# z3

Published articles for z3.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Solver-Like Behavior in Large Language Models as Formalizers

DevFeed: [Solver-Like Behavior in Large Language Models as Formalizers](<https://devfeed.tech/articles/solver-like-behavior-in-large-language-models-as-formalizers-115303.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2611.02395>)

Author: Rikhil Amonkar, Stuti Mohan, Kevin Nguyen, Ceyhun Efe Kayan, Ronan Le Bras, Li Zhang

Published: 2026-11-03T05:00:00Z

Content type: article

Language: en

Sources: [arXiv: Artificial Intelligence](<https://devfeed.tech/sources/arxiv-artificial-intelligence.md>)

Topics: [llm-reasoning](<https://devfeed.tech/topics/llm-reasoning.md>), [LLM evaluation / benchmarking](<https://devfeed.tech/topics/llm-evaluation-benchmarking.md>), [Chain-of-thought](<https://devfeed.tech/topics/chain-of-thought.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>)

Tags: [constraint-satisfaction](<https://devfeed.tech/tags/constraint-satisfaction.md>), [cs-ai](<https://devfeed.tech/tags/cs-ai.md>), [cs-cl](<https://devfeed.tech/tags/cs-cl.md>), [declarative](<https://devfeed.tech/tags/declarative.md>), [evaluation](<https://devfeed.tech/tags/evaluation.md>), [language-models](<https://devfeed.tech/tags/language-models.md>), [program](<https://devfeed.tech/tags/program.md>), [python](<https://devfeed.tech/tags/python.md>), [reasoning-models](<https://devfeed.tech/tags/reasoning-models.md>), [reasoning-tokens](<https://devfeed.tech/tags/reasoning-tokens.md>), [traces](<https://devfeed.tech/tags/traces.md>), [z3](<https://devfeed.tech/tags/z3.md>)

### AI overview

In a study of 2,000 generations from three reasoning models across four constraint-satisfaction datasets, solver-like behavior (SLB)--searching through candidate values in the reasoning trace--appeared in 85% of traces and used 24% of reasoning tokens. Programs usually recomputed the answer, making this work redundant; the 9% that reused trace answers also carried their errors and could pass output-only evaluation when correct. SLB was more common in imperative Python than in declarative Z3 or PDDL, and its amount was not associated with accuracy. Cautionary prompts reduced SLB by about a quarter, while replacing problem values with placeholders revealed to the program only at run time removed 97% without reducing accuracy. The authors argue that formalizers should be evaluated by how programs are reached as well as by outputs.

### Source excerpt

arXiv:2611.02395v1 Announce Type: cross Abstract: In the LLM-as-formalizer paradigm, a large language model translates a problem into a formal program and leaves the search to a solver, gaining the solver's guarantees. Formalizers are now often reasoning models that write a long reasoning trace before the program, yet they are judged only by the program's output. We find that the trace routinely does the solver's job, assigning, testing and ruling out values until it often reaches the full answer; we call this solver-like behavior (SLB). We define an ontology of SLB over the trace, the program and its output, and use LLM judges, checked against human labels, to label 2,000 generations from three reasoning models on four constraint satisfaction datasets, each formalized in a declarative and an imperative formal language. SLB appears in 85% of traces and takes 24% of reasoning tokens, yet the program usually recomputes the answer, so the effort is redundant. The 9% of programs that inherit the trace's answer also inherit its errors, and pass output-based evaluation whenever that answer is correct. The amount of SLB is not associated with accuracy, and SLB is more common in imperative Python than in declarative Z3 or PDDL. Cautionary prompts reduce it by only a quarter, but hiding the problem's values behind placeholders, which the program receives only at run time, removes 97% of it without loss of accuracy. Formalizers should therefore be evaluated by how their programs are reached, not only by what they output.

## RAM: the forgotten history

DevFeed: [RAM: the forgotten history](<https://devfeed.tech/articles/ram-the-forgotten-history-102385.md>)

Original publisher: [Read original article](<https://blog.adafruit.com/2026/10/27/ram-the-forgotten-history/>)

Author: Anne Barela

Published: 2026-10-27T17:05:57Z

Content type: article

Language: en

Sources: [Adafruit Industries](<https://devfeed.tech/sources/adafruit-industries-makers-hackers-artists-designers-and-engineers.md>)

Topics: [ecc ram](<https://devfeed.tech/topics/ecc-ram.md>), [Memory Heirarchy](<https://devfeed.tech/topics/memory-heirarchy.md>)

Tags: [history](<https://devfeed.tech/tags/history.md>), [magnetic](<https://devfeed.tech/tags/magnetic.md>), [manager](<https://devfeed.tech/tags/manager.md>), [memory](<https://devfeed.tech/tags/memory.md>), [ram](<https://devfeed.tech/tags/ram.md>), [relay](<https://devfeed.tech/tags/relay.md>), [storage](<https://devfeed.tech/tags/storage.md>), [vintage-computing](<https://devfeed.tech/tags/vintage-computing.md>), [z3](<https://devfeed.tech/tags/z3.md>)

### AI overview

The excerpt traces working memory from relay latches to magnetic RAM, showing how costly early components pushed computers toward alternative storage schemes. Konrad Zuse's Z3 used roughly 2,000 relays in its memory unit, compared with about 600 in the rest of the machine. The 1918 Eccles-Jordan bistable tube circuit is presented as an ancestor of modern SRAM latch cells. Later approaches included capacitor drums, mercury delay lines, torsion wire, phosphor-dot tubes, magnetic drums, and ferrite core memory; one 8x8-inch core module held 32 kB. The excerpt adds that MRAM remains available: Everspin sells modules up to 16 MB that behave like SRAM while retaining data without power.

### Source excerpt

lcamtuf has posted a history of working memory on blog.coredump.cx, arguing that RAM gets far less attention than Babbage and that memory constraints held back personal computing until the end of the 20th century. The post starts with relay latches, including the roughly 2,000 relays in the memory unit of Konrad Zuse's Z3, against about [...]

## A Neuro-Symbolic Reasoning Engine for Compilation-Free Patch Presence Testing

DevFeed: [A Neuro-Symbolic Reasoning Engine for Compilation-Free Patch Presence Testing](<https://devfeed.tech/articles/a-neuro-symbolic-reasoning-engine-for-compilation-free-patch-presence-testing-93712.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2610.27871>)

Author: Siyuan Li, Jiayi Zhou, Zhiyuan Xia, Weijie Wang, Yaowen Zheng, Weiran Tang, Hong Li, Hongsong Zhu, Shanqing Guo

Published: 2026-10-21T04:00:00Z

Content type: article

Language: en

Sources: [arXiv: Software Engineering](<https://devfeed.tech/sources/arxiv-software-engineering.md>)

Topics: [llm-reasoning](<https://devfeed.tech/topics/llm-reasoning.md>), [Automated reasoning](<https://devfeed.tech/topics/automated-reasoning.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Parsing](<https://devfeed.tech/topics/parsing.md>)

Tags: [alignment](<https://devfeed.tech/tags/alignment.md>), [code](<https://devfeed.tech/tags/code.md>), [compilation](<https://devfeed.tech/tags/compilation.md>), [cs-se](<https://devfeed.tech/tags/cs-se.md>), [engine](<https://devfeed.tech/tags/engine.md>), [formal](<https://devfeed.tech/tags/formal.md>), [large-language-models-llms](<https://devfeed.tech/tags/large-language-models-llms.md>), [parsing](<https://devfeed.tech/tags/parsing.md>), [patch](<https://devfeed.tech/tags/patch.md>), [pseudocode](<https://devfeed.tech/tags/pseudocode.md>), [reasoning](<https://devfeed.tech/tags/reasoning.md>), [security](<https://devfeed.tech/tags/security.md>), [smt](<https://devfeed.tech/tags/smt.md>), [symbolic-reasoning](<https://devfeed.tech/tags/symbolic-reasoning.md>), [testing](<https://devfeed.tech/tags/testing.md>), [z3](<https://devfeed.tech/tags/z3.md>)

### AI overview

SyLares tests for patch presence without compilation by converting source code and decompiled pseudocode into formal equivalence queries for the Z3 solver. Its Code2SMT engine combines deterministic syntactic parsing with LLM-driven code normalization and symbol alignment; the LLM produces specification-compliant SMT-LIB inputs but does not issue the final verdict. This design addresses a limitation reported for prior system Lares: Z3 succeeded on 20% of code cases, with the LLM deciding the rest as a separate, nondeterministic channel. The abstract describes SyLares's architecture but provides no evaluation results for the proposed system.

### Source excerpt

arXiv:2610.27871v1 Announce Type: new Abstract: Code reuse in modern software ecosystems facilitates the spread of 1-day vulnerabilities, posing significant security risks. Determining if patches are present is crucial, but traditional methods suffer from limited usability and accuracy, often depending on a fragile compilation process. In our prior work, we introduced Lares, the first compilation-free framework for patch presence testing that combines large language models (LLMs) with SMT solvers. However, Lares treats the LLM and the SMT solver as two separate, parallel decision channels: the symbolic channel (Z3) succeeded in only 20% of code cases, and the remaining cases fell back to the neural channel (the LLM) for the final decision. Letting the LLM act as the final arbiter turns verification into an informal, non-deterministic process that is prone to hallucination errors, while the two channels never reinforce each other. To overcome these limitations, we propose SyLares, which reformulates compilation-free patch presence testing as neuro-symbolic reasoning. Instead of letting the LLM emit a final verdict, SyLares uses the LLM as a neural feature extractor that perceives heterogeneous source code and decompiled pseudocode and produces specification-compliant SMT-LIB inputs, and delegates the final, deterministic judgment to the symbolic Z3 solver. This neural-perceives, symbolic-decides coupling is realized by a Code2SMT reasoning engine that combines deterministic syntactic parsing with LLM-driven code normalization and symbol alignment, so that every case is reduced to a formal equivalence query rather than an opaque LLM guess.

## New Blog Post: Some Silly Z3 Scripts I Wrote

DevFeed: [New Blog Post: Some Silly Z3 Scripts I Wrote](<https://devfeed.tech/articles/new-blog-post-some-silly-z3-scripts-i-wrote-25496.md>)

Original publisher: [Read original article](<https://buttondown.com/hillelwayne/archive/new-blog-post-some-silly-z3-scripts-i-wrote/>)

Author: Hillel Wayne

Published: 2026-02-23T16:49:10Z

Content type: article

Language: en

Sources: [Newsletter feed for Hillel Wayne's Newsletter](<https://devfeed.tech/sources/newsletter-feed-for-hillel-wayne-s-newsletter.md>)

Topics: [Library](<https://devfeed.tech/topics/library.md>)

Tags: [array](<https://devfeed.tech/tags/array.md>), [arrays](<https://devfeed.tech/tags/arrays.md>), [blog](<https://devfeed.tech/tags/blog.md>), [blog-post](<https://devfeed.tech/tags/blog-post.md>), [division-by-zero](<https://devfeed.tech/tags/division-by-zero.md>), [encoding](<https://devfeed.tech/tags/encoding.md>), [multiple](<https://devfeed.tech/tags/multiple.md>), [nested](<https://devfeed.tech/tags/nested.md>), [scripts](<https://devfeed.tech/tags/scripts.md>), [silly](<https://devfeed.tech/tags/silly.md>), [smt](<https://devfeed.tech/tags/smt.md>), [z3](<https://devfeed.tech/tags/z3.md>)

### AI overview

The post shares Z3 scripts drawn from material that did not make it into the roughly 50,000-word Logic for Programmers book. To demonstrate a conditioned property, the author chose a multiplicative inverse statement requiring a quantifier over a division-based alternative, which would have needed an explanation of Z3's total division semantics. This choice brought total operations back into the discussion of arrays. The author reports that an array example returns an unexplained maximum-profit value and speculates about optimizer short-circuiting on an ill-defined problem. An attempted Goldbach encoding to demonstrate SMT undecidability did not work; the author says nested quantifiers were difficult.

### Source excerpt

Now that I'm not spending all my time on Logic for Programmers, I have time to update my website again! So here's the first blog post in five months: Some Silly Z3 Scripts I Wrote. Normally I'd also put a link to the Patreon notes but I've decided I don't like publishing gated content and am going to wind that whole thing down. So some quick notes about this post: Part of the point is admittedly to hype up the eventual release of LfP. I want to start marketing the book, but don't want the marketing material to be devoid of interest, so tangentially-related-but-independent blog posts are a good place to start. The post discusses the concept of "chaff", the enormous quantity of material (both code samples and prose) that didn't make it into the book. The book is about 50,000 words... and considerably shorter than the total volume of chaff! I don't think most of it can be turned into useful public posts, but I'm not entirely opposed to the idea. Maybe some of the old chapters could be made into something? Coming up with a conditioned mathematical property to prove was a struggle. I had two candidates: a == b * c => a / b == c, which would have required a long tangent on how division must be total in Z3, and a != 0 => some b: b * a == 1, which would have required introducing a quantifier (SMT is real weird about quantifiers). Division by zero has already caused me enough grief so I went with the latter. This did mean I had to reintroduce "operations must be total" when talking about arrays. I have no idea why the array example returns 2 for the max profit and not 99999999. I'm guessing there's some short circuiting logic in the optimizer when the problem is ill-defined? One example I could not get working, which is unfortunate, was a demonstration of how SMT solvers are undecidable via encoding Goldbach's conjecture as an SMT problem. Anything with multiple nested quantifiers is a pain.

## Analyzing Teleport RBAC with Z3: Regexes, queries and formal methods

DevFeed: [Analyzing Teleport RBAC with Z3: Regexes, queries and formal methods](<https://devfeed.tech/articles/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-29983.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/z3-rbac/>)

Author: info@goteleport.com (Andrew Helwer)

Published: 2022-01-19T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [Formal methods](<https://devfeed.tech/topics/formal-methods.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [Python](<https://devfeed.tech/topics/python.md>), [Software](<https://devfeed.tech/topics/software.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Software Engineering](<https://devfeed.tech/topics/software-engineering.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [formal-methods](<https://devfeed.tech/tags/formal-methods.md>), [library](<https://devfeed.tech/tags/library.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [python](<https://devfeed.tech/tags/python.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [regex](<https://devfeed.tech/tags/regex.md>), [regular-expressions](<https://devfeed.tech/tags/regular-expressions.md>), [security](<https://devfeed.tech/tags/security.md>), [syntax](<https://devfeed.tech/tags/syntax.md>), [z3](<https://devfeed.tech/tags/z3.md>)

### AI overview

This tutorial explains how to use the Z3 theorem prover to analyze Teleport's role-based access control system. It covers checking whether roles admit the same users to the same nodes and handling constraints involving string equality, regular expressions, interpolation, and basic string functions.

### Source excerpt

Learn how to use Z3 to ask questions about our RBAC system. Are two roles the same?

## Optimization Models for Subset Cover

DevFeed: [Optimization Models for Subset Cover](<https://devfeed.tech/articles/optimization-models-for-subset-cover-40441.md>)

Original publisher: [Read original article](<https://www.jeremykun.com/2020/10/20/optimization-models-for-subset-cover/>)

Published: 2020-10-20T09:00:00Z

Content type: article

Language: en

Sources: [Jeremy Kun](<https://devfeed.tech/sources/jeremy-kun.md>)

Topics: [Optimization](<https://devfeed.tech/topics/optimization.md>), [Code](<https://devfeed.tech/topics/code.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [boolean-satisfiability](<https://devfeed.tech/tags/boolean-satisfiability.md>), [combinatorics](<https://devfeed.tech/tags/combinatorics.md>), [integer-programming](<https://devfeed.tech/tags/integer-programming.md>), [mathematics](<https://devfeed.tech/tags/mathematics.md>), [optimization](<https://devfeed.tech/tags/optimization.md>), [programming](<https://devfeed.tech/tags/programming.md>), [python](<https://devfeed.tech/tags/python.md>), [smt](<https://devfeed.tech/tags/smt.md>), [source](<https://devfeed.tech/tags/source.md>), [subset-cover](<https://devfeed.tech/tags/subset-cover.md>), [z3](<https://devfeed.tech/tags/z3.md>)

### AI overview

This article explores subset covering as a combinatorial optimization problem and compares Integer Linear Programming solvers with Z3, an open-source SMT solver from Microsoft. It defines a generalized formulation for covering all subsets of size l with the fewest subsets of size k.

### Source excerpt

In a recent newsletter article I complained about how researchers mislead about the applicability of their work. I gave SAT solvers as an example. People provided interesting examples in response, but what was new to me was the concept of SMT (Satisfiability Modulo Theories), an extension to SAT. SMT seems to have more practical uses than vanilla SAT (see the newsletter for details). I wanted to take some time to explore SMT solvers, and I landed on Z3, an open-source SMT solver from Microsoft.

## Taming a wild nanomite-protected MIPS binary with symbolic execution: No Such Crackme

DevFeed: [Taming a wild nanomite-protected MIPS binary with symbolic execution: No Such Crackme](<https://devfeed.tech/articles/taming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme-39697.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2014/10/11/taiming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme/>)

Author: Axel "0vercl0k" Souchet & Emilien "tr4nce" Girault

Published: 2014-10-12T04:35:00Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Assembly](<https://devfeed.tech/topics/assembly.md>), [Security](<https://devfeed.tech/topics/security.md>), [debugging](<https://devfeed.tech/topics/debugging.md>), [Linux](<https://devfeed.tech/topics/linux.md>)

Tags: [assembly](<https://devfeed.tech/tags/assembly.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [intel](<https://devfeed.tech/tags/intel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mips](<https://devfeed.tech/tags/mips.md>), [nosuchcon](<https://devfeed.tech/tags/nosuchcon.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [security](<https://devfeed.tech/tags/security.md>), [symbolic-execution](<https://devfeed.tech/tags/symbolic-execution.md>), [z3](<https://devfeed.tech/tags/z3.md>), [z3py](<https://devfeed.tech/tags/z3py.md>)

### AI overview

A technical walkthrough of a No Such Con security challenge involving a nanomite-protected MIPS binary. The article introduces the challenge, MIPS fundamentals, debugging setup, and symbolic-execution-based analysis, with two co-authored solution paths.

### Source excerpt

As last year, the French conference No Such Con returns for its second edition in Paris from the 19th of November until the 21th of November. And again, the brilliant Eloi Vanderbeken & his mates at Synacktiv put together a series of three security challenges especially for this occasion. Apparently, the ...