Cited by 17Logic, programming, and type systemsSoftware Testing and Debugging TechniquesEvolutionary Algorithms and Applications

Relational program synthesis

Open access
Wang, Yuepeng, Wang, Xinyu, Dillig, Isil·2018·Proceedings of the ACM on Programming Languages

Abstract

This paper proposes relational program synthesis, a new problem that concerns synthesizing one or more programs that collectively satisfy a relational specification. As a dual of relational program verification, relational program synthesis is an important problem that has many practical applications, such as automated program inversion and automatic generation of comparators. However, this relational synthesis problem introduces new challenges over its non-relational counterpart due to the combinatorially larger search space. As a first step towards solving this problem, this paper presents a synthesis technique that combines the counterexample-guided inductive synthesis framework with a novel inductive synthesis algorithm that is based on relational version space learning. We have implemented the proposed technique in a framework called Relish, which can be instantiated to different application domains by providing a suitable domain-specific language and the relevant relational specification. We have used the Relish framework to build relational synthesizers to automatically generate string encoders/decoders as well as comparators, and we evaluate our tool on several benchmarks taken from prior work and online forums. Our experimental results show that the proposed technique can solve almost all of these benchmarks and that it significantly outperforms EUSolver, a generic synthesis framework that won the general track of the most recent SyGuS competition.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper introduces relational program synthesis, where one or more programs are synthesized together to satisfy a relational specification, and presents a CEGIS-based technique using hierarchical finite tree automata (HFTA) for relational version space learning. Implemented as Relish, it synthesizes string encoder/decoder pairs and comparators, solving almost all benchmarks and substantially outperforming EUSolver.

Key findings

  • Relish solved all 10 encoder/decoder benchmarks, averaging 17.9 seconds per benchmark; EUSolver solved half within the 24-hour limit and averaged approximately 12 minutes on those it solved. On the five benchmarks solved by both, Relish’s average speed-up was 46.5x.
  • Relish solved 19 of 20 comparator benchmarks (95%), averaging 94.7 seconds; EUSolver solved 13. Relish solved 46% more benchmarks than EUSolver and was 26x faster on the common benchmarks.
  • Relish required fewer CEGIS iterations on average: 2.8 vs. 3.4 for encoder/decoder benchmarks, and 7.0 vs. 9.9 for comparator benchmarks.
  • The paper proves HFTA soundness and completeness for relaxed specifications, and soundness/completeness of the overall synthesis algorithm under stated assumptions.

Methods

  • The approach uses counterexample-guided inductive synthesis (CEGIS): a verifier checks candidate programs against the relational specification and returns relational counterexamples as ground formulas, which strengthen the inductive specification.
  • The inductive synthesizer relaxes the ground specification, builds an HFTA whose nodes correspond to subterms/subformulas and whose inter-FTA transitions compose individual version spaces, then enforces functional consistency via the FindProgs and Propagate procedures.
  • Relish was instantiated for string encoders/decoders (10 benchmarks, 7 from prior work plus Base32hex, UTF-32, UTF-7; 2–3 input-output examples; inversion property ∀x.decode(encode(x))=x) and comparators (20 StackOverflow benchmarks; specifications include anti-symmetry, transitivity, totality, reflexivity, and examples; 2–30 examples, average 16). It was compared against EUSolver using the same DSLs, CEGIS loop, and bounded verifier, with a 24-hour timeout.

Limitations

  • The paper states that the method only works with simple DSLs without recursion, loops, or let bindings, and only allows relational specifications of the form ∀x.φ(x) where φ is quantifier-free, so it does not handle quantifier alternation.
  • Evident from the text: the failed comparator-20 benchmark is not expressible in the current DSL because it requires comparing integers obtained by concatenating all substrings that represent integers in the input strings.
  • Evident from the text: verification in each CEGIS iteration uses bounded testing over permutations up to a bounded length k (over a million test cases per iteration), resorting to full verification only after the candidate passes those tests.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1145/3276525

Cites

72 of 72 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

1 of 5 cited sources checked · 0 supported · 0 flagged · accuracy not yet measured

  • Findingown data

    Relish significantly outperforms EUSolver, a general-purpose synthesis tool that won the General Track of the most recent SyGuS competition for syntax-guided synthesis.

    “Our evaluation also shows that Relish significantly outperforms EUSolver, a general-purpose synthesis tool that won the General Track of the most recent SyGuS competition for syntax-guided synthesis.”
    Quote in the paperSubstantial claim
  • Findingown data

    The proposed technique can solve almost all of the benchmarks.

    “Our experimental results show that the proposed technique can solve almost all of these benchmarks and that it significantly outperforms EUSolver, a generic synthesis framework that won the general track of the most recent SyGuS competition.”
    Quote in the paperSubstantial claim
  • Findingown data

    Relish can automatically synthesize the correct Base64 encoder and decoder from the given specification using a DSL targeted for this domain.

    “Relish can automatically synthesize the correct Base64 encoder and decoder from this specification using a DSL targeted for this domain (see Section 6.2).”
    Quote in the paperSubstantial claim
  • Findingown data

    The proposed technique significantly outperforms EUSolver, a generic synthesis framework that won the general track of the most recent SyGuS competition.

    “Our experimental results show that the proposed technique can solve almost all of these benchmarks and that it significantly outperforms EUSolver, a generic synthesis framework that won the general track of the most recent SyGuS competition.”
    Quote in the paperSubstantial claim
  • Findingown data

    Relish can efficiently solve interesting benchmarks taken from previous literature and online forums.

    “Our evaluation shows that Relish can efficiently solve interesting benchmarks taken from previous literature and online forums.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. 10
  • May combine two claims. 22
  • The quote only partly states this claim. 7
  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    EUSolver is an enumeration-based synthesizer that won the General Track of the most recent SyGuS competition.

    “EUSolver [Alur et al. 2017], an enumeration-based synthesizer that won the General Track of the most recent SyGuS competition [Alur et al. 2013].”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites Alur et al. 2017

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Alur et al. 2013 source

      The conclusion describes organizing a SyGuS-solvers competition as a future step, but gives no competition results. Searches for EUSolver, the General Track, and a winner found no passage in our copy establishing the attributed win. (LLM, conf=0.78)

      Experimental — accuracy not yet measured
  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims. The quote only partly states this claim.

    Findingown data

    The 20 comparator benchmarks collected from StackOverflow have between 2 and 30 examples, with an average of 16.

    “Among these benchmarks, the number of examples range from 2 to 30, with an average of 16.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Findingreasoning

    If FindProgs returns programs P (not null) given H and M, then P satisfy Φ, and program Pi for function fi conforms to grammar G(fi).

    “If the FindProgs procedure returns programs P (not null) given input H and M, then P satisfy Φ, and program P i for function f i conforms to the grammar G(f i ).”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data

    Relish takes an average of 4.5 seconds per CEGIS iteration, whereas EUSolver takes 208.4 seconds on average across the five encoder/decoder benchmarks it solves.

    “Relish takes an average of 4.5 seconds per iteration, whereas EUSolver takes 208.4 seconds on average across the five benchmarks that it is able to solve.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingreasoning

    Assuming the soundness of the Verify procedure invoked by Algorithm 1, the set of programs P returned by Synthesize are guaranteed to satisfy the relational specification Ψ, and program Pi of function fi conforms to grammar G(fi).

    “Assuming the soundness of the Verify procedure invoked by Algorithm 1, then the set of programs P returned by Synthesize are guaranteed to satisfy the relational specification Ψ, and program P i of function f i conforms to grammar G(f i ).”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The Verify procedure invoked by Algorithm 1 is sound.
  • The quote only partly states this claim.

    Findingreasoning

    If G,M ⊢ Φ ↠ H and P1,...,Pn |= Φ, then there exists a hierarchical tree T accepted by H such that Υ(v_fi)=Pi for all i.

    “By Lemma A.6, we know there exists a hierarchical tree T = (V , ϒ, v r , E) accepted by H ′ such that ϒ(v f i ) = P i for all i ∈ [1, n].”
    Quote in the paperSubstantial claim
  • The quote only partly states this claim.

    Findingown data

    Relish correctly solves all ten encoder/decoder benchmarks.

    “As shown in Table 1, Relish can correctly solve all of these benchmarks 9 and takes an average of 17.9 seconds per benchmark.”
    Quote in the paperSubstantial claim
  • May combine two claims. The quote only partly states this claim.

    Findingown data

    Relish solves 19 of the 20 comparator benchmarks with an average total time of 94.7 seconds and an average speedup of 26.0x over EUSolver.

    “Average | 26.5 | 7.7 | 94.7 | 80.8 | 3382 | 9.9 | 4873.4 | 4866.7 | 26.0x”
    • Also stated in: § B COMPLEXITY ANALYSIS · plain
      “comparator-20 | - | - | T/O | T/O | - | - | T/O | T/O | -”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data

    The Base64xml benchmark takes 6 CEGIS iterations and consumes 1843 MB, while UTF-32 takes 2 iterations and consumes 284 MB.

    “which take 6 and 2 iterations and consume 1843 MB and 284 MB respectively.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingreasoning

    For the conditions of Lemma A.6, if P1,...,Pn |= Φ then the run of Υ(vr) on Ω(vr) is rooted with final state q⊤s0; if P1,...,Pn ̸|= Φ then it is rooted with final state q⊥s0.

    “(1) If P 1 , . . . , P n |= Φ, the run of ϒ(v r ) on Ω(v r ) is rooted with final state q ⊤ s 0 . (2) If P 1 , . . . , P n ̸ |= Φ, the run of ϒ(v r ) on Ω(v r ) is rooted with final state q ⊥ s 0 .”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data

    Relish solves the 10 Unicode encoder/decoder benchmarks with an average total time of 17.9 seconds and an average speedup of 46.5x over EUSolver.

    “Average | 7.6 | 7.2 | 4.0 | 17.9 | 11.1 | 685 | 3.4 | 708.4 | 703.2 | 46.5x”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingreasoning

    If there exist programs P that satisfy Ψ and can be implemented using the DSLs given by G, then Algorithm 1 will eventually terminate with programs satisfying Ψ.

    “we can conclude that Algorithm 1 will eventually terminate with programs satisfying Ψ.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data

    On the five encoder/decoder benchmarks solved by both tools, Relish takes 2.8 CEGIS iterations on average, whereas EUSolver needs an average of 3.4 attempts.

    “Relish takes 2.8 CEGIS iterations on average, whereas EUSolver needs an average of 3.4 attempts to find the correct program.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationreasoning

    Given a set of relational counterexamples, our inductive synthesizer compactly represents tuples of programs and efficiently searches for their implementations that satisfy all relational counterexamples.

    “Specifically, given a set of relational counterexamples, such as f (1) = д(1) or f (д(1), д(2)) = f (3), our inductive synthesizer compactly represents tuples of programs and efficiently searches for their implementations that satisfy all relational counterexamples.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationcitation

    Our method alternates between inductive synthesis and verification, and the counterexamples returned by the verifier are relational in nature.

    “Similar to other synthesis algorithms based on counterexample-guided inductive synthesis (CEGIS) [Solar-Lezama 2008], our method also alternates between inductive synthesis and verification; but the counterexamples returned by the verifier are relational in nature.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Solar-Lezama 2008

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Premisenone given

    Relational program synthesis is a dual of relational program verification.

    “As a dual of relational program verification, relational program synthesis is an important problem that has many practical applications, such as automated program inversion and automatic generation of comparators.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationown data

    The HFTA-based approach might have better generalization power than enumerative search, as confirmed by comparator results.

    “again confirming the hypothesis that the HFTA-based approach might have better generalization power.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationreasoning

    The relaxation strategy eliminates circular dependencies and allows us to build a relational version space in a compositional way.

    “The relaxed specification, however, eliminates such circular dependencies and allows us to build a relational version space in a compositional way.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim.

    Interpretationnone given

    Propagate returns a new HFTA H' such that the FTAs for all occurrences of f only accept programs that have the same input-output behavior as p.

    “Given an HFTA H and a function symbol f with candidate implementation p, Propagate returns a new HFTA H ′ such that the FTAs for all occurrences of f only accept programs that have the same input-output behavior as p.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductnone given

    The authors manually inspected the synthesized solutions and confirmed their correctness.

    “We manually inspected the synthesized solutions and confirmed their correctness.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductnone given

    The same CEGIS loop used in Relish is implemented for EUSolver, and the same bounded verifier is used in the evaluation.

    “Additionally, we implement the same CEGIS loop used in Relish for EUSolver and use the same bounded verifier in our evaluation.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Premisenone given

    Compared to other CEGIS synthesis algorithms, the key differences of the proposed method are the use of relational counterexamples and a new inductive synthesis algorithm that utilizes relational specifications.

    “the key differences of our method are (a) the use of relational counterexamples and (b) a new inductive synthesis algorithm that utilizes relational specifications.”
    Quote in the paperSubstantial claim
  • The quote only partly states this claim.

    Interpretationreasoning

    Theorem 5.2: If G,M ⊢ Φ ↠ H, then for any hierarchical tree T accepted by H, the functions Υ(v_{f1}),...,Υ(v_{fn}) satisfy Φ.

    “Thus, ϒ(v f 1 ), . . . , ϒ(v f n ) |= Φ.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning

    A time limit of 24 hours is set for each benchmark.

    “Due to finite computational resources, we set a time limit of 24 hours for each benchmark.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationreasoning

    The HFTA is compositional: there is a separate node for every subterm, and inter-FTA transitions account for information flow from each subterm to its parent.

    “Observe that our HFTA is compositional in that there is a separate node for every subterm, and the inter-FTA transitions account for the flow of information from each subterm to its parent.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: Every variable x_i in function f is annotated by f to enforce its global uniqueness.
  • May combine two claims.

    Interpretationown data

    Evaluation shows that Relish significantly outperforms EUSolver in efficiency of inductive synthesis and generalization power per CEGIS iteration.

    “Our evaluation also shows that Relish significantly outperforms EUSolver, both in terms of the efficiency of inductive synthesis as well as its generalization power per CEGIS iteration.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The 24-hour time limit is a fair and meaningful criterion for comparing Relish and EUSolver.
    • Rests on an assumption: EUSolver is a state-of-the-art enumerative solver and a fair baseline for evaluating Relish.
  • May combine two claims.

    Premisenone given

    The method works with arbitrary ground formulas representing relational counterexamples and uses hierarchical finite tree automata to compose version spaces of individual functions, whereas existing version space learning algorithms only work with input-output examples.

    “While existing version space learning algorithms only work with input-output examples, the method proposed here works with arbitrary ground formulas representing relational counterexamples and uses hierarchical finite tree automata to compose the version spaces of individual functions.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationown data

    Evaluation in encoders/decoders and comparators demonstrates that Relish can effectively synthesize pairs of closely related programs (inverses) and individual programs that must obey non-trivial k-safety specifications such as transitivity.

    “Our evaluation in two different application domains (namely, encoders/decoders and comparators) demonstrate that Relish can effectively synthesize pairs of closely related programs (i.e., inverses) as well as individual programs that must obey non-trivial k-safety specifications (e.g., transitivity).”
    Quote in the paperSubstantial claim
  • The quote only partly states this claim.

    Interpretationown data

    Higher memory usage for comparators is attributed to larger synthesized programs.

    “First, as shown in Table 2, the size of the synthesized programs is larger for the comparator domain.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    This paper is the first to address the dual synthesis variant of the relational verification problem.

    “To the best of our knowledge, this paper is the first one to address the dual synthesis variant of the relational verification problem.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim.

    Study design and conductown data

    In the experiments, over a million test cases are used in each iteration.

    “In our experiments, we use over a million test cases in each iteration, and resort to full verification only when the synthesized program passes all of these test cases.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim.

    Interpretationnone given

    Given relaxed specification Φ', the next step is to construct an HFTA whose language consists of exactly those programs that satisfy Φ'.

    “(2) HFTA construction: Given the relaxed specification Φ ′ , the next step is to construct an HFTA whose language consists of exactly those programs that satisfy Φ ′ (line 9).”
    Quote in the paperSubstantial claim
  • The quote only partly states this claim.

    Interpretationreasoning

    The size of the target program has an impact on memory usage; larger synthesized programs tend to increase memory usage.

    “the size of the target program also has an impact on memory usage.”
    Quote in the paperNot a substantial claim
33 of 33
  • The authors state this as an assumption.

    Every variable x_i in function f is annotated by f to enforce its global uniqueness.

    “Every variable x i in function f is assumed to be annotated by f to enforce its global uniqueness.”
  • The paper relies on this without support.

    Hierarchical trees with lower cost are likely to have better generalization power.

    “Because hierarchical trees with lower cost are likely to have better generalization power, our algorithm lazily enumerates hierarchical trees according to their cost.”
  • The paper relies on this without support.

    The collected encoder/decoder and comparator benchmarks are representative of real-world relational synthesis tasks.

    “this experiment demonstrates that Relish can successfully synthesize non-trivial string comparators that arise in real-world scenarios.”
  • The paper relies on this without support.

    The 24-hour time limit is a fair and meaningful criterion for comparing Relish and EUSolver.

    “If a tool fails to solve the desired task within the 24 hour time limit, we write T/O to indicate a time-out.”
  • The paper relies on this without support.

    EUSolver is a state-of-the-art enumerative solver and a fair baseline for evaluating Relish.

    “This experiment also demonstrates the advantages of our new relational synthesis approach compared to an existing state-of-the-art solver.”
  • The paper relies on this without support.

    The relational specifications constructed for each benchmark correctly capture the intended sorting or encoding/decoding task.

    “The relational specification Ψ for each benchmark consists of the following three parts:”
  • The authors state this as an assumption.

    The Verify procedure invoked by Algorithm 1 is sound.

    “Assuming the soundness of the Verify procedure invoked by Algorithm 1”
  • The authors state this as an assumption.

    If there is an interpreted function in the relational specification, a trivial grammar with a single production for that function is added to G by default.

    “If there is an interpreted function in the relational specification, we assume that a trivial grammar with a single production for that function is added to G by default.”
  • The authors state this as an assumption.

    In the proof of Lemma A.7, the function symbols are assigned in the order f1,...,fn.

    “Without loss of generality, we assume the function symbols are assigned in the order of f 1 , . . ., f n .”
9 of 9

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • HFTA node v2 is assigned the wrong automaton

    Minor

    The mapping assigns A3 to both v2 and v3, but the subsequent description says the second ground term is accepted by A2. The listed inter-FTA transitions from A2's r-states likewise require v2 to use A2.

1 of 1

Cites

Flagged first, then by citations

Research works printed but not linked: 7

  1. 10.5555/2021296.2021319 · DOI
  2. 10.5555/1009380.1009669 · DOI
  3. Angelis Emanuele De, Proc
  4. 10.5555/1624562.1624585 · DOI
  5. Mordvinov Dmitry, 2017, EPiC Series in Computing
  6. Morgan Carroll, Programming from specifications
  7. Thien Nguyen Hoang Duong, 2013, Proc. of ICSE. 772–781

Cited by

Sorted by citations

Authors
Wang, Y., Wang, X., & Dillig, I.
Affiliations
  • The University of Texas at Austin (US)
  • University of Texas at Austin, USA
Venue
Proceedings of the ACM on Programming Languages
Published
2018-10-24
Volume
2
Issue
OOPSLA
Pages
1-27
ISSN
2475-1421 (ISSN-L)
OpenAlex
W2890639568
Cited by
17
References
55
Citations by year
2025: 1 · 2024: 7 · 2023: 3 · 2022: 2 · 2020: 2 · 2019: 2
FWCI
0.54
Type
journal article
Language
en
Open access
Locations
  • Proceedings of the ACM on Programming Languages (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • National Science Foundation (1712067, 1811865, 1646522)
  • Air Force Research Laboratory (8750-14-2-0270)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Logic, programming, and type systems
  • Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Evolutionary Algorithms and Applications
Keywords
counterexample-guided inductive synthesis, Relish, program inversion, program synthesis

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-11-06.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-11-06.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review