semantics-based attack generation