Dynamic Bottom-Up Search Methods

• Dynamic Bottom-Up Search is a method that builds programs from complete atomic units, using online guidance and dynamic programming for efficient synthesis.
• It leverages techniques like observational equivalence, online reweighting, and learned search policies as seen in systems such as Probe, BUSTLE, CrossBeam, and Bee Search.
• This approach improves search efficiency in program synthesis and extends its utility to areas like vulnerability testing and visual search.

Searching arXiv for papers on dynamic bottom-up search and related bottom-up synthesis methods. Dynamic bottom-up search denotes a family of search procedures in which construction begins from complete, executable atomic units and proceeds by composing previously generated fragments, while the order of exploration is altered online by costs, learned guidance, or state-dependent control. In program synthesis, its canonical substrate is bottom-up enumeration with dynamic programming and observational equivalence, but the “dynamic” component varies substantially: Probe updates a PCFG from partial solutions during synthesis (Barke et al., 2020), BUSTLE reweights intermediate values from learned semantic signals (Odena et al., 2020), CrossBeam replaces exhaustive combination with an on-policy learned search policy (Shi et al., 2022), and Bee Search performs exact best-first generation in an abstract cost-tuple space (Ameen et al., 2023). The collected usage also extends beyond synthesis, where the same phrase or closely related language is used for local-to-global replanning, function-level vulnerability validation, and dynamically updated visual search (Liu et al., 2020, Muralee et al., 3 Sep 2025, Yang et al., 2023).

1. Bottom-up search as an executable search substrate

In the program-synthesis literature, bottom-up search starts from terminals, literals, variables, inputs, and constants, and repeatedly applies DSL operators to already explored fragments. Probe describes this as a bank-based enumeration procedure that first appeared in height-based form and was then improved by enumerating by size rather than height (Barke et al., 2020). BUSTLE makes the same executable-subprogram assumption explicit: every intermediate expression can be run on the examples, so search manipulates semantically meaningful values rather than incomplete syntax trees (Odena et al., 2020). CrossBeam adopts the same substrate and identifies its combinatorial bottleneck as the need, for an operator of arity $a$, to consider $|S|^a$ argument tuples from the explored set $S$ (Shi et al., 2022).

A central pruning mechanism is observational equivalence. Probe merges or discards programs that evaluate identically on all examples, and BUSTLE states the same principle in value-centric form by storing values rather than merely program syntax (Barke et al., 2020, Odena et al., 2020). This yields semantic deduplication: if two expressions produce the same value on the examples, only one representative need be retained. Bee Search preserves this bottom-up advantage and explicitly contrasts itself with Heap Search, which sacrifices observational equivalence elimination, and with Brute, which retains equivalence pruning but can generate huge numbers of programs that are never evaluated (Ameen et al., 2023).

The shared technical consequence is that bottom-up search makes partial execution available at every step. This, in turn, makes dynamic guidance possible: partial solutions, intermediate values, and exact costs can be used to reprioritize later expansions. This suggests that “dynamic” in this literature is best understood not as a single data structure, but as online adaptation layered onto a semantically executable bottom-up core.

2. Online reweighting and just-in-time guidance

Probe implements dynamic bottom-up search through just-in-time learning. It begins with a uniform PCFG,

$p_u(R)=\frac{1}{|R(N)|},$

assigns programs probabilities

$p(P)=\prod_{R_i\in tr(P)} p(R_i),$

and converts those probabilities to costs by

$rcost(R)=-\log(p(R)).$

For implementation, the real-valued costs are rounded to discrete costs, and bottom-up search enumerates programs under a cost budget rather than a size budget (Barke et al., 2020). The dynamic step occurs when Probe encounters partial solutions that satisfy some but not all examples. It selects promising partial solutions—its implementation uses First Cheapest—updates rule probabilities from those partial solutions, and restarts bottom-up search from scratch because the revised PCFG invalidates the old bank ordering and representatives (Barke et al., 2020). Dynamic guidance here is therefore not incremental in the narrow sense; it is batchwise re-estimation of the search prior during synthesis itself.

BUSTLE instantiates a different form of online control. Its model does not predict full programs; it classifies whether an intermediate value is likely to be part of a final solution,

$p(y \mid I, V, O),$

using property signatures computed from the inputs, the intermediate value, and the outputs (Odena et al., 2020). The model’s confidence is discretized into six bins,

$\delta \in \{0,\ldots,5\},$

with boundaries

$[0.0, 0.1, 0.2, 0.3, 0.4, 0.6, 1.0],$

and the candidate is reweighted by

$w' = w + 5 - \delta.$

Because the model consumes execution-derived property signatures, the current search frontier is continually reprioritized by semantic evidence obtained during search rather than by fixed syntactic size (Odena et al., 2020).

The contrast between the two systems is structurally important. Probe updates a global grammar-level distribution from short partial solutions and then restarts enumeration (Barke et al., 2020). BUSTLE leaves the grammar fixed but reweights each new value online from a learned semantic classifier (Odena et al., 2020). Both are dynamic bottom-up search in the sense that neither relies on a search order fixed before execution begins.

3. Learned search policies and exact cost-ordered generation

CrossBeam replaces exhaustive bottom-up combination with a learned search policy. Its search context includes the input-output examples $|S|^a$0, the current operation $|S|^a$1, the set $|S|^a$2 of previously explored values, and the execution results and provenance of those values (Shi et al., 2022). The explored set is embedded as a matrix $|S|^a$3, summarized by max-pooling, and combined with the I/O embedding to initialize an autoregressive pointer-network-style decoder. For each argument-selection step,

$|S|^a$4

Only type-compatible values are allowed, and during evaluation CrossBeam uses UniqueRandomizer to draw distinct argument lists without replacement. The reported evaluation procedure keeps sampling until it produces $|S|^a$5 new values or exhausts a budget of $|S|^a$6 samples per operation per iteration, with $|S|^a$7 (Shi et al., 2022). Dynamic bottom-up search here means that the system repeatedly queries a learned policy that conditions on the evolving search history and directly controls which concrete combinations are instantiated.

Bee Search addresses a different deficiency: the mismatch between approximate cost-guided BUS and true best-first generation. Probe and Bustle lose cost information through rounding or discretization, while Heap Search is best-first only in the order of evaluation, not in the order of program generation (Ameen et al., 2023). Bee Search therefore searches an abstract space of program-cost tuples. For additive costs,

$|S|^a$8

a tuple $|S|^a$9 indexes the $S$0-th smallest cost in a global sorted list $S$1, and the tuple’s children are generated by incrementing one coordinate at a time: $S$2 The priority queue is initialized with $S$3 per non-terminal rule, and the algorithm pops the cheapest tuple state first (Ameen et al., 2023). Because only the cheaper abstract cost states are expanded into concrete programs, Bee Search “does not even create in memory programs that are more expensive than the solution program” (Ameen et al., 2023).

Bee Search also introduces an unbounded cost function,

$S$4

so that the raw model probability influences ranking through $S$5 rather than through a capped discretized penalty (Ameen et al., 2023). In this formulation, dynamic bottom-up search is an exact, abstract, generation-aware cost ordering rather than a learned policy over concrete combinations.

4. Search order, guarantees, and failure modes

The principal theoretical distinction in this literature is between best-first evaluation and best-first generation. Bee Search emphasizes that A* and Dijkstra-style descriptions do not capture its guarantee, because those procedures may still generate nodes more expensive than the goal. Its theorems establish best-first generation for additive pre-generation cost functions and additive, penalizing post-generation cost functions, while preserving observational equivalence elimination and completeness under the stated assumptions (Ameen et al., 2023). This is a stronger claim than merely evaluating cheap programs earlier.

CrossBeam makes the opposite tradeoff. Because it does not enumerate the entire program space, it has “no guarantee of eventual exhaustive search” (Shi et al., 2022). Its strength lies in reducing the explored search space; its weakness is that missing the right combinations can cause failure even when a solution exists. BUSTLE likewise depends on the accuracy and cost of the classifier: if inference is too slow or not accurate enough, learning in the loop may fail to beat pure enumeration, and dataset mismatch remains a limitation because the model is trained on synthetic programs (Odena et al., 2020).

Probe illustrates another subtlety. Dynamic guidance can invalidate earlier search state. Because updating the PCFG changes program costs, the old bank cannot simply be retained, so the system restarts search after each learning phase (Barke et al., 2020). A common misconception is that “dynamic” necessarily means monotone refinement of a persistent frontier. Probe shows that, in bottom-up synthesis, dynamic guidance may instead require repeated reinitialization to maintain correctness of program ordering and equivalence classes.

A second misconception is that all bottom-up best-first methods are equivalent. The source set draws sharp distinctions: Heap Search is best-first in evaluation order but gives up observational equivalence elimination; Brute is best-first and retains equivalence pruning but can generate huge numbers of programs that are never evaluated; Bee Search combines exact cost ordering, observational equivalence elimination, and best-first generation (Ameen et al., 2023). The term therefore encodes a family of search-ordering properties rather than a single canonical algorithm.

5. Empirical behavior in program synthesis

Probe is evaluated on 140 benchmarks—82 String, 27 BitVec, and 31 Circuit—with a 10 minutes timeout (Barke et al., 2020). On String benchmarks it solves 48, compared with 42 for size-based and 9 for height-based unguided enumeration; on BitVec it solves 21, compared with 20 and 13; on Circuit all three solve 22. Across all benchmarks and the extended string grammar, Probe solves 116 tasks versus 93 for size-based and 45 for height-based (Barke et al., 2020). Against EuPhony, Probe solves 48 vs 23 on String, 21 vs 14 on BitVec, and 22 vs 13 on Circuit, while requiring no offline training data (Barke et al., 2020).

BUSTLE is evaluated on 38 human-written tasks and 89 SyGuS string tasks (Odena et al., 2020). On the authors’ 38 benchmarks it solves 31 tasks within 30 million candidate expressions or 30 seconds and outperforms plain bottom-up search, DeepCoder-style premise selection, and RobustFill (Odena et al., 2020). On the SyGuS benchmarks, the results are more mixed, but the combination of BUSTLE’s learned model with domain heuristics yields the strongest overall performance in that study (Odena et al., 2020).

CrossBeam reports that on the Bustle benchmarks it solves 62% more tasks than Bustle within a fixed budget of 50,000 candidate expressions, and that to match Bustle’s performance it needs about 20× fewer candidate programs (Shi et al., 2022). With a larger budget of 1 million candidates it still outperforms Bustle. On synthetic logic tasks it achieves close to 100% success rate for sizes up to 16 and still over 50% at size 19, while competing methods drop to 0% by size 13; on handcrafted arithmetic-like relations it solves 28/30 tasks, compared with 23 for plain enumeration, 18 for Metagol, and 11–18 for Popper variants depending on settings (Shi et al., 2022).

Bee Search is evaluated on 205 SyGuS string tasks, 38 handcrafted string tasks from Bustle, and 27 bit-vector tasks (Ameen et al., 2023). The study states that Bee Search is never worse than the corresponding prior method and often better, especially in larger DSLs. With Bustle’s cost function it solves slightly more string tasks than Bustle and clearly more than Brute, and with the new unbounded cost function $S$6 it is reported as the best overall method on the SyGuS string benchmark and the strongest on the larger handcrafted string benchmark (Ameen et al., 2023).

Taken together, these results indicate that dynamic bottom-up search has been used to pursue three distinct empirical objectives: better search priors without offline data in Probe, semantic reprioritization of executable intermediates in BUSTLE, policy-driven reduction of explored combinations in CrossBeam, and exact cost-ordered generation in Bee Search.

6. Terminological extensions beyond synthesis

Outside program synthesis, the phrase is used in broader but related ways. In heterogeneous Earth observation replanning, dynamic bottom-up search refers to a bottom-up distributed coordinated framework in which disturbed tasks are repaired first by neighboring resource coordination, then by single planning center coordination, and finally by multiple planning center coordination (Liu et al., 2020). The operational mechanism is a three-round multiround combinatorial allocation (MCA) procedure plus a float interval-based local search (FLS) heuristic. In the large-scale allocation experiments, MCA is reported to achieve about 95% completion rate at 500 tasks, and in dynamic environments it maintains low replanning time and lower Rate of Scheme Change (RSC) than alternative methods (Liu et al., 2020). Here, “bottom-up” means escalation from local repair to broader coordination rather than composition of subprograms.

In software testing, Reactive Bottom-Up Testing begins from vulnerable functions rather than from main, fuzzes function-level harnesses, extracts crash constraints by symbolic execution, and then backtracks through callers by stitching constraints until reachability from program entry is established (Muralee et al., 3 Sep 2025). The prototype Griller detects 28 / 48 known vulnerabilities, reports 6 false positives, fully backtracks 15 vulnerabilities to main with 100% precision, and finds 6 previously unknown vulnerabilities in real-world applications (Muralee et al., 3 Sep 2025). This is bottom-up in the sense of function-to-caller validation, and dynamic in the sense that feasibility is solved only for crashes that actually appear.

In scanpath prediction, the Human Attention Transformer treats free-viewing as the canonical bottom-up setting and models attention as a dynamically updated working memory in which each fixation appends a new foveal token while peripheral tokens remain available (Yang et al., 2023). On COCO-Search18 target-absent search, HAT reports SemSS = 0.382, SS = 0.402, cIG = 1.686, cNSS = 3.103, and cAUC = 0.961 (Yang et al., 2023). This is a different use of “dynamic bottom-up search”: it describes history-conditioned gaze control rather than symbolic enumeration.

The broader usage suggests that the term has become a methodological label for local-first, history-sensitive search or repair, even when the underlying objects are not programs. A boundary case appears in the supplied source set for “Efficient Bottom-Up Synthesis for Programs with Local Variables” (Li et al., 2023): the supplied material states that the document is only a placeholder ACM LaTeX template and contains no technical content on lifted interpretation, enumeration of binding contexts, observational equivalence reduction for local variables, or Arborist/WebRobot/Helena results. Consequently, no substantiated account of that specific line of work can be given from the present source set (Li et al., 2023).