RustHorn: CHC-based Verification for Rust Programs

Reduction to satisfiability of constrained Horn clauses (CHCs) is a widely studied approach to automated program verification. Current CHC-based methods, however, do not work very well for pointer-manipulating programs, especially those with dynamic memory allocation. This article presents a novel reduction of pointer-manipulating Rust programs into CHCs, which clears away pointers and memory states by leveraging Rust’s guarantees on permission. We formalize our reduction for a simplified core of Rust and prove its soundness and completeness. We have implemented a prototype verifier for a subset of Rust and confirmed the effectiveness of our method.

A single-cell reference atlas delineates CD4+ T cell subtype-specific adaptation during acute and chronic viral infections

CD4+ T cells are critical orchestrators of immune responses against a large variety of pathogens, including viruses. The multifaceted roles of CD4+ T cells, including their help to innate cells, CD8+ T and B cells and their support for long-lived immunity rely on a profound functional heterogeneity. While multiple CD4+ T cell subtypes and their key transcriptional regulators have been identified, there is a lack of consistent definition for CD4+ T cell transcriptional states. In addition, the progressive changes affecting CD4+ T cell subtypes during and after immune responses remain poorly defined. Taking advantage of single-cell transcriptomics, efficient computational methods, and robust animal models, we characterize the transcriptional landscape of CD4+ T cells responding to self-resolving and chronic viral infections. We build a comprehensive atlas of virus-specific CD4+ T cells and their evolution over time, and identify six major distinct cell states that are consistently observed in acute and chronic infections. During the course of acute infection, T cell composition progressively changes from effector to memory states, with subtype-specific gene modules and kinetics. Conversely, T cells in persistent infections fail to transition from effector to memory states, and acquire distinct, chronicity-associated transcriptional programs. By single-cell T cell receptor (TCR) sequencing analysis, we characterize the clonal structure of virus-specific CD4+ T cells across individuals and T cell subtypes. We find that virus-specific CD4+ T cell responses are mainly private across individuals and that most T cells differentiate into all subtypes independently of their TCR, in both acute and chronic infections. Finally, we show that our CD4+ T cell atlas can be used as a reference to accurately interpret cell states in external single-cell datasets. Overall, this study describes a previously unappreciated level of adaptation of the transcriptional states of CD4+ T cells responding to viruses and provides a new computational resource for CD4+ T cell analysis, available online at https://spica.unil.ch.

The Effects of Adding Reachability Predicates in Quantifier-Free Separation Logic

The list segment predicate ls used in separation logic for verifying programs with pointers is well suited to express properties on singly-linked lists. We study the effects of adding ls to the full quantifier-free separation logic with the separating conjunction and implication, which is motivated by the recent design of new fragments in which all these ingredients are used indifferently and verification tools start to handle the magic wand connective. This is a very natural extension that has not been studied so far. We show that the restriction without the separating implication can be solved in polynomial space by using an appropriate abstraction for memory states, whereas the full extension is shown undecidable by reduction from first-order separation logic. Many variants of the logic and fragments are also investigated from the computational point of view when ls is added, providing numerous results about adding reachability predicates to quantifier-free separation logic.

What do laboratory-forgetting paradigms tell us about use-inspired forgetting?

Directed forgetting is a laboratory task in which subjects are told to remember some information and forget other information. In directed forgetting tasks, participants are able to exert intentional control over which information they retain in memory and which information they forget. Forgetting in this task appears to be mediated by intentional control of memory states in which executive control mechanisms suppress unwanted information. Recognition-induced forgetting is another laboratory task in which subjects forget information. Recognizing a target memory induces the forgetting of related items stored in memory. Rather than occurring due to volitional control, recognition-induced forgetting is an incidental by-product of activating items in memory. Here we asked whether intentional directed forgetting or unintentional recognition-induced forgetting is a more robust forgetting effect. While there was a correlation between forgetting effects when the same subjects did both tasks, the magnitude of recognition-induced forgetting was larger than the magnitude of directed forgetting. These results point to practical differences in forgetting outcomes between two commonly used laboratory-forgetting paradigms.

Automatic Generation of ROP Through Static Instructions Assignment and Dynamic Memory Analysis

W⊕X is a protection mechanism against control-flow hijacking attacks. Return-oriented programming (ROP) can perform a specific function by searching for appropriate assembly instruction fragments (gadgets) in a code segment and bypass the W⊕X. However, manual search for gadgets that match the conditions is inefficient, with high error and missing rates. In order to improve the efficiency of ROP generation, the authors propose an automatic generation method based on a fragmented layout called automatic generation of ROP. This method designs new intermediate instruction construction rules based on an automatic ROP generation framework Q, uses symbolic execution to analyze program memory states and construct data constraints for multi-modules ROP, and solves ROP data constraints to generate test cases of an ROP chain. Experiments show that this method can effectively improve the space efficiency of the ROP chain and lower the requirements of the ROP layout on memory conditions.