Skip to main content

Xavier Rival

Followers

0

Following

1

Public Views

National Tsing Hua University

Università Ca' Foscari Venezia

Georges Depeyrot

Centre National de la Recherche Scientifique / French National Centre for Scientific Research

Carolina Gonzalez Rodriguez

Universidad de Buenos Aires

Claudio Sottoriva

Università Cattolica del Sacro Cuore (Catholic University of the Sacred Heart)

Viacheslav Kuleshov

Stockholm University

Alexander Vovin

EHESS-Ecole des hautes études en sciences sociales

Michinori Shimoji

Kyushu University

University of Melbourne

Tohoku University

Interests

Uploads

Papers by Xavier Rival

A Categorical Framework for Program Semantics and Semantic Abstraction

Electronic Notes in Theoretical Informatics and Computer Science, Nov 22, 2023

Categorical semantics of type theories are often characterized as structure-preserving functors. ... more Categorical semantics of type theories are often characterized as structure-preserving functors. This is because in category theory both the syntax and the domain of interpretation are uniformly treated as structured categories, so that we can express interpretations as structure-preserving functors between them. This mathematical characterization of semantics makes it convenient to manipulate and to reason about relationships between interpretations. Motivated by this success of functorial semantics, we address the question of finding a functorial analogue in abstract interpretation, a general framework for comparing semantics, so that we can bring similar benefits of functorial semantics to semantic abstractions used in abstract interpretation. Major differences concern the notion of interpretation that is being considered. Indeed, conventional semantics are value-based whereas abstract interpretation typically deals with more complex properties. In this paper, we propose a functorial approach to abstract interpretation and study associated fundamental concepts therein. In our approach, interpretations are expressed as oplax functors in the category of posets, and abstraction relations between interpretations are expressed as lax natural transformations representing concretizations. We present examples of these formal concepts from monadic semantics of programming languages and discuss soundness.

A Product of Shape and Sequence Abstractions

Lecture Notes in Computer Science, Dec 31, 2022

Verification, Model Checking, and Abstract Interpretation

Springer eBooks, 2022

The use of general descriptive names, registered names, trademarks, service marks, etc. in this p... more The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Abstraction of Arrays Based on Non Contiguous Partitions

Springer eBooks, 2015

Array partitioning analyses split arrays into contiguous partitions to infer properties of cell s... more Array partitioning analyses split arrays into contiguous partitions to infer properties of cell sets. Such analyses cannot group together non contiguous cells, even when they have similar properties. In this paper, we propose an abstract domain which utilizes semantic properties to split array cells into groups. Cells with similar properties will be packed into groups and abstracted together. Additionally, groups are not necessarily contiguous. This abstract domain allows to infer complex array invariants in a fully automatic way. Experiments on examples from the Minix 1.1 memory management demonstrate its effectiveness.

Verification, Model Checking, and Abstract Interpretation - 15th International Conference, VMCAI 2014, San Diego, CA, USA, January 19-21, 2014, Proceedings

New Results - Taking Static Analysis to the Next Level: Proving the Absence of Run-Time Errors and Data Races with Astrée

Proofnets and Context Semantics for the Additives

Springer eBooks, 2002

We provide a context semantics for Multiplicative-Additive Linear Logic (MALL), together with pro... more We provide a context semantics for Multiplicative-Additive Linear Logic (MALL), together with proofnets whose reduction preserves semantics, where proofnet reduction is equated with cut-elimination on MALL sequents. The results extend the program of Gonthier, Abadi, and Lévy, who provided a "geometry of optimal λ-reduction" (context semantics) for λ-calculus and Multiplicative-Exponential Linear Logic (MELL). We integrate three features: a semantics that uses buses to implement slicing; a proofnet technology that allows multidimensional boxes and generalized garbage, preserving the linearity of additive reduction; and finally, a read-back procedure that computes a cut-free proof from the semantics, which is closely related to full abstraction theorems. Peut-être que la logique se trompe. -Yves Lafont Linear Logic appeared in 1987 and turned out quickly to be an interesting tool to model programming languages, specifically reasoning that is sensitive to the notion of consumable resources. Indeed the multiplicative fragment of Linear Logic (⊗, ) allows linear products (pairing and unpairing), implementing functions: a context pairs a continuation and an argument, a function unpairs and connects the two. The additive fragment (⊕, &) allows linear sums (injection and case dispatch), implementing features of processes in the style of CSP or CCS . The crucial difference between these two components is the way they take care with consumption of resources. The exponential fragment implements sharing of resources: arguments, control contexts. We can then implement, for example, graph reduction technology for λ-calculus with control operators (call/cc, abort, jumps), and related mechanical proof systems for classical logic-taking care of the sharing and copying, implicit in these calculi . Linear Logic was initially a sequent calculus, but this sequentialized structure was too strong and the design of a nice cut-elimination procedure was complicated. Therefore, proofnets were introduced as a more flexible representation of proofs . Further, Geometry of Interaction (GoI) developed the idea that the reduction of proofs can be seen as a local interaction process . Its intensional features provide a mediating Purgatory between the Heaven of denotational semantics, and the Hell of operational semantics. GoI was simplified in the "geometry of optimal λ-reduction" by Gonthier, Abadi and Lévy in the context of the MELL fragment. They reduced Hilbert spaces to simple data-structures, known as context semantics, and developed a proofnet technology which implemented the context semantics locally. Reduction on proofnets preserves the semantics, and Lamping's algorithm for optimal reduction of λ-terms [14] is a method of graph reduction. They further indicated how to read back any part of the Böhm tree (normal form) of a λ-term from its context semantics. Can this program be carried out for full Linear Logic? In this paper we extend these result to the MALL fragment (multiplicatives and additives): this may be a step towards a satisfactory proofnet syntax for full Linear Logic with a good characterization of proofs. The MALL fragment is quite problematic since it does not have a nice cutelimination procedure-unlike MLL, which enjoys a straightforward one. Part of the work will be to understand and improve the reduction procedure for MALL. The main contributions of this paper are to provide an integrated development of (1) a context semantics for the MALL fragment; (2) a proofnet technology allowing normalization of MALL proofs, using the ideas of multidimensional boxes and generalized garbage; and (3) a read-back procedure that inputs a valid context semantics and outputs a normalized proofnet. In Section 1, we recall some basic definitions on MALL, proofnets and Linear Logic. We introduce in Section ?? a form of context semantics for MALL proofs, and we derive from it a bus-notation based proofnet syntax in Section 3. Then, we envisage the main problems that come from the reduction on the additives in Section 4. The first difficulty is that the additive cut-elimination is not really linear, since an additive reduction step erases a whole part of the proof (this is also a problem for the locality of the reduction we would like to achieve). The second problem also stems from the additives: the way one should reduce a cut involving auxiliary formulas of two &-links is unclear. The solution to this problem will come from an extension of the MALL syntax. After this adaptation, we will be able to get a much more satisfactory cut-elimination procedure. In Section 5, we show how a normalized proof can be read-back from the context semantics of a proof, and we see how this result can be related to a form of full completeness. In Section 6, we compare our approach with other works.

Memory Abstraction, Emerging Techniques and Applications (NII Shonan Meeting 2017-12)

NII Shonan Meet. Rep., 2017

New Results - Relational Inductive Shape Analysis

Abstraction of Optional Numerical Values

Springer eBooks, 2015

We propose a technique to describe properties of numerical stores with optional values, that is, ... more We propose a technique to describe properties of numerical stores with optional values, that is, where some variables may have no value. Properties of interest include numerical equalities and inequalities. Our approach lifts common linear inequality based numerical abstract domains into abstract domains describing stores with optional values. This abstraction can be used in order to analyze languages with some form of option scalar type. It can also be applied to the construction of abstract domains to describe complex memory properties that introduce symbolic variables, e.g., in order to summarize unbounded sets of program variables, and where these symbolic variables may be undefined, as in some array or shape analyses. We describe the general form of abstract states, and propose sound and automatic static analysis algorithms. We evaluate our construction in the case of an array abstract domain. 1 Mayas are among the civilizations believed to have independently invented number "zero".

Design and Implementation of a Special-Purpose Static Program Analyzer for Safety-Critical Real-Time Embedded Software, invited chapter

We report on a successful preliminary experience in the design and implementation of a special-pu... more We report on a successful preliminary experience in the design and implementation of a special-purpose Abstract Interpretation based static program analyzer for the verification of safety critical embedded real-time software. The analyzer is both precise (zero false alarm in the considered experiment) and efficient (less than one minute of analysis for 10,000 lines of code). Even if it is based on a simple interval analysis, many features have been added to obtain the desired precision: expansion of small arrays, widening with several thresholds, loop unrolling, trace partitioning, relations between loop counters and other variables. The efficiency of the tool mainly comes from a clever representation of abstract environments based on balanced binary search trees. Dedicated to Neil Jones, for his 60 th birthday.

Abstract Interpretation-Based Certification of Assembly Code

Springer eBooks, Dec 16, 2002

We present a method for analyzing assembly programs based on source program analysis and invarian... more We present a method for analyzing assembly programs based on source program analysis and invariant translation. It is generic in the choice of an abstract domain for representing stores. This method is adapted to the design of certification tools for assembly programs generated by compiling programs written in an imperative language, without writing a specific compiler or modifying an existing

Symbolic transfer function-based approaches to certified compilation

We present a framework for the certification of compilation and of compiled programs. Our approac... more We present a framework for the certification of compilation and of compiled programs. Our approach uses a symbolic transfer functions-based representation of programs, so as to check that source and compiled programs present similar behaviors. This checking can be done either for a concrete semantic interpretation (Translation Validation) or for an abstract semantic interpretation (Invariant Translation) of the symbolic transfer functions. We propose to design a checking procedure at the concrete level in order to validate both the transformation and the translation of abstract invariants. The use of symbolic transfer functions makes possible a better treatment of compiler optimizations and is adapted to the checking of precise invariants at the assembly level. The approach proved successful in the implementation point of view, since it rendered the translation of very precise invariants on very large assembly programs feasible.

Interprocedural Shape Analysis Using Separation Logic-based Transformer Summaries

HAL (Le Centre pour la Communication Scientifique Directe), Nov 18, 2020

Shape analyses aim at inferring semantic invariants related to the data-structures that programs ... more Shape analyses aim at inferring semantic invariants related to the data-structures that programs manipulate. To achieve that, they typically abstract the set of reachable states. By contrast, abstractions for transformation relations between input states and output states not only provide a finer description of program executions but also enable the composition of the effect of program fragments so as to make the analysis modular. However, few logics can efficiently capture such transformation relations. In this paper, we propose to use connectors inspired by separation logic to describe memory state transformations and to represent procedure summaries. Based on this abstraction, we design a top-down interprocedural analysis using shape transformation relations as procedure summaries. Finally, we report on implementation and evaluation.

Recommandations sur les « éditeurs de la zone grise »

HAL (Le Centre pour la Communication Scientifique Directe), Jan 25, 2023

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific r... more HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Automatically Proving Microkernels Free from Privilege Escalation from their Executable

arXiv (Cornell University), Mar 19, 2020

Operating system kernels are the security keystone of most computer systems, as they provide the ... more Operating system kernels are the security keystone of most computer systems, as they provide the core protection mechanisms. Kernels are in particular responsible for their own security, i.e. they must prevent untrusted user tasks from reaching their level of privilege. We demonstrate that proving such absence of privilege escalation is a pre-requisite for any definitive security proof of the kernel. While prior OS kernel formal verifications were performed either on source code or crafted kernels, with manual or semi-automated methods requiring significant human efforts in annotations or proofs, we show that it is possible to compute such kernel security proofs using fully-automated methods and starting from the executable code of an existing microkernel with no modification, thus formally verifying absence of privilege escalation with high confidence for a low cost. We applied our method on two embedded microkernels, including the industrial kernel AnonymOS 1 : with only 58 lines of annotation and less than 10 minutes of computation, our method finds a vulnerability in a first (buggy) version of AnonymOS and verifies absence of privilege escalation in a second (secure) version.

On Correctness of Automatic Differentiation for Non-Differentiable Functions

arXiv (Cornell University), Jun 11, 2020

Differentiation lies at the core of many machine-learning algorithms, and is wellsupported by pop... more Differentiation lies at the core of many machine-learning algorithms, and is wellsupported by popular autodiff systems, such as TensorFlow and PyTorch. Originally, these systems have been developed to compute derivatives of differentiable functions, but in practice, they are commonly applied to functions with non-differentiabilities. For instance, neural networks using ReLU define nondifferentiable functions in general, but the gradients of losses involving those functions are computed using autodiff systems in practice. This status quo raises a natural question: are autodiff systems correct in any formal sense when they are applied to such non-differentiable functions? In this paper, we provide a positive answer to this question. Using counterexamples, we first point out flaws in oftenused informal arguments, such as: non-differentiabilities arising in deep learning do not cause any issues because they form a measure-zero set. We then investigate a class of functions, called PAP functions, that includes nearly all (possibly nondifferentiable) functions in deep learning nowadays. For these PAP functions, we propose a new type of derivatives, called intensional derivatives, and prove that these derivatives always exist and coincide with standard derivatives for almost all inputs. We also show that these intensional derivatives are what most autodiff systems compute or try to compute essentially. In this way, we formally establish the correctness of autodiff systems applied to non-differentiable functions.

New Results - Memory Abstraction

Weakly Sensitive Analysis for Unbounded Iteration over JavaScript Objects

Springer eBooks, 2017

JavaScript framework libraries like jQuery are widely used, but complicate program analyses. Inde... more JavaScript framework libraries like jQuery are widely used, but complicate program analyses. Indeed, they encode clean high-level constructions such as class inheritance via dynamic object copies and transformations that are harder to reason about. One common pattern used in them consists of loops that copy or transform part or all of the fields of an object. Such loops are challenging to analyze precisely, due to weak updates and as unrolling techniques do not always apply. In this paper, we observe that precise field correspondence relations are required for client analyses (e.g., for call-graph construction), and propose abstractions of objects and program executions that allow to reason separately about the effect of distinct iterations without resorting to full unrolling. We formalize and implement an analysis based on this technique. We assess the performance and precision on the computation of call-graph information on examples from jQuery tutorials.

An array content static analysis based on non-contiguous partitions

Computer Languages, Systems & Structures, 2017

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific r... more HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

A Categorical Framework for Program Semantics and Semantic Abstraction

Electronic Notes in Theoretical Informatics and Computer Science, Nov 22, 2023

Categorical semantics of type theories are often characterized as structure-preserving functors. ... more Categorical semantics of type theories are often characterized as structure-preserving functors. This is because in category theory both the syntax and the domain of interpretation are uniformly treated as structured categories, so that we can express interpretations as structure-preserving functors between them. This mathematical characterization of semantics makes it convenient to manipulate and to reason about relationships between interpretations. Motivated by this success of functorial semantics, we address the question of finding a functorial analogue in abstract interpretation, a general framework for comparing semantics, so that we can bring similar benefits of functorial semantics to semantic abstractions used in abstract interpretation. Major differences concern the notion of interpretation that is being considered. Indeed, conventional semantics are value-based whereas abstract interpretation typically deals with more complex properties. In this paper, we propose a functorial approach to abstract interpretation and study associated fundamental concepts therein. In our approach, interpretations are expressed as oplax functors in the category of posets, and abstraction relations between interpretations are expressed as lax natural transformations representing concretizations. We present examples of these formal concepts from monadic semantics of programming languages and discuss soundness.

A Product of Shape and Sequence Abstractions

Lecture Notes in Computer Science, Dec 31, 2022

Verification, Model Checking, and Abstract Interpretation

Springer eBooks, 2022

The use of general descriptive names, registered names, trademarks, service marks, etc. in this p... more The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Abstraction of Arrays Based on Non Contiguous Partitions

Springer eBooks, 2015

Array partitioning analyses split arrays into contiguous partitions to infer properties of cell s... more Array partitioning analyses split arrays into contiguous partitions to infer properties of cell sets. Such analyses cannot group together non contiguous cells, even when they have similar properties. In this paper, we propose an abstract domain which utilizes semantic properties to split array cells into groups. Cells with similar properties will be packed into groups and abstracted together. Additionally, groups are not necessarily contiguous. This abstract domain allows to infer complex array invariants in a fully automatic way. Experiments on examples from the Minix 1.1 memory management demonstrate its effectiveness.

Verification, Model Checking, and Abstract Interpretation - 15th International Conference, VMCAI 2014, San Diego, CA, USA, January 19-21, 2014, Proceedings

New Results - Taking Static Analysis to the Next Level: Proving the Absence of Run-Time Errors and Data Races with Astrée

Proofnets and Context Semantics for the Additives

Springer eBooks, 2002

We provide a context semantics for Multiplicative-Additive Linear Logic (MALL), together with pro... more We provide a context semantics for Multiplicative-Additive Linear Logic (MALL), together with proofnets whose reduction preserves semantics, where proofnet reduction is equated with cut-elimination on MALL sequents. The results extend the program of Gonthier, Abadi, and Lévy, who provided a "geometry of optimal λ-reduction" (context semantics) for λ-calculus and Multiplicative-Exponential Linear Logic (MELL). We integrate three features: a semantics that uses buses to implement slicing; a proofnet technology that allows multidimensional boxes and generalized garbage, preserving the linearity of additive reduction; and finally, a read-back procedure that computes a cut-free proof from the semantics, which is closely related to full abstraction theorems. Peut-être que la logique se trompe. -Yves Lafont Linear Logic appeared in 1987 and turned out quickly to be an interesting tool to model programming languages, specifically reasoning that is sensitive to the notion of consumable resources. Indeed the multiplicative fragment of Linear Logic (⊗, ) allows linear products (pairing and unpairing), implementing functions: a context pairs a continuation and an argument, a function unpairs and connects the two. The additive fragment (⊕, &) allows linear sums (injection and case dispatch), implementing features of processes in the style of CSP or CCS . The crucial difference between these two components is the way they take care with consumption of resources. The exponential fragment implements sharing of resources: arguments, control contexts. We can then implement, for example, graph reduction technology for λ-calculus with control operators (call/cc, abort, jumps), and related mechanical proof systems for classical logic-taking care of the sharing and copying, implicit in these calculi . Linear Logic was initially a sequent calculus, but this sequentialized structure was too strong and the design of a nice cut-elimination procedure was complicated. Therefore, proofnets were introduced as a more flexible representation of proofs . Further, Geometry of Interaction (GoI) developed the idea that the reduction of proofs can be seen as a local interaction process . Its intensional features provide a mediating Purgatory between the Heaven of denotational semantics, and the Hell of operational semantics. GoI was simplified in the "geometry of optimal λ-reduction" by Gonthier, Abadi and Lévy in the context of the MELL fragment. They reduced Hilbert spaces to simple data-structures, known as context semantics, and developed a proofnet technology which implemented the context semantics locally. Reduction on proofnets preserves the semantics, and Lamping's algorithm for optimal reduction of λ-terms [14] is a method of graph reduction. They further indicated how to read back any part of the Böhm tree (normal form) of a λ-term from its context semantics. Can this program be carried out for full Linear Logic? In this paper we extend these result to the MALL fragment (multiplicatives and additives): this may be a step towards a satisfactory proofnet syntax for full Linear Logic with a good characterization of proofs. The MALL fragment is quite problematic since it does not have a nice cutelimination procedure-unlike MLL, which enjoys a straightforward one. Part of the work will be to understand and improve the reduction procedure for MALL. The main contributions of this paper are to provide an integrated development of (1) a context semantics for the MALL fragment; (2) a proofnet technology allowing normalization of MALL proofs, using the ideas of multidimensional boxes and generalized garbage; and (3) a read-back procedure that inputs a valid context semantics and outputs a normalized proofnet. In Section 1, we recall some basic definitions on MALL, proofnets and Linear Logic. We introduce in Section ?? a form of context semantics for MALL proofs, and we derive from it a bus-notation based proofnet syntax in Section 3. Then, we envisage the main problems that come from the reduction on the additives in Section 4. The first difficulty is that the additive cut-elimination is not really linear, since an additive reduction step erases a whole part of the proof (this is also a problem for the locality of the reduction we would like to achieve). The second problem also stems from the additives: the way one should reduce a cut involving auxiliary formulas of two &-links is unclear. The solution to this problem will come from an extension of the MALL syntax. After this adaptation, we will be able to get a much more satisfactory cut-elimination procedure. In Section 5, we show how a normalized proof can be read-back from the context semantics of a proof, and we see how this result can be related to a form of full completeness. In Section 6, we compare our approach with other works.

Memory Abstraction, Emerging Techniques and Applications (NII Shonan Meeting 2017-12)

NII Shonan Meet. Rep., 2017

New Results - Relational Inductive Shape Analysis

Abstraction of Optional Numerical Values

Springer eBooks, 2015

We propose a technique to describe properties of numerical stores with optional values, that is, ... more We propose a technique to describe properties of numerical stores with optional values, that is, where some variables may have no value. Properties of interest include numerical equalities and inequalities. Our approach lifts common linear inequality based numerical abstract domains into abstract domains describing stores with optional values. This abstraction can be used in order to analyze languages with some form of option scalar type. It can also be applied to the construction of abstract domains to describe complex memory properties that introduce symbolic variables, e.g., in order to summarize unbounded sets of program variables, and where these symbolic variables may be undefined, as in some array or shape analyses. We describe the general form of abstract states, and propose sound and automatic static analysis algorithms. We evaluate our construction in the case of an array abstract domain. 1 Mayas are among the civilizations believed to have independently invented number "zero".

Design and Implementation of a Special-Purpose Static Program Analyzer for Safety-Critical Real-Time Embedded Software, invited chapter

We report on a successful preliminary experience in the design and implementation of a special-pu... more We report on a successful preliminary experience in the design and implementation of a special-purpose Abstract Interpretation based static program analyzer for the verification of safety critical embedded real-time software. The analyzer is both precise (zero false alarm in the considered experiment) and efficient (less than one minute of analysis for 10,000 lines of code). Even if it is based on a simple interval analysis, many features have been added to obtain the desired precision: expansion of small arrays, widening with several thresholds, loop unrolling, trace partitioning, relations between loop counters and other variables. The efficiency of the tool mainly comes from a clever representation of abstract environments based on balanced binary search trees. Dedicated to Neil Jones, for his 60 th birthday.

Abstract Interpretation-Based Certification of Assembly Code

Springer eBooks, Dec 16, 2002

We present a method for analyzing assembly programs based on source program analysis and invarian... more We present a method for analyzing assembly programs based on source program analysis and invariant translation. It is generic in the choice of an abstract domain for representing stores. This method is adapted to the design of certification tools for assembly programs generated by compiling programs written in an imperative language, without writing a specific compiler or modifying an existing

Symbolic transfer function-based approaches to certified compilation

We present a framework for the certification of compilation and of compiled programs. Our approac... more We present a framework for the certification of compilation and of compiled programs. Our approach uses a symbolic transfer functions-based representation of programs, so as to check that source and compiled programs present similar behaviors. This checking can be done either for a concrete semantic interpretation (Translation Validation) or for an abstract semantic interpretation (Invariant Translation) of the symbolic transfer functions. We propose to design a checking procedure at the concrete level in order to validate both the transformation and the translation of abstract invariants. The use of symbolic transfer functions makes possible a better treatment of compiler optimizations and is adapted to the checking of precise invariants at the assembly level. The approach proved successful in the implementation point of view, since it rendered the translation of very precise invariants on very large assembly programs feasible.

Interprocedural Shape Analysis Using Separation Logic-based Transformer Summaries

HAL (Le Centre pour la Communication Scientifique Directe), Nov 18, 2020

Shape analyses aim at inferring semantic invariants related to the data-structures that programs ... more Shape analyses aim at inferring semantic invariants related to the data-structures that programs manipulate. To achieve that, they typically abstract the set of reachable states. By contrast, abstractions for transformation relations between input states and output states not only provide a finer description of program executions but also enable the composition of the effect of program fragments so as to make the analysis modular. However, few logics can efficiently capture such transformation relations. In this paper, we propose to use connectors inspired by separation logic to describe memory state transformations and to represent procedure summaries. Based on this abstraction, we design a top-down interprocedural analysis using shape transformation relations as procedure summaries. Finally, we report on implementation and evaluation.

Recommandations sur les « éditeurs de la zone grise »

HAL (Le Centre pour la Communication Scientifique Directe), Jan 25, 2023

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific r... more HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Automatically Proving Microkernels Free from Privilege Escalation from their Executable

arXiv (Cornell University), Mar 19, 2020

Operating system kernels are the security keystone of most computer systems, as they provide the ... more Operating system kernels are the security keystone of most computer systems, as they provide the core protection mechanisms. Kernels are in particular responsible for their own security, i.e. they must prevent untrusted user tasks from reaching their level of privilege. We demonstrate that proving such absence of privilege escalation is a pre-requisite for any definitive security proof of the kernel. While prior OS kernel formal verifications were performed either on source code or crafted kernels, with manual or semi-automated methods requiring significant human efforts in annotations or proofs, we show that it is possible to compute such kernel security proofs using fully-automated methods and starting from the executable code of an existing microkernel with no modification, thus formally verifying absence of privilege escalation with high confidence for a low cost. We applied our method on two embedded microkernels, including the industrial kernel AnonymOS 1 : with only 58 lines of annotation and less than 10 minutes of computation, our method finds a vulnerability in a first (buggy) version of AnonymOS and verifies absence of privilege escalation in a second (secure) version.

On Correctness of Automatic Differentiation for Non-Differentiable Functions

arXiv (Cornell University), Jun 11, 2020

Differentiation lies at the core of many machine-learning algorithms, and is wellsupported by pop... more Differentiation lies at the core of many machine-learning algorithms, and is wellsupported by popular autodiff systems, such as TensorFlow and PyTorch. Originally, these systems have been developed to compute derivatives of differentiable functions, but in practice, they are commonly applied to functions with non-differentiabilities. For instance, neural networks using ReLU define nondifferentiable functions in general, but the gradients of losses involving those functions are computed using autodiff systems in practice. This status quo raises a natural question: are autodiff systems correct in any formal sense when they are applied to such non-differentiable functions? In this paper, we provide a positive answer to this question. Using counterexamples, we first point out flaws in oftenused informal arguments, such as: non-differentiabilities arising in deep learning do not cause any issues because they form a measure-zero set. We then investigate a class of functions, called PAP functions, that includes nearly all (possibly nondifferentiable) functions in deep learning nowadays. For these PAP functions, we propose a new type of derivatives, called intensional derivatives, and prove that these derivatives always exist and coincide with standard derivatives for almost all inputs. We also show that these intensional derivatives are what most autodiff systems compute or try to compute essentially. In this way, we formally establish the correctness of autodiff systems applied to non-differentiable functions.

New Results - Memory Abstraction

Weakly Sensitive Analysis for Unbounded Iteration over JavaScript Objects

Springer eBooks, 2017

JavaScript framework libraries like jQuery are widely used, but complicate program analyses. Inde... more JavaScript framework libraries like jQuery are widely used, but complicate program analyses. Indeed, they encode clean high-level constructions such as class inheritance via dynamic object copies and transformations that are harder to reason about. One common pattern used in them consists of loops that copy or transform part or all of the fields of an object. Such loops are challenging to analyze precisely, due to weak updates and as unrolling techniques do not always apply. In this paper, we observe that precise field correspondence relations are required for client analyses (e.g., for call-graph construction), and propose abstractions of objects and program executions that allow to reason separately about the effect of distinct iterations without resorting to full unrolling. We formalize and implement an analysis based on this technique. We assess the performance and precision on the computation of call-graph information on examples from jQuery tutorials.

An array content static analysis based on non-contiguous partitions

Computer Languages, Systems & Structures, 2017

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific r... more HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.