Terms
- Run
- One campaign of one tool on one program.
- Cores
- The parallel processes of one campaign.
- Budget
- The longest a campaign may run.
- Fixed track
- The command line is given and the tool supplies only the input. Method
- Open track
- The tool also chooses arguments, files and environment. Method
- Median
- The middle value over a tool's runs; the median of two runs is their mean.
- standard
- Conventional gcov replay of every retained test case, same counting code and denominators. Method
- Output tokens
- Model output of a whole campaign, reasoning included, as self-reported in the release.
- Agent
- A language model that plans a campaign of other tools or inputs and reads the results.
- Language model
- A system in which a language model does the central reasoning of a classical technique, such as concolic execution.
- Symbolic
- Runs the program on symbolic inputs and asks a constraint solver for concrete inputs that reach new paths.
- Fuzzer
- Coverage-guided fuzzing: mutates inputs and keeps those that reach new code.
- Hybrid
- A fuzzer paired with a concolic executor; each supplies the other with inputs.
- Main
- Shown by default: the tools a reader is most likely to compare.
- Ablation
- Variants of the agent that switch off or change one part, to show what that part adds.
- Seeding
- Runs of a tool that start from seeds produced by another system.
- Control
- Systems that run without the agent, as a reference for the main group.
- Release
- A dated snapshot of the data, named like 2026.1. It never changes; corrections go into the next release.
- A12
- The probability that a run of A covers more branches than a run of B, ties counting half. Method
A: KLEE fixed options, 6 coresB: SymTuner, 6 cores
Both ran on 18 programs.
Median final coverage
| Program | Median share | A median | B median | B − A | A12 | Runs A / B | Curves |
|---|---|---|---|---|---|---|---|
| bc1,922 branches | A22.4% B27.9% | 430 | 537 | +107 | 0.00 | 3 / 3 | |
| Confetti632 branches | A32.3% B41.3% | 204 | 261 | +57 | 0.00 | 3 / 3 | |
| diff4,369 branches | A21.4% B30.7% | 936 | 1,340 | +404 | 0.00 | 3 / 3 | |
| du7,331 branches | A14.5% B18.0% | 1,061 | 1,320 | +259 | 0.00 | 3 / 3 | |
| gawk20,356 branches | A10.1% B24.1% | 2,057 | 4,897 | +2,840 | 0.00 | 3 / 3 | |
| gcal15,632 branches | A22.6% B44.5% | 3,539 | 6,953 | +3,414 | 0.00 | 3 / 3 | |
| grep4,806 branches | A36.2% B47.0% | 1,739 | 2,257 | +518 | 0.00 | 3 / 3 | |
| gzip3,083 branches | A35.6% B47.1% | 1,099 | 1,451 | +352 | 0.00 | 3 / 3 | |
| jq18,280 branches | A8.6% B13.2% | 1,570 | 2,419 | +849 | 0.00 | 3 / 3 | |
| Krep1,231 branches | A47.1% B55.9% | 580 | 688 | +108 | 0.00 | 3 / 3 | |
| Libmatheval591 branches | A24.7% B44.7% | 146 | 264 | +118 | 0.00 | 3 / 3 | |
| LibYAML4,275 branches | A41.0% B54.6% | 1,752 | 2,333 | +581 | 0.00 | 3 / 3 | |
| ls4,441 branches | A28.8% B39.9% | 1,279 | 1,771 | +492 | 0.00 | 3 / 3 | |
| Oggenc1,138 branches | A17.7% B29.5% | 201 | 336 | +135 | 0.00 | 3 / 3 | |
| sed6,958 branches | A17.9% B42.4% | 1,246 | 2,950 | +1,704 | 0.00 | 3 / 3 | |
| WOFF211,412 branches | A1.4% B7.9% | 163 | 899 | +736 | 0.00 | 3 / 3 | |
| xmlwf6,293 branches | A21.6% B32.8% | 1,360 | 2,062 | +702 | 0.00 | 3 / 3 | |
| xorriso54,607 branches | A6.4% B8.3% | 3,502 | 4,552 | +1,050 | 0.22 | 3 / 3 |
Branches only each tool reaches
| Program | Only A | Both | Only B | Split of the union |
|---|---|---|---|---|
| bc | 41 | 479 | 98 | |
| Confetti | 0 | 205 | 73 | |
| diff | 26 | 1,022 | 547 | |
| du | 0 | 1,078 | 374 | |
| gawk | 0 | 2,153 | 3,413 | |
| gcal | 1 | 3,775 | 4,273 | |
| grep | 15 | 2,140 | 310 | |
| gzip | 0 | 1,172 | 324 | |
| jq | 2 | 1,630 | 934 | |
| Krep | 19 | 594 | 161 | |
| Libmatheval | 0 | 149 | 115 | |
| LibYAML | 33 | 2,050 | 428 | |
| ls | 0 | 1,347 | 467 | |
| Oggenc | 0 | 210 | 127 | |
| sed | 0 | 1,413 | 1,843 | |
| WOFF2 | 0 | 163 | 916 | |
| xmlwf | 0 | 1,463 | 753 | |
| xorriso | 40 | 3,604 | 1,424 |
Resources
| Resource | KLEE fixed options, 6 cores | SymTuner, 6 cores |
|---|---|---|
| Family | Symbolic | Symbolic |
| Backend | KLEE | KLEE |
| Model | none | none |
| Track | open | open |
| Cores per campaign | 6 | 6 |
| Budget per campaign | 6 h | 6 h |
| Runs, on the shared programs | 54 | 54 |
| Output tokens per run, median, on the shared programs | not applicable (no model) | not applicable (no model) |