ASE 2025
Sun 16 - Thu 20 November 2025 Seoul, South Korea

While static program analyzers based on abstract interpretation implement precision-improving techniques to reduce false alarms, such as loop unrolling, their computational cost requires carefully devised heuristics for selective application. Manually designing such heuristics is non-trivial and error-prone, possibly leading to state explosion.

This paper presents Loupe, a novel end-to-end approach for automatically learning loop unrolling heuristics for static program analysis. Unlike previous data-driven methods, Loupe leverages Graph Neural Networks (GNNs) to learn directly from graph-based program representations. To enable supervised learning, we use the static analyzer itself to automatically label training data. We implement Loupe on top of Frama-C/EVA, an open source C static analyzer, and demonstrate that the best performing heuristic (GINE) outperforms the Frama-C/EVA built-in heuristic on real-world programs, reducing false alarms by 1.5x while improving analysis performance by 56%. Remarkably, GINE accurately predicts loop unrolling decisions made by expert Frama-C/EVA engineers, while maintaining acceptable false-positive rates. Finally, we show that Loupe can effectively learn heuristics for other static analyzers such as Mopsa.