CS 703: Possible Project Topics

1. Some project based on E-graphs and the 1976 Irvine Program Transformation Catalogue
   o Whenever a subtree t is created, the e-graph is populated with
      Standish*(t), where Standish(t) means one application of
      a transformation in the Standish catalog

   References:
   o E-graphs: https://dl.acm.org/doi/10.1145/3434304 and https://egraphs-good.github.io/
   o The Irvine Program Transformation Catalogue: https://escholarship.org/uc/item/79p8s9qv

2. Create a symbolic-execution engine that takes two inputs, a program P
   and a target program location t, and attempts to reach t

   References:
   o Dinges, P. and Agha, G., Targeted test input generation using symbolic-concrete backward execution.
     ASE 2014.  https://dl.acm.org/doi/pdf/10.1145/2642937.2642951
   o Wang, Z., Liblit, B., and Reps, T.W.,
     TOFU: Target-Orienter FUzzer. CoRR abs/2004.14375 (2020).
     https://browse.arxiv.org/pdf/2004.14375.pdf

3. Program synthesis via (i) theorem proving using a constructive logic,
   followed by (ii) extraction of a program from the proof.
   One account of extraction of a program from a proof in a constructive
   logic can be found in Chapter 4 of

   Bates, J.L., A Logic for Correct Program Development. Cornell University, 1979.
   [https://scholar.google.com/scholar_url?url=https://ecommons.cornell.edu/bitstream/handle/1813/7503/79-388.pdf%3Fsequence%3D1&hl=en&sa=T&oi=gsb-gga&ct=res&cd=0&d=12871516675402136636&ei=8TkPZbH8LJH4yASkjaj4DQ&scisig=AFWwaebJ_vQt-NZN3G6WyrzHNB38]

   - What are ways the user could control the search space
     (narrowing/specializing the proof rules?)
   - Eliminating redundancies is important in program synthesis.
     Are there redundancies that can be eliminated in the
     proof-synthesis-followed-by-code-extraction approach?
   - Can data structures like version-space algebra/E-graphs help?
   - Are proofs tall but skinny, so that an enumeration-by-size strategy
     would work well?
   - The Wadler paper explains how proof simplification by rewrite rules
     corresponds to program execution.  We know how to perform symbolic
     execution of programs; what does symbolic execution correspond to
     on the proof side of things?

4. There is also a version of propositions-as-types for classical logic
   (Griffin, T., A Formulae-as-Types Notion of Control. POPL 1990
   [https://dl.acm.org/doi/pdf/10.1145/96709.96714]).
   Perhaps that result could be used to create a synthesis system following
   the proof-synthesis-followed-by-code-extraction that could use proofs
   generated by standard automated theorem provers.
   Unfortunately, the paper does not give any end-to-end examples (which
   would therefore be a good Milestone during a class project)   

5. In the security context, the ``everything is synthesis'' viewpoint translates
   to both

   o Given program P and desired outcome O, synthesize an attack against P that
     results in O

   o Given program P and class of attacks A, synthesize a defense for P
     against all attacks on P.  (A defense might be as simple as a collection
     of  pairs such that (i) a trace that represents an
     attack in A will be detected, and (ii) a trace that is not an attack
     will execute normally.)

   Pick attack or defense, and devise a suitable approach based on synthesis.

6. The path-problem version of automatic differentiation only depends on having
   an extend operation and a combine operation.  Are there algebraic systems other
   than (extend = multiplication, combine = plus) for which AD is interesting?
   If so, we could find such ``derivatives'' by solving path problems.

7. Loris D'Antoni's list of potential project topics:
   https://github.com/lorisdanto/cs703-program-synthesis/wiki/Project-Ideas

8. Propose a topic of your own.  If you are already doing research in
   some area of CS, you may wish to exploit your existing domain
   expertise by exploring some issue in that area that is related to
   verification or synthesis.  (If you are working with a professor
   from another sub-field X of CS, you might also check with them to
   see if they have a suggestion about how to address some problem of
   interest in area X that might be addressed by a verification and/or
   synthesis technique.)

--- Added after the e-mail to the class mailing list ---------------------------
9. Aids to debugging via automated reasoning on incomplete observations
   about program executions.  Peter Ohmann wrote a UW Ph.D. dissertation
   about the topic, advised by Ben Liblit (http://pages.cs.wisc.edu/~liblit/dissertations/ohmann.pdf.)
   See his DBLP page for papers in the 2013-2017 time frame.  One short paper
   on the topic is

   Ohmann, P., Brown, D.B., Liblit, B. and Reps, T.W., Recovering
   execution data from incomplete observations. WODA@SPLASH 2015: 19-24
   https://dl.acm.org/doi/pdf/10.1145/2823363.2823368.

10. The characteristic found in CDCL solvers of using learned information
    to prevent the solver's search from exploring a fruitless path a second
    time is appealing.  Although CDCL SAT solvers learn clauses (and only
    clauses), in principle learned information could take other forms,
    such as abstract-domain elements that characterize a set of fruitless
    states, paths, etc.  One paper in the area is the following:

    Mukherjee, R., Schrammel, P., Haller, L., Kroening, D., and
    Melham, T., Lifting CDCL to Template-Based Abstract Domains for
    Program Verification. ATVA 2017: 307-326
    https://link.springer.com/content/pdf/10.1007/978-3-319-68167-2_21.pdf?pdf=inline%20link