ESCAPING ISLA NUBLAR: COMING AROUND TO LLMS FOR FORMAL METHODS

Summary from the TLDR InfoSec newsletter

CNnotator is a tool that combines large language models (LLMs) with formal verification to generate memory-safety annotations for C code automatically. It works through an iterative process where LLM-generated annotations are tested against a CN verifier. This approach addresses the challenge of translating legacy C/C++ code—which accounts for 70% of Chromium's security bugs—into memory-safe languages like Rust. Testing showed that OpenAI's o3 reasoning model achieved a 90% success rate on the first attempt and 97% within three attempts.