Toward Neural-Network-Guided Program Synthesis and Verification

Abstract

We propose a novel framework of program and invariant synthesis called neural network-guided synthesis. We first show that, by suitably designing and training neural networks, we can extract logical formulas over integers from the weights and biases of the trained neural networks. Based on the idea, we have implemented a tool to synthesize formulas from positive/negative examples and implication constraints, and obtained promising experimental results. We also discuss an application of our method for improving the qualifier discovery in the framework of ICE-learning-based CHC solving, which can in turn be applied to program verification and inductive invariant synthesis. Another potential application is to a neural-network-guided variation of Solar-Lezama’s program synthesis by sketching.

Appendices

Appendix

A Additional Information for Sect. 2

1.1 A.1 On Three-Layer vs Four-Layer NNs

As reported in Sect. 2.2, three-layer NNs with a sufficient number of nodes performed well in the experiment on learning formulas $(A\wedge B)\vee (C\wedge D)$, contrary to our expectation. This section reports our analysis to find out the reason.

We used the instance shown on the left-hand side of Fig. 8, and compared the training results of three-layer and four-layer NNs. To make the analysis easier, we tried to train the NNs with a minimal number of hidden nodes in the second layer. For the four-layer-case, the training succeeded for only two hidden nodes in the second layer (plus eight hidden nodes in the third layer), and only relevant quantifiers of the form $x>c, x<c, y>c, y<c$ for $c\in \{-2,1,0,1\}$ were generated. In contrast, for the three-layer case, 12 hidden nodes were required for the training to succeed. The right-hand side of Fig. 8 shows the lines $b_i+w_{i,x}x + w_{i,y}y=0\; (i\in \{1,\ldots ,12\})$ where $w_{i,x}, w_{i,y}$ and $b_i$ are the weights and bias for the $i$-th hidden node. We can see that the lines that are (seemingly) irrelevant to the original formula are recognized by the hidden nodes. Removing any hidden node (e.g., the node corresponding to line 1) makes the NN fail to properly separate positive and negative examples. Thus, the three-layer NN is recognizing positive and negative examples in a manner quite different from the original formula; it is performing a kind of patchwork to classify the examples. Nevertheless, even in that patchwork, there are lines close to the horizontal and vertical lines $y=0$ and $x=0$. Thus, if we use the trained NN only to extract qualifier candidates (rather than to recover the whole formula by inspecting also the weights of the third layer), three-layer NNs can be useful, as already observed in the experiments in Sect. 2.2.

Fig. 8.

Problem instance for learning $(x\ge 0\wedge y\ge 0)\vee (x\le 0\wedge y\le 0)$ (left) and lines recognized by Three-Layer NNs for problem instance $(x\ge 0\wedge y\ge 0)\vee (x\le 0\wedge y\le 0)$ (right).

1.2 A.2 On Activation Functions

To justify our choice of the sigmoid function as activation functions, we have replaced the activation functions with ReLU ($f(x)=x$ for $x\ge 0$ and $f(x)=0$ for $x<0$) and Leaky ReLU ($f(x)=x$ for $x\ge 0$ and $f(x)=-0.01x$ for $x<0$) and conducted the experiments for synthesizing $(A\wedge B)\vee (C\wedge D)$ by using the same problem instances as those used in Sect. 2.2. Here are the results.

activation	#nodes	#retry	%success	%qualifiers	#candidates	time (sec.)
ReLU	32:32	15	18.3%	66.7%	72.4	55.9
Leaky ReLU	32:32	32	61.7%	88.8%	64.4	52.8
sigmoid	32:32	10	85.0%	91.7%	40.4	39.9

In this experiment, we have used the mean square error function as the loss function (since the log loss function assumes that the output belongs to $[0,1]$, which is not the case here). For comparison, we have re-shown the result for the sigmoid function (with the mean square error loss function).

As clear from the table above, the sigmoid function performs significantly better than ReLU and Leaky ReLU, especially in %success (the larger is better) and #candidates (the smaller is better). This confirms our expectation that the use of the sigmoid function helps us to ensure that only information about $b+w_1\,x_1+\cdots +w_k\,x_k>c$ for small $c$’s may be propagated to the output of the second layer, so that we can find suitable qualifiers by looking at only the weights and biases for the hidden nodes in the second layer. We do not report experimental results for the tanh function ($\texttt {tanh}(x) = 2\sigma (x)-1$), but it should be as good as the sigmoid function, as it has similar characteristics.

1.3 A.3 On Biases

As for the biases in the second later, we have actually removed them and instead added a constant input $1$, so that the weights for the constant input play the role of the biases (thus, for two-dimensional input $(x,y)$, we actually gave three-dimensional input $(x,y,1)$). This is because, for some qualifier that requires a large constant (like $x+y-150>0$), adding additional constant inputs such as $100$ (so that inputs are now of the form $(x,y,1,100)$) makes the NN training easier to succeed. Among the experiments reported in this paper, we added an additional constant input $10$ for the experiments in Sect. 2.3.

Similarly, we also observed (in the experiments not reported here) that, when the scales of inputs vary extremely among different dimensions (like $(x,y) = (1, 100), (2, 200), ...$), then the normalization of the inputs helped the convergence of training.

B Additional Information for Sect. 3

Here we provide more details about our experiments on the CHC problem xyz, which shows a general pitfall of the ICE-based CHC solving approach of HoIce (rather than that of our neural network-guided approach). Here is the source program of xyz written in OCaml (we have simplified the original program, by removing redundant arguments).

Here is (a simplified version of) the corresponding CHC generated by r_type.

$$\begin{aligned} x< 10\wedge loopa (x+1, z-2, r)\Rightarrow & {} loopa (x, z, r) \end{aligned}$$

(1)

$$\begin{aligned} x\ge 10\Rightarrow & {} loopa (x, z, z) \end{aligned}$$

(2)

$$\begin{aligned} x>0 \wedge loopb (x,z)\Rightarrow & {} loopb (x-1,z+2) \end{aligned}$$

(3)

$$\begin{aligned} x\le 0 \wedge loopb (x,z)\Rightarrow & {} z>-1 \end{aligned}$$

(4)

$$\begin{aligned} loopa (0,0,r)\Rightarrow & {} loopb (10,r) \end{aligned}$$

(5)

When we ran HoIce for collecting learning data, we observed that no positive examples for $loopb$ and no negative examples for $loopa$ were collected. Thus NeuGuS returns a trivial solution such as $loopa (x,z,r)\equiv \mathtt {true}$ and $loopb (x,z)\equiv \mathtt {false}$. The reason why HoIce generates no positive examples for $loopb$ is as follows. A positive example of $loopb$ can only be generated from the clause (5), only when a positive example of the form $loopa (0,0,r)$ is already available. To generate a positive example of the form $loopa (0,0,r)$, however, one needs to properly instantiate the clauses (2) and (1) repeatedly; since HoIce generates examples only lazily when a candidate model returned by the learner does not satisfy the clauses. In short, HoIce must follow a very narrow sequence of non-deterministic choices to generate the first positive example of $loopb$. Negative examples of $loopa$ are rarely generated for the same reason.

Another obstacle is that even if HoIce can generate a negative counterexample through clause (5) with a luck, it is only of the form $loopa (0,0,r)$. Although further negative examples can be generated through (1), the shape of the resulting negative examples are quite limited.