🤖 AI Summary
Existing program analysis techniques lack a unified mathematical framework capable of simultaneously addressing type checking, vulnerability detection, and behavioral equivalence verification. This work proposes the first unified model based on Čech cohomology, representing program semantics as a presheaf over the category of program sites. In this framework, the zeroth cohomology group \(H^0\) captures globally consistent typing, while the first cohomology group \(H^1\) characterizes errors or failures of equivalence arising from local inconsistencies. By integrating tools from algebraic geometry to model Python semantics and leveraging the Mayer–Vietoris sequence, the approach enables incremental obstruction analysis and minimal repair counting. The resulting tool, Deppy, achieves 100% vulnerability recall, 99% zero-false-positive equivalence accuracy, and 98% specification conformance accuracy on a benchmark suite of 375 programs, substantially outperforming state-of-the-art type checkers such as mypy and pyright.
📝 Abstract
We present a framework in which program analysis -- type checking, bug finding, and equivalence verification -- is organized as computing the Čech cohomology of a semantic presheaf over a program's site category. The presheaf assigns refinement-type information to observation sites and restricts it along data-flow morphisms. The cohomology group $H^{0}$ is the space of globally consistent typings. The first cohomology group $H^{1}$ classifies gluing obstructions -- bugs, type errors, and equivalence failures -- each localized to a specific pair of disagreeing sites.
This formulation yields three concrete results unavailable in prior work: (1) the rank of $H^1$ over $F_{2}$ counts the minimum independent fixes; (2) $H_{1}(U, Iso) = 0$ is sound and complete for behavioral equivalence; (3) Mayer-Vietoris enables compositional, incremental obstruction counting.
We implement the framework in Deppy, a Python analysis tool, and evaluate it on a suite of 375~benchmarks: 133~bug-detection programs, 134~equivalence pairs, and 108~specification-satisfaction checks. Deppy achieves {100% bug-detection recall} (69% precision, F1 = 81%), 99% equivalence accuracy with zero false equivalences, and 98% spec accuracy with zero false satisfactions -- outperforming mypy and pyright, which report zero findings on unannotated code. The analysis models Python semantics as algebraic geometry: variables live on the generic fiber (non-None) unless on the closed nullable subscheme, integers form Spec($\mathbb{Z}$) with no bounded section (no overflow), and short-circuit evaluation defines an open-set topology on the presheaf.