Directed Symbolic Execution for Vulnerability Discovery: An LLM-Guided Approach in KLEE

2026-07-27 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Expert, quick

Summary

KLEECopilot, a Large Language Model (LLM)-guided directed symbolic execution approach built on KLEE, addresses the path explosion problem in vulnerability discovery. Traditional symbolic execution engines like KLEE often get trapped in cyclic control-flow regions, consuming exploration budgets before reaching deeper vulnerabilities. KLEECopilot mitigates this by using LLMs to mark potentially vulnerable code and guide path prioritization. It also integrates loop-exit prioritization to escape non-vulnerable cycles. Compared to baselines like Empc, KLEECopilot significantly improves code coverage, achieving a 42.24% increase in basic block coverage and a 125.82% increase in line coverage. It discovered 1,335 total violations and 87 unique violations, outperforming the second-best baseline by 32.2% in total violations and Empc by 24.3% in unique violations. The system's effectiveness is sensitive to the LLM family but not significantly to model scale.

Key takeaway

For AI Security Engineers evaluating advanced vulnerability discovery tools, KLEECopilot demonstrates a significant leap forward. If you are struggling with path explosion in symbolic execution, consider integrating LLM-guided prioritization and loop-exit strategies. This approach improves basic block coverage by 42.24% and unique vulnerability detection by 24.3% over baselines. You should investigate LLM family choices, as effectiveness is sensitive to the model used, to optimize your security analysis.

Key insights

LLMs can guide symbolic execution to overcome path explosion, improving vulnerability discovery by prioritizing vulnerable code and escaping cycles.

Principles

• Path explosion hinders symbolic execution.
• LLMs can mark vulnerable code effectively.
• Loop-exit prioritization escapes exploration cycles.

Method

KLEECopilot uses LLMs to mark vulnerable code, guiding KLEE's path prioritization. It integrates loop-exit prioritization to escape non-vulnerable cycles, directing exploration towards deeper vulnerabilities.

In practice

• Enhance symbolic execution with LLM guidance.
• Implement loop-exit prioritization in scanners.
• Evaluate LLM family for security tool efficacy.

Topics

• Symbolic Execution
• Vulnerability Discovery
• Large Language Models
• KLEE
• Path Prioritization
• Code Coverage

Best for: AI Scientist, AI Security Engineer, Research Scientist

Related on AIssential

• Tool-Guided Retrieval-Augmented Repair for Securing LLM-Generated C Code — Integrating multi-tool feedback and retrieval of repair patterns significantly improves LLM-generated C code security and reliability.
• Needles at Scale: LLM-Assisted Target Selection for Windows Vulnerability Research — LLM-assisted target selection can efficiently narrow millions of functions to a manageable shortlist for Windows vulnerability research.
• A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems — LLM security must encompass the full application lifecycle and stack, not just model weights.
• DIG: Oracle-Guided Directed Input Generation for One-Day Vulnerabilities — Patch analysis with LLMs can synthesize explicit vulnerability preconditions, guiding effective PoC generation.
• Using LLMs to Secure Source Code — LLMs streamline vulnerability discovery, shifting the security bottleneck to verification, triage, and patching.
• One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety — Incremental, single-word prompts can bypass LLM safety by gradually shifting internal refusal and safety representations.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.