Semantically-Oriented Mutation Operators (SOMO)

• SOMO are mutation operators that use behavioral semantics—such as truth-table evaluations in CGP—to drive efficient and targeted mutations.
• They redefine mutation testing by incorporating domain invariants, fault models, and conservation principles to better expose defects.
• Applications range from CGP circuit evolution to LLM-based and intent-driven mutations, yielding significant efficiency gains and deeper fault insights.

Semantically-Oriented Mutation Operators (SOMO) denote mutation operators whose construction is guided by semantics—behavioral meaning, domain invariants, intent, or task-specific fault models—rather than solely by local syntactic rewrites. In the narrow sense, the term is used explicitly for a mutation operator in Cartesian Genetic Programming (CGP) that exploits truth-table semantics to choose beneficial reconnections during Boolean circuit evolution (Hodan et al., 2020). In a broader and partly inferential sense, adjacent work extends the same design principle to semantic-preserving rewrites used as mutation-like probes for robustness, domain-semantic mutants for metamorphic testing, LLM-generated context-aware buggy replacements, latent-space mutations aligned with semantic program components, and mutations of natural-language programming intents (Hort et al., 30 Mar 2025, Li et al., 17 May 2026, Tip et al., 2024, Siper et al., 7 Feb 2026, Hamidi et al., 6 Jul 2026). The unifying question is not merely how to edit code, but what notion of semantics a mutation operator is intended to preserve, perturb, or expose.

1. Conceptual scope and relation to classical mutation

Classical mutation testing usually operates with fixed syntactic operator sets: arithmetic-operator replacement, condition negation, literal substitution, statement deletion, and comparable AST-local edits. SOMO departs from that regime by redefining the target of mutation. Depending on the setting, the operator may preserve semantics to test invariance under meaning-equivalent variants, or it may inject semantically meaningful faults that better match the defect hypotheses of a domain.

The cited literature exhibits several distinct substrates for semantics-oriented mutation. In CGP, semantics are exact Boolean truth tables (Hodan et al., 2020). In defect detection, semantics are preserved while syntax is rewritten, so inconsistencies in model predictions reveal brittleness (Hort et al., 30 Mar 2025). In scientific computing, mutation operators are defined around conservation, hyperparameters, trajectories, and structural changes rather than AST-local edits (Li et al., 17 May 2026). LLM-based mutation systems replace local templates with context-aware buggy fragments or code synthesized from altered intents (Tip et al., 2024, Hamidi et al., 6 Jul 2026). In continuous program search, mutation is compiled around semantically paired latent subspaces and behavioral locality (Siper et al., 7 Feb 2026). Domain-specific mutation systems such as SuMo design operators around likely Solidity faults, including visibility, modifiers, Ether transfer, and blockchain globals (Barboni et al., 2021).

Setting	What is mutated	Semantic basis
CGP circuit evolution	Active-node connections	Truth-table behavior
Defect detection robustness	Semantic-preserving code rewrites	Prediction invariance under equivalent code
Scientific computing metamorphic testing	Domain-semantic mutant classes	Conservation, operator/API choice, hyperparameters, trajectories, structure
LLM-based mutation testing	Contextual buggy replacements	Plausible behavioral mistakes in code context
Intent-based mutation	Natural-language programming intents	Slightly altered specifications
Continuous program search	Latent semantic components	Behavioral locality in learned program space
Solidity smart contracts	Language- and domain-specific operators	Smart-contract fault realism

A common misconception is to equate semantic orientation with arbitrary complexity. The scientific-computing formulation makes the boundary explicit: a mutation is semantic only if it satisfies at least one of three necessary conditions—cross-function/module boundary replacement, dependence on domain knowledge for legality, or change of algorithmic class (Li et al., 17 May 2026). This criterion distinguishes semantics-oriented mutation from merely elaborate syntax editing.

2. Original SOMO in Cartesian Genetic Programming

The term SOMO originates in "Semantically-Oriented Mutation Operator in Cartesian Genetic Programming for Evolutionary Circuit Design" (Hodan et al., 2020). The paper addresses a specific weakness of standard CGP: point mutation is described as “blind” because both the mutated genes and their new values are chosen randomly. In Boolean circuit synthesis, where genotypes contain many inactive nodes and the search space is highly neutral, such randomness yields poor scalability.

The CGP setting is a directed acyclic graph with input nodes $C_{PI}$, output nodes $C_{PO}$, edges $E$, and a function assignment $\psi$. Fitness is the Hamming distance between the circuit output and the target truth table: $$fitness(p) = \mathrm{HD}(p, \mathrm{TT}) = \sum_{\forall x \in \mathbb{B}^{n_i}} \mathrm{OnesCount}(p(x) \oplus \mathrm{TT}(x)).$$ A perfect circuit has fitness $0$.

SOMO mutates an active node, but does not reconnect it arbitrarily. After decoding the genotype, identifying active nodes, and selecting one active non-input node uniformly at random, the operator chooses an input edge to reconnect. It then evaluates candidate predecessor nodes semantically: for each input assignment, it simulates the remaining DAG twice, once with the selected input forced to $0$ and once with it forced to $1$, and infers which value would help satisfy the truth table. The required input value is derived with the ternary mask operator

$\maskop(t, v_0, v_1) = \begin{cases} \mathrm{`X`} & \mathrm{if~} v_0 = v_1 \ \mathrm{`0`} & \mathrm{if~} v_0 = t \ \mathrm{`1`} & \mathrm{if~} v_1 = t \end{cases}$

and the reduction operator

$\redop(a, b) = \begin{cases} a & \mathrm{when~} a \neq \mathrm{`X`} \ b & \mathrm{otherwise}. \end{cases}$

Candidate nodes are scored by how often their outputs match the inferred requirement; the selected replacement is $C_{PO}$0, with ties resolved in favor of the node closest to the program inputs.

The experiments used $C_{PO}$1-CGP with $C_{PO}$2, one-row CGP, $C_{PO}$3, $C_{PO}$4, AVX2-based parallel simulation, 15 independent runs per configuration, a 12-hour timeout, and a 15-minute no-progress abort condition (Hodan et al., 2020). SOMO successfully evolved 10-bit parity, 10+10-bit adder, and 5x5-bit multiplier circuits; the most complex circuits were evolved in less than one hour with a single-thread implementation running on a common CPU. The paper reports a 30× to 114× reduction versus the best CGP variants in the cited comparison table, and for parity circuits SOMO is reported as 119× faster on 6-bit parity, 586× on 8-bit parity, and 5098× on 9-bit parity than the compared semantic GP baseline (Hodan et al., 2020).

The original SOMO is thus not a generic mutation-testing operator. It is an operator-design intervention in evolutionary search: semantics are used to choose which mutation value is most promising, while preserving CGP’s fixed-length encoding and avoiding the bloat associated with geometric semantic GP.

3. Semantic-preserving transformations as mutation operators for robustness

A second SOMO-like direction treats semantic-preserving rewrites as mutation operators at application time. "Semantic-Preserving Transformations as Mutation Operators: A Study on Their Effectiveness in Defect Detection" (Hort et al., 30 Mar 2025) asks whether semantically identical code variants can improve vulnerability detection by ensembling predictions over the original program and its transformed versions. The setup is explicitly close to metamorphic testing: if a function and its transformed version are semantically identical, then a defect detector should ideally produce the same prediction for both.

The study first collected transformations from prior literature. It found 28 publications with 94 distinct semantic-preserving transformations, organized into six categories: Trivial, Data and Declaration, Control Flow, Function, Dead/bogus code, and API (Hort et al., 30 Mar 2025). Variable renaming appeared in 25 of the 28 publications. Among these papers, 19 shared implementation artifacts. Filtering for implementation availability, multiple transformations, and applicability to C/C++ reduced the pool to four repositories: NatGen, CodeImitator, LimitsOfML4Vuln, and RoPGen, yielding 39 transformations relevant to the study.

The crucial empirical warning is the manual semantic validation. Each of the 39 transformations was checked on up to 20 transformed functions per transformation. 23/39 transformations were rejected because manual inspection showed that they changed semantics or produced erroneous behavior; only 16/39 remained for the final experiments (Hort et al., 30 Mar 2025). This establishes a central limitation of semantics-preserving SOMO workflows: published “semantic-preserving” repositories cannot be assumed correct without verification.

The validated transformations were applied to the Devign benchmark from CodeXGLUE, which contains 27,318 C/C++ functions with binary vulnerable/non-vulnerable labels and an 80% train, 10% validation, 10% test split. Each test function could be transformed 6.3 times on average, with a range of 4 to 12 transformations, and only 3 functions received all 12 possible transformations (Hort et al., 30 Mar 2025). Four of the 16 transformations applied to every test function, especially whitespace, comments, and dead-code-related transformations.

Two fine-tuned defect detectors were evaluated: VulBERTa-MLP and PLBART. The paper considered three ensemble settings—Single model, multiple functions; Multiple models, single function; and Multiple models, multiple functions—and three combination styles: majority voting, averaging, and weighted combination. The weighted prediction is

$C_{PO}$5

with labels-based and probability-based weighting and weight optimization via SciPy’s Nelder-Mead, Powell, CG, BFGS, L-BFGS-B, TNC, COBYLA, and SLSQP optimizers (Hort et al., 30 Mar 2025).

The transformations changed model predictions in 49% of cases, while about 51% of transformed inputs preserved the original prediction. This confirms brittleness under semantically equivalent rewrites. Yet the ensemble strategies did not improve defect-detection accuracy. VulBERTa-MLP had a reproduced original accuracy of 64.71%, but its best data-ensemble result was 52.49%; PLBART had a reproduced original accuracy of 61.79%, with the best data-ensemble result 59.19% (Hort et al., 30 Mar 2025). Combining the two original models without transformed variants yielded at best 62.52%, still below VulBERTa-MLP. Tie-breaking in favor of label 0 generally worked better, likely because the dataset is class-imbalanced toward non-vulnerable functions, and averaging probabilities generally outperformed hard-label voting. The principal conclusion is negative but technically important: robustness-revealing semantic mutations need not translate into better test-time classification.

4. Domain-semantic mutation and metamorphic-relation adequacy

" A semantic mutation metric for metamorphic relation adequacy in scientific computing programs" (Li et al., 17 May 2026) generalizes the SOMO idea into an adequacy metric, the Semantic Mutation Score (SMS). The paper argues that classical mutation score, grounded in syntactic AST mutations, misses the domain semantics of scientific computing. Faults of interest include violated conservation laws, altered convergence behavior, incorrect hyperparameters, distorted trajectories, and structural changes in the computation. These are often not AST-local.

The paper defines five semantic mutation operator families:

Family	Alias	Targeted semantic pattern
Conservation Erosion	CE / $C_{PO}$6	Conservation
Operator Substitution	OS / $C_{PO}$7	Monotonicity / API- or operator-level replacement
Hyperparameter	HP / $C_{PO}$8	Convergence-related parameterization
Trajectory Flip	TF / $C_{PO}$9	Trajectory-shape / sequence distortion
Structural Injection	SI / $E$0	Fidelity-order / structural change

The SMS formula is a direct generalization of classical mutation score: $E$1 Equivalence is conservative and two-part. E1 requires AVP coherence over all metamorphic relations in $E$2, and E2 requires output equivalence on $E$3 within $E$4 (Li et al., 17 May 2026). A mutant is killed if there exists a metamorphic relation for which the source program passes and the mutant fails. The paper also proves that SMS degenerates to classical mutation score in a characterized limit, so it remains backward-compatible with mutation-testing literature in the classical regime.

Empirically, the study used a 12-PUT × 5-MP design over four scientific-computing classes—numeric, probabilistic, surrogate, and machine-learning—on single-output float-to-float kernels (Li et al., 17 May 2026). LLM-generated semantic mutants were compared with a default cosmic-ray syntactic pool at the AST-normalized level. Across 12 PUTs, there were 292 P2 mutants versus 1,250 cosmic-ray mutants, but only 15 AST-normalized overlaps, for an overall overlap rate of 5.14%. By operator class, HP had 72 mutants, 0 overlap; SI had 33 mutants, 0 overlap; TF had 54 mutants, 0 overlap; CE had 64 mutants, 5 overlap; and OS had 60 mutants, 7 overlap (Li et al., 17 May 2026). The paper concludes that HP, SI, and TF are categorically unreachable under default first-order syntactic configurations.

The measured SMS distribution is sparse: across the 60 cells, mean SMS = 0.104, median SMS = 0.000, and 45/60 cells had SMS = 0 (Li et al., 17 May 2026). Signal concentrates in aligned operator–MR cells, with aligned mean SMS = 0.275 and cross mean SMS = 0.061. Cliff’s delta for aligned versus cross is 0.323 in same-source and 0.314 in cross-source, both in the medium effect range and below the pre-registered large-effect threshold of 0.474. This is an important caution: domain-semantic mutant spaces can differ sharply from syntactic ones without automatically yielding large effect sizes. The paper identifies the main bottleneck as MR design adequacy, not merely mutant generation.

5. LLM-mediated and intent-level semantic mutation

LLM-based mutation systems extend SOMO by replacing fixed mutator sets with context-aware synthesis. "LLMorpheus: Mutation Testing using LLMs" (Tip et al., 2024) does not use the term SOMO explicitly, but it operationalizes the same idea. It parses JavaScript or TypeScript source files, chooses candidate mutation sites—conditions in if, switch, while, and do-while; loop headers and components; and the receiver, arguments, or full argument sequence of function calls—replaces the selected fragment with "<PLACEHOLDER>", and prompts an LLM to supply buggy alternatives. The default prompt includes general background about mutation testing, the source code containing the placeholder, the original fragment, and instructions to replace the placeholder with a buggy fragment that behaves differently from the original. It asks for three candidate replacements, each in a fenced code block with a one-line code fragment and a short explanation, under a system prompt that positions the model as a “mutation testing expert” (Tip et al., 2024).

The evaluation covered 13 subject packages and used codellama-34b-instruct as the main model, with additional experiments on codellama-13b-instruct and mixtral-8x7b-instruct (Tip et al., 2024). In the main run, totals were 23,890.63 prompts and 25,557.70 mutants, with 5,841,112 prompt tokens, 721,984 completion tokens, and a reported total LLM cost of about $3.62 using the commercial octo.ai service. Manual inspection of 517 surviving mutants found that 63.2% were “not equivalent,” 8.5% equivalent, 9.7% near-equivalent, and 18.6% unknown. The paper reports that LLMorpheus can produce mutants resembling existing bugs that cannot be produced by StrykerJS, including wrong method calls, property-access changes, and event-name substitutions.

Intent-based mutation moves the semantic substrate higher still, from code context to natural-language specification. "Intent-Based Mutation Testing: From Naturally Written Programming Intents to Mutants" (Hamidi et al., 6 Jul 2026) mutates the programming intent implemented by the program. One alphanumeric token at a time is masked, BERT predicts a replacement, and GPT-3.5-turbo generates executable code for the mutated intent. The study also asks GPT to produce 10 alternative implementations of the original intent directly (Hamidi et al., 6 Jul 2026). The evaluation used 29 programs derived from HumanEval-x Java tasks augmented with translated HumanEval+ tests.

The paper reports 2357 generated and 2144 valid mutants for the mutated-intent approach, 290 generated and 235 valid for direct intent generation, and 3608 generated and 996 valid for the syntax-based baseline (Hamidi et al., 6 Jul 2026). This corresponds to validity rates of 91%, 81%, and 27.6%. Intent-based mutants were syntactically much more distant from the original code than syntax-based mutants, with mean distances such as 1 - BLEU = 0.672 for intent-mutated and 1 - BLEU = 0.031 for syntax-based mutation. The key semantic-diversity result is that 55% of the intent-based mutations are not subsumed by traditional mutations. Using the merged global subsuming set as reference, tests generated from intent-mutated mutants killed 81.7%, compared with 77% for syntax-based and 66% for direct-intent mutants (Hamidi et al., 6 Jul 2026). The paper therefore treats intent-based mutation as a complement rather than a replacement: no single approach subsumes the others completely.

6. Semantically aligned search spaces and domain-specific operator suites

A distinct but closely related SOMO line treats mutation as search in a semantic representation rather than direct editing of source syntax. "Continuous Program Search" (Siper et al., 7 Feb 2026) frames the problem as operator design for genetic programming. Standard GP mutation is said to be locality-breaking: small syntactic edits can induce large, unpredictable behavioral shifts. The proposed solution is to learn a continuous program space in which latent distance has behavioral meaning, then mutate within that space while keeping the underlying $E$5 evolutionary strategy fixed.

The paper uses a compact trading DSL, GPTL, whose strategies decompose into four Boolean signal expressions: LE, SE, LX, and SX. The learned latent vector is block-factorized as

$E$6

with total latent dimension 128, hence 32 dimensions per block (Siper et al., 7 Feb 2026). Behavioral locality is measured through decode success, normalized AST edit distance, and action-sequence divergence. The appendix defines

$E$7

and the empirical trust region is

$E$8

Three operators were compared under identical evaluation budgets across five assets: isotropic Gaussian mutation over all 128 dimensions, dual-block Gaussian mutation restricted to semantically paired subspaces, and Geometry-Compiled Mutation (GCM) with a learned flow-based direction model trained on logged mutation traces (Siper et al., 7 Feb 2026). The main results are GCM median Sharpe: 1.152, Isotropic median Sharpe: 1.005, Dual-block median Sharpe: 0.890, with fractions of budget needed to find strong solutions of 13.7%, 88.5%, and 100.0%, respectively. Isotropic mutation occasionally attains a higher peak Sharpe—1.607 versus GCM’s 1.518—but GCM is faster and more reliable.

A more traditional domain-specific operator suite appears in "SuMo: A Mutation Testing Strategy for Solidity Smart Contracts" (Barboni et al., 2021). SuMo implements 44 mutation operators, including 25 Solidity-specific operators and 19 general operators, designed from Solidity documentation, existing vulnerability taxonomies, and mutation frameworks such as muJava, PIT, MuSC, Deviant, ContractMut, and Vertigo (Barboni et al., 2021). The design criteria were Meaningfulness / semantic realism and Test reachability. To reduce stillborn mutants, SuMo excludes operator types known to generate many invalid mutants, merges redundant mutations, and applies precondition checks during AST traversal using semantic information.

The Solidity-specific operators target faults such as wrong address usage (AVR — Address Value Replacement), incorrect Ether-transfer semantics (ETR — Ether Transfer function Replacement), access-control errors (FVR — Function Visibility Replacement), modifier misuse (MOC, MOD, MOI, MOR), destruction logic faults (SFD, SFI), and SafeMath misuse (SFR) (Barboni et al., 2021). On EtherCrowdfunding, SuMo reported 681 total mutants, 59 stillborn mutants, 13 equivalent mutants, and a mutation score of 47.73% with all operators. On bionic-event-dapp, the corresponding values were 189, 29, 34, and 58.7%; after test-suite enhancement, the mutation score rose to 86.84% (Barboni et al., 2021). The study emphasizes that high code coverage did not imply high mutation score, and that surviving mutants often exposed weak tests for event emission, error paths, addresses, self-destruction behavior, and access control.

7. Significance, limitations, and recurring controversies

Several conclusions recur across the literature. First, semantic orientation is not identical with semantic preservation. The defect-detection study uses semantic-preserving transformations precisely because the desired relation is invariance under meaning-equivalent code (Hort et al., 30 Mar 2025). By contrast, SMS in scientific computing, intent-based mutation, SuMo, LLMorpheus, and the original CGP SOMO all inject behavioral change, but they do so along semantically motivated axes rather than by arbitrary syntax-local perturbation (Li et al., 17 May 2026, Hamidi et al., 6 Jul 2026, Barboni et al., 2021, Tip et al., 2024, Hodan et al., 2020).

Second, richer mutant spaces do not automatically yield superior downstream performance. In defect detection, semantically equivalent rewrites changed predictions in 49% of cases but improved neither VulBERTa-MLP nor PLBART (Hort et al., 30 Mar 2025). In scientific computing, the aligned-versus-cross effect remained in the medium effect range and did not meet the pre-registered large-effect threshold (Li et al., 17 May 2026). In continuous program search, semantically aligned mutation improved median performance and sample efficiency, yet isotropic mutation still achieved a higher peak Sharpe in some runs (Siper et al., 7 Feb 2026). This suggests that semantic fidelity and optimization efficacy are related but non-identical criteria.

Third, semantics-oriented mutation raises validation burdens. The defect-detection study found 23/39 supposedly semantic-preserving transformations to be semantically wrong on manual inspection (Hort et al., 30 Mar 2025). LLMorpheus discards syntactically invalid suggestions and still reports equivalent and near-equivalent mutants in manual assessment (Tip et al., 2024). Intent-based mutation depends on the availability and adequacy of natural-language specifications (Hamidi et al., 6 Jul 2026). SuMo explicitly engineers around stillborn mutants because compilation-invalid mutants waste CPU and reduce usability (Barboni et al., 2021). Semantic richness therefore often shifts effort from operator enumeration to operator validation, artifact filtering, and equivalence judgment.

Fourth, the strongest results generally frame SOMO as a complement to classical mutation, not a wholesale replacement. SMS is formally backward-compatible with classical mutation score (Li et al., 17 May 2026). Intent-based mutation shows that 55% of intent-based mutations are not subsumed by traditional mutations, yet the syntax-based approach still contributes 53.3% of the merged subsuming set (Hamidi et al., 6 Jul 2026). SuMo combines Solidity-specific and general operators rather than discarding classical operators altogether (Barboni et al., 2021). Even the original CGP SOMO retains the surrounding CGP machinery and changes the value-selection logic of mutation rather than abandoning mutation-based search (Hodan et al., 2020).

A plausible synthesis is that SOMO is best understood as an operator-design paradigm. Its central claim is not that semantics-oriented mutation is universally superior, but that mutation operators should be matched to the semantics of the system, the intended adequacy notion, and the fault hypotheses that matter in the target domain.