Teaching LLMs Program Semantics via Symbolic Execution Traces

TL;DR

This paper presents an evaluation framework for C verification tasks, analyzes model weaknesses in violation detection, and demonstrates that training on symbolic execution traces combined with chain-of-thought reasoning significantly improves model performance across multiple property types.

Contribution

The paper introduces a new evaluation framework, and shows that combining symbolic execution trace training with chain-of-thought reasoning enhances violation detection in LLMs.

Findings

High overall accuracy masks violation detection weaknesses.

Training on symbolic execution traces improves violation detection by over 17%.

Trace training combined with chain-of-thought reasoning yields superadditive gains.

Abstract

We introduce an evaluation framework of 500 C verification tasks across five property types (memory safety, overflow, termination, reachability, data races) built on SV-COMP 2025, and evaluate 14 models across six families. We find that high overall accuracy masks a critical weakness: while most models reliably confirm properties hold, violation detection varies widely and degrades sharply with program length. To close this gap, we train on formal verification artifacts: running the Soteria symbolic execution engine on generic open-source C code and using the resulting traces for continued pretraining of Qwen3-8B. Just ${\sim}$3,000 bug traces combined with chain-of-thought reasoning at inference time improve violation detection by over 17 percentage points, producing one of the most balanced accuracy profiles among evaluated models. On violation detection, the trained 8B model outperforms the 4$\times$ larger Qwen3-32B without thinking and approaches it in overall accuracy. The interaction between trace training and chain-of-thought is superadditive: neither alone provides meaningful gains, but their combination does. Improvements transfer across all five property types, including ones the training traces do not target. Our 28 configurations confirm the gains stem from trace semantics, not code volume, and that trace curation and format matter.