Neuro-Symbolic Proof-of-Vulnerability Generation with Open-Weight Models

POVGEN aims to turn a known software vulnerability into a concrete test input that triggers it. That gives maintainers a way to reproduce the problem and check a repair. The paper's abstract describes narrowing the relevant code, analyzing paths that can reach it, and combining language-model reasoning with a mathematical solver to find inputs satisfying the necessary conditions.

The authors report valid triggering inputs for 74.8% of 250 disclosed vulnerabilities that lacked public examples. They also say the generated tests exposed six flawed patches, subsequently fixed. These results support the approach as a way to validate repairs on the studied cases; they do not establish coverage of every vulnerability type.

“POVGEN successfully generates PoVs for 78.98% of vulnerabilities in a recent benchmark, outperforming fuzzing (up to 50.20%) and symbolic execution (2.45%).”

“The fine-tuned open-weight models match frontier commercial LLMs on key sub-tasks (i.e., the core constraint-reasoning steps) while running locally at no per-sample API cost.”

“Applying the generated PoVs revealed six flawed patches in disclosed CVEs (all subsequently fixed) and five previously unreported vulnerabilities (of which four have been confirmed and fixed by the developers).”