Neuro-Symbolic Proof-of-Vulnerability Generation with Open-Weight Models

2026-08-04

AI Summary

This work addresses the significant challenge of efficiently generating verifiable proofs of vulnerability (PoVs) in the absence of publicly available trigger inputs. The authors propose POVGEN, a novel framework that for the first time deeply integrates open-source large language models with path-sensitive symbolic execution. By leveraging semantic-guided vulnerability localization, reachability analysis, and SMT-based constraint solving, POVGEN enables low-cost, highly controllable automatic PoV generation without requiring patch information. Evaluated on standard benchmarks, the approach achieves a PoV generation success rate of 78.98%, substantially outperforming both fuzzing and traditional symbolic execution techniques. Furthermore, when applied to 250 real-world CVEs, it yields effective PoVs for 74.80% of them and successfully identifies six incorrect patches and five previously unknown vulnerabilities.

Abstract

Software vulnerabilities are persistent, but validating them remains difficult: a Proof-of-Vulnerability (PoV) requires a concrete input that triggers the vulnerable behavior, yet public triggering inputs are often unavailable for disclosed vulnerabilities. Existing techniques make different tradeoffs in effectiveness, scalability, cost, and controllability, leaving room for complementary designs. To complement them, we present POVGEN, a low-cost neuro-symbolic framework that makes PoV generation cost-effective via semantic focusing and LLM-guided constraint reasoning using open-weight models. POVGEN first localizes vulnerability-relevant regions (utilizing patch information if available), then performs path-sensitive reachability analysis, and finally generates PoVs by extracting and solving constraints with LLM-guided reasoning backed by an SMT solver. POVGEN successfully generates PoVs for 78.98% of vulnerabilities in a recent benchmark, outperforming fuzzing (up to 50.20%) and symbolic execution (2.45%). On 250 real-world CVEs without public PoVs, it generates valid PoVs for 74.80% of cases and reproduces 65.1% when without patch information. The fine-tuned open-weight models match frontier commercial LLMs on key sub-tasks (i.e., the core constraint-reasoning steps) while running locally at no per-sample API cost. Applying the generated PoVs revealed six flawed patches in disclosed CVEs (all subsequently fixed) and five previously unreported vulnerabilities (of which four have been confirmed and fixed by the developers).

Problem

• Proof-of-Vulnerability
• software vulnerabilities
• triggering inputs
• vulnerability validation
• CVE

Innovation

• Neuro-Symbolic
• Proof-of-Vulnerability
• Open-Weight LLMs
• Constraint Reasoning
• SMT Solver