Incorrectness Separation Logic (ISL)

• Incorrectness Separation Logic (ISL) is an under-approximate separation logic that focuses on reachable, error-inducing outcomes in heap-based programs.
• It reverses standard over-approximate implications to ensure that specified error states are concrete and actually reachable from given preconditions.
• ISL underpins automated bug detection through techniques like bi-abduction and compositional symbolic execution, influencing related logics and tool architectures.

Incorrectness Separation Logic (ISL) is an under-approximate separation logic for heap-manipulating programs. Whereas Hoare Logic and standard Separation Logic are over-approximate and characterize properties that all terminating executions satisfy, ISL is designed to characterize reachable outcomes, especially concrete error states, and is therefore aimed at bug finding rather than proof of safety. In recent completeness-oriented formulations, an ISL judgment $[P]\ C\ [\epsilon:Q]$ means that every state satisfying $Q$ is reachable from some state satisfying $P$ by executing $C$ with exit condition $\epsilon\in\{ok,er\}$; the postcondition is thus a lower bound on behavior rather than an upper bound (Lee et al., 3 Aug 2025). Systematic work on separation-logic design places ISL in the class of forward, under-approximate, heap-based logics and treats it as a central reference point for local reasoning about bugs (Bruni et al., 20 May 2026).

1. Semantic orientation and judgmental form

The semantic inversion that distinguishes ISL from Hoare-style reasoning is usually expressed by reversing the inclusion direction. For correctness logics, a triple $\{P\}\,c\,\{Q\}$ has the standard over-approximate reading $[c]P \subseteq Q$; for incorrectness logics, including ISL, the corresponding validity is under-approximate and takes the form $Q \subseteq [c]P$ (Bruni et al., 20 May 2026). In this sense, ISL does not attempt to describe all reachable post-states. It specifies a set of post-states that are definitely reachable from some initial state satisfying the precondition.

A useful abstract summary is the strongest-postcondition characterization. Partial correctness can be written as $sp(p,b)\Rightarrow c$, while incorrectness can be written as $c\Rightarrow sp(p,b)$ (Verscht et al., 2023). This reversed implication is not a notational variant: it changes the direction of consequence, the shape of proof rules, and the meaning of specifications. In ISL, a reported error is intended to be a reachable witness, not merely an element of an over-approximate error set.

This orientation explains why ISL is closely associated with true bug-finding. Under-approximation permits proof obligations that establish the presence of a bug without claiming that the analysis has characterized all terminating behaviors. Exact characterization of all terminating behavior belongs to different logics, such as Exact Separation Logic, rather than to ISL itself (Maksimović et al., 2022).

2. Heap assertions, invalidity, and locality

ISL inherits the heap-local structure of Separation Logic. Assertions are built over symbolic heaps and use separating conjunction $Q$0 to describe disjoint heap fragments. In a relatively complete ISL framework, assertions are disjunctions of existentially quantified symbolic heaps,

$Q$1

where a quantifier-free symbolic heap may contain $Q$2, points-to atoms, pure equalities and disequalities, and separating conjunction (Lee et al., 3 Aug 2025). This gives ISL the modular heap vocabulary needed for pointer programs while preserving under-approximate reachability semantics.

Negative heap information is central. One relatively complete presentation uses the atom $Q$3 to mean that $Q$4 is in the heap domain and maps to $Q$5, i.e. a deallocated cell (Lee et al., 3 Aug 2025). In related ISL-style symbolic-heap domains, invalidated locations are written as $Q$6 (Lin et al., 2024). These assertions are not cosmetic additions: they support reachable error reasoning for use-after-free, double-free, and invalid dereference patterns.

Recent extensions refine the memory model further. The array-and-pointer-arithmetic extension uses states $Q$7, where $Q$8 is a finite set of non-overlapping memory blocks, and adds block-sensitive terms $Q$9 and $P$0 together with a variable-length array predicate $P$1 and a negative array predicate $P$2 for deallocated ranges (Lee et al., 2 Mar 2025). This allows ISL to reason about non-head frees such as free(array + 1), pointer arithmetic inside arrays, and stores that split arrays into left segment, singleton cell, and right segment.

A recurring subtlety is framing. The naive Frame rule is unsound in incorrectness settings, because framed heap parts can affect reachability in the opposite direction from Hoare Logic (Lee et al., 2 Mar 2025). Accordingly, several ISL systems restrict framing; a relatively complete formulation admits only an ok-frame rule and does not extend it to the er-case (Lee et al., 2 Mar 2025). The treatment of framing is therefore a technical fault line in ISL, not a routine transfer of standard separation-logic practice.

3. Proof rules, weakest postconditions, and relative completeness

Completeness-oriented ISL systems include rules for skip, error, sequencing, choice, loops, consequence, disjunction, existential quantification, assignment, havoc, assume, local variables, and heap-manipulating commands such as allocation, free, load, and store (Lee et al., 3 Aug 2025). The consequence rule has the under-approximate shape

$P$3

so proof search weakens the precondition and strengthens the postcondition in the direction appropriate to reachability (Lee et al., 3 Aug 2025).

The modern relative-completeness results are driven by weakest postconditions rather than by semantic predicates. The semantic set

$P$4

collects the exact $P$5-outcomes reachable from $P$6, and the proof system constructs a syntactic assertion $P$7 intended to denote exactly that set (Lee et al., 3 Aug 2025). The key expressiveness result is

$P$8

which yields the derivability of the weakest-postcondition triple and then relative completeness via consequence (Lee et al., 3 Aug 2025).

Because heap operations are alias-sensitive, canonicalization is needed. The recent completeness proof introduces canonicalization that includes variable aliasing: for every relevant pair of terms, the canonical form contains either an equality or a disequality, and the function $P$9 gathers all variables known equal to $C$0 in the pure part of a canonical symbolic heap (Lee et al., 3 Aug 2025). This case analysis is what makes free, load, and store rules precise enough for completeness.

The resulting theorem is Cook-style relative completeness:

$C$1

The result is relative because it assumes an oracle capable of checking entailment between formulas (Lee et al., 3 Aug 2025). The array-and-pointer-arithmetic extension proves the analogous relative completeness result after enriching the assertion language and weakest-postcondition calculus with arrays, block boundaries, and pointer arithmetic (Lee et al., 2 Mar 2025).

4. Universal frames, local axioms, and systematic redesign

A major recent development is a general methodology for deriving separation logics systematically from semantics rather than designing them ad hoc. In this framework, ISL appears as the forward-under-approximate point in a taxonomy parameterized by direction of analysis and sense of approximation, and the methodology derives local axioms by combining consequence closure, frame closure, existential closure, and optionally disjunction closure (Bruni et al., 20 May 2026).

The most consequential change for ISL is the use of universal frames defined with logical variables. A universal frame $C$2 constrains only logical variables and satisfies

$C$3

which eliminates the classical syntactic side condition

$C$4

by construction (Bruni et al., 20 May 2026). The resulting semantic frame rule uses heap compatibility rather than a program-variable side condition, and the framework proves preservation theorems for both forward and backward analyses. For ISL-style reasoning, this yields a universal frame rule without additional syntactic side conditions.

Within this systematic reconstruction, the paper defines an ISL+ that reproduces ISL-style reasoning but with local axioms derived from minimal heaps and without requiring the special ISL memory model as a prerequisite for sound framing (Bruni et al., 20 May 2026). The paper states that ISL+ is more expressive than ISL. The incompleteness source identified in original ISL is that valid triples can be blocked by side conditions like $C$5, even when the variable is not actually modified along the relevant path.

A representative separating example is

$C$6

which is provable in ISL+ but not in original ISL because the frame-rule side condition blocks the use of the local axiom for x := [y] after y has been deallocated (Bruni et al., 20 May 2026). The same framework also proves a state-wise completeness property for ISL+: if a concrete run exists, then for every concrete pre-state there is a derivable triple capturing the corresponding post-state (Bruni et al., 20 May 2026). This reframes ISL not as a fixed calculus but as one instance of a broader semantic design space for local bug logics.

5. Automation, compositional analysis, and tool architectures

ISL is closely tied to symbolic execution and bi-abduction. In the context of vulnerability detection, it is described as especially useful for automatic memory-safety bug detection because it can be automated via bi-abduction based symbolic execution and supports compositional and incremental program analysis (Murray et al., 2021). It is already automated in the Infer tool, and its characteristic bug classes include null-pointer dereferences and use-after-free errors (Murray et al., 2021).

This automation pattern has been reused and generalized. Insecurity Separation Logic is a relational under-approximate logic for information leakage and memory-safety issues in interactive programs, but it is designed to purposefully resemble the non-relational ISL already automated in Infer (Murray et al., 2021). Its proof rules for skip, assignment, load/store, allocation/free, sequential composition, frame, consequence, disjunction, and existential quantification are analogous to ISL rules, and its symbolic execution procedure is purposefully essentially identical to that for ISL (Murray et al., 2021). The significance is methodological: ISL serves as a reusable automation template for under-approximate reasoning beyond single-execution memory safety.

A more abstract account comes from compositional symbolic execution engines based on consume and produce. One such engine provides a common foundation for both separation-logic correctness reasoning and ISL-style incorrectness reasoning, with the difference in the underlying engine mainly amounting to the choice to use satisfiability or validity and to mode-dependent behavior in consume and produce (Lööw et al., 2024). The same line of work extends Gillian with incorrectness reasoning and automatic true bug-finding using incorrectness bi-abduction (Lööw et al., 2024).

Memory-model-parametric work pushes this further. A recent foundation for compositional symbolic execution is explicitly based on standard definitions of SL and ISL, is mechanized in Rocq, and is instantiated to a broad range of memory models, including models for C and CHERI (Lööw et al., 21 Aug 2025). In this architecture, ISL supplies the UX soundness side of the engine: symbolic execution may discard some paths, but it must not invent false bugs. The framework also makes precise that UX soundness can be delicate and memory-model dependent (Lööw et al., 21 Aug 2025).

ISL has also been extended with blame and sanitization. SILC enriches ISL assertions with world-tagged blame predicates and sanitization templates so that when a manifest memory bug appears in composed client-vendor code, the analysis can determine which side is responsible and where to insert a mitigation (Lin et al., 2024). In that setting, ISL remains the reasoning engine; the novelty is fault tracking and sanitization insertion layered on top of the same symbolic-heap and biabductive substrate.

6. Generalizations, variants, and conceptual extensions

ISL has become a reference point for several neighboring logics. Exact Separation Logic addresses a limitation inherent in under-approximate logics by introducing exact specifications that are simultaneously over-approximate enough to characterize all terminating behavior and under-approximate enough to guarantee that all established results and errors are reachable (Maksimović et al., 2022). That work proves soundness with mutually recursive functions and states that it demonstrates, for the first time, function compositionality for a UX logic (Maksimović et al., 2022). Its comparison with ISL also highlights a recurring UX caveat: abstraction cannot be used as freely in UX logics as in OX logics (Maksimović et al., 2022).

Outcome Separation Logic generalizes the local-reasoning idea in a different direction. It is sound for both correctness and incorrectness reasoning in programs with computational effects, interprets executions as weighted collections of outcomes, supports a frame rule, and can simulate ISL-style bug-finding by retaining one bug-relevant outcome and collapsing the rest into $C$7 (Zilberstein et al., 2023). This places ISL within a wider outcome-based semantics that also encompasses nondeterministic and probabilistic choice (Zilberstein et al., 2023).

Sufficient Incorrectness Logic and Separation SIL provide a backward under-approximate contrast. The paper’s central claim is that Incorrectness Logic and SIL both perform under-approximations, but whereas the former exposes only true errors, the latter locates the set of initial states that lead to such errors (Ascari et al., 2023). When instantiated with Separation Logic, Separation SIL can yield more succinct postconditions and stronger guarantees than ISL on pointer programs, particularly because it characterizes sufficient error-causing initial states rather than only reachable erroneous outcomes (Ascari et al., 2023).

The same under-approximate philosophy has been exported beyond heaps. A graph-program incorrectness logic adapts the semantics of reachable bad states and finitely failing executions to graph rewriting, proving soundness and relative completeness while replacing heap assertions with graph assertions (Poskitt, 2021). Although it is not a separation logic over heaps, it preserves the semantic inversion, reversed consequence, and weakest-postcondition orientation characteristic of incorrectness reasoning (Poskitt, 2021).

A more recent conceptual extension moves in the opposite direction, from program logic into type theory. Coverage types reinterpret refinement types as lower bounds on what expressions are guaranteed to produce, thereby embedding must-style underapproximate reasoning in a type system and drawing an explicit connection to Incorrectness Logic and ISL (Zhou et al., 1 Sep 2025). In property-based testing, this supports reasoning not only about safety of generators but also about their completeness or coverage (Zhou et al., 1 Sep 2025). This suggests that ISL is best understood not merely as a specialized heap calculus, but as one influential realization of a broader reachability-oriented view of specification in which specifications are lower bounds on behavior rather than upper bounds.