Evidence ceiling E3Proof boundary
SEARCH-BASED COUNTEREXAMPLES
Attack combinations, not only individual mutations.
The v0.19 reference search composes mutation operators with bounded breadth-first search, allowing it to discover vulnerabilities that require multiple individually harmless changes.
Proof of non-vacuity
The synthesizer is tested against a deliberately weak target.
The test suite requires the search engine to discover a two-step unsafe path in the weak target and find no unsafe path in the corresponding hardened target within the same bounded space.
- SEARCH STRATEGY
- bounded breadth-first composition of mutation operators rather than singleton enumeration
- MAXIMUM CLAIM
- BOUNDED SEARCH ONLY
- UNIVERSAL SAFETY PROOF
- NOT CLAIMED