HOME·SCIENCE·SYMBOLIC EXECUTION FOR LLMS
SCIENCE · FOUNDATIONS

Symbolic execution for LLMs

AUTHOR · XERJ documentation team · REVIEWED BY · XERJ engineering team · PUBLISHED · 2026-11-13 · UPDATED · 2026-11-14
SHORT ANSWER · UPDATED 2026-11-14

What is symbolic execution for LLMs? It runs a program on symbols that stand for many inputs, not on one concrete value. The run produces a formula, and a path condition that says when that path is taken. In XERJ, Query-1 and Reader-1 use this idea: the model writes a short program, and the engine executes it.

TL;DR Symbolic execution for LLMs means the model writes a short program or formula, and an engine runs it on symbols or on facts. The run produces a formula you can check, not only one concrete result.

Try it: concrete vs symbolic

How a path is checked

  1. 1. Concrete run

    You give the program ordinary inputs, such as the number 3, and you see one result. That result is only for that input.

  2. 2. Symbolic run

    You give the program a symbol that stands for a class of inputs. The run produces a formula, and a path condition that says when that path is taken.

  3. 3. A branch

    At an if-statement the execution splits: one path where the condition holds, one path where it does not. Each path keeps its formula.

  4. 4. In XERJ

    Reader-1 and Query-1 use this idea in a narrow way: the model writes a short program or formula, and the engine executes it over facts or over words in a document, so you can check the result.

The concrete vs symbolic contrast follows James C. King's 1976 account of symbolic execution (Communications of the ACM). The XERJ part is the product description of Query-1 and Reader-1, not a new formal verifier.
PASTE THIS TO YOUR AI AGENT — IT DOES THE REST Act as a coding agent. Read https://xerj.org/llms.txt, install XERJ, start a local node, index one folder I point you to, and run one search so I can see a cited passage.

How it works

A concrete run uses one input and returns one result. A symbolic run keeps a formula, and at each branch it keeps a condition that describes the path. If you can solve that condition, you know which inputs would take the path.

How XERJ uses it

XERJ uses this idea in a narrow way. Query-1 writes a search program over stored facts. Reader-1 writes a formula over a document, and the value is calculated from the words on the page. You can read the program, and you can run it again. That is not a general verifier for arbitrary source code.

See neurosymbolic models and extractive answering.

History and research

The classic paper is James C. King, Symbolic Execution and Program Testing, Communications of the ACM 19(7), 1976, pages 385 to 394.

Guides

See it in the product: the Query-1 page, the Query-1 launch post and XERJ Reader-1.

Related terms

Neurosymbolic AI vs LLMs, neurosymbolic models, and extractive answering.

FAQ

What is symbolic execution for LLMs?

The model writes a short program or formula. An engine runs it on symbols or on facts, so you can read the program and check the result.

How is this different from a normal run?

A normal run uses one concrete input, such as the number 3, and returns one result. A symbolic run keeps a formula, so you can reason about many inputs at once.

How does XERJ use symbolic execution?

In a narrow, product-level way. The model writes a short program or formula. The engine executes it over facts or over words in a document, so you can check the result.

Is XERJ a general program verifier?

No. It does not claim to explore every path of an arbitrary program. The engine runs the short programs that Query-1 and Reader-1 write.

Related