paperbot · PL 论文追踪

全部论文 待读 收藏

P2 ProofPulse: Interactive Proof Coverage Analysis for Dafny

ProofPulse:面向 Dafny 的交互式证明覆盖率分析
ASE Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering2026匹配度 4/10 · 该论文属于形式化验证与静态分析工具,关注 Dafny 规格质量诊断,与程序验证/静态分析方向相邻;但未涉及 LLM/Agent、浮点程序分析或贝叶斯程序分析,也不面向 ML/Agentic 程序,因此与画像核心方向交集有限。引用 0 inbox
Álvaro F. Silva, Ruben Martins, Alexandra Mendes
crossref: 2026-10-09

AI 速览

一句话:提出三值证明覆盖率模型,通过证明依赖分析诊断 Dafny 规格质量,揭示弱前置条件与空洞证明。

演绎验证能保证实现满足规格,但验证成功并不意味着规格本身质量良好:弱规格与冗余不变式会让人对“已验证”代码产生过度自信。作者提出 ProofPulse,一个面向 Dafny 的规格质量诊断工具,其核心是三值证明覆盖率模型。该模型分析证明依赖关系,将规格与程序元素区分为三类:真正贡献于规格意图的、仅用于辅助检查的、以及对任何证明义务都无关的。在来自 dafny-synthesis 基准的 252 个程序构成的 oracle 上评估,ProofPulse 对规格弱点(尤其是不必要的前置条件与空洞证明)给出高精度信号;结合 unsat core 最小化后,前置条件分类达到完美精度,并在所有评估类别上减少了误报。结果表明证明覆盖率是验证的实用补充:虽无法完全刻画语义意图,但能在看似完全验证的程序中暴露薄弱的证明耦合。

问题
演绎验证成功只说明实现满足给定规格,无法保证规格本身不过弱或含冗余不变式,从而使开发者对“已验证”代码产生错误的信心。
方法
提出三值证明覆盖率模型,通过分析证明依赖关系将元素划分为贡献规格意图、仅作辅助检查、与证明义务无关三类,并借助 unsat core 最小化提升分类精度。
评估
以 dafny-synthesis 基准中 252 个程序构建的 oracle 为参照进行评测,前置条件分类达到完美精度,且 unsat core 最小化在各评估类别上均降低误报。
原文摘要(Abstract)

Deductive verification ensures that an implementation satisfies its specification, but successful verification does not guarantee the quality of the specification. As such, weak specifications and redundant invariants may create overconfidence in "verified" code. We present ProofPulse, a tool for Dafny that diagnoses specification quality using a three-valued proof coverage model. By analyzing proof dependencies, ProofPulse distinguishes between elements that contribute to specification intent, those used only for auxiliary checks, and those irrelevant to any proof obligation. Evaluated against an oracle of 252 programs from the dafny-synthesis benchmark, ProofPulse provides a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification and reduces false positives across all evaluated categories. These results show that proof coverage is a practical complement to verification. Although it cannot fully capture semantic intent, it can reveal weak proof coupling in programs that otherwise appear fully verified. Just as a pulse check distinguishes vitality from the mere absence of symptoms, ProofPulse exposes weaknesses in proofs that technically verify successfully but still suffer from inadequate or redundant code and specifications. Demo: https://www.youtube.com/watch?v=8pO3NAodjoQ Code: https://github.com/VeriFixer/ProofPulse Prebuilt Docker image: https://doi.org/10.5281/zenodo.21174686

链接与引用

DOI 原文 · arXiv ·

BibTeX
@inproceedings{paperbot12279,
  title = {ProofPulse: Interactive Proof Coverage Analysis for Dafny},
  author = {Álvaro F. Silva and Ruben Martins and Alexandra Mendes},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3834600}
}