---
title: PARAMING in Static Analysis Tuning
url: https://www.emergentmind.com/topics/paraming
type: topic
---

# PARAMING in Static Analysis Tuning

Searching arXiv for PARF and closely related static-analysis tuning work.
PARAMING, in the sense developed through PARF, denotes the automatic mining and tuning of parameter configurations for static program analysis. The central problem is to choose an abstraction strategy for a static analyzer so that analysis returns as few alarms as possible within a fixed time budget, without requiring labor-intensive manual tuning. PARF formulates this problem for analyzers such as Frama-C/Eva by modeling abstraction parameters as random variables over complete lattices, sampling configurations, analyzing the target program, and adaptively refining parameter distributions from intermediate alarm-elimination evidence until the budget is exhausted [2505.13229].

## 1. Problem setting and formal objective

Static analysis approximates concrete semantics with abstract interpretation to detect runtime errors without executing code. Its abstraction strategy governs the precision–efficiency trade-off, and this strategy is often exposed through external parameters such as domain activation, loop unrolling limits, widening delay, and state partitioning or splitting options. PARAMING arises because finer precision can reduce false alarms but can also increase analysis time or induce non-termination under resource limits, while off-the-shelf analyzers expose many parameters with large, often infinite, search spaces [2505.13229].

The formal optimization target is: given a target program $\mathrm{prog}$, a time budget $T > 0$, a monotonic static analyzer $\mathrm{Analyze}$, and its joint parameter space $S$, find $p \in S$ such that $\mathrm{Analyze}(\mathrm{prog}, p)$ returns as few alarms as possible within $T$. Monotonicity means that higher-precision parameter settings lead to fewer alarms. This assumption is operational rather than absolute: the reported results note corner cases with departures from strict monotonicity, but the method remains robust in practice [2505.13229].

PARF addresses this task by combining exploitation and exploration. Exploitation preserves the least precision already shown sufficient to eliminate observed alarms. Exploration samples more precise settings when the current budget and completion rate permit. A plausible implication is that PARAMING is best viewed not as exhaustive search, but as an adaptive, evidence-driven control layer over an otherwise unchanged analyzer.

## 2. Lattice-theoretic parameter model

PARF assigns each parameter a value space $S$ equipped with a complete lattice $L = (S, \sqsubseteq, \sqcup, \sqcap, \top, \bot)$. This makes “more precise” and “less precise” parameter settings comparable and enables component-wise aggregation in the joint parameter space [2505.13229].

For integer parameters such as `slevel` and loop-unrolling controls, the space is $S = \mathbb{N} \cup \{\infty\}$, ordered by $a \sqsubseteq b$ iff $a \le b$, with join $\max$, meet $\min$, $\top = \infty$, and $\bot = 0$. For Boolean parameters such as `split-return` and `remove-redundant-alarms`, the space is $S = \{F, T\}$, ordered by implication, with join $\lor$, meet $\land$, $\top = T$, and $\bot = F$. For set-of-strings parameters such as `domains`, the space is $S = 2^U$, ordered by subset inclusion, with join as union, meet as intersection, $\top = U$, and $\bot = \varnothing$. A set-valued parameter can be encoded as a Boolean vector $(b_1,\dots,b_c)$ for $c = |U|$.

The joint space $S_{\text{joint}}$ is the product lattice across all parameters, ordered pointwise. This product structure is essential because PARF summarizes “minimum precision to eliminate alarms” by taking meets within a parameter and joins across alarms. The method therefore treats abstraction tuning as order-theoretic inference rather than as flat hyperparameter search.

Each parameter $P$ is modeled as a composite random variable
$$
P = P_{\text{base}} \oplus P_{\text{delta}}.
$$
Here $P_{\text{base}}$ is a Dirac random variable encoding retained knowledge, while $P_{\text{delta}}$ is a type-specific exploration variable. For integers, $P_{\text{delta}} \sim \mathrm{Poisson}(\lambda)$ and $\oplus$ is addition. For Booleans, $P_{\text{delta}} \sim \mathrm{Bernoulli}(q)$ and $\oplus$ is disjunction. For set-of-strings parameters, the delta is a vector of independent Bernoulli variables and $\oplus$ is pointwise disjunction. This decomposition is the core abstraction of PARF: the base records established necessity, whereas the delta governs stochastic exploration [2505.13229].

## 3. Adaptive sampling and refinement

PARF initializes $P_{\text{base}}$ from a low-precision baseline aligned with Frama-C/Eva’s `-eva-precision 0`, for example `slevel = 0`, `partition-history = 0`, and `domains = (T,F,F,F,F)` with `cvalues` enabled and the other domains disabled. The initialization of $P_{\text{delta}}$ reflects expected efficiency impact: costlier knobs start with smaller Poisson means, while Bernoulli parameters use neutral initialization such as $q = 0.5$ [2505.13229].

The iterative loop has three stages. First, PARF samples `num_sample` configurations by drawing each parameter independently from its base and delta parts and combining them via $\oplus$. Second, it analyzes these configurations in parallel with Frama-C/Eva using `num_process` workers until the per-iteration time budget is exhausted, recording termination flags and emitted alarms. Third, it refines both the base and delta distributions from the completed analyses.

Base refinement uses an outcome matrix $R$ whose entries indicate whether an analysis emits a given alarm, together with the vector $V$ of parameter values used in those analyses. The least-precision setting sufficient to eliminate all newly observed false alarms is computed as follows:

```text
For each alarm j:
  tmp ← ⊤
  For i = 1..m:
    If R_ij = “no alarm” then tmp ← tmp ⊓ V_i
  If tmp ≠ ⊤ then P_base' ← P_base' ⊔ tmp
Return P_base'
```

The meet accumulates the greatest lower bound among values that eliminate a particular alarm, and the outer join combines these requirements across alarms. This preserves monotonic knowledge: once evidence shows that some precision is necessary, that evidence is retained in the base component [2505.13229].

Delta refinement is resource-aware. Let
$$
\eta_c = \frac{\#\text{completed analyses}}{\text{num\_sample}}, \qquad
\eta = 2\eta_c + \frac{1}{\text{num\_sample}}.
$$
Then PARF scales exploration by updating Poisson and Bernoulli parameters:
$$
\lambda' = \lambda \times \eta, \qquad
q' = 1 - (1-q)^\eta.
$$
For set-of-strings parameters, the Bernoulli update is applied component-wise. Larger $\eta$ broadens exploration because more sampled analyses completed within budget; smaller $\eta$ dampens exploration to avoid repeated timeouts. Fitness is measured primarily by the number of emitted alarms, with termination status affecting exploration through $\eta$. PARF therefore does not rely on Bayesian posterior updates or acquisition functions; its refinement is lattice-guided and resource-aware [2505.13229].

The refinement cost per parameter is $O(m \cdot n)$ per round, where $m$ is the number of completed runs and $n$ the number of distinct alarms. In practice, analyzer runtime dominates.

## 4. Instantiation in Frama-C/Eva

PARF is implemented on top of Frama-C/Eva and supports 13 parameters across several types. The analyzer is treated as a black box with interface $\mathrm{Analyze}(\mathrm{prog}, p) \rightarrow A_p$, and inputs are passed through Frama-C/Eva’s parameter interface. Parallel execution is implemented via Parmap in OCaml, and the system includes an OCaml backend of approximately 1,500 LOC and a frontend in Next.js/TypeScript [2505.13229].

| Parameter class | Supported parameters | Encoding |
|---|---|---|
| Integers | `min-loop-unroll`, `auto-loop-unroll`, `widening-delay`, `partition-history`, `slevel`, `ilevel`, `plevel`, `subdivide-non-linear` | $\mathbb{N} \cup \{\infty\}$ |
| Booleans | `split-return`, `remove-redundant-alarms`, `octagon-through-calls` | $\{F,T\}$ |
| String/sets | `equality-through-calls \in \{none, formals\}`, `domains \subseteq \{\text{cvalues, octagon, equality, gauges, symbolic-locations}\}` | Boolean or Boolean-vector |

Two examples are especially important. For `slevel`, increasing the integer value increases precision; PARF samples $s = a + X$ with $a$ from the Dirac base and $X \sim \mathrm{Poisson}(\lambda)$. For `domains`, the base is a Boolean vector and the delta is a vector of Bernoulli variables, so each sampling round decides probabilistically which abstract domains to enable in addition to the retained baseline. This suggests that the framework is not tied to a particular knob type; it depends instead on whether the parameter admits an ordered precision interpretation.

Soundness is preserved because tuning occurs inside the analyzer’s own sound abstraction mechanisms, and PARF raises the base component conservatively only when alarm elimination evidence justifies doing so. Exploration scaling is designed specifically to avoid aggressive precision increases that lead to timeouts [2505.13229].

## 5. Dominance analysis, interface, and interpretability

PARF includes a post-hoc controlled-experiment procedure for identifying dominant parameters on a per-benchmark basis. In the “Selected” experiment, one parameter from the best found configuration `Parf_opt` is retained while the other 12 are reset to the low-precision baseline `precision0`. In the “Excluded” experiment, one parameter from `Parf_opt` is replaced with its low-precision version while the other 12 remain fixed. The influence score is then
$$
s = \frac{0.5 \cdot a + 0.5 \cdot b}{d},
$$
where $a = (\#\text{alarms in baseline}) - (\#\text{alarms in Selected})$, $b = (\#\text{alarms in Excluded}) - (\#\text{alarms in Parf\_opt})$, and $d = (\#\text{alarms in baseline}) - (\#\text{alarms in Parf\_opt})$ [2505.13229].

Across OSCS, `slevel` is the most influential parameter with average score $0.490$, and `domains` is second with $0.258$. Dominance is program-dependent: `auto-loop-unroll` or `min-loop-unroll` dominate on certain `miniz` tasks with heavy loops. Negative influence scores occur in corner cases that indicate departures from strict monotonicity. The reported interpretation is that PARF’s meet-and-join refinement tends to suppress disturbing parameters and elevate truly dominant ones.

The system also exposes a web-based UI supporting program upload, hyperparameter configuration (`num_sample`, `time_budget`, `num_process`), visualization of evolving parameter distributions, and monitoring of progress and final results. The interface shows how $P_{\text{base}}$ accumulates least-precision guarantees and how $P_{\text{delta}}$ expands or contracts exploration. A plausible implication is that PARF does not treat tuning as opaque optimization; it also provides an interpretability layer for static-analysis practice [2505.13229].

A concrete case study on the `tutorials` benchmark illustrates this point. The `expert` baseline uses high `slevel` and `partition-history = 2` but still leaves an out-of-bound false alarm, whereas PARF finds that high `slevel` with `partition-history = 0` eliminates the alarm. This shows that raising every knob is not always beneficial.

## 6. Empirical results, comparisons, and limitations

The empirical evaluation uses the Frama-C Open Source Case Studies, comprising 37 real-world C projects such as `x509-parser` and `chrony`, and the SV-COMP 2024 NoOverflows tasks with Frama-C-SV. The main OSCS configuration uses `num_sample = 4`, a time budget of 1 hour per benchmark, and hardware with dual AMD EPYC 32 cores and 128GB RAM. Baselines include `precision0`, `default`, `expert`, and `official` tailored configurations [2505.13229].

On OSCS, PARF achieves the least number of alarms on 33/37 benchmarks, or 89.2%, and obtains exclusively best results on 11/37, or 29.7%. Repeated runs report both `Parf_opt` and `Parf_avg`, with `Parf_opt` compared against baselines. The strongest gains occur on large-scale, complex programs with low initial `-eva-precision`, which the paper attributes to effective exploration and exploitation under time constraints.

On SV-COMP NoOverflows verification, the comparison is between `Frama-C-SV_precision11` and `Frama-C-SV_Parf`, using the SV-COMP scoring rules: true correct `+2`, false correct `+1`, true incorrect `-32`, false incorrect `-16`, and unknown, failure, or error `0`. The total score improves from `1006` to `1084`. PARF eliminates all `104` timeouts by finding adaptive configurations, successfully verifies `42` tasks among prior failures, and misses only `3` true correct tasks out of `1057` [2505.13229].

The reported comparisons situate PARF against several prior tuning styles. Frama-C/Eva’s `-eva-precision` packs make coarse precision jumps without automatic adaptation. The `expert` strategy raises precision sequentially but binds parameters together and cannot learn from alarm evidence across runs. Goblint autotuning performs a syntactic heuristic toggle once before analysis, without dynamic refinement during execution. CPA+ tunes precision from internal verification context, while data-driven approaches such as BinGraph and GNN-based refinement require training data. PARF is presented instead as analyzer-agnostic, alarm-driven, and training-free.

Its limitations are equally explicit. Parameters are modeled as independent random variables, even though interactions such as `partition-history` increasing `slevel` needs can be strong. Initialization remains heuristic. PARF cannot eliminate all false positives, and the paper identifies conditional models, joint distributions, learning-based initialization, and integration with SMT or proof assistants for alarm validation as future directions. This suggests that PARAMING, as instantiated by PARF, is best understood as a principled adaptive tuner for abstraction strategy rather than a complete solution to precision, soundness, or alarm validation in static analysis [2505.13229].

Source: https://www.emergentmind.com/topics/paraming