State Merging with Quantifiers in Symbolic Execution

We address the problem of constraint encoding explosion which hinders the applicability of state merging in symbolic execution. Specifically, our goal is to reduce the number of disjunctions and if-then-else expressions introduced during state merging. The main idea is to dynamically partition the symbolic states into merging groups according to a similar uniform structure detected in their path constraints, which allows to efficiently encode the merged path constraint and memory using quantifiers. To address the added complexity of solving quantified constraints, we propose a specialized solving procedure that reduces the solving time in many cases. Our evaluation shows that our approach can lead to significant performance gains

UVB-Induced Tumor Heterogeneity Diminishes Immune Response in Melanoma

Although clonal neo-antigen burden is associated with improved response to immune therapy, the functional basis for this remains unclear. Here we study this question in a novel controlled mouse melanoma model that enables us to explore the effects of intra-tumor heterogeneity (ITH) on tumor aggressiveness and immunity independent of tumor mutational burden. Induction of UVB-derived mutations yields highly aggressive tumors with decreased anti-tumor activity. However, single-cell-derived tumors with reduced ITH are swiftly rejected. Their rejection is accompanied by increased T cell reactivity and a less suppressive microenvironment. Using phylogenetic analyses and mixing experiments of single-cell clones, we dissect two characteristics of ITH: the number of clones forming the tumor and their clonal diversity. Our analysis of melanoma patient tumor data recapitulates our results in terms of overall survival and response to immune checkpoint therapy. These findings highlight the importance of clonal mutations in robust immune surveillance and the need to quantify patient ITH to determine the response to checkpoint blockade

Chopped symbolic execution

Symbolic execution is a powerful program analysis technique that systematically explores multiple program paths. However, despite important technical advances, symbolic execution often struggles to reach deep parts of the code due to the well-known path explosion problem and constraint solving limitations. In this paper, we propose chopped symbolic execution , a novel form of symbolic execution that allows users to specify uninter- esting parts of the code to exclude during the analysis, thus only targeting the exploration to paths of importance. However, the excluded parts are not summarily ignored, as this may lead to both false positives and false negatives. Instead, they are executed lazily, when their effect may be observable by code under anal- ysis. Chopped symbolic execution leverages various on-demand static analyses at runtime to automatically exclude code fragments while resolving their side effects, thus avoiding expensive manual annotations and imprecision. Our preliminary results show that the approach can effectively improve the effectiveness of symbolic execution in several different scenarios, including failure reproduction and test suite augmenta- tion

Past-sensitive pointer analysis for symbolic execution

We propose a novel fine-grained integration of pointer analysis with dynamic analysis, including dynamic symbolic execution. This is achieved via past-sensitive pointer analysis, an on-demand pointer analysis instantiated with an abstraction of the dynamic state on which it is invoked. We evaluate our technique in three application scenarios: chopped symbolic execution, symbolic pointer resolution, and write integrity testing. Our preliminary results show that the approach can have a significant impact in these scenarios, by effectively improving the precision of standard pointer analysis with only a modest performance overhead

Evaluation Artifact: State Merging with Quantifiers in Symbolic Execution

Replication package for the paper: State Merging with Quantifiers in Symbolic Execution.</p