Search papers, labs, and topics across Lattice.
This paper introduces ConcoLixir, a reactive LLM extension designed to enhance Python concolic testing by addressing limitations in symbolic variable handling during library calls and semantic operations. By utilizing the LLM as a discovery oracle, ConcoLixir generates initial seeds, proposes concrete inputs when solvers fail, and targets unexplored code paths, leading to significant improvements in line coverage. The experimental results demonstrate an average increase in line coverage of 8.6 to 17.0 percentage points across various test scenarios, highlighting the effectiveness of LLMs in complementing traditional symbolic reasoning methods.
ConcoLixir boosts Python concolic testing coverage by leveraging LLMs to intelligently navigate semantic barriers and library boundaries.
Concolic testing combines concrete execution with symbolic constraint solving, but Python programs expose recurring limits. Library calls can cause symbolic variables to downgrade to concrete values. Regular expressions, checksums, parsers, and other semantic operations can be hard to solve, and exploration can plateau on already covered paths. We present ConcoLixir, a reactive LLM extension for Python concolic execution. The LLM acts as a discovery oracle, not a replacement for the solver or a correctness oracle. It generates initial seeds, proposes concrete inputs after solver failures, and targets uncovered code when coverage stalls. Each candidate is executed concolically, and only observed coverage and collected path constraints guide later exploration. Across synthetic, real-world, and library targets, ConcoLixir improves mean line coverage over the baseline concolic tester without an LLM oracle by 8.6, 15.1, and 17.0 percentage points. The gains are strongest near semantic barriers and library boundaries, and the full evaluation costs \$1.63 in API charges. These results show that bounded LLM discovery can complement symbolic reasoning without replacing it.
