PARAMING in Static Analysis Tuning

• PARAMING is the automatic tuning of parameter configurations in static program analysis to minimize false alarms while managing resource constraints.
• It employs an adaptive sampling strategy with lattice-theoretic models to balance exploration and exploitation of abstraction precision settings.
• Implemented in Frama-C/Eva, PARAMING refines parameters dynamically, improving analysis efficiency and effectiveness on real-world benchmarks.

Searching arXiv for PARF and closely related static-analysis tuning work. PARAMING, in the sense developed through PARF, denotes the automatic mining and tuning of parameter configurations for static program analysis. The central problem is to choose an abstraction strategy for a static analyzer so that analysis returns as few alarms as possible within a fixed time budget, without requiring labor-intensive manual tuning. PARF formulates this problem for analyzers such as Frama-C/Eva by modeling abstraction parameters as random variables over complete lattices, sampling configurations, analyzing the target program, and adaptively refining parameter distributions from intermediate alarm-elimination evidence until the budget is exhausted (Wang et al., 19 May 2025).

1. Problem setting and formal objective

Static analysis approximates concrete semantics with abstract interpretation to detect runtime errors without executing code. Its abstraction strategy governs the precision–efficiency trade-off, and this strategy is often exposed through external parameters such as domain activation, loop unrolling limits, widening delay, and state partitioning or splitting options. PARAMING arises because finer precision can reduce false alarms but can also increase analysis time or induce non-termination under resource limits, while off-the-shelf analyzers expose many parameters with large, often infinite, search spaces (Wang et al., 19 May 2025).

The formal optimization target is: given a target program $\mathrm{prog}$, a time budget $T > 0$, a monotonic static analyzer $\mathrm{Analyze}$, and its joint parameter space $S$, find $p \in S$ such that $\mathrm{Analyze}(\mathrm{prog}, p)$ returns as few alarms as possible within $T$. Monotonicity means that higher-precision parameter settings lead to fewer alarms. This assumption is operational rather than absolute: the reported results note corner cases with departures from strict monotonicity, but the method remains robust in practice (Wang et al., 19 May 2025).

PARF addresses this task by combining exploitation and exploration. Exploitation preserves the least precision already shown sufficient to eliminate observed alarms. Exploration samples more precise settings when the current budget and completion rate permit. A plausible implication is that PARAMING is best viewed not as exhaustive search, but as an adaptive, evidence-driven control layer over an otherwise unchanged analyzer.

2. Lattice-theoretic parameter model

PARF assigns each parameter a value space $S$ equipped with a complete lattice $L = (S, \sqsubseteq, \sqcup, \sqcap, \top, \bot)$. This makes “more precise” and “less precise” parameter settings comparable and enables component-wise aggregation in the joint parameter space (Wang et al., 19 May 2025).

For integer parameters such as slevel and loop-unrolling controls, the space is $S = \mathbb{N} \cup \{\infty\}$, ordered by $T > 0$0 iff $T > 0$1, with join $T > 0$2, meet $T > 0$3, $T > 0$4, and $T > 0$5. For Boolean parameters such as split-return and remove-redundant-alarms, the space is $T > 0$6, ordered by implication, with join $T > 0$7, meet $T > 0$8, $T > 0$9, and $\mathrm{Analyze}$0. For set-of-strings parameters such as domains, the space is $\mathrm{Analyze}$1, ordered by subset inclusion, with join as union, meet as intersection, $\mathrm{Analyze}$2, and $\mathrm{Analyze}$3. A set-valued parameter can be encoded as a Boolean vector $\mathrm{Analyze}$4 for $\mathrm{Analyze}$5.

The joint space $\mathrm{Analyze}$6 is the product lattice across all parameters, ordered pointwise. This product structure is essential because PARF summarizes “minimum precision to eliminate alarms” by taking meets within a parameter and joins across alarms. The method therefore treats abstraction tuning as order-theoretic inference rather than as flat hyperparameter search.

Each parameter $\mathrm{Analyze}$7 is modeled as a composite random variable

$\mathrm{Analyze}$8

Here $\mathrm{Analyze}$9 is a Dirac random variable encoding retained knowledge, while $S$0 is a type-specific exploration variable. For integers, $S$1 and $S$2 is addition. For Booleans, $S$3 and $S$4 is disjunction. For set-of-strings parameters, the delta is a vector of independent Bernoulli variables and $S$5 is pointwise disjunction. This decomposition is the core abstraction of PARF: the base records established necessity, whereas the delta governs stochastic exploration (Wang et al., 19 May 2025).

3. Adaptive sampling and refinement

PARF initializes $S$6 from a low-precision baseline aligned with Frama-C/Eva’s -eva-precision 0, for example slevel = 0, partition-history = 0, and domains = (T,F,F,F,F) with cvalues enabled and the other domains disabled. The initialization of $S$7 reflects expected efficiency impact: costlier knobs start with smaller Poisson means, while Bernoulli parameters use neutral initialization such as $S$8 (Wang et al., 19 May 2025).

The iterative loop has three stages. First, PARF samples num_sample configurations by drawing each parameter independently from its base and delta parts and combining them via $S$9. Second, it analyzes these configurations in parallel with Frama-C/Eva using num_process workers until the per-iteration time budget is exhausted, recording termination flags and emitted alarms. Third, it refines both the base and delta distributions from the completed analyses.

Base refinement uses an outcome matrix $p \in S$0 whose entries indicate whether an analysis emits a given alarm, together with the vector $p \in S$1 of parameter values used in those analyses. The least-precision setting sufficient to eliminate all newly observed false alarms is computed as follows:

$T$4

The meet accumulates the greatest lower bound among values that eliminate a particular alarm, and the outer join combines these requirements across alarms. This preserves monotonic knowledge: once evidence shows that some precision is necessary, that evidence is retained in the base component (Wang et al., 19 May 2025).

Delta refinement is resource-aware. Let

$p \in S$2

Then PARF scales exploration by updating Poisson and Bernoulli parameters:

$p \in S$3

For set-of-strings parameters, the Bernoulli update is applied component-wise. Larger $p \in S$4 broadens exploration because more sampled analyses completed within budget; smaller $p \in S$5 dampens exploration to avoid repeated timeouts. Fitness is measured primarily by the number of emitted alarms, with termination status affecting exploration through $p \in S$6. PARF therefore does not rely on Bayesian posterior updates or acquisition functions; its refinement is lattice-guided and resource-aware (Wang et al., 19 May 2025).

The refinement cost per parameter is $p \in S$7 per round, where $p \in S$8 is the number of completed runs and $p \in S$9 the number of distinct alarms. In practice, analyzer runtime dominates.

4. Instantiation in Frama-C/Eva

PARF is implemented on top of Frama-C/Eva and supports 13 parameters across several types. The analyzer is treated as a black box with interface $\mathrm{Analyze}(\mathrm{prog}, p)$0, and inputs are passed through Frama-C/Eva’s parameter interface. Parallel execution is implemented via Parmap in OCaml, and the system includes an OCaml backend of approximately 1,500 LOC and a frontend in Next.js/TypeScript (Wang et al., 19 May 2025).

Parameter class	Supported parameters	Encoding
Integers	min-loop-unroll, auto-loop-unroll, widening-delay, partition-history, slevel, ilevel, plevel, subdivide-non-linear	$\mathrm{Analyze}(\mathrm{prog}, p)$1
Booleans	split-return, remove-redundant-alarms, octagon-through-calls	$\mathrm{Analyze}(\mathrm{prog}, p)$2
String/sets	equality-through-calls \in \{none, formals\}, domains \subseteq \{\text{cvalues, octagon, equality, gauges, symbolic-locations}\}	Boolean or Boolean-vector

Two examples are especially important. For slevel, increasing the integer value increases precision; PARF samples $\mathrm{Analyze}(\mathrm{prog}, p)$3 with $\mathrm{Analyze}(\mathrm{prog}, p)$4 from the Dirac base and $\mathrm{Analyze}(\mathrm{prog}, p)$5. For domains, the base is a Boolean vector and the delta is a vector of Bernoulli variables, so each sampling round decides probabilistically which abstract domains to enable in addition to the retained baseline. This suggests that the framework is not tied to a particular knob type; it depends instead on whether the parameter admits an ordered precision interpretation.

Soundness is preserved because tuning occurs inside the analyzer’s own sound abstraction mechanisms, and PARF raises the base component conservatively only when alarm elimination evidence justifies doing so. Exploration scaling is designed specifically to avoid aggressive precision increases that lead to timeouts (Wang et al., 19 May 2025).

5. Dominance analysis, interface, and interpretability

PARF includes a post-hoc controlled-experiment procedure for identifying dominant parameters on a per-benchmark basis. In the “Selected” experiment, one parameter from the best found configuration Parf_opt is retained while the other 12 are reset to the low-precision baseline precision0. In the “Excluded” experiment, one parameter from Parf_opt is replaced with its low-precision version while the other 12 remain fixed. The influence score is then

$\mathrm{Analyze}(\mathrm{prog}, p)$6

where $\mathrm{Analyze}(\mathrm{prog}, p)$7, $\mathrm{Analyze}(\mathrm{prog}, p)$8, and $\mathrm{Analyze}(\mathrm{prog}, p)$9 (Wang et al., 19 May 2025).

Across OSCS, slevel is the most influential parameter with average score $T$0, and domains is second with $T$1. Dominance is program-dependent: auto-loop-unroll or min-loop-unroll dominate on certain miniz tasks with heavy loops. Negative influence scores occur in corner cases that indicate departures from strict monotonicity. The reported interpretation is that PARF’s meet-and-join refinement tends to suppress disturbing parameters and elevate truly dominant ones.

The system also exposes a web-based UI supporting program upload, hyperparameter configuration (num_sample, time_budget, num_process), visualization of evolving parameter distributions, and monitoring of progress and final results. The interface shows how $T$2 accumulates least-precision guarantees and how $T$3 expands or contracts exploration. A plausible implication is that PARF does not treat tuning as opaque optimization; it also provides an interpretability layer for static-analysis practice (Wang et al., 19 May 2025).

A concrete case study on the tutorials benchmark illustrates this point. The expert baseline uses high slevel and partition-history = 2 but still leaves an out-of-bound false alarm, whereas PARF finds that high slevel with partition-history = 0 eliminates the alarm. This shows that raising every knob is not always beneficial.

6. Empirical results, comparisons, and limitations

The empirical evaluation uses the Frama-C Open Source Case Studies, comprising 37 real-world C projects such as x509-parser and chrony, and the SV-COMP 2024 NoOverflows tasks with Frama-C-SV. The main OSCS configuration uses num_sample = 4, a time budget of 1 hour per benchmark, and hardware with dual AMD EPYC 32 cores and 128GB RAM. Baselines include precision0, default, expert, and official tailored configurations (Wang et al., 19 May 2025).

On OSCS, PARF achieves the least number of alarms on 33/37 benchmarks, or 89.2%, and obtains exclusively best results on 11/37, or 29.7%. Repeated runs report both Parf_opt and Parf_avg, with Parf_opt compared against baselines. The strongest gains occur on large-scale, complex programs with low initial -eva-precision, which the paper attributes to effective exploration and exploitation under time constraints.

On SV-COMP NoOverflows verification, the comparison is between Frama-C-SV_precision11 and Frama-C-SV_Parf, using the SV-COMP scoring rules: true correct +2, false correct +1, true incorrect -32, false incorrect -16, and unknown, failure, or error 0. The total score improves from 1006 to 1084. PARF eliminates all 104 timeouts by finding adaptive configurations, successfully verifies 42 tasks among prior failures, and misses only 3 true correct tasks out of 1057 (Wang et al., 19 May 2025).

The reported comparisons situate PARF against several prior tuning styles. Frama-C/Eva’s -eva-precision packs make coarse precision jumps without automatic adaptation. The expert strategy raises precision sequentially but binds parameters together and cannot learn from alarm evidence across runs. Goblint autotuning performs a syntactic heuristic toggle once before analysis, without dynamic refinement during execution. CPA+ tunes precision from internal verification context, while data-driven approaches such as BinGraph and GNN-based refinement require training data. PARF is presented instead as analyzer-agnostic, alarm-driven, and training-free.

Its limitations are equally explicit. Parameters are modeled as independent random variables, even though interactions such as partition-history increasing slevel needs can be strong. Initialization remains heuristic. PARF cannot eliminate all false positives, and the paper identifies conditional models, joint distributions, learning-based initialization, and integration with SMT or proof assistants for alarm validation as future directions. This suggests that PARAMING, as instantiated by PARF, is best understood as a principled adaptive tuner for abstraction strategy rather than a complete solution to precision, soundness, or alarm validation in static analysis (Wang et al., 19 May 2025).