (2) By composing our reduction with existing automata-theoretic decision procedures for PBV_1, we obtain a new sound and complete decision procedure for a fragment of PBV_n with parametric widths. This new decidable fragment subsumes the prior state-of-the-art fragment of linear and bitwise operations, by adding support for zero and sign extension. All our solvers are implemented in Lean, with mechanized proofs of soundness and completeness for the unbounded solver. Empirically, we find that our equisatisfiable reduction from PBV_n to PBV_1 turns exponential enumeration into a single QF_BV query that nearly saturates standard PBV benchmarks (506 of 528 problems across all datasets), while our unbounded solvers solve 1.5x as many problems as the state of the art CVC5-based solver for all bitwidths.

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@article{paperbot12162,
  title = {Sound and Complete Solving for Multi-width Parametric Bitvectors via Principled Reductions},
  author = {Siddharth Bhat and Léo Stefanesco and George Rennie and John Regehr and Tobias Grosser},
  journal = {Proceedings of the ACM on Programming Languages},
  volume = {10},
  number = {OOPSLA2},
  year = {2026},
  doi = {10.1145/3839511}
}