REVIEW 14 cited by
IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Software is prone to security vulnerabilities. Program analysis tools to detect them have limited effectiveness in practice due to their reliance on human labeled specifications. Large language models (or LLMs) have shown impressive code generation capabilities but they cannot do complex reasoning over code to detect such vulnerabilities especially since this task requires whole-repository analysis. We propose IRIS, a neuro-symbolic approach that systematically combines LLMs with static analysis to perform whole-repository reasoning for security vulnerability detection. Specifically, IRIS leverages LLMs to infer taint specifications and perform contextual analysis, alleviating needs for human specifications and inspection. For evaluation, we curate a new dataset, CWE-Bench-Java, comprising 120 manually validated security vulnerabilities in real-world Java projects. A state-of-the-art static analysis tool CodeQL detects only 27 of these vulnerabilities whereas IRIS with GPT-4 detects 55 (+28) and improves upon CodeQL's average false discovery rate by 5% points. Furthermore, IRIS identifies 4 previously unknown vulnerabilities which cannot be found by existing tools. IRIS is available publicly at https://github.com/iris-sast/iris.
Forward citations
Cited by 14 Pith papers
-
ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments
Adaptive adversarial source-code comments evade four LLM vulnerability detectors at >90% success on 125 real null-pointer bugs without altering program behavior.
-
Mystra: Declarative Dynamic Taint Analysis via Shadow Virtual Machine
A Shadow Virtual Machine plus declarative Mystra rules delivers portable multi-level DTA for JS/Python with 95.5% recall and 1.85× overhead on Node.js.
-
SeedSmith: LLM-Driven Seed Synthesis for Directed Fuzzing
An agentic LLM seed generator that recovers missing call edges and crash preconditions yields 11–15× geometric-mean crash-time speedups on Magma and unlocks 16 previously unreachable ARVO bugs.
-
Veritas: Grounding LLM Agents for Reliable Vulnerability Reasoning over Stripped Binaries
Veritas detects out-of-bounds vulnerabilities in stripped binaries at 90% recall by grounding LLM reasoning in static witness-backed flows and runtime validation.
-
AXE: Grey-Box Exploitability Confirmation for Localized Vulnerability Reports
Grey-box metadata (CWE + code location) plus a multi-agent LLM workflow raises automated web-exploit confirmation from ~10% to 30% on CVE-Bench, with actionable PoC output.
-
PoCGen: Generating Proof-of-Concept Exploits for Vulnerabilities in Npm Packages
PoCGen combines LLM-based exploit generation with static taint analysis and dynamic validation to produce proof-of-concept exploits for 77% of 560 npm vulnerabilities in the SecBench.js dataset.
-
JavaVulBench: A Java Vulnerability Benchmark with Realistic Splits, a Unified Multi-Backend Harness, and a Leakage-Aware Evaluation Mode
A Java vulnerability benchmark of ~30.6k methods across 1,740 CVEs ships five realistic splits, a unified multi-backend harness, and leakage-aware metrics that show project-disjoint evaluation collapses F1 by ~0.09–0....
-
VulWeaver: Weaving Broken Semantics for Grounded Vulnerability Detection
VulWeaver improves Java vulnerability detection to 0.75 F1 by enhancing dependency graphs with LLM semantic fixes, extracting full context from slices plus implicit usage info, and applying type-specific meta-promptin...
-
KubeGuard: LLM-Assisted Kubernetes Hardening via Configuration Files and Runtime Logs Analysis
KubeGuard generates and refines Kubernetes Roles, NetworkPolicies, and Deployments from aggregated audit, network, and provenance logs using prompt-chained LLMs, achieving F1 up to 0.96 with GPT-4o.
-
Locus: Agentic Predicate Synthesis for Directed Fuzzing
Locus uses an LLM agent to synthesize and validate intermediate predicates that make directed fuzzing reach target bug states faster, reporting an average 41.6x speedup across eight fuzzers.
-
Minimizing False Positives in Static Bug Detection via LLM-Enhanced Path Feasibility Analysis
LLM4PFA combines iterative LLM-based constraint extraction with Z3 solving to reduce false positives in static analysis, achieving 72-96% false positive reduction and 93% recall on a new benchmark.
-
Understanding Automated Program Repair Agents Through the Lens of Traceability: An Empirical Study
An empirical study of five LLM-based program repair agents shows they excel on simple fixes but overfit tests and struggle with test generation, regression selection, and advanced tooling.
-
Using LLMs to Adjudicate Static-Analysis Alerts with Error Reduction Techniques
Mid-tier reasoning LLMs with consistency checks and LLM reasoning evaluation adjudicate static-analysis alerts at ≥98% recall and ≥94.8% specificity across Juliet, FormAI, and SV-COMP.
-
Interpretable models for forecasting high-dimensional functional time series
Functional ANOVA plus residual functional factor models improve Japanese subnational mortality curve forecasts by about 25–45% versus an existing method while keeping regional and sex effects interpretable.
Discussion (0). Sign in to comment.