SE Home
登录

近期新增论文

跟踪 arXiv 与关注会议/期刊的新论文，按发布时间浏览和检索。

近期新增论文
汇总 arXiv 与关注会议/期刊的新论文，检索时按相关性优先排序。
智能提示
TOSEM Recent ArticlesArchitecture and DesignACM Transactions on Software Engineering and Methodologyapproachempirical studyArchitecture quality attributesDesign and architecture modeling and analysisACM TOSEMACM Transactions on Software Engineering and MethodologyComputer scienceQueueing theory

HQP: Hybrid Queueing and Configuration-Aware Performance Modeling for Microservice Systems

Yuanjie Xia, Kundi Yao, Lizhi Liao, Daniele Di Pompeo, Catia Trubiani, Boris E. Zibitsker, Weiyi Shang
2026/08/01 08:00已过 3 天

Understanding the performance of microservice-based systems is challenging because workloads and configurations often change dynamically, and their combined effects can influence system behavior. Existing performance testing and modeling techniques study workloads or configurations in isolation, overlooking their joint impact. The large configuration space and diverse workload patterns further complicate accurate prediction. Although prior studies have combined performance models with queueing formalisms, limited work has integrated configuration-aware modeling with queueing analysis to capture workload-dependent, system-level dynamics. We present HQP ( H ybrid Q ueueing and Configuration-aware P erformance Modeling), a modeling approach that integrates lightweight configuration-aware performance models with the Queueing Petri Net (QPN) formalism to capture both service-level behavior and architectural interactions. HQP models how configuration settings and workload variations interact and propagate through microservice dependencies. Using the µBench, which allows customizable architectures and service functions, we construct four microservice systems to evaluate HQP. Results show that HQP achieves Spearman correlations up to 0.94 and MARE below 11%, while requiring only one-fifth the samples needed by baselines. We further introduce SCPM ( S earch and C ondition P rediction on hybrid M odeling), a search-based method that identifies performance-equivalent, performance-spiked, and performance-saturated conditions with over 80% accuracy. Together, HQP and SCPM provide efficient, accurate performance analysis for evolving microservice systems.

论文页
TOSEM Recent ArticlesTesting and AnalysisACM Transactions on Software Engineering and Methodologybenchmarkempirical studyDebugging and fault localizationACM TOSEMACM Transactions on Software Engineering and MethodologyarXiv (Cornell University)Computer science

Reassessing Code Authorship Attribution in the Era of Language Models

Atish Kumar Dipongkor, Ziyu Yao, Kevin Moran
2026/07/31 08:00已过 4 天

The study of Code Stylometry, and in particular Code Authorship Attribution (CAA), aims to analyze coding styles to identify the authors of code samples. CAA has been illustrated to be an important component of automating software engineering (SE) tasks such as bug triaging, fault localization, and test prioritization. In addition, CAA is also important in cybersecurity and software forensics for addressing copyright disputes and detecting plagiarism. Past techniques for CAA tend to leverage hand-crafted code-related features that typically carry limitations that prevent proper authorship characterization and lead to sensitivities to adversarial attacks. Recently, transformer-based Language Models (LMs) have shown remarkable efficacy across a range of SE tasks, and in authorship attribution for natural language in the NLP domain. However, their effectiveness in CAA is not well understood. As such, we conduct the first extensive empirical study applying two larger state-of-the-art code LMs, and five smaller code LMs to the task of CAA on six diverse datasets that encompass 12k code snippets written by 463 developers. Furthermore, we perform an in-depth quantitative and qualitative analysis of our studied models’ performance on CAA using established interpretability techniques. Our results illustrate important aspects of the behavior of LMs in understanding stylometric code patterns.

论文页PDF
TOSEM Recent ArticlesEvolutionACM Transactions on Software Engineering and MethodologybenchmarkapproachEvolution and maintenanceACM TOSEMACM Transactions on Software Engineering and MethodologyarXiv (Cornell University)Computer science

SDLog: A Deep Learning Framework for Detecting Sensitive Information in Software Logs

Roozbeh Aghili, Qiaolin Qin, Xingfang Wu, Heng Li, Foutse Khomh, Heng Li
2026/07/31 08:00已过 4 天

Software logs are messages recorded during the execution of a software system that provide crucial run-time information about events and activities. Although software logs have a critical role in software maintenance and operation tasks, publicly accessible log datasets remain limited, hindering advances in log analysis research and practices. The presence of sensitive information, particularly Personally Identifiable Information (PII) and quasi-identifiers , introduces serious privacy and re-identification risks, discouraging the publishing and sharing of real-world logs. In practice, log anonymization techniques primarily rely on regular expression patterns, which involve manually crafting rules to identify and replace sensitive information. However, these regex-based approaches suffer from significant limitations, such as extensive manual efforts and poor generalizability across diverse log formats and datasets. To mitigate these limitations, we introduce SDLog, a deep learning-based framework designed to identify sensitive information in software logs. Our results show that SDLog overcomes regex limitations and outperforms the best-performing regex patterns in identifying sensitive information. With only 100 fine-tuning samples from the target dataset, SDLog can correctly identify 99.5% of sensitive attributes and achieves an F1-score of 98.4%. To the best of our knowledge, this is the first deep learning alternative to regex-based methods in identifying sensitive information in software logs.

论文页PDF
TOSEM Recent ArticlesTesting and AnalysisACM Transactions on Software Engineering and Methodologyapproachempirical studySoftware testingACM TOSEMACM Transactions on Software Engineering and MethodologyQualitative researchComputer science

GenAI Is No Silver Bullet for Qualitative Research in Software Engineering

Neil Ernst, Christoph Treude
2026/07/31 08:00已过 4 天

Qualitative research gives rich insights into the quintessentially human aspects of software engineering as a socio-technical system. Qualitative research spans diverse strategies and methods, from interpretivist, in situ observational field studies, to deductive coding of data from mining studies. Advances in large language models and generative AI (GenAI) have prompted claims that artificial intelligence could automate qualitative analysis. Such claims are overgeneralizing from narrow successes. GenAI support must be carefully adapted to the data of interest, but also to the characteristics of a particular research strategy. In this Frontiers of SE paper , we discuss the emerging use of GenAI in relation to the broad spectrum of qualitative research in software engineering. We outline the dimensions of qualitative work in software engineering, scan limited emerging empirical evidence for GenAI assistance, examine the promises and pitfalls of GenAI-assisted qualitative research, and revisit qualitative research quality factors, in light of GenAI. Our goal is to inform researchers about the promises and pitfalls of GenAI-assisted qualitative research. We conclude with a research agenda to advance understanding of its use in software engineering.

论文页
TOSEM Recent ArticlesDependability and SecurityACM Transactions on Software Engineering and Methodologyapproachempirical studyFormal methods and model checkingACM TOSEMACM Transactions on Software Engineering and MethodologyModel checkingComputer science

A Divide & Conquer Approach to Model Checking Linear Temporal Properties

Canh Minh, Tsubasa Takagi, Kazuhiro Ogata
2026/07/31 08:00已过 4 天

This paper proposes a divide & conquer approach to model checking linear temporal properties to mitigate the state space explosion problem in model checking. The core idea of the approach is to split an original model checking problem into multiple smaller model checking problems using the tableau method and tackle each smaller one independently. We prove a theorem ensuring that these smaller model checking problems are equivalent to the original model checking problem. By leveraging the natural parallelism of the divide-and-conquer approach, the smaller model checking problems can be tackled simultaneously to improve the verification time significantly. To support our approach, we develop a tool in Maude called DCA2MC , which uses Maude LTL model checker as a software component to conduct model checking experiments and supports both sequential and parallelization modes for verification. DCA2MC also supports the integration of external model checkers, such as Spin, allowing users to choose between Maude LTL model checker and Spin to conduct model checking experiments. This integration shows that other model checkers can leverage our approach to mitigate the state space explosion and handle larger state spaces more effectively. To maximize the effectiveness of our approach, layer configuration selection plays a crucial role. We introduce a semi-automated method for finding a good layer configuration, supported by custom commands developed in DCA2MC . Finally, we conduct case studies on five mutual exclusion protocols and provide extensive experimental results comparing DCA2MC with Maude LTL model checker, Spin, and LTSmin in terms of memory consumption and runtime performance, thereby demonstrating the power of our approach.

论文页
TOSEM Recent ArticlesTesting and AnalysisACM Transactions on Software Engineering and MethodologyapproachAutomated test generationACM TOSEMACM Transactions on Software Engineering and MethodologyComputer scienceLocality

Unsatisfiable Core Guided Constraint Solving in Symbolic Execution

Ziqi Shuai, Zhenbang Chen, Yufeng Zhang, Hengbiao Yu, Ji Wang, Jifeng Xuan
2026/07/31 08:00已过 4 天

Constraint solving remains a fundamental challenge in symbolic execution. To reduce the computational overhead of SMT solvers, modern symbolic execution tools commonly cache and reuse the results of previously solved queries. However, existing caching mechanisms primarily focus on satisfiable queries, offering limited support for unsatisfiable ones, which are still delegated to the underlying SMT solver. To address this problem, we introduce a novel Unsatisfiable Core Guided ( Ucg ) constraint solving framework for symbolic execution. The proposed framework accelerates constraint solving by systematically exploiting unsatisfiable cores, which provide compact explanations for unsatisfiability. Specifically, Ucg first constructs an unsatisfiable core cache with a least-recently-used (LRU) replacement policy to enable the reuse of previously computed unsatisfiable cores. Upon a cache miss, Ucg further exploits the temporal locality of assertions within unsatisfiable cores to predict a potential unsatisfiable core for the pending query. This predicted core serves as an over-approximation of the original query and is likely to be unsatisfiable. By solving this much smaller over-approximated formula, Ucg can infer the satisfiability of the original query with substantially reduced SMT solver effort. We integrated Ucg into Klee , a state-of-the-art symbolic execution tool for C programs. Experimental results on 99 open-source real-world programs demonstrate that Ucg consistently improves the efficiency of both constraint solving and path exploration in symbolic execution across various search strategies. In the best-case scenario, Ucg can achieve improvements of up to two orders of magnitude.

论文页
TOSEM Recent ArticlesTesting and AnalysisACM Transactions on Software Engineering and Methodologybenchmarkapproachempirical studyProgram analysisACM TOSEMACM Transactions on Software Engineering and MethodologyComputer scienceCompiler

Two in One: A case for Combined Points-to and MHP Analysis

Ramya Kasaraneni, V. Krishna Nandivada
2026/07/31 08:00已过 4 天

With parallel programs becoming a mainstay, analyzing them has become an important requirement. Points-to analysis and May-Happen-in-Parallel (MHP) analysis are two of the most foundational analyses for parallel programs written in OO languages like Java. It is well known that precise MHP analysis needs points-to analysis results and precise flow-sensitive points-to analysis needs MHP analysis results. In this paper, we explore the interdependence between these analyses and propose new schemes to perform them efficiently. We start by proving that there is a phase-ordering relation between MHP analysis and flow-sensitive points-to analysis; that is, they are interdependent such that no particular order of performing the analyses can yield the precise result. Next, we propose a novel combined MHP and points-to analysis scheme (called ComPoMHP ) based on inclusion constraints, for real world parallel Java applications; this generates flow-sensitive, context-insensitive results; it even computes the required call graph information on the fly. We have implemented ComPoMHP in the Soot compiler framework and tested our analysis on thirteen benchmarks drawn from multiple sources. We show that the combined analysis leads to significant improvements in terms of precision of both MHP and points-to results, across seven different clients. We find that ComPoMHP leads to an excellent time-precision trade-off for points-to results, compared to the popular Doop based analyses. We also show that composing the points-to results of ComPoMHP with the results from existing Doop based flow-insensitive, context-sensitive analysis leads to highly precise results at affordable costs. We believe that our work paves the way for more precise and practical analysis of parallel Java programs.

论文页
arXiv cs.SE / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.SEcs.CLcs.LGarXiv cs.SE

Change2Task: From Repository Changes to Executable Coding Agent Tasks and Environments

Haomin Qi, Xingliang Wang, Xuanqi Gao, Baihui Sang, Xin Zhang, Minghua Ma, Pengfei Gao, Yu Kang, Qingwei Lin, Saravan Rajmohan, Dongmei Zhang, Qi Zhang
2026/07/31 01:44已过 4 天

Scaling coding agents requires a continuing supply of executable data for training, benchmarking, and continuous evaluation. Each task must couple a realistic software state with a specification, development tools, and reliable verification. To expand this supply, we present Change2Task, a system grounded in repository history that converts merged pull requests into verified tasks on healthy modern revisions of the same repository. It aligns historical evidence with evolved code, reconstructs task states through Patch Reversal, Code Mapping, or Agent Reconstruction, and validates the lifecycle from a healthy base to a task state and a restored state. By deriving multiple tasks grounded in developer evidence from maintained environments, Change2Task provides executable data for coding agent training and evaluation while reducing repeated environment setup, storage, and task construction effort. We evaluate the system through five common and widely adopted coding agent task families: Bug Fix, Feature Addition, Test Generation, Application Programming Interface Migration, and Security Repair. Starting from 1,130 source changes eligible for construction, Change2Task achieves 79.6% verified task construction success across these task families. On a matched candidate set, it recovers 29.2% more verified tasks than a construction baseline based on pull requests. Historical and reconstructed cases achieve up to 98.0% matched outcome agreement under agent evaluation, while reuse of modern bases reduces measured expenditure across the complete pipeline by 10.8%.

论文页PDF
arXiv cs.SE / arXiv SWE-bench / Defects4J / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelsCollaborative AI for SEcs.SEcs.AIarXiv cs.SEarXiv SWE-bench / Defects4J

PAIChecker: Uncovering and Checking PR-Issue Misalignment in SWE-Bench-Like Benchmarks

Manyi Wang, Junjielong Xu, Pinjia He
2026/07/31 01:42已过 4 天

SWE-bench-like benchmarks are widely used for evaluating LLM's issue resolution capability. They typically follow a common construction pipeline: each PR (Pull Request) is paired with its linked issue by extracting issue references from the PR description; the issue description is used as the problem statement, and the PR patch serves as the test oracle. However, due to the inherent complexity of developing and maintaining large repositories, such PR-Issue pairings are often misaligned in practice. In this work, we systematically study SWE-bench Verified instances, finding that 13.6% exhibit misalignment across five patterns in eleven fine-grained scenarios. To enable reliable and scalable construction of those benchmarks in the future, we propose PAIChecker, a multi-agent system for checking PR-Issue misalignment in SWE-bench-like benchmarks. Specifically, PAIChecker adopts a three-phase design that combines specific pattern identification, cross-agent label synthesis, and code-level validation, thereby enabling more accurate, generalizable, and progressively verified detection. Experiments on SWE-Gym and SWE-bench Multilingual show that PAIchecker achieves the best performance across all four LLM backbones, reaching up to 92.12% and 91.67% binary accuracy, respectively.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.LOcs.PLarXiv cs.CR

Formalization of security

Gilles Barthe
2026/07/31 01:21已过 4 天

Proof assistants are often used to validate that designs and implementations meet their expected security properties. A further motivation for using proof assistants is to support certification. This chapter focuses on their applications to system security, language-based security, secure compilation, and cryptography.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv LLM4Code / Program Repair / arXiv AI Agents for Software EngineeringAnalyticsarXivbenchmarkapproachData-driven user experienceSoftware metrics and measurementscs.CLcs.AIcs.SEarXiv cs.SE

ORCA-bench: How Ready Are Language Model Agents for Oncall?

Albert Gong, Kyuseong Choi, Abhineet Agarwal, Jason Schechner, Ryan Huang, Raj Agrawal, Anish Agarwal, Raaz Dwivedi
2026/07/31 01:14已过 4 天

Large language models can write, patch, and search code, but oncall root cause analysis (RCA) demands something different: reasoning over noisy metrics, logs, traces, and source code, starting from ambiguous user-facing reports, often hours after the incident began. We introduce ORCA-bench, a benchmark that puts general-purpose coding agents in a production-fidelity oncall setting. ORCA-bench pairs a live OpenTelemetry-instrumented microservice system--exposing six days of metrics, logs, and traces through real telemetry interfaces (Prometheus, Jaeger, and OpenSearch via Grafana) and full source-code access--with 1,079 RCA tasks that systematically vary report specificity, time-to-detection, and co-occurring fault scenarios. Ground-truth symptoms are curated and signed off by expert SREs, and our LLM-as-judge is independently re-scored by humans (Cohen's $κ_w=0.90$). Across five frontier agents, the best RCA Accuracy is 25.3% on Medium-difficulty tasks (the realistic-input setting) and 10.0% on Hard--a gap that remains even with Claude Fable 5. The weakest model hallucinates an implausible root cause in 40% of incident reports, and removing source-code access degrades every metric. Crucially, these are performances on a curated 50 GB / six-day testbed with tasks investigated in isolation on a system whose code and instrumentation are public. Since real production systems are order of magnitudes larger, more dynamic, and more idiosyncratic, the gap we report is a lower bound on the engineering investment required before frontier coding agents can be safely entrusted with production reliability. We release the public set at https://hub.harborframework.com/datasets/orca-bench/ORCA-bench.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.LOarXiv cs.CR

Implementing Homomorphic Encryption-Based Logic Locking in System-on-Chip Designs

Ye Ziyang, Makoto Ikeda
2026/07/31 01:11已过 4 天

This study presents a logic locking scheme based on the binary Ring Learning With Errors algorithm, implemented in a RISC-V System-on-Chip design. Unlike traditional logic locking methods that require providing users with raw locking parameters, the proposed approach secures critical logic paths in the privilege switching process without exposing these sensitive parameters. The implemented locking module itself consumes 3519 Look-Up Tables and 2645 Registers, leading to an overall overhead of 6.0% in Look-Up Tables and 6.9% in Registers compared to the baseline system. The unlock process requires about 2.6 us, introducing moderate performance impact, primarily affecting system-level operations while preserving user-level computational efficiency.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.SEarXiv cs.SEarXiv AI Coding 3YarXiv LLM4Code / Program Repair

CoGate: Confidence-Gated Co-Decoding for Secure Code Generation

Minghao Hu, Lannan Luo, Allen Roush, Phillip Howard
2026/07/31 01:02已过 4 天

Large language models are widely used for code generation, but they can also produce insecure programs due to patterns learned from their pretraining data. Decoding-time steering has become an important solution to this problem: a small expert model is combined with the target model at each step to generate more secure code, which is referred to as co-decoding. However, the acceptance rule for existing co-decoding approaches does not consider the expert model's confidence. When the security expert is unconfident due to unseen patterns or out-of-distribution (OOD) contexts, its guidance can therefore be misleading. To address the challenge, we propose CoGate, a confidence-gated co-decoding approach that controls the expert's influence on the co-decoding process based on its confidence. We implement our approach and evaluate it across multiple LLM backends (CodeGen, DeepSeek-Coder, Qwen-Coder, StarCoder) on several code generation benchmarks (HumanEval, security suite, and CWEval). Our approach outperforms existing co-decoding methods (CoSec+) across multiple benchmarks, achieving up to a 12.6% gain of Func-Sec@10 on CWEval.

论文页PDF
arXiv cs.CRAI for Software EngineeringarXivapproachPrompt engineering for SEAutomating SE tasks with LLM and foundation modelscs.LGcs.CRarXiv cs.CR

Cybersecurity Detection Classification with Reasoning-enabled Language Models

Amol Khanna, Manu Nandan, Cristian Viorel Popa, Joan Pujol-Roig, Diana Bolocan, Laura Vasilie, Alexandru Apostu, Chase Helwig, Mihaela Gaman, Michael Brautbar, Edward Raff, Chase Midler, Sven Krasser
2026/07/31 00:22已过 4 天

A major issue in Security Operations Centers (SOCs) is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models (LLMs) to emit a triage label directly, but does not train them to reason about whether a detection is a genuine threat. We train a chain-of-thought (CoT) reasoning-enabled triage classifier on real, human-labeled Windows endpoint detections by combining automated prompt optimization, self-training, and reinforcement learning with verifiable rewards. We find that CoT reasoning also degrades the label-token probabilities that automated triage relies on, so we separately train a calibrator that reads the full reasoning trace and estimates the probability that the verdict is correct. Our system reaches 82.6% test accuracy and, at the high-confidence operating point that governs automated triage, improves benign recall by 43.0% and malicious recall by 18.3% over a direct-label LLM classifier. We further show that the trained calibrator is necessary - an untrained confidence judge collapses high-confidence recall to zero - and that a finetuned 30B model significantly outperforms frontier general-purpose models, motivating targeted training over scale.

论文页PDF
arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachAI-enabled recommender systems for automated SEcs.CLarXiv AI Coding 3Y

Lightning OPD 2.0: Mitigating Style Bias in Cross-Teacher On-Policy Distillation for Large Reasoning Models

Yecheng Wu, Song Han, Han Cai
2026/07/31 00:17已过 4 天

On-policy distillation (OPD) provides dense token-level supervision from a teacher, but its effectiveness can depend on teacher consistency, meaning that the model providing OPD supervision should also have generated the demonstrations used to train the supervised fine-tuning (SFT) reference. However, this condition is frequently violated in practice when SFT data have mixed or unknown provenance or when different models are preferred for SFT data generation and subsequent distillation. In such cross-teacher settings, even a stronger OPD teacher can yield little improvement over the SFT reference. We find that raw teacher--reference disagreement contains potentially useful context-specific teacher evidence as well as a recurring component associated with differences in wording, formatting, and reasoning cadence. We introduce Lightning OPD 2.0 with cross-fitted style residualization, which uses rollout-level cross-fitting to estimate this recurring component as an operational proxy for style-token bias and subtracts it before constructing the token-level OPD update. Across mathematical reasoning and code generation benchmarks, Lightning OPD 2.0 consistently outperforms Lightning OPD in cross-teacher settings. Starting from Klear-Reasoner-8B-SFT, Lightning OPD 2.0 reaches 82.4% on AIME 2024 and 63.0% on LiveCodeBench v5. Together, these results establish Lightning OPD 2.0 as a practical approach to cross-teacher OPD, relaxing teacher consistency as a prerequisite and allowing the SFT data generator and distillation teacher to be selected independently. Code will be released soon.

论文页PDF
arXiv cs.SE / arXiv cs.CRDependability and SecurityarXivapproachempirical studysurveyConfidentialityintegrityprivacycs.SEcs.CRarXiv cs.SEarXiv cs.CR

Emerging Challenges in Threat Modeling for GenAI-Augmented Systems: A View from the Trenches

Nicolás E. Díaz Ferreyra, Manish Mahesh Kumar, Nohemí Villarreal, Pankaj Pantel, Immo Brueggemann, Riccardo Scandariato
2026/07/31 00:08已过 4 天

Threat modeling remains a central task in secure software engineering, as it enables the identification of security issues from system architectures. As Generative Artificial Intelligence (GenAI) becomes increasingly pervasive across software systems, traditional threat modeling methods (e.g., STRIDE) are insufficient to assess emerging GenAI-specific risks. In this work, we present the first results from an exploratory assessment of GenAI-aware threat modeling methods in a Small and Medium Enterprise (SME) setting. For this, we conducted a rapid literature review to select relevant techniques and systematically applied three shortlisted methods to an industrial case study involving a GenAI-augmented system. The results highlight differences in the threats identified by each technique and reveal limited support for certain GenAI-specific risk categories, particularly those related to software supply chains and human-centered security issues. We further report practitioners' perceptions of the usability and integration of these methods in SME development workflows, including their perceived effort and adoption challenges.

论文页PDF
arXiv cs.SEDependability and SecurityarXivapproachempirical studysurveyConfidentialityintegrityprivacycs.SEarXiv cs.SE

Demystifying Solana Bots: From GitHub Blueprints to On-Chain Fingerprints

Xiaoye Zheng, Yujing Chen, Minghao Wu, David Lo, Difan Xie, Daoyuan Wu, Xiaohu Yang, Zhiyuan Wan
2026/07/31 00:02已过 4 天

Solana is an emerging blockchain platform designed for high throughput and low transaction fees, making it inexpensive to submit transactions at scale and, consequently, increasing exposure to bot spamming and related financial exploitation. Solana bots are typically off-chain software systems that operate in a competitive on-chain execution environment by constructing and submitting transactions, and the bot-related transactions on the decentralized exchanges exceed 250 million dollars in daily trading volume in January 2026. Prior studies on Solana have examined system performance, smart-contract security, and specific on-chain phenomena. However, we still lack a systematic understanding of what Solana bots implement in practice and how these implementations manifest as observable on-chain execution fingerprints. To address this gap, we performed a large-scale empirical study of Solana bots from two complementary views: (i) 586 bot repositories collected from GitHub, and (ii) 200 bot addresses on Solana, with over 44 million on-chain transactions. Our study derives an implementation-grounded taxonomy of Solana bots comprising 15 categories grouped into five domains (e.g., Trading Operations, MEV, and On-chain Analytics), identifies a largely shared five-stage operational pipeline manifested in bot implementations, and uncovers systematic variation in on-chain trading behaviors of Solana bots across diverse trading platforms and assets. Based on our findings, we highlight future research directions, and provide recommendations for building and operating bots on the Solana blockchain.

论文页PDF
arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivbenchmarkapproachempirical studyAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelscs.AIarXiv AI Coding 3YarXiv LLM4Code / Program Repair

When Specifications Conflict: A Symmetry-Based Framework for Measuring LLM Preferences

Tairan Wang, Liang Zhou, Zikang Zhan, Pingchuan Yan
2026/07/30 23:42已过 4 天

Large language models (LLMs) are increasingly required to integrate multiple sources of information that may be inconsistent or conflicting. However, there is still a lack of controllable and attributable methods for analyzing how models resolve conflicts between competing specifications. We propose a controlled experimental framework for studying model preferences under conflicting specifications. By constructing specifications with explicit conflicts, the framework enables model choices between competing specifications to be directly observed and analyzed. A symmetry-based design further reduces confounding factors, allowing preferences across representation types to be compared systematically. We evaluate the framework on an executable mathematical benchmark with 550 conflict instances spanning 11 function families, comparing four representation types: pure natural language, formal language, naturalized formal language, and input--output examples. Results show systematic preference patterns rather than random behavior, with a consistent ordering: $ \text{Formal} \approx \text{Naturalized Formal} > \text{Pure Natural Language} > \text{Input--Output Examples} $. Example effects further depend on model capability and function family. We extend the framework to heterogeneous specification conflicts in Boolean algebra, code generation, and the clinical domain, demonstrating its applicability across diverse tasks and specification forms. The framework provides a unified approach for measuring how LLMs resolve conflicts between competing sources of information.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.LGcs.CRcs.DCstat.ML

Encryption-Compatible Clustered Federated Learning via Distributed Expectation-Maximization over Metadata

Michael Ben Ali, Imen Megdiche, André Péninou, Olivier Teste
2026/07/30 23:04已过 4 天

Clustered Federated Learning (CFL) addresses data heterogeneity in federated settings by grouping clients with similar data distributions to enable effective training. Existing methods face a trade-off between privacy preservation, communication cost, and computational efficiency. We formalize this as the CFL trilemma, according to which improving two of these dimensions comes at the expense of the third. A prominent paradigm relies on metadata (i.e., low-dimensional representations of client datasets shared with the server) to enable communication- and computation-efficient clustering. However, such approaches are not compatible with standard FL privacy-preserving mechanisms. To address this limitation, we propose FLAMECHE, which reformulates metadata-based CFL as a distributed Expectation-Maximization (EM) procedure, restricting server updates to additive operations while preserving efficiency. This design enables compatibility with practical secure FL schemes. We conducted extensive experiments on multiple datasets under various heterogeneous scenarios. Results show that FLAMECHE improves the effectiveness of client models. It enables encryption-compatible metadata-based clustering, enhancing its positioning within the CFL trilemma.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairArchitecture and DesignarXivapproachDesign and architecture modeling and analysisArchitecture quality attributescs.SEarXiv cs.SEarXiv AI Coding 3YarXiv LLM4Code / Program Repair

Structural Validation of LLM-Generated Microservice Decompositions Using Source-Code Dependencies

Daniel Silva, Renan Alves, Emanuel Dantas Filho, Ademar Sousa Neto, Mirko Perkusich, Danyllo Wagner Albuquerque, Kyller Gorgônio, Angelo Perkusich
2026/07/30 23:00已过 4 天

Decomposing monolithic systems into microservices is a key activity in software modernization. Although Large Language Models (LLMs) can generate semantically plausible decompositions from textual requirements, it remains unclear whether these proposals preserve the structural dependencies implemented in the source code. This paper evaluates the structural adherence of microservice decompositions generated by OpenAI o3 for the PetClinic and Bookstore systems. We propose an automated validation pipeline based on static dependency analysis and compare zero-shot and few-shot prompting using dependency preservation (TPD) and dependency violation (TVD) metrics. A robustness analysis was conducted to control for differences in class-to-service mapping coverage. After normalization, both prompting strategies produced equivalent structural adherence, achieving TPD values of 68.0% (PetClinic) and 83.3% (Bookstore). The findings demonstrate that structural evaluations of LLM-generated decompositions should explicitly control for mapping coverage, as apparent differences between prompting strategies may otherwise reflect methodological bias rather than genuine architectural quality.

论文页PDF
arXiv cs.SE / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachempirical studyAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelsPrompt engineering for SEcs.SEcs.AIarXiv cs.SEarXiv LLM4Code / Program Repair

From Textual Requirements to Microservice Architectures - A Comprehensive Evaluation of LLM-Based Design Synthesis

Danyllo Albuquerque, José Renan, Guillermo Rodríguez, Guillermo Rodríguez, Emanuel Dantas, Ademar França, Mirko Perkusich, Kyller Gorgônio, Angelo Perkusich
2026/07/30 22:45已过 4 天

Microservice architectures have become dominant for modernizing monolithic systems, yet identifying appropriate services remains challenging and largely manual. Existing decomposition approaches are predominantly code-centric, limiting applicability in early design stages where only textual requirements are available. Despite advances in Large Language Models (LLMs), limited empirical evidence exists on their ability to synthesize complete microservice architectures from natural-language requirements, including service definitions and inter-service interactions. This study investigates whether an LLM can bridge requirements engineering and architectural design, generating architectures solely from textual requirements and evaluating structural agreement and perceived quality of results. We conduct a mixed-method study using OpenAI o3 under zero-shot (ZS) and few-shot (FS) prompting across two systems (Bookstore, PetClinic), one execution per system/condition. Architectures are evaluated through (i) comparison with reference architectures using precision, recall, and F1-score for service identification and communication recovery, and (ii) a blinded expert assessment of correctness, completeness, modularity, and plausibility, plus open feedback synthesis. OpenAI o3 identifies services with higher agreement under FS prompting (F1 = 0.79 for ZS versus = 0.97 for FS). Communication recovery is more challenging: ZS produces dense architectures with high recall but low precision (F1 = 0.61), while FS improves agreement, reaching F1 = 0.82 and reducing unsupported dependencies. Expert evaluation corroborates these results, with FS architectures perceived as more modular, coherent, and plausible than ZS outputs. OpenAI o3 shows potential for requirements-driven synthesis when guided by exemplar prompting. Results are model- and context-specific from two small systems, not model-independent proof.

论文页PDF
arXiv cs.SETesting and AnalysisarXivapproachempirical studyProgram synthesiscs.SEcs.AIarXiv cs.SE

Agentic Method for Deterministic Validation of Legacy Code Migration

Andras Ferenczi, Jordan Docherty, Mariya Bessonov, Matthew Findlay, Krishna Lingamneni
2026/07/30 22:25已过 4 天

Migration of legacy COBOL programs to Java requires extensive testing to ensure correct functionality. This effort is often complicated by the lack of test data and the difficulty of validating all corner cases. In this paper we propose a novel agentic test-synthesis method, the "Locksmith Loop," which is initiated by preparing two runtime environments: the COBOL source and the generated Java target are each instrumented with mocks and executed off-mainframe on commodity hardware, then an iterative agentic loop performs Witness Search over input mocks to penetrate program branches, followed by parity-preserving mutations. When routing boundaries are reached, an analyzer identifies a Locked Paragraph: a condition preventing deeper exploration. Across three COBOL-Java case studies, spanning two open-source programs and one internal production-like COBOL program and ranging from 430 to 4,114 source lines, Locksmith consistently improved coverage beyond input-search plateaus, reaching nearly complete coverage on the two open-source programs and 91.90% branch coverage on the internal production-like COBOL program. The generated Java matched the COBOL reference under deterministic parity checks in all accepted test cases. Through these findings we demonstrate, to the best of our knowledge, a novel approach for validating agentic coding output using a deterministic oracle.

论文页PDF
arXiv cs.SEHuman and Social AspectsarXivapproachTeamscommunitiesand companiescs.SEcs.AIcs.MAarXiv cs.SE

Agentic Metaverse Services: A New As-a-Service Paradigm

Xiaofei Xu, Quan Z. Sheng, Zhongjie Wang, Boualem Benatallah, Xiao Wang, Ruipeng Han
2026/07/30 22:06已过 4 天

Generative Artificial Intelligence (GenAI) is reconstructing the digital virtual world, upgrading agents through enhancing their abilities in autonomous learning, multi-modal interaction, content generation, and collaborative decision-making. In particular, the shift from conversational chatbots to agentic AI, the most recent significant technical breakthrough of GenAI, has brought a new form of services, agentic services and Agent-as-a-Service (AaaS), in which the agent's abilities are encapsulated, such as perception, decision-making, execution, collaboration, and content generation, to provide the customized agent services to users. The metaverse is a virtual ecosystem for human life, work, creation, and entertainment, supported by the new generation of digital technologies. Through combining agentic services and the metaverse, an Agentic Metaverse Service, denoted as AMServ, is produced for metaverse business processing, as a new form of metaverse service. The AaaS in the metaverse environment, denoted as Meta-AaaS, as an approach to realize AMServ, has become a new paradigm of agentic services and service computing. This paper overviews the evolution and new features of agents and services empowered by GenAI, reveals the roles and principles of agentic services in the metaverse environment, presents the forms, characteristics, and principles of the AMServ and the Meta-AaaS, discusses the typical application examples of the AMServ and the Meta-AaaS, and finally points out the new tendencies and research directions of the AMServ and the Meta-AaaS. The AMServ and the Meta-AaaS will bring great opportunities to human society and services in the AI era, and promote the rapid development of emerging service industries in the future.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachempirical studyConfidentialityintegrityprivacycs.ARcs.CRarXiv cs.CR

Demystifying DRAM Read Disturbance: Bridging the Gap Between Experimental Characterization and Device-Level Modeling of RowHammer and RowPress Phenomena

Haocong Luo, Longda Zhou, Ataberk Olgun, İsmail Emir Yüksel, Nisa Bostanci, Zhigang Ji, Xing Wu, Onur Mutlu
2026/07/30 22:03已过 4 天

DRAM read disturbance, like RowHammer and RowPress, is a critical robustness issue where accessing DRAM can cause unintended bitflips in other unaccessed DRAM locations. DRAM read disturbance bitflips significantly impact the safe, secure, and reliable operation of DRAM-based computing systems. Many prior works experimentally characterize these bitflips and propose mitigations based on empirical results. Other device-level works study their underlying physical mechanisms, but these mechanisms do not fully explain all major empirical observations. Our goal is to bridge the gap between experimental characterization and device-level modeling and understanding of RowHammer and RowPress, providing a principled foundation for future work on understanding, characterizing, and mitigating DRAM read disturbance. We first identify and demonstrate gaps and inconsistencies between the physical mechanisms of RowHammer and RowPress described by existing device-level models and experimental characterization of their bitflips. We focus on three fundamental metrics that should map to first-order physical mechanisms: 1) bitflip directions, 2) bitflip counts, and 3) the minimum number of aggressor row activations that trigger the first bitflips (i.e., ACmin). Second, we present a comprehensive and rigorous set of TCAD simulations that match phenomena observed in experimental characterizations of RowHammer and RowPress bitflips. From our results, we 1) summarize updated device-level error mechanisms for understanding RowHammer and RowPress bitflips, and 2) identify key modeling and simulation parameters that significantly affect whether simulation results match real-chip characterization. We discuss implications for 1) rigorous, comprehensive, and efficient experimental characterization methodologies of DRAM read disturbance bitflips, and 2) the design of DRAM read disturbance mitigation techniques.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachsurveyConfidentialityintegrityprivacycs.CRcs.AIarXiv cs.CR

Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation

Fazhong Liu, Zhuoyan Chen, Haozhen Tan, Yan Meng, Guoxing Chen, Haojin Zhu
2026/07/30 21:58已过 4 天

World models give embodied AI a predictive core: they compress observations into states, simulate action-conditioned futures, and enable planning beyond reactive control. This predictive layer, however, opens a new security boundary-compromise can propagate from data, sensors, prompts, or feedback into physical action. Rather than treating world models as an isolated component, this survey traces threats across their entire lifecycle-from data construction and representation learning, through state grounding and imagination, to trajectory evaluation, execution, and long-term adaptation via memory and tools. We show that familiar attack families: poisoning, backdoors, adversarial examples, sensor spoofing, prompt injection, trajectory manipulation, and supply-chain attacks take on distinct meanings when they corrupt world states, learned dynamics, affordance estimates, or safety costs. We also highlight a duality: world models can serve as runtime safety shields, yet when compromised or over-trusted they generate predictive safety illusions. The survey offers a lifecycle taxonomy, maps existing attacks to world-model security properties, outlines evaluation protocols for safety failures, and structures defenses across provenance, robust grounding, uncertainty-aware prediction, trajectory gating, feedback auditing, and deployment assurance.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.DCcs.LGarXiv cs.CR

Secure Aggregation for Privacy-Preserving Federated Learning on Clinical EEG Data

Pouya Rajabi, Mohsen Toorani
2026/07/30 21:28已过 4 天

Federated learning enables multiple institutions to train shared models without exchanging raw clinical EEG data, but it does not fully prevent privacy leakage from individual model updates. This paper presents a privacy-preserving federated learning framework for clinical EEG data using masking-based secure aggregation as the core protection mechanism. The framework combines graph-based communication, threshold secret sharing, dropout-resilient aggregation, local update clipping, an optional Bloom filter-based privacy-preserving record-linkage initialization module, and auxiliary-notary-based verifiability. It supports both semi-honest and malicious aggregation settings and is implemented using the Flower federated learning framework. The secure-aggregation variants are evaluated in a simulated cross-silo healthcare setting using TUH EEG-derived data under different client configurations. Under the stated assumptions, the secure variants hide individual updates from the aggregation server. The results show that these variants remain compatible with federated model training, although malicious-setting safeguards and lightweight consistency-checking mechanisms introduce additional computation, communication, and round-duration overhead. The semi-honest variant provides the lowest overhead among the secure configurations, while malicious and auxiliary-notary variants offer stronger consistency, integrity, and lightweight verification support at higher cost.

论文页PDF
arXiv cs.SE / arXiv cs.CRDependability and SecurityarXivbenchmarkapproachempirical studyConfidentialityintegrityprivacycs.AIcs.CRcs.SEarXiv cs.SE

Old Tricks, New Models: How Simple Image Transformations Break Modern AI-based Content Moderation

Marco Alecci, Francesco Marchiori, Iyiola Emmanuel Olatunji, Tegawendé F. Bissyandé, Jacques Klein
2026/07/30 21:25已过 4 天

While automated content-moderation systems have become essential for screening harmful content at scale, conventional task-specific classifiers often provide limited policy cov- erage and contextual understanding. Recently, commercial multimodal moderation APIs built on large foundation models have been introduced with the promise of providing broader and more capable safety filters. In this work, we analyze whether this shift also yields more robust image moderation. We conduct a large-scale black-box evaluation on three established commercial image-moderation services and compare their robustness. By evaluating seven simple, model-agnostic image transformations across multiple providers, datasets, harm categories, perceptual-similarity constraints, and transformation intensities, we find that: (1) all three commercial services can be bypassed using inexpensive image transformations that require no gradients, surrogate models, or knowledge of the target system; (2) even fixed transformations such as color inversion and grayscale conversion induce unsafe-to-safe decision changes while preserving content that remains recognizable to humans; (3) their robustness varies substantially across datasets and harm categories, with multimodal content and self-harm exhibiting pronounced vulnerabilities. This yields the conclusion that replacing conventional moderation classifiers with foundation-model-based APIs does not, by itself, provide a reliable security boundary. Such systems must be evaluated under realistic transformations and deployed as one component of a layered moderation pipeline rather than as standalone safety filters.

论文页PDF
arXiv cs.CRHuman and Social AspectsarXivapproachTeamscommunitiesand companiescs.CYcs.CRarXiv cs.CR

Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned

Jan Vykopal, Pavel Čeleda, Martin Horák, Valdemar Švábenský
2026/07/30 21:17已过 4 天

This innovative practice full paper examines the integration of technology-enhanced tabletop exercises (TTXs) into computing education, focusing on cybersecurity curricula. The motivation is to better prepare students for complex, collaborative problem solving typical of incident response and IT governance, where coordination, communication, and timely decision-making are essential. Although TTXs are well-established in professional practice, they remain underused in universities. We address this gap by augmenting TTX delivery and evaluation through the INJECT Exercise Platform (IXP), a web-based environment that automates scenario flow and enables data-driven assessment. Our practice implements IXP to automatically deliver scenario updates, facilitate team discussions, and collect interaction data to support automated assessment. This combination enhances realism, reduces instructor workload, and provides actionable insight into student learning. From 2024 to 2026, we ran 25 exercises with 743 participants in multiple university courses and extracurricular events. We observed increased engagement and collaboration among students, and clearer visibility for instructors into how teams navigate complex scenarios. This paper shares 24 lessons learned from these exercises. Instructors and curriculum designers may benefit from concrete guidance for integrating technology-enhanced TTXs. We demonstrate that digital TTXs provide a scalable and replicable model for cybersecurity courses and others requiring team-based problem-solving.

论文页PDF
arXiv cs.SERequirements and ModelingarXivapproachempirical studyRequirements engineeringcs.SEcs.AIarXiv cs.SE

Integrating AI into Requirements Quality Learning in Software Engineering Education: A TPACK-Guided Empirical Study

Hansika Ekanayake Mudiyanselage, Rohan Jai Dharmaraj, Malik Abdul Sami, Zheying Zhang
2026/07/30 21:15已过 4 天

The rapid adoption of generative Artificial Intelligence (AI) in software engineering (SE) practice creates a need for pedagogically grounded approaches to AI integration in SE education, especially in conceptually intensive subjects such as requirements engineering (RE). This study examines a TPACK-guided integration of a multi-agent AI tool into a master-level RE assignment on requirements quality analysis. Using a mixed-methods design (N=100; 72 submissions analysed), we examine how structured assignment design shaped students' AI use, affected their understanding of user story quality criteria, and influenced their perceptions of AI's benefits and limitations. Results show that students used the AI tool selectively, mainly as support for analysis and evaluation rather than automation. Alignment improvements were most evident for structurally concrete requirements quality dimensions, such as value articulation and testability, while negotiability showed mixed effects. Students reported conditional trust, active refinement, and increased awareness of quality criteria, alongside moderate usability challenges. The findings show that TPACK-guided scaffolding can align AI affordances with pedagogical goals and RE content, offering design guidance for responsible AI integration in RE education.

论文页PDF
arXiv cs.CRAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelsPrompt engineering for SEEfficacy measurement beyond traditional metricscs.CRarXiv cs.CR

Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents

Mingxiao Liu, Yitong Li, Haoren Zhao, Yaoxiang Bian, Jianan Ma, Jian Zhang, Jialuo Chen, Xinhao Deng, Zhen Wang
2026/07/30 21:04已过 4 天

Large Language Model (LLM)-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-explored attack surface, as audio inputs inevitably contain environmental noise beyond user control. In this paper, we investigate concurrent audio prompt injection attacks targeting multimodal agents. Distinct from traditional acoustic attacks on voice devices, we propose novel techniques for instruction augmentation and scenario concealment. These methods allow malicious audio instructions to imperceptibly "piggyback" onto user speech, thereby hijacking agents to execute malicious actions. To systematically quantify this threat, we construct AudioAgentSecurity, the first comprehensive benchmark for audio instruction injection attacks, encompassing 8 real-world task scenarios and 10 distinct attack patterns. We evaluate 11 state-of-the-art agents, including Gemini 3 Pro and GPT-4o-audio. Notably, our methods achieve an average Attack Success Rate (ASR) of 69.10\% against the advanced Gemini 3 Pro. To counter this threat, we further introduce Cascaded Audio Decoupling and Verification (CADV), a defense mechanism based on source separation and consistency analysis. Compared with existing prompt-level defenses, CADV leverages acoustic source separation and cross-modal consistency analysis to detect audio instruction injections more robustly, achieving over 90\% detection success across diverse attack vectors. Finally, real-world experiments with human volunteers on Doubao AI Smartphone in diverse dynamic real-world scenarios confirm the attacks' high stealth and efficacy, while demonstrating that our defense reliably mitigates these vulnerabilities.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems

Yu Cui, Wuli Yang, Yirui Shi, Junhao Xia, Hui Jiang, Lei Gao, Chenfu Bao
2026/07/30 20:54已过 4 天

Autonomous multi-agent systems (AMAS) built on large language models (LLMs), such as Hermes, increasingly rely on inference-time harnesses to coordinate reasoning and action. Constructing these harnesses requires substantial engineering effort and computational resources, as they are iteratively optimized over a combinatorial search space while co-evolving with the underlying LLM. Inference-time harnesses therefore constitute valuable intellectual property (IP). Although prior work has investigated IP leakage in static multi-agent systems with pre-configured architectures, it remains unclear whether similar risks arise in AMAS, where harness behavior emerges dynamically during inference. To address this gap, we introduce Agent Harness Distillation (AHD), a framework for studying the security risks arising from inference-time harness extraction in AMAS. We formalize harness extraction as a new security problem and develop an evaluation framework for quantifying such risks. AHD extracts inference-time harness capabilities from a target agent through black-box interactions and consists of two stages. In the pre-distillation stage, AHD infers inference-time harness behaviors from the responses of the target agent and constructs an initial harness. In the post-distillation stage, AHD iteratively refines the initial harness to align with the behavioral patterns of the target agent. Experiments on real-world AMAS across multiple backbone LLMs demonstrate the effectiveness of AHD and reveal substantial IP leakage risks. We further propose a deception-based defense that reduces harness extraction effectiveness while preserving the utility of the protected agent. Our findings uncover a previously underexplored security threat to AMAS.

论文页PDF
arXiv cs.SEArchitecture and DesignarXivbenchmarkapproachArchitecture quality attributescs.SEarXiv cs.SE

Advancing Awkward Arrays for High-Performance CPU and GPU Processing

Ianna Osborne, Manasvi Goyal
2026/07/30 20:53已过 4 天

Awkward Array is a Python library for representing and processing nested, variable-length data that is widely used in high-energy physics. As HL-LHC analyses increasingly rely on accelerator hardware, efficient execution of irregular workloads has become essential. While dense numerical arrays map naturally to GPUs, nested and variable-length data structures remain significantly more difficult to accelerate because they require indirect indexing, segmented operations, and irregular memory access patterns. We present recent developments in the Awkward Array GPU backend, including CUDA implementations built on NVIDIA CUDA Core Compute Libraries (CCCL), optimized memory management, and segmented reduction algorithms for ragged arrays. These developments preserve the existing Python programming model while substantially improving GPU throughput on irregular workloads. We describe the backend architecture, automated validation framework, and benchmark results comparing CPU, CuPy, and CUDA implementations.

论文页PDF
arXiv cs.SE / arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRcs.LOcs.SEarXiv cs.SE

Checking Information Flow in Cloud-based IoT Access Control Policies (Extended Version)

Lorenzo Ceragioli, Letterio Galletta, Edoardo Lunati
2026/07/30 19:54已过 4 天

Many cloud providers for IoT technologies offer access control mechanisms whose proper configuration is critical for security. However, verifying permissions in isolation is insufficient in a setting where devices have different levels of trust or are compartmentalised in various subsystems. This work analyses IoT access control policies to identify potential security vulnerabilities from unwanted information flow between devices. To this end, we formally model AWS IoT Core's components and define an information flow graph to capture the communication among devices permitted by the access control policies. We build a finite representation of the graph by leveraging an SMT solver, thus enabling the verification of information flow between devices. We implement our approach in a tool called IOT:POKER, and assess it on a realistic scenario and several real-world policies.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.CRcs.AIarXiv cs.CR

Temporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs

Roberto Riaño, Gorka Abad, Stjepan Picek, Aitor Urbieta
2026/07/30 19:49已过 4 天

Backdoor attacks on Spiking Neural Networks (SNNs) have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, where a fixed timestamp transformation is applied only to the target-class training streams, leaving their labels unchanged. The transformation preserves the per-pixel, per-polarity event count exactly, making clean and triggered samples identical after temporal aggregation while altering the sequence processed by the SNN. Across three neuromorphic datasets and both convolutional and transformer-based victims, the attack reaches an ASR of 1.00 in the strongest configurations. We analyze the attack through poison-budget and trigger-shape ablations and evaluate established backdoor defenses adapted to spiking models. Defenses that collapse the time axis before inspection are blind by construction, while feature-space methods detect the poison only in selected settings. Our model-free detector, based on per-step event mass, detects the evaluated temporal transformations, demonstrating both the limitation of rate-collapsed defenses and the boundary of the attack's stealth. To our knowledge, this is the first clean-label backdoor attack evaluated on SNNs and neuromorphic event data.

论文页PDF
arXiv AI Coding 3YAI for Software EngineeringarXivapproachAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelscs.MAcs.AIcs.CEarXiv AI Coding 3Y

VISA: A Structured Description Protocol for Agent-Based Simulation Models Towards Machine Reproducibility

Zhou He
2026/07/30 19:14已过 4 天

Agent-based models (ABMs) are difficult to reproduce: their behavior is spread across prose narratives, platform-specific code, and implicit assumptions, so that two readers routinely reconstruct different models from the same documentation. We present VISA, a structured, symbol-based description protocol that specifies a model in eight interconnected tables---four at the agent level (Agent, Variable, Sensing, Internal Function) and four at the model level (Associated Data, Input/Output, Schedule, Validation)---under the principle of minimality with completeness. VISA makes a model machine-parseable and unambiguous via two artifacts: nineteen executable consistency rules that turn model validity into a checkable property, and three reusable LLM-executable skills (authoring, checking, and code generation) that operationalize the full author--check--code--reproduce loop. We validate the protocol on three external, independently authored ABMs spanning three platforms: we reproduce two cross-language (NetLogo to Python) directly from their VISA specifications, and we capture a third, an industrial AnyLogic model, in eight tables (passing all nineteen rules) while honestly demarcating where reproduction is blocked by a proprietary movement library and unavailable data---itself a transparency contribution. VISA moves the reproduction barrier from the model, where it is invisible, to a named, localized dependency, where it is actionable.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRcs.AIcs.LGarXiv cs.CR

Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attacks

Spyridon Raptis, Haralampos-G. Stratigopoulos
2026/07/30 18:36已过 4 天

Spiking Neural Networks (SNNs) communicate through sparse binary spike events rather than dense activations, enabling energy-efficient inference on neuromorphic hardware and motivating their use in always-on, battery-powered edge systems. We show that this same efficiency advantage creates a distinct security risk: sponge attacks can increase inference-time spike activity and synaptic workload, inflating energy consumption while remaining difficult to detect through correctness-based monitoring alone. Prior input-space efficiency attacks on SNNs have focused on per-sample optimization, primarily in rate-coded settings. We extend this threat to native event-based binary inputs and study two attack models. First, we develop a per-sample sponge attack that crafts a custom adversarial spike train for each input via gradient-based optimization. This attack increases per-inference SynOps by 1.5-2.6x on three SNN models for the NMNIST, SHD, and IBM DVS Gesture datasets, while preserving the predicted class on at least 98% of evaluated samples. Second, to the best of our knowledge, we introduce the first universal sponge attack for native event-based SNN inputs: a fixed binary perturbation computed offline and applied via XOR to all subsequent inputs. Although weaker, it still inflates SynOps by 1.09-1.24x across all three datasets and represents a more realistic deployment threat because it requires no per-input optimization. Mapping SynOp inflation to estimated Loihi-1 energy yields per-inference overheads from 14 $μ$J to 13.24 mJ. These results show that native event-based SNNs are vulnerable to practical input-space efficiency attacks, and that reusable universal perturbations can accumulate into meaningful battery drain in continuously deployed edge systems.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachAI-assisted software design and model driven engineeringAI-enabled recommender systems for automated SEcs.SEcs.AIarXiv cs.SEarXiv AI Coding 3Y

Specification-Guided Synthesis of Deadlock-Free Communication Protocol Refinements with Large Language Models

Yang Li, Ping Hou, Nobuko Yoshida
2026/07/30 18:11已过 4 天

Ensuring behavioural correctness in communication protocols is a central challenge in distributed software systems, as subtle inconsistencies can lead to deadlocks. In such settings, protocol refinement - the safe substitution of a protocol that preserves correctness and compatibility with other components - is essential. Large language models (LLMs) have demonstrated strong capabilities in code generation and program synthesis, yet lack mechanisms to reliably produce outputs with correct behaviour. Formal specification approaches, such as multiparty session types (MPST), offer rigorous guarantees, including deadlock freedom, but provide limited support for automatically constructing protocol refinements. In this paper, we present Syntropy, a framework for synthesising protocol refinements guided by MPST specifications and LLMs. It incorporates refinement constraints directly into the generation process, ensuring the generated variants satisfy these guarantees. Our comprehensive evaluation indicates that Syntropy achieves 95.6%-99.5% validity while maintaining high syntactic correctness, and produces diverse, non-trivial refinements across multiple LLMs.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachReliabilityavailabilityand safetycs.CRcs.AIarXiv cs.CR

Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

Pingyu Wu, Lingyao Zhu, Weiming Zhang, Nenghai Yu
2026/07/30 17:59已过 4 天

Large language model safeguards decide whether to answer before seeing how an answer will be used. This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history. We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers. The result yields a safety trilemma: Useful Capability, Reliable Safety, and Open Access cannot coexist. We then show how a trusted credential can complement existing safeguards by adding hard-to-copy information that predicts actual downstream use, and identify the stronger condition needed to eliminate the floor. Evidence from dual-use evaluations, adaptive attacks, and deployed trusted-access programs supports the practical relevance of these conditions.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRarXiv cs.CR

Benign on Label, Malicious by Design: Clean-Label Dormant-to-Activated Backdoor via Machine Unlearning with Removable Camouflage

Dongdong Zhao, Can Li, Xiang Yao, Fan He, Qihang Ge, Baogang Song
2026/07/30 17:46已过 4 天

Existing backdoor attacks often become effective immediately after backdoor implantation and may therefore be exposed before exploitation. Machine unlearning activated dormant backdoors mitigate such behavioral exposure by remaining inactive after training and becoming effective only after selected training records are unlearned. However, existing methods struggle to simultaneously achieve a low pre-unlearning attack success rate and strong post-unlearning activation under clean-label constraints and realistic unlearning requests. Achieving this transition requires jointly establishing a persistent latent association and a removable suppressive influence. To address this challenge, we propose a clean-label unlearning-activated backdoor framework based on dual-generator learning and formulate it as a bilevel optimization problem: By simulating latent backdoor establishment and machine unlearning, the framework alternately learns sample-specific triggers that establish a latent trigger-to-target association and label-consistent camouflage samples that provide removable suppression. Once a small subset of camouflage samples is unlearned, the suppression is lifted and the dormant backdoor is activated. Experiments on CIFAR-10 and ImageNet-10 show that our method maintains lower pre-unlearning attack success rates while achieving stronger post-unlearning activation across multiple unlearning algorithms than representative backdoor baselines. These results demonstrate that reliable dormancy-to-activation transitions can be achieved by coordinating a persistent latent association with removable suppression under clean-label and realistic deletion constraints.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachempirical studysurveyAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelsTrustworthy AI for SEcs.SEarXiv cs.SEarXiv AI Coding 3YarXiv LLM4Code / Program Repair

The Case for Vibe Modeling: A Missing Step in AI-Based Trustworthy Software Development

Shalini Chakraborty, Michael Mittermaier, Judith Michael
2026/07/30 17:37已过 4 天

Large Language Models (LLMs) are increasingly used to generate software artifacts from natural language prompts. While this enables rapid prototyping and lowers the barrier to software creation, it also introduces challenges related to understanding, validation, traceability, and trust. In this paper, we argue that current AI-based development practices focus too heavily on the direct generation of code and insufficiently on intermediate representations that preserve human intent and support reasoning about system behavior. We argue for vibe modeling as a lightweight intermediate abstraction between natural language interaction and code generation. To explore its potential, we present a student survey study that examines perceptions of LLM output understanding, validation effort, trust and the perceived usefulness of vibe modeling across several AI-assisted development scenarios. Our results are intended to inform future studies for trustworthy and explainable AI-based software engineering via vibe modeling.

论文页PDF
arXiv cs.SE / arXiv LLM4Code / Program RepairDependability and SecurityarXivbenchmarkapproachempirical studyConfidentialityintegrityprivacycs.SEarXiv cs.SEarXiv LLM4Code / Program Repair

A comparative analysis of automated techniques for security bug report identification

Muhammad Laiq
2026/07/30 17:08已过 4 天

Timely identification of security-related bug reports is essential to minimize the window of vulnerabilities in software systems. Manually screening incoming bug reports to identify security-related issues is time-consuming, error-prone, and non-scalable for large-scale software systems. Thus, a variety of automatic techniques, including traditional machine learning (ML) techniques and large language models, have been proposed to facilitate this task. However, the literature remains fragmented. Most studies introduce or optimize a particular technique and evaluate it against a limited set of baselines, often under different experimental setups. As a result, it is difficult to compare their results and draw reliable conclusions about the effectiveness of existing approaches, leaving researchers and practitioners without clear guidance on which techniques are most suitable for the task. To address this gap, we conducted a comparative analysis of several promising automated techniques to identify security-related bug reports using benchmark datasets. We evaluated Logistic Regression, Support Vector Machines, Random Forest, OpenAI's GPT-5.2, BERT-base, RoBERTa, and SetFit (a state-of-the-art few-shot learning framework). Our results indicate that SetFit achieves the best overall performance, achieving an F1-score of 0.80 and outperforming other techniques on three of the four datasets. RoBERTa performs competitively and approaches SetFit in some projects, while traditional ML techniques, particularly Logistic Regression, remain a strong baseline in certain contexts. In contrast, GPT-5.2 performs poorly in both zero-shot and few-shot settings. In addition, cross-project experiments demonstrate that transfer learning can improve performance for projects with limited data, but may degrade results for projects with strong project-specific characteristics.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachempirical studyConfidentialityintegrityprivacycs.CRarXiv cs.CR

Don't Trust the AI Ecosystem: Analyzing Privacy Leakage in Compromised Open-Source Components

Jin-Seong Kim, Han-Ju Lee, Seok-Won Hong, Takeshi Takahashi, Chansu Han, Tomohiro Morikawa, Seok-Hwan Choi
2026/07/30 17:02已过 4 天

Existing model inversion (MI) attacks predominantly rely on post-training optimization to recover private data from model outputs. However, these methods are fundamentally constrained by the target model's generalization bottleneck, often yielding generic features rather than specific identities, particularly on high-dimensional datasets. In this paper, we introduce GradLock, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters. Operating within a compromised supply chain context, GradLock leverages stateless deterministic indexing to establish isolated data vaults and employs dynamic gradient locking to prevent payload degradation during the optimization process. This mechanism allows the adversary to extract pixel-perfect data from the final model without retaining access to the training environment. Extensive experiments on MNIST, Imagenette, and CelebA demonstrate that GradLock achieves near-lossless reconstruction (SSIM ~ 1.0) and instant extraction (< 1.0s). Compared to existing training-time injection methods, our approach exhibits superior robustness against standard deployment optimizations, including quantization, pruning, and fine-tuning. Furthermore, a user deployment study reveals that 93.3% of participants failed to detect the malicious logic, highlighting a severe blind spot in the security of modern AI supply chains.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

Adaptive Security at the Edge for 6G-Enabled Healthcare IoT

Ijaz Ahmad, Ijaz Ahmad, Erkki Harjula
2026/07/30 16:34已过 4 天

Healthcare IoT services increasingly rely on edge gateways to relay routine telemetry and deliver rare but timecritical alarms. Even short traffic bursts can inflate worstcase delay and interfere with urgent messages. We present NANOEDGEGUARD, a kernel-plane closed-loop controller that observes per-source traffic intensity at the edge and enforces an auditable, multi-tier rate policy using in-kernel traffic-control hooks. Unlike static firewall rules or user-space control loops, our design prioritizes fast actuation and explicit recovery through hysteresis, and it records policy transitions for auditability. Using a Raspberry Pi gateway hosting an MQTT broker and two ESP32 endpoints generating vitals, alarms, and a timed burst, we show that adaptive kernel-plane rate control reduces the 99th-percentile alarm RTT by 13.3% compared to a user-space firewall baseline while maintaining no-enforcement-level RTT, and it reduces excess admitted burst traffic by 46% compared to no enforcement. These early results indicate that adaptive, auditable enforcement at the gateway can improve resilience for healthcare IoT, and it can be extended toward on-demand policy deployment in future edge intelligence.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

CHARGE: Leveraging CWE Hierarchies for Hardware Security SystemVerilog Assertion Generation

Xiao Tan, Cynthia Sturton
2026/07/30 15:08已过 4 天

This paper presents CHARGE, an automated framework for generating security properties for unverified RTL modules using CWEs and large language models (LLMs). The hallmark is a reasoning process that leverages the hierarchical nature of CWE entries to improve accuracy when identifying security-critical assets in unverified RTL modules. As a result, the approach can infer expected security behaviors and generate properties from identified assets and CWE semantics, avoiding the need for trusted design specifications and reducing manual engineering effort. We evaluate the framework on the Hack@DAC18, 19, and 21 open source SoC designs using OpenAI's GPT-4.1. CHARGE detects 27 of 42 known bugs in these designs. For Hack@DAC21 OpenPiton SoC, 89% of the generated SVAs run in Cadence JasperGold FPV, and 92.2% are non-vacuous. We compare to an open-source, manually written set of properties for these designs and find that CHARGE correctly writes properties for three bugs in which the manually written properties were incorrect. In addition, CHARGE-generated properties identify a new bug in the Hack@DAC21 OpenPiton SoC that was not previously identified.

论文页PDF
arXiv cs.CRDependability and SecurityarXivsurveyConfidentialityintegrityprivacycs.CRarXiv cs.CR

Distributed Point Functions and Function Secret Sharing

Elette Boyle, Niv Gilboa, Yuval Ishai, Peter Scholl
2026/07/30 13:27已过 5 天

A distributed point function (DPF) is a cryptographic primitive that enables compressed additive sharing of a secret weight-1 vector (equivalently, a point function) across two or more parties. The appealing lightweight structure of DPF constructions has enabled a wide range of applications. These include private information retrieval, anonymous messaging, secure computation with preprocessing, and pseudorandom correlation generators for expanding small correlated seeds into large pseudorandom instances of cryptographic correlations. In this article, we survey definitions, constructions, and applications of DPFs. We also discuss the extension of DPF to function secret sharing (FSS), which generalizes point functions to support richer function classes. Efficient FSS schemes yield a similar generalization for most of the applications of DPFs.

论文页PDF
arXiv cs.SEAI for Software EngineeringarXivapproachempirical studyAutomating SE tasks with LLM and foundation modelsTrustworthy AI for SEcs.SEarXiv cs.SE

Can Large Language Models Resolve Real Java Merge Conflicts? An Evaluation with a Calibrated LLM-as-Judge

Bowen Shen
2026/07/30 12:38已过 5 天

Merge conflicts are a recurring cost of collaborative software development, and the traditional structured and semi-structured merge tools that address them frequently abstain: when their heuristics do not apply, they leave the conflict unresolved. Large language models (LLMs) can instead produce a candidate resolution for almost any conflict, but measuring whether those resolutions are actually good at scale is hard, because obtaining human desirability judgments for every model output does not scale. We study both problems together on real Java merge conflicts from ConflictBench. We first build an LLM solver as a generate-validate-retry agent that uses only inference-time signals (conflict markers, a Java parser, and duplicate-declaration checks) and never sees the developer's answer. We then evaluate its resolutions with a two-metric suite: (1) a developer-match LLM-as-judge implemented as a G-Eval metric and, crucially, calibrated against ConflictBench's human labels before use, and (2) a deterministic structural-validity check that uses no LLM. On a meta-evaluation of 292 human-labeled cases, the judge reaches 100% precision (zero false accepts) at 64.6% recall, so every acceptance is trustworthy and every downstream rate is a conservative lower bound. Under this validated judge, LLM solvers match the developer's own resolution on about 55% of true conflicts (conservative floor), and under a coverage-fair comparison the LLMs (55-59%) beat the strongest traditional tool (AutoMerge, 36.7%) by roughly 18-22 points; the edge comes almost entirely from coverage, not raw accuracy, since the tools abstain on 20-90% of conflicts while the LLM under forced resolution abstains on none. Finally, the LLM judge accepted 4 of the 5 resolutions that fail the deterministic structural check, evidence that structural correctness must not be delegated to an LLM.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.CReess.SYarXiv cs.CR

Strategy Phasing of Cyber Attacks on Digital Substations

Akila Herath, Chen-Ching Liu, Junho Hong, Kuchan Park
2026/07/30 12:17已过 5 天

Digital substations that comply with IEC 61850 have improved the operational efficiency of modern power systems. However, adversaries can abuse IEC 61850 communication to manipulate circuit breaker operations in substations, which can result in severe system impacts. These cyber attacks are crafted based on broader multi-phase strategies. The existing intrusion detection systems (IDSs) often flag only isolated symptoms. Thus, there is a lack of context in the attack phase to support the deployment of mitigation measures. This paper proposes Substation Cyber Attack Strategy Phasing (SubCASP), a Hidden Markov Model(HMM)- based method that fuses IDS data logs to infer the current attack phase, next attack phase, and retrospective attack path. The attack phases are derived from an ATT&CK-based threat modeling. The SubCASP model is trained and evaluated on a reproducible attack-graph dataset. Test results are presented to demonstrate the robustness of SubCASP for various IDS observability levels and missing IDS data logs scenarios.

论文页PDF
arXiv cs.SEAI for Software EngineeringarXivapproachempirical studyTrustworthy AI for SEAutomating SE tasks with LLM and foundation modelsPrompt engineering for SEcs.SEarXiv cs.SE

Not as Sweet by Another Name: An Empirical Study of Format Robustness in LLM Document Workflows

Xiaoyu Zhang, Xianyun Cheng, Tianlin Li, Yuwei Zheng, Yue Yang, Yang Liu
2026/07/30 11:59已过 5 天

LLM-driven software systems are rapidly evolving from plain-text conversations to document-centric end-to-end workflows, where the same semantic content can be delivered in diverse document formats (e.g., CSV) through file upload interfaces. Yet existing testing work focuses on the robustness and reliability of models and systems whose input is a single prompt string, leaving a critical question unanswered: Can these document workflows maintain robust behaviors when the same content arrives in a different document format? To fill the gap, in this paper, we propose a format-aware metamorphic testing framework with three metamorphic relations to comprehensively evaluate the format robustness of end-to-end LLM document workflows. Based on this framework, we conduct a large-scale empirical study spanning four representative LLM workflows, four real-world tasks, and four document formats, comprising a total of 48,000 workflow executions. Our findings reveal that format variation poses a systematic and serious threat. Merely switching formats can cause accuracy to drop by up to 53.63% and trigger decision drifts in over 41% of instances. We further design lightweight mitigation strategies from the users' perspective that recover up to 44.21% of format-induced decision drift without model retraining. Our study demonstrates that document format is not a neutral wrapper but a critical factor affecting the reliability of LLM software systems, calling for corresponding testing and safeguards in the deployment in real-world high-stakes scenarios.

论文页PDF
arXiv cs.SEAI for Software EngineeringarXivapproachAutomating SE tasks with LLM and foundation modelscs.AIcs.ROcs.SEarXiv cs.SE

HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution

Taewoo Park, Kyeonghyun Yoo, Kiseok Kim, Seunghyun Yoo, Hwangnam Kim
2026/07/30 11:46已过 5 天

Recent agentic AI systems may return a heterogeneous response containing notices, requests, handoffs, and actions. Conditions can change before external use, so components from the same response need not remain supported together. Rejecting the whole response discards useful components, whereas checking components independently can leave a dependent without its prerequisite. We present Heterogeneous Admission with Localized Obligations (HALO), a runtime protocol that preserves supported components whose declared prerequisites also remain supported, rechecks each exact action before dispatch, and allows blocked actions to be replaced only by fresh candidates. HALO matched all 96 admission expectations and passed all 20 protocol tests. In structured-response replay, it retained 248/248 supported components, including 128/128 unaffected by unrelated changes, while a whole-response policy retained 0/248. Across ten cold-start PX4/Gazebo sessions, HALO blocked every tested stale route, observed no matching stale setpoint, and completed all fresh recoveries.

论文页PDF
arXiv cs.SETesting and AnalysisarXivbenchmarkapproachProgram synthesiscs.SEarXiv cs.SE

LimICE: Integrating LLM into ICE Framework for Efficient Loop Invariant Inference

Kai Fan, ShiWen Yu, GuangSheng Fan, HaoAng Chi, WanWei Liu, Ji Wang
2026/07/30 10:50已过 5 天

Loop invariant synthesis is a fundamental problem in program verification, yet the inherent undecidability makes it highly challenging. Recent studies have increasingly employed various machine learning techniques to generate loop invariants. However, most of these methods adopt a monolithic approach. Due to the inability to strictly constrain the learning process, learning-based methods struggle to simultaneously consider all necessary conditions and generate complete invariants when tackling complex problems. In fact, a loop invariant is often an ordered sequence of lemmas, rather than a single invariant formula. This motivates us to propose Incremental ICE, a novel learning framework for incremental synthesis. Our framework integrates the incremental philosophy of IC3 into the general invariant learning framework ICE. By defining a lemma-specific learning objective and introducing a counterexample filtering mechanism, we can achieve sound incremental learning. Under this framework, we instantiate a loop invariant synthesis tool, LimICE, which leverages LLMs to generate the ordered sequence of lemmas and incorporates ICE-DT as a fallback mechanism to complement the lemma sequence. Experiments on 367 linear benchmarks and 50 nonlinear benchmarks demonstrate the effectiveness of the proposed approach. LimICE solves 349 (out of 367) linear problems on an average of 15.2 seconds and 47 (out of 50) nonlinear problems on an average of 8.8 seconds. Compared to the state-of-the-art LLM-based baseline, our approach solves 12-24% more instances while running 36-63% faster across linear and nonlinear benchmarks. LimICE also consistently outperforms strong non-LLM baselines and solves at least 86 and 27 additional instances on the linear and nonlinear benchmarks, respectively.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRcs.AIarXiv cs.CR

Revisiting the Adversarial Robustness of Graph-Based Traffic Forecasting

Qingzhao Zhang
2026/07/30 10:49已过 5 天

Traffic forecasting by graph-based AI is a critical component of intelligent transportation systems, motivating security research on robustness to malicious sensor readings. We argue that prior robustness evaluations are largely shaped by unrealistic threat models and untargeted objectives, so both attacks and defenses must be revisited. We study a practical adversary with limited model knowledge and the ability to monitor and manipulate only a few road sensors. More importantly, practical attacks can be localized to specific links or routes, causing incorrect estimated arrival times or unnecessary rerouting while leaving the broader network largely unaffected. This targeted setting remains underexplored, and defenses such as adversarial training do not transfer well from the norm-bounded attacks they train on to structurally different, physics-aware attacks that mimic genuine congestion. We therefore reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed. We evaluate across a variety of model architectures and benchmarks. The physics-aware attack multiplies target-link error several-fold while the network-wide error barely moves, and adversarial training, tuned to norm-bounded perturbations, barely dents it. Our detection--mitigation defense improves even on adversarial training hardened against the physics-aware attack itself, on $13$ of $15$ model--dataset settings and by the widest margin on a held-out attack, at near-zero clean cost. The results emphasize the need to examine abstracted AI adversarial attacks under application-specific constraints to assess their true security impacts.

论文页PDF
arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachAutomating SE tasks with LLM and foundation modelsAI-enabled recommender systems for automated SEcs.CVcs.AIarXiv AI Coding 3YarXiv LLM4Code / Program Repair

Drawing-Recode: Annotation Grounding for Parametric CAD Code Generation from Raster 2D CAD Drawings

Mingi Kim, Yongjun Kim, Hyungki Kim
2026/07/30 09:05已过 5 天

Recovering Parametric CAD sequences from raster-format 2D Computer-Aided Design (CAD) drawings accumulated prior to digital transformation is important for part reproduction and manufacturing process automation. However, existing studies either process only vector drawings or are limited to specific domains, and fail to explicitly connect dimensional annotations to geometric information, limiting their use of dimensional information for 3D Parametric CAD sequences recovery. We propose Drawing-Recode, a framework that generates Parametric CAD sequences as CAD code from raster 2D CAD drawings. Drawing-Recode extracts geometric features via an image encoder and recognizes annotations through a separate text recognition module, then explicitly grounds annotations to geometric information using cross-attention and our proposed Annotation Grounding Loss (AGL). The resulting features are fed into a Large Language Model (LLM) to generate CAD code in the Structured Parametric CAD Code (SPCC) format. Experiments show that Drawing-Recode outperforms existing baselines and remains robust on scanned drawings resembling industrial conditions. We expect Drawing-Recode contributes to digitizing raster 2D CAD drawings in industrial settings and to part reproduction and manufacturing automation.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRarXiv cs.CR

AnchorMark: Robust Diffusion Watermarking via Latent-Space Rotation Synchrony

Yuqi Qian, Yun Cao, Haocheng Fu, Haochen Zhao, Hong Zhang, Meineng Zhu
2026/07/30 08:52已过 5 天

Inversion-based watermarking embeds watermark payloads directly into the generative process, avoiding a separate post-hoc image-domain embedding stage while preserving the native visual fidelity of synthesized images. However, existing methods remain vulnerable to compound lossy post-processing, particularly when rotation is involved, as it disrupts the spatial correspondence required for latent-space decoding. To overcome this limitation, we introduce AnchorMark, a training-free, robust inversion-based watermarking. We uncover a latent-space property termed Rotation Synchrony: image-domain rotations and their counterparts in the recovered initial latent share the same angle. Building on this property, AnchorMark embeds a synchronization anchor in the central region of the initial latent, enabling accurate estimation and correction of the rotation angle during extraction. Experiments show that AnchorMark substantially improves bit accuracy under rotation and combined attacks, with limited impact on image quality.

论文页PDF
arXiv cs.SE / arXiv cs.CR / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringDependability and SecurityarXivapproachempirical studyConfidentialityintegrityprivacycs.CRcs.AIcs.CLcs.SE

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Cristian Leo, Anton Dykyi, Danny Cortegaca, Daniel Begimher, Prakash Jha
2026/07/30 07:46已过 5 天

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to adversary tactics, techniques, and procedures (TTPs) from a pluggable set of frameworks (MITRE ATT&CK, CAPEC, and cloud-specific threat matrices), and synthesizes actionable mitigations. ThreatForest decomposes threat modeling into a multi-stage agent pipeline -- repository analysis, context refinement, threat generation, parallel attack-tree construction with TTP mapping and mitigation synthesis, and report generation -- orchestrated as a directed graph with deterministic verification gates, bounded retries, and three human-in-the-loop validation points. A domain-specific sentence-transformer maps each attack step to candidate techniques by cosine similarity; we show empirically that this embedding stage, not the surrounding pipeline, is the dominant accuracy bottleneck. We evaluate ThreatForest across seven application domains on a sixteen-dimension rubric, scored by a panel of independent LLM raters with an adversarial verification pass and expert review. Panel-measured quality reaches 0.63-0.68 (on a 0-1 scale) for threat statements, attack trees, and mitigations, but only 0.29 for embedding-only TTP mapping -- a gap stable across all seven domains that isolates the binding constraint. A controlled single-call baseline on the same model more than doubles mapping defensibility, pinning the limitation on the embedding encoder rather than the multi-agent design. To our knowledge, ThreatForest is the first end-to-end system that turns a code repository into TTP-mapped attack trees with evidence-based mitigations across adversary frameworks, with a reusable framework for benchmarking such systems.

论文页PDF
arXiv SWE-bench / Defects4J / arXiv AI Coding 3YDependability and SecurityarXivbenchmarkapproachVulnerability detection and software securitycs.AIarXiv SWE-bench / Defects4JarXiv AI Coding 3Y

Automated Transcript Analysis for Detecting Flaws in Agentic Benchmarks

Jeff Mohl, Nelson Gardner-Challis, Magda Dubois, Harry Coppock, Benjamin Allan-Rahill, Kaelan Yim, Damian Sójka, James Mann, Justin Olive
2026/07/30 07:17已过 5 天

Capabilities of frontier models are often assessed using agentic benchmarks. To trust these results, benchmarks must accurately measure what they claim to and be free from invalidating flaws. Previous manual audits of benchmarks such as SWE-Bench-Verified have uncovered several validity issues in transcripts. However, manual review is difficult to scale, and it is unclear whether automated methods can reliably surface flaws that compromise benchmark validity. In this paper, we developed AI scanners to detect four types of validity issues: ground truth access, tool failure, guessing vulnerability, and answer format ambiguity. We produced grading rubrics for each to instruct human labeling, and evaluated the scanners against human labels on a held-out test set of Inspect Evals benchmarks. Our scanners identified several verified quality issues in five widely used benchmarks, including cases unlikely to be caught by random manual inspection. Not all cases were identified, and scanner performance varied substantially across benchmarks, criteria and models. We highlight several open challenges to be addressed to improve scanners for stronger quality assurance claims, including broader standardization gaps in the evaluation field that degrade scanner performance. Together, these results serve as a proof of concept for using automated transcript analysis to audit benchmark quality more broadly.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats

Gabriel K. Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, Aljosha Judmayer
2026/07/30 06:54已过 5 天

End-to-end encrypted (E2EE) messaging apps are widely praised for their security and thus also used for sensitive coordination in group chats (e.g., by political decision makers). After Threema and WhatsApp, also Signal and iMessage have recently introduced polls to aid agreement processes in groups. This implicitly sets the expectation that all participants see the same outcome and thus have the same view of the conversation. This property is commonly referred to as transcript consistency (TC). In this work, we demonstrate that today's major E2EE messengers do not guarantee any form of TC for group chats, allowing a malicious group member to selectively omit, reorder, or present altered content to different recipients without triggering warnings in their user interface. We systematically investigate the extent of the problem under a malicious-participant threat model that targets the integrity of the shared transcript, or inconsistent delivery across a user's linked devices. We identify multiple equivocation vectors that range from protocol fallback paths to deliberate use of pairwise delivery channels within groups. We demonstrate concrete exploitation scenarios such as social engineering, evading moderation, and, in particular, rigging polls. Beyond these cross-service design issues, we also uncover implementation-specific behaviors with privacy implications (e.g., device OS fingerprinting). Finally, we contextualize our findings within prior transcript-consistency research and outline practical low-overhead mitigations and UI signaling strategies that can be integrated into state-of-the-art E2EE group protocols.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRarXiv cs.CR

Flock: Fast Proving for Batch Boolean Computations

Benedikt Bünz, Ron D. Rothblum, William Wang
2026/07/30 06:11已过 5 天

For many applications of SNARKs, a key bottleneck is proving large batches of standard cryptographic hash evaluations, such as SHA-256, Keccak, or BLAKE3. We introduce Flock, a hash-based SNARK for extremely fast proving of such batched Boolean computations. Flock proves batches of the same R1CS circuit (plus input/output relations between them), can prove hash-chains and Merkle path openings, and in principle can be extended to full-fledged hash-based signature verification. At its core, Flock combines new optimizations for the lincheck and zerocheck protocols with an aggressively optimized proof-of-concept implementation co-designed by coding agents. On a single core of an M4 Max processor, Flock proves 82k evaluations of the BLAKE3 compression function, 42k SHA-256 compressions, and 30k Keccak permutations per second --- less than a $250\times$ overhead over native execution. On ten cores, throughput exceeds 660k BLAKE3 compressions per second; in proving SHA-256, Flock is more than $9\times$ faster than Binius64, the prior state of the art, and more than $500\times$ faster than the fastest elliptic curve-based SNARK we measured against.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

Granite: A Modular Methodology for Foundational Verification of Hardware-Software Leakage Contracts

Stella Lau, Andres Erbsen, Adam Chlipala
2026/07/30 05:44已过 5 天

Granite is a methodology for modular verification of both functional correctness and nonleakage of RTL processors against ISA contracts. We prove that the cycle-by-cycle timing of a pipelined RISC design--with speculation, precise interrupts, and I/O--is determined solely by observables specified in an ISA leakage contract. For programs that keep observables independent of secrets (i.e., following the cryptographic-constant-time discipline), this result rules out information leakage through known and unknown timing side channels. Granite's specifications only constrain functional correctness and information-flow dependencies: not how many cycles an instruction takes, at which instruction an interrupt is handled, or the exact latencies of submodules such as multipliers and memory. Granite's central technique is leakage-aware refinement via determinism, which establishes correctness and confidentiality together as trace equivalence with respect to a family of cycle-level, deterministic spec machines. Secret-independent nondeterminism is handled by existentially parameterizing specs with untrusted, deterministic functions acting only on public data. Submodules are proved against their own leakage-aware specs, and these proofs compose into the whole-design guarantee--which therefore holds over a space of secure implementations. We believe this work is the first to achieve modular and foundational connection between instruction-set-level leakage contracts and microarchitecture-specific cycle-by-cycle execution with wire-level observations. Our proofs compose with a certified static analysis that recognizes cryptographic-constant-time code to derive a single Rocq theorem about the cycle-by-cycle confidentiality of a hardware-and-software cryptographic implementation--eliminating every intermediate specification, including the ISA contract itself, from the trusted computing base.

论文页PDF
arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelsPrompt engineering for SEcs.AIarXiv AI Coding 3Y

Leveraging Trajectory Graphs for Pre-Execution Error Diagnosis in Agentic LLM Systems

Xu Zheng, Zhuomin Chen, Chaohao Lin, Hua Wei, Haifeng Chen, Wei Cheng, Dongsheng Luo
2026/07/30 04:14已过 5 天

Large Language Model~(LLM)-based agents have demonstrated exceptional performance across a wide range of complex interactive tasks. However, they often struggle with long-horizon interactive tasks common in domains, such as embodied AI. The complexity and vast action spaces in these settings lead to compounding errors, where a single suboptimal action can derail an entire trajectory, causing the agent to exhaust its limited step budget on inefficient or unrecoverable paths. To overcome this without costly fine-tuning, we draw inspiration from software debugging, where execution logs are analyzed to preemptively catch errors. We propose \textit{Trajectory Graph Copilot}, a novel framework that acts as a ``copilot'' for LLM agents by diagnosing potential action errors before they are executed. At its core,\textit{Graph Debugger} models historical trajectories as a probabilistic graph and uses a Graph Neural Network to identify sequential action patterns that frequently lead to failure. Functioning as a proactive diagnostic sandbox, our method provides early warnings on potentially flawed actions, prompting the agent to self-correct. This pre-action error diagnosis prevents costly mistakes, significantly enhancing the agent's ability to complete long-horizon tasks successfully. The extensive experiments on four benchmarks with three LLM agents demonstrate a $14.69\%$ pass ratio improvement on average.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringAI for Software EngineeringarXivbenchmarkapproachEfficacy measurement beyond traditional metricscs.SEcs.AIarXiv cs.SEarXiv AI Coding 3Y

SWE-NFI: Studying and Benchmarking Coding Agents for Non-Functional Improvements

Pengyu Xue, He Yang Yuan, Xin Wang, Junkai Chen, Haonan Zhang, Boyuan Chen, Zishuo Ding, Zhenhao Li, Weiyi Shang
2026/07/30 03:28已过 5 天

Although coding agents have achieved impressive performance on correctness-oriented benchmarks, their ability to make behavior-preserving non-functional improvements (NFIs) remains underexplored. In real-world software development, developers continuously improve software quality without changing observable behavior, yet existing benchmarks primarily evaluate functional correctness and provide limited support for assessing these non-functional improvements. In this paper, we present SWE-NFI, a benchmark for evaluating coding agents on NFIs beyond functional correctness. Our benchmark contains 188 tasks constructed from real merged pull requests in open-source Python projects. We operationalize developer-oriented NFIs into 92 executable rules and develop a comprehensive evaluation suite that combines functional correctness testing with rule-based NFI evaluation. We evaluate state-of-the-art commercial and open-source coding agents. Although the best-performing agent achieves a 70.0\% functional correctness rate, all evaluated agents generally fall short of human developers in overall NFI capability. The gap is particularly evident for structural code improvements, where agents' NFI scores range from 0.0 to 1.3, compared with 1.5 for the human reference. Our benchmark and findings provide a reproducible foundation for evaluating and advancing coding agents beyond functional correctness.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRarXiv cs.CR

Low-Latency Bootstrapping for CKKS using Roots of Unity

Jean-Sebastien Coron, Robin Koestler
2026/07/30 03:15已过 5 天

We introduce Sparse Roots of Unity (SPRU) bootstrapping, a new bootstrapping algorithm for the CKKS homomorphic encryption scheme for approximate arithmetic. The original CKKS bootstrapping method relies on homomorphically evaluating a polynomial that approximates modular reduction modulo q. In contrast, SPRU bootstrapping directly embeds the additive group modulo q into the complex roots of unity, which can be evaluated natively in the CKKS scheme. This approach significantly reduces the multiplicative depth required for bootstrapping, enabling the use of a smaller ring dimension and improving efficiency. In practice, using the OpenFHE C++ library, SPRU bootstrapping achieves up to a 5x reduction in latency when applied to ciphertexts with a small number of slots.

论文页PDF
arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringAI for Software EngineeringarXivbenchmarkapproachPrompt engineering for SEAutomating SE tasks with LLM and foundation modelscs.CVcs.AIarXiv AI Coding 3YarXiv AI Agents for Software Engineering

VideoCoCo: Code-as-CoT for Physically-Consistent Video Generation via an Agentic Dual-Engine System

Haodong Li, Tianfei Ren, Xiaoxiao Ma, Chunmei Qing, Zhen Fang, Sipeng He, Ziyu Guo, Haoyu Wu, Juanxi Tian, Yihang Zou, Ruichuan An, Dongzhi Jiang, Boxue Yang, Ji Xie, Xu Huang, Wenhao Yan, Jialv Zou, Zhengrong Yue, Yaxin Luo, Xiaotong Li, Yuzhu Wang, Junyan Ye, Jinjing Zhao, Zehui Chen, Lin Chen, Renye Yan, Feng Zhao, Pheng-Ann Heng
2026/07/30 02:38已过 5 天

Text-to-video models have achieved remarkable visual quality, yet they still struggle to generate physically consistent dynamics because the temporal evolution of a scene must be inferred implicitly from a highly compressed text prompt. Existing chain-of-thought approaches introduce intermediate plans or visual states, but these representations are typically non-executable or temporally sparse, limiting their ability to instantiate and control the complete spatiotemporal process. To address this limitation, we introduce VideoCoCo, an agentic dual-engine framework in which executable Blender code serves as a process-level chain of thought. Given a text prompt, a coding agent synthesizes a Blender program that explicitly specifies the scene and its temporal evolution. The executable simulation engine runs the program to produce a deterministic spatiotemporal draft, which is subsequently transformed into a photorealistic video by a generative video engine through draft-conditioned editing. This decomposition separates process-level reasoning from high-fidelity visual realization. To adapt the video editor to simulated drafts, we construct VideoCoCo-3K, a curated dataset of draft-instruction-target triplets. VideoCoCo improves the OmniWeaving baseline from 0.475 to 0.558 on PhyGenBench and from 52.18 to 77.88 on VBench-2.0, achieving the best average score on both benchmarks. These results demonstrate that executable code provides an effective, controllable, and inspectable intermediate representation for physically consistent video generation.

论文页PDF
arXiv cs.SE / arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.SEcs.CRarXiv cs.SEarXiv cs.CR

From Backlog Items to Security Guidance: Towards Continuous Security Compliance

Ignacio García Núñez, Florian Angermeir, Fabiola Moyón Constante
2026/07/30 02:31已过 5 天

Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief, free-form descriptions and often lack timely guidance on applicable requirements. We present an NLP-based backlog enrichment system that detects security-relevant backlog items and links them to relevant security requirements. The approach combines a security-relevance classifier with a retrieval-augmented generation (RAG) pipeline over security requirements documents. The approach was developed and evaluated in the context of a large enterprise in highly regulated domains. We present three contributions. First, we release a dataset of 288 backlog items labeled for security relevance by nine security practitioners, with substantial agreement (Fleiss' $κ=0.787$). Second, a recall-oriented classifier achieving $F2=0.774$ in-distribution and mean zero-shot G-measure $\approx 0.65$ across five established benchmarks, matching or outperforming most published classical-ML and open-source GPT baselines. Third, we preliminarily evaluated a four-stage security requirements document-grounded RAG pipeline with two practitioners on industrial backlogs using company-internal security policies and CIS Benchmarks. Of the retrieved 24 clauses, 12 were rated at least 4/5 for relevance. Our findings provide first indicators that NLP-based product backlog enrichment can support engineers in identifying security requirements early in the development process. With this work we aim to facilitate continuous security compliance through proactive introduction of security requirements in continuous software engineering.

论文页PDF
arXiv cs.CRAI for Software EngineeringarXivapproachPrompt engineering for SEAutomating SE tasks with LLM and foundation modelsTrustworthy AI for SEcs.CRcs.AIarXiv cs.CR

RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation

Benyamin Tafreshian, Prathamesh Dhake
2026/07/30 02:25已过 5 天

Large language models (LLMs) are becoming increasingly integrated into mainstream development platforms and daily technological workflows, typically behind moderation and safety controls. Despite these controls, preventing prompt-based policy evasion remains challenging, and adversaries continue to "jailbreak" LLMs by crafting prompts that circumvent implemented safety mechanisms. Prior work has established cipher-mediated interaction, code-embedded decryption, prompt decomposition and reconstruction, and layered custom encryption as viable attack primitives. However, reported evaluations generally collapse visible acceptance, successful recovery of the concealed request, and subsequent execution into an aggregate attack-success outcome. This leaves limited evidence about where multistage prompt-transformation attacks fail within an observable black-box interaction. This paper introduces RoguePrompt, a jailbreak pipeline that partitions a forbidden prompt and applies two nested encodings, Vigenere followed by ROT13, along with natural-language reconstruction instructions. RoguePrompt was developed and evaluated under a black-box threat model, with only API or user-interface access to the hosted models, and was tested on 313 real-world, hard-rejected prompts. Success was measured in terms of moderation bypass, instruction reconstruction, and execution when the relevant stage exceeded its automated criterion. RoguePrompt achieved average rates of 93.93% for filter bypass, 79.02% for reconstruction, and 70.18% for execution. These results demonstrate the effectiveness of layered prompt encoding while providing stage-level evidence of where multistage jailbreaks fail during moderation bypass, instruction reconstruction, and execution.

论文页PDF
arXiv cs.SETesting and AnalysisarXivapproachSoftware testingcs.SEarXiv cs.SE

PROGRESS: Property-Guided Regression Search for Semantic Falsification

Davis Tocheuk Mo, Noshin Ulfat, Matthew B. Dwyer, Soneya Binta Hossain
2026/07/30 02:12已过 5 天

Search-based regression-test generation effectively explores complex program structures, yielding high structural coverage, but its oracles are derived from the system under test: faults already present are recorded as expected behavior rather than exposed. Property-based testing offers independent semantic oracles, but depends on high-quality properties and gives little guidance for reaching deep states or satisfying selective preconditions. We present PROGRESS (PROperty-Guided REgression Search for Semantic Falsification), integrating intent-driven properties into coverage-guided, search-based evolutionary test generation to reach deep program states and detect violations of intended behavior. PROGRESS (1) extracts intent-bearing code context and uses a language-model pipeline to generate executable jqwik properties while limiting implementation leakage; (2) extends EvoSuite's DynaMOSA with a search objective and property-aware fitness function per property, rewarding progress through preconditions and prioritizing falsifying executions; and (3) binds property parameters and uses jqwik-provided generators to connect quantified inputs to evolving test sequences, steering generation toward coverage and bug-detection goals. We evaluate PROGRESS on 25 large-scale Java systems against regression-test generation, standalone property-based testing, and context ablations. PROGRESS detects 328/562 current-version bugs (58%) versus none for regression-test generation, and satisfies all preconditions for 70/150 hard-to-reach properties versus 18 for standalone jqwik. Ablations show documentation and caller/callee context are key to generating valid executable properties. PROGRESS preserves structural exploration while exposing faults missed by regression-derived assertions; we release a comprehensive artifact package.

论文页PDF
arXiv cs.SEAI for Software EngineeringarXivbenchmarkapproachTrustworthy AI for SEcs.SEarXiv cs.SE

TrustChain-Review: A Risk-Adaptive Blockchain and Game-Theoretic Framework for Trustworthy AI-Assisted Code Review

Mohammad Naserameri
2026/07/30 01:53已过 5 天

Context: AI-assisted software development can speed up coding and review, but it also makes accountability harder to establish. Developers may submit insufficiently verified code, reviewers may approve changes with limited inspection, and centralized reputation records may be difficult to audit. Objectives: This study introduces TrustChain-Review, a framework that combines verifiable evidence, strategic incentives, and risk-sensitive governance to support more trustworthy code review. Methods: The framework includes a blockchain-based evidence layer, a three-player game-theoretic model for developers, reviewers, and the platform, and a rule that applies stronger governance when the expected benefit justifies its cost. The evaluation uses a controlled simulation calibrated with the Diff Quality Estimation dataset. Six governance configurations are compared over 30 independent runs using reputation accuracy, trust convergence, malicious-review detection, superficial-review detection, net platform utility, governance cost, and cost-efficiency. Results: The full-evidence configuration produces the strongest reputation, trust, and detection results, but it also has the highest governance cost. The risk-adaptive configuration lowers this cost and improves cost-efficiency by applying stronger controls selectively, although its trust and detection results are lower than those of the full-evidence setting. Conclusion: Strong evidence-based governance is most appropriate for high-risk or audit-sensitive changes. For routine or lower-risk contributions, selective governance offers a more practical balance between trustworthiness and operational cost.

论文页PDF
arXiv cs.SEAI for Software EngineeringarXivapproachAutomating SE tasks with LLM and foundation modelsTrustworthy AI for SEcs.SEarXiv cs.SE

SIGIL: Compiling Agent Skills into Typed Harnesses

Jayanaka Dantanarayana, Savini Kashmira, Lingjia Tang, Jason Mars
2026/07/30 01:49已过 5 天

AI-Integrated agents increasingly acquire capability from skills: prose procedure files loaded into a model's context and run by a tool-calling loop. A skill is described to the runtime but never encoded in it, so the model re-derives its control flow on every run and may skip mandated verification. Across 30 skills and two model generations, a prose agent performs only 56% of the steps its own skill mandates, while producing artifacts that pass output checks. The remedy is known: write a harness, in which the procedure is program structure. However, hand-writing harnesses is tedious and discards the authoring surface that made skills succeed. To address this limitation, we introduce Skill Compilation, realized in SIGIL, which compiles a prose skill into an executable harness. At its center is AG-IR, a typed agentic intermediate representation separating model-owned cognition from code-owned mechanism. Compiled harnesses perform 86% of mandated steps, complete the full procedure 2.3x as often, and require 0.58x the tokens. Notably, the guarantee is model-independent: the harness holds at 86% across two model generations while prose swings from 56% to 68%.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringTesting and AnalysisarXivbenchmarkapproachProgram synthesiscs.SEcs.CLarXiv cs.SEarXiv AI Coding 3Y

SpecFirst: Behavioral Specification Elicitation as a First-Class Step in Agent-Based Program Synthesis from Scratch

Yihao Chen, Shi Chang, Feng Lin, Khaled Chawa, Boyuan Chen, Shaowei Wang, Ahmed E. Hassan
2026/07/30 01:42已过 5 天

LLM-based agents excel at software engineering tasks where an existing codebase provides context, but constructing a program from scratch remains fundamentally harder. Recent benchmarks such as ProgramBench quantify this gap: given only natural-language documentation and an execute-only binary as a behavioral oracle, even frontier models solve fewer than 1% of instances. Existing frameworks conflate documentation reading, behavioral exploration, and code synthesis into a single pass, causing agents to probe insufficiently, lose behavioral intent as context drifts, and propagate early misinterpretations into the final implementation. Inspired by classical requirements engineering, we argue that behavioral specification elicitation should be a first-class phase that precedes implementation. We present SpecFirst, a two-stage framework that forces the specification elicitation before code synthesis. A dedicated spec agent first probes the binary and combines observations with documentation into a structured specification. Next, a code synthesis agent then uses this specification to drive implementation. This decomposition resolves documentation ambiguities before coding begins and provides a stable behavioral reference throughout synthesis. We evaluate SpecFirst on all 200 ProgramBench instances across four models spanning two families and an order of magnitude of capability. SpecFirst consistently outperforms the single-loop baseline, improving test pass rates by 6.9%-21.3% and binary exploration coverage by 9.4%-18.5%, all statistically significant. Behavioral analysis on code synthesis further shows that a prior specification enables earlier and more sustained code construction. Our results demonstrate that an explicit requirements-engineering phase is an effective paradigm for from-scratch program construction.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

Function Privatization in the Local Model

Yuting Liang, Tian Shu, Ke Yi
2026/07/30 01:39已过 5 天

We study the problem of privately releasing functions, with a particular focus on curves, which are images of continuous functions on some finite interval. Many types of data exist naturally as curves, such as trajectory data or $1$D density curves. We shall primarily be interested in the local model setting, where the function to be privatized captures data belonging to one individual, which is the more challenging setting with limited prior work. Under the standard notion of local differential privacy (DP), any two arbitrarily different functions are required to be made indistinguishable by privatization, which is too strong to allow meaningful utility; we thus work with a generalized notion of DP known as Geo-Privacy (GP), which allows functions far apart to be distinguished more easily while providing strong protection for near functions. To demonstrate the effectiveness of our framework, we provide experimental evaluation on several datasets.

论文页PDF
arXiv cs.SE / arXiv SWE-bench / Defects4J / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringTesting and AnalysisarXivbenchmarkapproachProgram synthesiscs.SEcs.CLcs.LGarXiv cs.SE

MindForge: Teaching Small Language Models Whole-Life-Cycle Software Engineering via Source-Free Program Synthesis

Yihao Chen, Shi Chang, Khaled Chawa, Feng Lin, Boyuan Chen, Shaowei Wang, Ahmed E. Hassan
2026/07/30 01:23已过 5 天

Coding agents have made substantial progress on software engineering tasks that modify existing codebases, including bug fixing and feature implementation. However, constructing a complete program from scratch remains a major challenge: even the frontier models evaluated on ProgramBench fully resolve fewer than 1% of tasks. One obstacle is the lack of scalable training environments for this from-scratch setting, spanning the whole software engineering life cycle, as existing environment-construction frameworks focus only on a single phase in software development. To address this gap, we introduce MindForge, an automated pipeline that converts open-source command-line programs into source-free environments that expose only a compiled reference executable and its documentation. Using MindForge, we construct training environments from repositories disjoint from those in ProgramBench, and curate a high-quality data recipe consisting of program synthesis trajectories using GLM-5.2 as the teacher agent. Fine-tuning Qwen3.6-27B on these trajectories increases its ProgramBench average test pass rate from 37.98% to 49.51%, achieving performance comparable to substantially larger frontier models. Moreover, the fine-tuned model consistently improves over the base model across all seven unseen software engineering benchmarks, spanning long-horizon repository generation and translation, bug fixing, feature implementation, and cross-language issue resolution, with absolute gains of 31.00 points on RepoZero-C2Rust, 14.16 on DeepSWE, 10.70/4.56 on NL2Repo-Bench (with/without tests), 5.04 on SWE-bench Verified, 5.93 on SWE-bench Pro, 5.22 on SWE-bench Multilingual, and 4.94 on FeatBench.

论文页PDF
arXiv cs.SEDependability and SecurityarXivbenchmarkapproachempirical studyReliabilityavailabilityand safetycs.SEarXiv cs.SE

A Taxonomy of Human-Robot Teamwork Requirements

Anastasia Mavridou, Hazel M. Taylor, Sandy Lozito, Louise A. Dennis, Michael Fisher, Marie Farrell
2026/07/30 00:56已过 5 天

Autonomous systems are increasingly deployed in safety- and mission-critical domains where humans and robots must operate as a team to complete complex tasks. Existing requirements for Human-Robot teamwork remain fragmented across disparate sources, with no unified framework that addresses complexities of collaborative Human-Robot tasks. We address this gap by presenting a taxonomy of Human-Robot Teamwork (HRT) requirements derived from analysis of (academic and industrial) literature, standards and regulatory guidance. We extracted a construction corpus of 361 requirements from 14 cross-domain sources. Through iterative classification and refinement, we develop a two-level hierarchical taxonomy comprising 6 high-level categories and 21 low-level subcategories that distinguish information provision, relational control, decision support, safety mechanisms, performance monitoring, and foundational system capabilities. We validate the taxonomy through expert evaluation with 5 domain specialists and a utility demonstration on an independently assembled corpus of 448 requirements drawn from 19 sources spanning six HRT domains.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachVulnerability detection and software securityReliabilityavailabilitycs.AIcs.CLcs.CRcs.LG

On-Policy Distillation for LLM Safety: A Routing Approach to Template-Robust Realignment

Yongjian Guo, Wanlun Ma, Lingyu Shen, Xi Xiao, Sheng Wen
2026/07/30 00:07已过 5 天

Fine-tuning is the dominant paradigm for specializing large language models (LLMs), yet it exposes a critical vulnerability: malicious data providers can embed harmful behaviors into downstream corpora, creating models that retain professional skills while violating human values on demand. Existing safety-realignment defenses often fail in practice due to three key limitations: they frequently cause catastrophic forgetting of specialized skills; their effectiveness collapses when the defender cannot observe the attacker's prompt template; and successfully realigned models remain susceptible to re-jailbreaking via simple system prompt switches. To address these challenges, we propose Routing-based On-Policy Distillation (ROPD), a novel realignment framework that models the divergence between aligned and compromised output probability distributions rather than fitting specific prompt templates. We conduct extensive experiments comparing ROPD against four state-of-the-art baselines across three datasets and three base models with varying alignment strengths. Our results demonstrate that when baseline defenses face template mismatches, often accompanied by severe degradation in downstream task performance. In contrast, ROPD substantially mitigates template-mismatch risks, maintaining superior robustness in both defense effectiveness and capability preservation. While our analysis indicates ROPD is not entirely immune to template shifts, its performance degradation is negligible compared to existing methods, establishing a new standard for robust LLM realignment.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRcs.AIarXiv cs.CR

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Xuanze Chen, Xukang Xie, Wentao Fu, Jiajun Zhou, Shanqing Yu, Qi Xuan
2026/07/30 00:06已过 5 天

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair under diverse memory-backend comparisons. To address this gap, we introduce MemSecBench, a task-grounded benchmark for the lifecycle security of agent memory systems. It contains 310 cases drawn from 48 realistic contexts across code and science, daily life, and office work. Each case follows a controlled Write--Execute--Forget protocol in an isolated runtime under an exact agent configuration, defined by an agent harness, a memory backend, and an LLM backend. Evidence-based adjudication combines a deterministic write check, checkpoint-specific judge-model evaluations, and programmatic gates across seven lifecycle checkpoints. The experimental design spans a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends. Across all 24 configurations, malicious memory persists in 84.2% of all cases, and the full Write--Execute chain succeeds in 50.3%. Among successfully poisoned cases, 59.6% complete the full Execute chain, while 56.1% achieve selective repair.Compared with matched Native configurations, the largest absolute differences are 16.1 percentage points for end-to-end attack success and 41.3 percentage points for selective repair. These descriptive contrasts indicate that the evaluated memory system stacks differ in lifecycle security, both in the propagation of malicious memory and in selective repair after successful memory poisoning.

论文页PDF
arXiv cs.SEArchitecture and DesignarXivapproachempirical studyDesign and architecture modeling and analysiscs.PLcs.SEarXiv cs.SE

A Type-and-Effect System for Temporal Dependency Analysis of Render-based Reactive Programs

June Wunder, Ankush Das, Marco Gaboardi
2026/07/29 23:59已过 5 天

Reactive programming frameworks such as React allow developers to build interactive applications by declaratively specifying how outputs depend on changing inputs. Although this model makes it easy to reason about what an application computes, the temporal behavior of reactive programs remains difficult to understand and verify. Applications implicitly rely on timing assumptions buried in framework runtimes, leading to subtle bugs such as stale reads, transient inconsistencies, order-dependent behavior, and unintended feedback cycles. To address these challenges, this paper presents Willow, a core calculus for reactive programming inspired by React. Willow gives a time-aware operational semantics that models computation in terms of renders, the fundamental evaluation step in which components produce user interface descriptions, and pairs it with a novel type-and-effect system that statically tracks timing behavior as effects. A "next" modality expresses delays measured not only in renders but in any unit the host environment exposes--renders, network requests, or milliseconds. A family of modalities tracks the lifecycle of event handlers: when they are registered, when they fire, when pending events are canceled and when handlers are removed. A key insight is that the resulting effects form a temporal dependency graph, letting standard graph algorithms statically detect render cascades and inter-render loops that cause non-termination or performance degradation. We formalize Willow and prove preservation of the effect system with respect to the time-aware semantics. We also implement a prototype checker with automatic effect inference and evaluate it on representative reactive patterns such as debouncing, form inputs, and API-driven updates. Our results demonstrate that time-aware typing provides a practical foundation for reasoning about the temporal correctness of reactive programs.

论文页PDF
arXiv cs.SE / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelsAI-enabled recommender systems for automated SEEfficacy measurement beyond traditional metricscs.SEarXiv cs.SEarXiv LLM4Code / Program Repair

AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents

Jiajun Zhou, Zhaoxuan Ke, Jihang Ye, Xuanze Chen, Shanqing Yu, Qi Xuan
2026/07/29 23:55已过 5 天

Large language model (LLM)-based workspace agents execute stateful, multi-step workflows across heterogeneous resources, external tools, and persistent state. Their safety must therefore be assessed from actions, side effects, and state changes throughout execution. Although recent benchmarks have advanced executable safety testing and trajectory-aware verification, they rarely provide a unified account of where risks enter, how they elicit unsafe behavior, which harms they target, and where supporting evidence appears during execution. We introduce AgentS4D, a sandboxed benchmark for lifecycle-wide runtime safety evaluation. Its four-dimensional runtime-safety framework uses six risk-entry sources, six induction strategies, and nine target harms to guide case construction, while seven lifecycle checkpoints organize post-run evidence. AgentS4D contains 328 risk-injected cases. We evaluate all 20 combinations of four harnesses (Hermes, OpenClaw, Claude Code, and Codex) and five LLM backends (GPT-5.5, Gemini 3.1 Pro, DeepSeek-V4-Pro, MiniMax-M3, and Qwen3.7-Plus) on these cases, yielding 6,560 runs. Overall, 4,461 runs (68.0%) trigger prespecified unsafe signals. Across the 20 configurations, the observed safety of an agent system varies with both its harness-LLM pairing and how risk is introduced. Agent systems exhibit markedly different safety behavior when the same induction strategy reaches them through different risk carriers. They also respond differently to the same target harm when it is realized through different carriers and strategies. Moreover, 4,344 runs (66.22% overall) are unsafe yet complete. Thus, task completion cannot establish runtime safety, and testing only one form of a risk can conceal important weaknesses. Evaluations should examine complete agent configurations across diverse risk conditions and retain evidence throughout execution.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachVulnerability detection and software securityReliabilityavailabilitycs.CRcs.LGarXiv cs.CR

HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models

Petr Simecek, Elnaz Babayeva, Jiri Balhar, Michal Bida, Michal Buran, Vaclav Cadek, Luigino Camastra, Tomas Dulka, Michal Janocko, Tomas Klohna, Pavel Kohout, Ondrej Kokes, Adam Krivka, Jakub Kubik, Patrik Mada, Igor Morgenstern, Marek Pavelka, Joshua Rogers, Petr Stastny, Jan Tattermusch, Dmitrijs Trizna, Martin Votruba, Guido Vranken, Jakub Zikl, Evelina Gabasova, Stanislav Fort
2026/07/29 23:25已过 5 天

LLM-based analyzers have begun finding real vulnerabilities in mature open-source projects: AISLE's analyzer is credited with more than 280 CVEs across 78 projects, including OpenSSL, curl, and GnuTLS. We introduce HoF-Bench (named after AISLE's public Hall of Fame), a benchmark built from 95 of these public AI-discovered CVEs across eight repositories pinned at vulnerable commits. Analyzers receive source and target-file scope but not CVE identifiers, descriptions, fixes, or expected mechanisms; a detector-blinded frontier-model judge credits only findings that identify the same code path, root cause, attack condition, and impact. A deliberately minimal LLM-based analyzer rediscovers up to 65 of the 95 CVEs (68%) under this strict protocol. No frontier model performs detection anywhere in the study. The ten detector backbones are five open-weight models (21B--284B total parameters, 3--13B active) and five proprietary small or "flash"-tier models. All of them run in the fixed scaffold with four repeated passes, an optional generated-context stage, and a replayable multi-round triage stage (7,600 model--CVE pass records). Difficulty is strongly structured by language; the CVEs missed by every model concentrate in C infrastructure code. HoF-Bench provides a compact test bed for comparing vulnerability scanners, their reliability across repeated runs, and the candidate volume they create. The dataset is available at https://huggingface.co/datasets/aisleinc/HoF-Bench.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachVulnerability detection and software securitycs.CRcs.CLcs.LGarXiv cs.CR

AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents

Ruoyu Wang, Heng Zhao, Renjie Wu, Mengnan Zhao, Zhixuan Chu, Wanyu Lin, Tianhang Zheng
2026/07/29 22:56已过 5 天

Large language model (LLM) agents automate penetration testing through an observation-action loop, selecting actions based on observations returned by tools. This dependence allows defenders to inject deceptive observations that can mislead the agent's decision-making process. However, existing defenses rely heavily on static, isolated artifacts planted in the environment prior to an attack. Advanced agents can progressively recognize and bypass these artifacts, ultimately refocusing their exploitation attempts on the real target. To address this issue, we introduce AgentSnare, a trajectory-adaptive deception system that dynamically unfolds a decoy environment to continually steer the penetration agent away from the real target. Specifically, AgentSnare employs an artifact-construction policy model that constructs candidate artifacts conditioned on the agent's interaction history and decoy state. AgentSnare then validates these candidates and incrementally incorporates valid artifacts into a factually consistent decoy environment, thereby delaying the attack by absorbing its tool calls, diverting its post-entry trajectory within the decoy, and defusing it by inducing completion reports grounded in decoy evidence. Across 15 CVE-Bench web applications and three attacker models, AgentSnare absorbs 46.8% of the agent's tool calls in the decoy and retains 55.9% of post-entry actions there, while 90.0% of completion attempts are grounded in decoy evidence; across all 45 attacker-CVE pairs, no real target is successfully exploited at pass@3.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense

Gal Engelberg, Michael Arenzon, Leon Goldberg
2026/07/29 22:46已过 5 天

Enterprises are moving toward autonomous cyber defense: agentic AI that builds situational awareness of an organization's security state and reasons from it to assessments, decisions, and actions. This rests on a holistic view of the enterprise's security state, the continuous, cross-vendor picture of identities, cloud and infrastructure, data, applications, and their configurations that security posture management assembles. As agents take on this work, what matters is not whether an agent can produce an answer but whether it should be trusted to. The field cannot yet answer this question. Real enterprise environments are private, cross-vendor, and deeply correlated, and none is exposed publicly as a shared, queryable target for evaluating such agents end to end. We call this the environment data gap. We present Open Security Benchmark (OSB), a framework that benchmarks agentic AI on this work. OSB surfaces a curated enterprise environment - a frozen, holistic view of the security state - and evaluates posture investigation across two modalities: text-to-SQL over a relational snapshot and each vendor's native API over a served instance of the same environment. Freezing the environment pins the target state as an immutable snapshot and anchors answers to a closed-form ground truth. OSB is built from five components: a data layer, a task and evaluation-set layer, a multi-dimensional scoring layer, a minimal auditable harness, and a bring-your-own path that serves public comparison and private tenant evaluation from one substrate. We instantiate the framework with two identity-security packs and a family of synthetic-organization environment datasets spanning multiple scales, and chart its extension to further posture subdomains, investigation modalities, and defense stages from assessment toward remediation.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivapproachempirical studysurveyTrustworthy AI for SEAutomating SE tasks with LLM and foundation modelscs.SEarXiv cs.SEarXiv AI Coding 3YarXiv LLM4Code / Program Repair

How Developers Experience Debugging Unfamiliar Codebases with Code Tours Generated and Evaluated by Local LLMs

Balfroid Martin, Albert Julien, Aliti Dzenatan, Devroey Xavier, Vanderose Benoît
2026/07/29 22:45已过 5 天

Code tours are interactive, onboarding documentation to guide developers through a codebase. Large Language Models (LLMs) can automatically synthesize code tours. Prior work on code tour generation has not studied developer experience or trust calibration when debugging unfamiliar codebases with code tours generated and evaluated by open-weight LLMs. This study surveys how the properties of components in open-weight LLM-authored code tours influence developers' experiences when debugging unfamiliar codebases. We built a pipeline that generated and evaluated code tours from real reproducible bugs. 26 developers with varying backgrounds participated in a user study. In total, 26 code tours were authored from real Java bugs mined from 2025 GitHub commits, with each tour independently judged by two different LLMs, resulting in 52 evaluated configurations. Participants thought aloud as they explored each tour. Three authors qualitatively coded the interviews to identify recurring themes. Developers generally preferred tours that scaled detail with the code length, avoided merely restating code, were easily scannable, and adopted a guiding tone. However, some preferences were mutually exclusive, such as the use of imperative mood. Stack traces were often insufficient to identify all steps developers found relevant. Developers also trusted descriptions they perceived as human-written more than those they believed were AI-generated. Finally, LLM-generated annotations of tour quality were unreliable: sycophancy, confabulation, and incoherence were pervasive. This work lays a basis for future research on fine-tuning open-weight models for code tour generation, personalizing generation to accommodate diverging preferences, selecting relevant steps beyond stack traces, calibrating users' trust to avoid both disuse and misuse, and improving open-weight LLMs' ability to be more trustworthy evaluators

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.CVarXiv cs.CR

InkShield: Writing Style Protection Against Unauthorized Handwriting Mimicry

Jian Xiong, Wenbo Jiang, Zihan Wang, Rui Zhang, Wenshu Fan, Hongwei Li, Guowen Xu
2026/07/29 22:35已过 5 天

Recent handwritten text generators can reproduce a writer's style from publicly available references, posing risks of document forgery and identity misuse. An attacker may use a publicly available handwritten note or signature sample to generate forged recommendation letters or authorization forms, leading to document fraud, identity misuse, and misleading decisions. However, existing protections against unauthorized image editing or synthesis transfer poorly to handwriting style mimicry. Designed for natural images with complex backgrounds, they often optimize perturbations over the whole image. For sparse handwriting images, such global perturbations become conspicuous in blank background regions and largely degrade the visual quality. In this work, we propose InkShield, a proactive writing-style defense that protects reference images before release. InkShield selects a decoy writer to define a style-displacement direction, optimizes perturbations with a frozen handwriting-generation surrogate, and confines them to ink-stroke edges to avoid conspicuous background artifacts. On IAM, the average Top-1/Top-5 rates at which generated samples are retrieved as the target writer by two independent writer evaluators decrease from 11.94%/36.52% to 2.03%/8.79%. Meanwhile, the protected references remain visually close to the originals (LPIPS 0.0078), and the generated text remains readable. InkShield also exhibits transferability to other handwriting generators. Overall, InkShield provides practical protection against unauthorized handwriting style mimicry.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringTesting and AnalysisarXivbenchmarkapproachSoftware testingcs.SEarXiv cs.SEarXiv AI Coding 3YarXiv AI Agents for Software Engineering

VITAL-RAG: Invariance Race for Context Allocation in Coding Agents

Zijian Lu, Yonghua Lu, Mingcai Chen, Yiping Zuo, Xin He, Weijun Wang, Weibei Fan
2026/07/29 22:05已过 5 天

Coding agents often retrieve code from an entire repository, but only limited evidence can fit into the final model input. Conventional retrieval-augmented generation (RAG) for coding agents treats fragments from the same code object as separate results, so redundant views can occupy multiple context positions and crowd out useful code. Grouping fragments by code object reduces this redundancy, but can discard local information needed for the task. We describe this tension as an invariance race: allocation should stay stable under redundant renderings but change when a fragment adds task-relevant semantics. To address this race, we introduce VITAL-RAG, which organizes evidence by canonical code object, keeps one query-relevant companion only when it adds semantics not already represented, and renders selected evidence under per-object and global token budgets. On RepoBench, VITALRAG improves Recall@4K from 39.59% to 63.67% while reducing evidence tokens by 35.63%. Across three model backends, it matches or outperforms recent baselines on RepoClassBench and achieves the highest raw Pass@1 on RepoExec.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.AIcs.CRarXiv cs.CR

What Does It Take to Detect an AI Agent? Minimal Feature Sets for Behavioral Detection under Browser Automation

Vishisht Choudhary, Lukas Schmidt, Anne Zoë Kenntner, Feras Skhab, Michel Osswald, Jens Ernstberger
2026/07/29 22:05已过 5 天

Bot detectors deployed at scale treat traffic as binary: human or bot. This assumption breaks when AI agents browse the web through browser automation, a traffic class that is neither and that binary classifiers structurally cannot represent. We present a three-class detection framework distinguishing humans, bots, and AI agents, and show that the binary-vs-agent confusion is architectural: a binary human-vs-bot detector misroutes agent sessions because its label space lacks an agent class. On our controlled benchmark, an MLP binary classifier misclassifies 39.1% of real AI agents as human and a SAINT binary transformer misclassifies 34.5%; adding an explicit agent class yields per-class agent F1 = 1.000 in all 30 runs (3 model families $\times$ 10 seeds). To measure evasion resistance, we construct a five-level evasion ladder spanning passive observation, GAN-generated trajectories, and replay of real human cursor data ($n = 2299$ evasion sessions). Across 10 seeds and 3 model families we observe zero agent misses in 22990 per-seed predictions. The discriminative signal is a browser-automation artifact, not evidence of agent reasoning: Playwright does not emit the raw pointer-move and wheel-delta streams a physical input device produces, and this absence signature survives trajectory manipulation. Exhaustive search over all feature subsets of size 1-5 (9401 GBMs) shows that two behavioral features (mouse_event_rate, teleport_click_ratio) give 100% observed agent recall at every evasion level with agent precision 0.994; five features lift macro-F1 to 0.991. The signal is redundantly encoded: removing teleport_click_ratio leaves agent detection at 100%. The single-feature regime is degenerate, flagging every agent only by collapsing the classifier to always predict "agent". Two features robustly isolate agents; five separate all three traffic classes at macro-F1 $\geq 0.99$.

论文页PDF
arXiv cs.CRAI for Software EngineeringarXivapproachEfficacy measurement beyond traditional metricsTrustworthy AI for SEcs.CRcs.AIcs.LGarXiv cs.CR

Defending Against Backdoor Attacks via Alignment Checking in Model-Contrastive Federated Learning

Hongliang Zhang, Zhongyuan Yu, Guijuan Wang, Tianqing He, Wenshuo Ma, Xiaosong Zhang, Jiguo Yu
2026/07/29 21:59已过 5 天

Federated Learning (FL) is vulnerable to backdoor attacks because of its distributed nature in edge computing scenarios. Existing defense methods show limited efficacy as they overlook the deviations among benign local updates caused by statistical heterogeneity and the stealthiness of backdoor attacks. To tackle these issues, we propose FedDAB, a two-phase method that combines local contrastive regularization with alignment checking, to defend against backdoor attacks. In the first phase, FedDAB introduces a novel model-contrastive term into the local objective to enhance direction and magnitude consistency among benign updates. In the second phase, FedDAB employs an alignment checking strategy to evaluate each local update in terms of overall-direction alignment and parameter-level alignment with historical information, excluding updates that exhibit abnormal alignment patterns from global aggregation. We theoretically prove FedDAB's robustness with a convergence rate of $\mathcal{O}(1/T)$. Extensive experiments show that FedDAB outperforms existing defense methods against backdoor attacks.

论文页PDF
arXiv cs.SETesting and AnalysisarXivbenchmarkapproachSoftware testingcs.LGcs.AIcs.SEarXiv cs.SE

Benchmarking the Residual: What Long-Horizon Evaluations Add Beyond Matched Short-Task Performance

Chao Peng, Zhiheng Lyu, Peijie Dong, Hande Dong, Qiang Lin
2026/07/29 21:57已过 5 天

Long-horizon benchmarks often show that agents fail more as tasks become longer. This observation is useful for deployment, but it does not by itself explain why failure occurs. More stages create more opportunities for ordinary errors to compound; longer tasks may also contain harder individual decisions or become harder as conversation history, tool outputs, and environment changes accumulate. We use trajectory-induced degradation to mean this last possibility: earlier execution makes later work harder. When the harmful accumulation is specifically the text visible to the model, it is often called context rot. In this position paper, we argue that to claim a "long-horizon failure", benchmarks must compare actual full-task success against a baseline prediction built from short, individual stages. We call the log-ratio between this prediction and actual success the horizon residual. The comparison must use the same agent configuration and specify in advance how stages, checkpoints, information, and budgets will be chosen. The residual shows that the full rollout differs from the chosen baseline; targeted experiments are still needed to explain why.

论文页PDF
arXiv cs.SETesting and AnalysisarXivapproachempirical studyProgram synthesiscs.DCcs.SEarXiv cs.SE

Hybrid Workflow Composition for Extreme-Scale Data Processing: A Case Study on the HL-LHC (Extended Version)

Alan Malta Rodrigues, Douglas Thain
2026/07/29 21:07已过 5 天

High-Throughput Computing (HTC) environments tailored for high-concurrency resource efficiency require sophisticated orchestration to manage petabyte-scale data across heterogeneous resources. A critical but often overlooked challenge is workflow composition: the strategic grouping of tasksets within a Directed Acyclic Graph (DAG) to mitigate execution overhead while maximizing resource utilization. This paper presents a novel simulation framework for characterizing the interplay between taskset granularity and system-level constraints (e.g., job latency, failure rate, throughput, and I/O bandwidth). By exploring a high-dimensional parameter space, we quantify the performance sensitivity of diverse workflow topologies. Our results demonstrate that hybrid composition strategies, which dynamically balance taskset independence with execution grouping, can yield up to 3.8x throughput increase and a 14.9x reduction in network overhead. We further propose a multi-metric objective function that enables policy-driven optimization, allowing system architects to navigate the Pareto frontier between throughput, I/O cost, and CPU efficiency. These findings provide a rigorous foundation for automated workflow synthesis in distributed systems, offering a scalable model for next-generation scientific pipelines. All artifacts are publicly available.

论文页PDF
arXiv AI Coding 3YAI for Software EngineeringarXivbenchmarkapproachAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelsstat.MLcs.AIcs.ITcs.LG

Think Short, Defer Smart, Act, and Repeat: Calibrated Reasoning and Uncertainty-Aware Deferral for Edge LLM Agents

Amirmohammad Farzaneh, Osvaldo Simeone
2026/07/29 20:47已过 5 天

LLM agents following the ReAct paradigm are promising enablers of complex multi-step tasks, including multi-hop question answering, code generation, and control of physical AI systems. Yet, when deployed at the edge, they must tightly manage their reasoning budget while remaining reliable and deferring to a cloud-side model only when local uncertainty is too high to act safely. We propose Think Short, Defer Smart (TSDS), a framework that synergistically integrates a lightweight convergence probe, which halts on-device reasoning once the intended action has stabilized, with a perplexity-based deferral rule that escalates uncertain actions to a cloud-side model. Both mechanisms are jointly calibrated on end-to-end episode trajectories via a multi-objective Learn-Then-Test (LTT) procedure, providing simultaneous finite-sample guarantees on expected episode reward and cloud-call rate. We evaluate TSDS on four ReAct benchmarks spanning arithmetic reasoning (GSM8K), multi-hop question answering (HotpotQA), code generation (MBPP), and multi-step embodied planning (household robot), and compare against thought-calibration-only and calibrated-deferral-only standalone baselines. TSDS reduces per-episode thinking compute by 43%-73% over deferral-only baselines across HotpotQA, MBPP, and the household robot task, while maintaining certified reward and cloud-call rate guarantees.

论文页PDF
arXiv cs.CRDependability and SecurityarXivbenchmarkapproachFormal methods and model checkingcs.CRcs.LGarXiv cs.CR

ToxScreen: Detecting Whether an LLM Has Been Poisoned

Anthony Hughes, Nicole Xing, Collin Francel, Andy Kim, Andrew Draganov
2026/07/29 20:35已过 5 天

As large language models (LLMs) are deployed in high-stakes domains, adversaries may poison training data to implant backdoors: hidden triggers that covertly manipulate model behavior at inference time. We ask whether a defender can recover such a trigger under realistic affordances, namely white-box access to the weights and knowledge of the behavior of concern, but no training data, no trusted reference model, no knowledge of the trigger, and no certainty that the model is poisoned. To evaluate whether a defender can recover such a trigger under realistic settings, we release ToxScreen, a benchmark of roughly 800 backdoored models spanning attack objectives, trigger mechanisms, poisoning rates, model scales, and backdoor training mechanisms. We also assert that the backdoors are high-quality: they achieve high attack success rates, generalize to unseen harmful inputs, and preserve clean-task performance. Scoring recovery of the planted trigger, we find that gradient-based prompt optimization fails in recovery, whereas a token look-up that ranks candidates by attack-success rate recovers the trigger wherever the backdoor is effective. To understand this more, we study the relationship between attack behaviors and the weights of an LLM. We find a phenomenon whereby backdoors operate via different mechanistic strategies than jailbreaks, allowing defenders to filter jailbreaks. Finally, no method reliably surfaces every backdoor, but a broadly jailbreakable model is itself anomalous, a useful signal even when the exact trigger is not recovered. We release all models and evaluation code

论文页PDF
arXiv cs.SEAI for Software EngineeringarXivbenchmarkapproachempirical studyAutomating SE tasks with LLM and foundation modelscs.SEarXiv cs.SE

When Knowledge Changes: Metamorphic Testing of RAG Systems with Mutations

Jinhan Kim, Samuele Pasini, Paolo Tonella
2026/07/29 20:32已过 5 天

Retrieval-Augmented Generation (RAG)-based LLM systems rely on external document corpora that can evolve and change over time. However, current evaluation methodologies (e.g., RAGAS) assess correctness against static snapshots, failing to detect faults when routine updates, factual changes, or noise alter the underlying data. We introduce a metamorphic testing framework that evaluates the consistency of RAG systems under corpus evolution. We formalise a fault taxonomy and 11 mutation operators that systematically perturb the system at both the pre-chunk (retrieval index) and post-chunk (retrieved context) levels. An empirical evaluation across five datasets and over 28k mutants reveals metamorphic violation rates of 4.9-10.2%. In a meta-evaluation against ground truth, our metamorphic oracle achieves F1 scores of 0.927-1.000, while the best RAGAS metric reaches only 0.570. Finally, we provide actionable insights into mitigating these faults through retrieval re-configuration, generator upgrades, and LLM-based reranking.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRarXiv cs.CR

Before Agents Speak: Pre-hoc Failure Risk Inference in Multi-Agent Systems

Shi Lin, Chenpei Wang, Peng Qian, Dezhang Kong, Minghao Li, Yufeng Li, Xun Wang
2026/07/29 20:26已过 5 天

LLM-based multi-agent systems (MAS) have exhibited remarkable capabilities in collaborative reasoning and decision-making, yet their interconnected communications introduce new systemic risk: localized hallucinations can propagate along agent communication chain, amplify through interactions, and ultimately trigger cascading failures. Existing countermeasures predominantly follow a post-hoc paradigm, identifying failures only after unsafe behaviors emerge, by which time harmful effects may have already spread throughout the agent network. To tackle this problem, we investigate a complementary pre-hoc approach and propose HalluProp, a Propagation-aware Hallucination inference framework that estimates individual agent failures and emergent system-level hallucination risks before inter-agent interaction. First, we model intrinsic hallucination risks by identifying fine-grained semantic misalignment between agent roles and task queries. We then characterize inter-agent risk propagation by modeling both semantic influence and communication topology. Finally, we integrate these two risks via a differentiable Noisy-OR inference mechanism to derive a systemic diagnosis. Extensive experiments show that HalluProp accurately localizes faulty agents, achieving an average AUROC of 84.6%, while enabling sub-second diagnosis with over $65\times$ speedup over post-hoc methods. By facilitating early intervention through upstream screening, HalluProp effectively complements post-hoc methods, highlighting the potential of pre-hoc risk inference for building more reliable multi-agent systems.

论文页PDF
arXiv cs.SEAnalyticsarXivbenchmarkapproachSoftware visualizationData-driven decision makingcs.SEarXiv cs.SE

A Scalable AI-Powered System for Explainable Machine Learning Pipelines in Brain Tumor

Yin Lin, Elena De Martin, Giacomo Conte, Domenico Aquino, Cristiana Pedone, Alberto Redaelli, Riccardo Barbieri, Laura Fariselli, Simona Ferrante
2026/07/29 20:26已过 5 天

Artificial intelligence and radiomics are increasingly used in brain tumor research, yet their translation into clinical practice remains limited by fragmented workflows, poor transparency, and weak integration with end users' needs. We present the first version of a scalable web-based visual analytics system designed to support radiomics-driven machine learning inference in neuro-oncology. The platform integrates three core functions within a single interface: cohort management from structured clinical tables, radiomic feature extraction from medical images and segmentation masks, and guarded inference with pre-trained machine learning models. The system was developed through an iterative user-centred design process and evaluated on both a public glioblastoma dataset and a proprietary clinical cohort. A key contribution is the explicit exposure of intermediate workflow artifacts, which improves traceability, interpretability, and responsible use of AI. By combining portability, inspectability, and deployment simplicity, the proposed framework offers a practical foundation for clinically oriented AI applications in brain tumor analysis.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachReliabilityavailabilityand safetycs.LGcs.CRarXiv cs.CR

Forecasting Trajectory-Level Safety Risks in Black-Box Multi-Turn Interactions

Shi Lin, Peng Qian, Dinghao Liu, Renjie Sun, Sifan Wu, Dezhang Kong, Chenpei Wang, Xun Wang
2026/07/29 20:14已过 5 天

As large language models (LLMs) evolve from standalone assistants into autonomous agents, ensuring their safety requires shifting beyond pointwise risk assessment to understand how risks emerge and unfold over long-horizon trajectories. In multi-turn interactions, malicious intent can be decomposed across seemingly harmless turns and gradually reconstructed through interaction trajectories, eventually resulting in safety failures. Existing safeguards remain largely reactive, detecting manifested violations while lacking the ability to predict latent risk evolution and enable preemptive prevention. To address this limitation, we propose Recast, a safety risk forecasting framework that advances LLM safeguarding beyond turn-level violation detection to trajectory-level risk prediction. Recast first retrieves risk-relevant evidence from both short-term dialogue progression and long-term historical context via a dual-scale trajectory view. It then models compositional risk evolution by capturing the current risk configuration and its temporal dynamics. Finally, a causal temporal encoder learns latent risk evolution patterns and predicts the distribution of future risk emergence turns. Extensive experiments across 7 risk categories show that Recast predicts 88.3% of future safety failures with an average lead time of 2.41 turns, while maintaining a false alarm rate of 12.3%, showcasing the effectiveness of trajectory-level forecasting in identifying emerging risks before safety violations occur.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringDependability and SecurityarXivapproachempirical studyFormal methods and model checkingcs.SEcs.AIarXiv cs.SEarXiv AI Coding 3Y

A First Look at Coding Agents' Compliance with AI Contribution Rules in Open-Source Communities

Wenhao Yang, Runzhi He, Minghui Zhou
2026/07/29 20:14已过 5 天

Open source communities have been flooded with AI-generated contributions. In defense, they have written contribution rules to regulate coding agents' behavior, spanning from a total ban, mandatory disclosure, to verification gates and human sign-offs. Yet, whether coding agents read and follow those rules, and behave in open source repositories, remains unknown. To estimate real-world rule compliance of coding agents, we curate 106 issues from 49 repositories containing AI contribution rules into RepoComplianceBench. We judge the trajectory of each run against the repository's rules, measuring whether the agent refuses to contribute, discloses its assistance truthfully, clears the required verification gates, or escalates critical steps to a human. We also test if extra prompts, rule disclosure, or feedback from the compliance verifier help with the situation. Our experiments on four frontier models show that today's agents almost never proactively retrieve the contribution rules. Agents pick up disclosure and verification with reminder prompts, rule quotes, and verifier feedback; however, they never refuse to contribute in AI-banned repositories under any condition we tested. The status reveals that verification and disclosure issues are solvable with existing mechanisms, yet enforcing bans and human escalations remains an open problem.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv LLM4Code / Program RepairAI for Software EngineeringarXivbenchmarkapproachAI-enabled recommender systems for automated SEAutomating SE tasks with LLM and foundation modelscs.SEarXiv cs.SEarXiv AI Coding 3YarXiv LLM4Code / Program Repair

MRCoder: An Efficient Context Selecting Approach for Repository-Level Code Generation

Peiding Wang, Li Zhang, Fang Liu
2026/07/29 19:47已过 5 天

Large language models (LLMs) have demonstrated strong capabilities in code generation. However, repository-level code generation remains challenging, as it requires effectively identifying and utilizing repository-specific context. While retrieval-augmented generation (RAG) incorporates relevant code snippets, it often introduces redundant context that interferes with the LLM's ability to utilize relevant information, leading to degraded generation quality and increased computational cost. Moreover, existing context selection and compression methods struggle to balance efficiency and quality, either introducing additional computational overhead or failing to effectively select valid context. In this paper, we propose MRCoder, an efficient context selection framework that improves both the effectiveness and efficiency of repository-level code generation. MRCoder adopts a Map-Reduce paradigm: in the Map Phase, a lightweight draft model generates drafts over partitioned contexts, and Structure-Aware Draft-Guided Selection (SADGS) selects informative contexts based on drafts through API consistency and logical similarity; in the Reduce Phase, the refined contexts are aggregated for final generation, with a parallel verification strategy further accelerating decoding. We evaluate MRCoder on two widely used repository-level code generation benchmarks, CoderEval and DevEval, using Qwen2.5-Coder and DeepSeek-Coder as backbone LLMs. Experimental results show that MRCoder improves code generation accuracy over strong baselines while reducing token consumption by 30 to 50% and inference time by up to 52%. These results demonstrate that our proposed structured and draft-guided context selection strategy is crucial for improving both the quality and efficiency of repository-level code generation

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringAI for Software EngineeringarXivapproachAI-enabled recommender systems for automated SEEfficacy measurement beyond traditional metricscs.LGcs.SEarXiv cs.SEarXiv AI Coding 3Y

RLPF: Reinforcement Learning from Performance Feedback for Code Generation

Huihao Jing, Haozhe Cui, Wenbin Hu, Shaojin Chen, Haochen Shi, Changxuan Fan, Yuxuan Liu, Hanyu Yang, Sirui Zhang, Ziyi Chen, Haoran Li, Yangqiu Song
2026/07/29 19:39已过 5 天

Code models are increasingly trained with execution feedback, but most training signals still stop at correctness. This leaves an important gap for systems code: two programs can pass the same tests while differing greatly in runtime. We study how to train code agents to prefer faster correct implementations, rather than treating efficiency only as an evaluation metric. The key difficulty is that runtime is a fragile reward. It is meaningful only after a program is correct, varies across tasks, and gives little guidance when most sampled programs fail to compile or run. We propose \textbf{RLPF}, reinforcement learning from performance feedback, which turns execution outcomes into a staged reward. Failed programs are ordered by execution progress, while correct programs are ranked by their relative improvement from the baseline toward the expert reference. This gives useful feedback before correctness and performance-sensitive feedback after correctness. Fine-tuning Qwen3-32B with RLPF on PerfCodeBench raises correct-and-runnable solutions from $11.1\%$ to $54.6\%$ and improves relative efficiency from $8.1\%$ to $38.6\%$. The trained model becomes competitive with stronger open-weight systems, and its optimization behavior transfers modestly to EffiBench-X. Additional studies show that model-generated references provide useful but weaker supervision, and that the full composite reward is more reliable than correctness-only or runtime-only baselines. These results suggest that code agents can be trained not only to pass tests, but also to optimize the programs they write.

论文页PDF
arXiv cs.CRAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelsCollaborative AI for SEEfficacy measurement beyond traditional metricscs.CRcs.AIcs.CLarXiv cs.CR

SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response

Lehan Wang, Boli Chen, Ruixue Ding, Pengjun Xie, Jinwei Huang, Zhendong Liu, Shuo Wang, Tao Lei, Xin Ouyang, Xiaomeng Li
2026/07/29 19:32已过 5 天

Large Language Model (LLM) agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces (CLIs), making it critical to thoroughly assess their security capabilities. However, existing cybersecurity benchmarks focus on pre-compromise settings where agents are placed in a clean and idealized environment before an attack occurs. This leaves the post-compromise setting underexplored. To address this gap, we introduce SecRespond, the first benchmark for evaluating LLM agents on the post-compromise incident-response workflow. Given a forensic disk snapshot of a compromised host together with the alerts, vulnerability scans, and baseline checks reported by a host security product, agents are required to produce forensic reports on intrusions, baseline risks, and vulnerability risks, together with a remediation plan. We instantiate this task across 10 cyber ranges, each constructed from a distinct compromised cloud host, spanning 4 entry-point types, 21 ATT&CK techniques, and 5 operating systems. We evaluate 23 frontier LLMs on the OpenCode agent harness. Experimental results show that although current agents can reliably uncover the problems exposed by alerts, they struggle to proactively investigate the disk for silent intrusions and to produce comprehensive, verified remediation plans, with no model achieving complete detection and remediation on any single range. This reveals a fundamental bottleneck in building agents for real-world incident response. The benchmark is publicly available at https://github.com/Alibaba-NLP/qqr/tree/main/data/secrespond.

论文页PDF
arXiv cs.SE / arXiv AI Coding 3Y / arXiv AI Agents for Software EngineeringAI for Software EngineeringarXivbenchmarkapproachAutomating SE tasks with LLM and foundation modelscs.SEarXiv cs.SEarXiv AI Coding 3YarXiv AI Agents for Software Engineering

CodeSpec: Dual Executable Specifications for Agentic Long-Horizon Feature Development

Peiding Wang, Li Zhang, Fang Liu, Taichuan Li, Yinghao Zhu
2026/07/29 19:20已过 5 天

LLM-based code agents have advanced repository-level software development through iterative interaction with codebases and tools. However, feature development requires integrating new behaviors into existing architectures through coherent cross-component functional chains. Existing agents typically derive such chains through free-form reasoning, often producing unreliable feature designs with incomplete functional chains. Moreover, textual designs are difficult to verify and enforce, making it challenging to maintain design-implementation consistency throughout long-horizon development. We propose CodeSpec, a dual executable specification method for repository-level feature development. It builds reliable functional chains from evidence pairing sub-requirement semantics with repository architectures, then compiles them into complementary architecture and behavior specifications that check chain completeness and correctness while preserving design-implementation consistency over long interactions. On FeatureBench, which targets feature development in existing repositories, CodeSpec achieves 70.7%, 55.0%, and 49.9% pass rates under DeepSeek-V4-Pro, outperforming representative baselines such as Claude Code. Results on the repository generation benchmark NL2Repo-Bench further demonstrate its generalizability.

论文页PDF
arXiv cs.SEArchitecture and DesignarXivbenchmarkapproachArchitecture quality attributescs.IRcs.AIcs.CLcs.SE

MediaWiki Code2Code Search: Neural Retrieval for the Semantic Discovery of Open-Source Software Entities

Francesco Tosoni
2026/07/29 19:07已过 5 天

Code search in large-scale ecosystems is often hindered by the lexical gap between user queries and implementation details, alongside the trade-off between the low latency of traditional Information Retrieval (IR) and the precision of Deep Learning (DL). We present MediaWiki Code2Code Search, a neural retrieval system for semantic code-to-code discovery. By indexing 1.29 million structural entities (functions, types, and templates) across 2,500+ MediaWiki repositories, our system enables retrieval based on computational intent rather than surface tokens. We employ a split-build architecture, decoupling GPU-intensive offline indexing from a CPU-only serving layer; our FAISS IVF-PQ index occupies 168.6 MB: a 96.6\% reduction compared to a flat float32 baseline, and achieves a median query latency of 1.85 seconds on commodity hardware, satisfying the 6 GiB RAM constraint of Wikimedia Toolforge. Our evaluation across a 27-query benchmark demonstrates superior performance over the BM25 baseline, achieving a P@10 of 0.87 compared to 0.64 (0.52 versus 0.34 for strict matching). Gains are most pronounced in name-obfuscated tasks where lexical methods fail. The system is available at https://code2codesearch.toolforge.org under the Apache 2.0 licence and provides an open RESTful API.

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachConfidentialityintegrityprivacycs.CRarXiv cs.CR

Verifiable Random Sampling

Yeoh Wei Zhu, Soorya Rethinasamy, Anthony Alexiades Armenakas, Yash Satsangi, Shaltiel Eloul, Ruslan Shaydulin
2026/07/29 18:27已过 5 天

Verifiable random functions (VRF) underpin a wide range of applications that require publicly verifiable evaluations of a pseudorandom function on a given input. However, once the public key is published, the induced function is fixed and is a deterministic function of the input. This determinism can enable collusion and grinding-style attacks in which adversaries precompute and selectively exploit favorable input-output pairs. To address these limitations, we introduce the formal notion of verifiable random sampling (VRS). We propose a concrete VRS construction based on random quantum circuit sampling (RCS) executable on today's quantum computing devices. VRS supports multiparty protocols in which the verifier's final output is a sample that is statistically close to a specified target distribution, while remaining publicly verifiable. We model the construction and prove its security within the constructive cryptography (CC) framework, thereby ensuring composability with other cryptographic protocols. Overall, our results provide a mechanism for verifiable random sampling that simultaneously guarantees sample freshness and public verifiability, enabling applications that require unpredictable, fresh randomness while preserving fairness through public verifiability.

论文页PDF
arXiv cs.SEEvolutionarXivbenchmarkapproachEvolution and maintenancecs.SEarXiv cs.SE

Tangling Pull Requests: Curating a Commit Untangling Dataset from Merged PRs

Yuki Ueno, Profir-Petru Pârţachi, Takashi Kobayashi
2026/07/29 18:19已过 5 天

Composite commits (CC), in which multiple unrelated changes are bundled into a single commit, are frequent in software development and significantly hinder code comprehension and maintenance. Although machine learning-based methods have been developed to ``untangle'' such commits into smaller, coherent change sets, these methods require large-scale training data with correct untangling labels. Preparing such datasets is costly and typically requires expert labelling. In this study, we propose a scalable and cost-effective method for dataset construction by leveraging commits extracted from open-source repositories' pull requests (PRs). We empirically validated our dataset and found that when applying our filtering rules, PRs that, when viewed as a single commit, are tangled, yet each individual commit on the feature branch is atomic (ideal PRs), increased from 9.5% to 55%. This composite commits dataset is more than 5.7 times larger than previous heuristic-based datasets. Using our new dataset, we find that the PR-based dataset differs statistically from previous datasets directly constructed using Herzig's proposed heuristics even after accounting for our proposed rules that may alter CC or STS sizes. When constructing datasets using the previous heuristics, they differ statistically along dimensions that impact the confidence voters and are likely to impact learning-based approaches. We validate the impact on the original Herzig \etal method, which used confidence voters across our dataset. To show that our approach extends to other languages, we also create a Python dataset which we empirically validate, finding comparable rates for ideal PRs (56.5%).

论文页PDF
arXiv cs.CRDependability and SecurityarXivapproachFormal methods and model checkingcs.CRcs.AIarXiv cs.CR

FARI: Robust One-Step Inversion for Watermarking in Diffusion Models

Jindong Yang, Han Fang, Weiming Zhang, Nenghai Yu, Kejiang Chen
2026/07/29 18:13已过 5 天

Inversion-based watermarking is a promising approach to authenticate diffusion-generated images, yet practical use is bottlenecked by inversion that is both slow and error-prone. While the primary challenge in the watermarking setting is robustness against external distortions, existing approaches over-optimize internal truncation error, and because that error scales with the sampler step size, they are inherently confined to high-NFE (number of function evaluations) regimes that cannot meet the dual demands of speed and robustness. In this work, we have two key observations: (i) the inversion trajectory has markedly lower curvature than the forward generation path does, making it highly compressible and amenable to low-NFE approximation; and (ii) in inversion for watermark verification, the trade-off between speed and truncation error is less critical, since external distortions dominate the error. A faster inverter provides a dual benefit: it is not only more efficient, but it also enables end-to-end adversarial training to directly target robustness, a task that is computationally prohibitive for the original, lengthy inversion trajectories. Building on this, we propose \textbf{FARI} (\textbf{F}ast \textbf{A}symmetric \textbf{R}obust \textbf{I}nversion), a one-step inversion framework paired with lightweight adversarial LoRA fine-tuning of the denoiser for watermark extraction. While consolidation slightly increases internal error, FARI delivers large gains in both speed and robustness: with approximately 20 minutes of fine-tuning on a single NVIDIA RTX A6000 GPU, it surpasses 50-step DDIM inversion on watermark-verification robustness while dramatically reducing inference time. Code and pretrained models are available at https://github.com/0xD009/FARI.

论文页PDF