--- title: "Symbolic execution for LLMs" canonical: "https://xerj.org/science/symbolic-execution" updated: "2026-11-14" source: "content/science/symbolic-execution.md" --- # Symbolic execution for LLMs **Short answer** (updated 2026-11-14): What is symbolic execution for LLMs? It runs a program on symbols that stand for many inputs, not on one concrete value. The run produces a formula, and a path condition that says when that path is taken. In XERJ, Query-1 and Reader-1 use this idea: the model writes a short program, and the engine executes it. **TL;DR** Symbolic execution for LLMs means the model writes a short program or formula, and an engine runs it on symbols or on facts. The run produces a formula you can check, not only one concrete result. ## Agent prompt ```text Act as a coding agent. Read https://xerj.org/llms.txt, install XERJ, start a local node, index one folder I point you to, and run one search so I can see a cited passage. ``` *Figure: The concrete vs symbolic contrast follows James C. King's 1976 account of symbolic execution (Communications of the ACM). The XERJ part is the product description of Query-1 and Reader-1, not a new formal verifier.* ## How it works A concrete run uses one input and returns one result. A symbolic run keeps a formula, and at each branch it keeps a condition that describes the path. If you can solve that condition, you know which inputs would take the path. ## How XERJ uses it XERJ uses this idea in a narrow way. Query-1 writes a search program over stored facts. Reader-1 writes a formula over a document, and the value is calculated from the words on the page. You can read the program, and you can run it again. That is not a general verifier for arbitrary source code. See [neurosymbolic models](/science/neurosymbolic-models) and [extractive answering](/science/extractive-answering). ## History and research The classic paper is James C. King, [Symbolic Execution and Program Testing](https://dl.acm.org/doi/10.1145/360248.360252), Communications of the ACM 19(7), 1976, pages 385 to 394. ## Guides See it in the product: the [Query-1 page](/xerj-query-1), the [Query-1 launch post](/blog/xerj-query-ai-model) and [XERJ Reader-1](/blog/xerj-reader-1-waitlist). ## Related terms [Neurosymbolic AI vs LLMs](/science/neurosymbolic-ai), [neurosymbolic models](/science/neurosymbolic-models), and [extractive answering](/science/extractive-answering). ## FAQ ### What is symbolic execution for LLMs? The model writes a short program or formula. An engine runs it on symbols or on facts, so you can read the program and check the result. ### How is this different from a normal run? A normal run uses one concrete input, such as the number 3, and returns one result. A symbolic run keeps a formula, so you can reason about many inputs at once. ### How does XERJ use symbolic execution? In a narrow, product-level way. The model writes a short program or formula. The engine executes it over facts or over words in a document, so you can check the result. ### Is XERJ a general program verifier? No. It does not claim to explore every path of an arbitrary program. The engine runs the short programs that Query-1 and Reader-1 write. ## Related - [Neurosymbolic AI vs LLMs](/science/neurosymbolic-ai) - [What are neurosymbolic models?](/science/neurosymbolic-models) - [What is extractive answering?](/science/extractive-answering) - [XERJ Reader-1](/blog/xerj-reader-1-waitlist) - [Model.Surgery joins XERJ](/blog/model-surgery-joins-xerj) - [What is agentic memory?](/science/agentic-memory) (same intent: Science) - [BM25 vs vector search](/science/bm25) (same intent: Science) - [What is context engineering?](/science/context-engineering) (same intent: Science)