Metraipolis › archive › dc_008fa7368b1e

Self-Evolving Static Analysis via LLM Pseudo-Labeling — arXiv:2610.30184

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.30184
License (as archived): CC0-1.0
Archived: 2026-10-25T20:57:36.059Z
SHA-256 of the archived text: 0b86384dd7f7b7a5abcb8a379d20695e02a45def0fee7b4987baff6ba6f889ff
Stable URL of this page: https://metraipolis.com/documento/dc_008fa7368b1e

How to cite

Self-Evolving Static Analysis via LLM Pseudo-Labeling — arXiv:2610.30184 — arXiv (en), https://arxiv.org/abs/2610.30184 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_008fa7368b1e (Metraipolis archive dc_008fa7368b1e, sha256 0b86384dd7f7b7a5abcb8a379d20695e02a45def0fee7b4987baff6ba6f889ff)

BibTeX

@misc{dc008fa7368b1e,
  title = {Self-Evolving Static Analysis via LLM Pseudo-Labeling — arXiv:2610.30184},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.30184},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_008fa7368b1e; sha256 0b86384dd7f7b7a5abcb8a379d20695e02a45def0fee7b4987baff6ba6f889ff},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.30184. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Security bugs often slip past static analysis not because they are impossible to detect, but because detection rules have not yet been written for the code in front of us. New frameworks, APIs, and coding idioms continually create such gaps, leaving developers to discover failures and manually encode new rules. We present SESAA, a framework in which an Large Language Model (LLM) agent starts from no rules and iteratively evolves a set of readable and auditable joern queries. The agent receives feedback only from a second LLM critic, which inspects flagged and unflagged code to identify likely false alarms and suspected misses, without access to ground-truth labels. The agent then uses this feedback to revise its queries. On the OWASP Benchmark for Python, SESAA reaches a mean F1 of 0.742 across 8 independent runs, well above the default configurations of five widely used tools and comparable to the strongest of them once it is tuned with access to ground-truth labels that SESAA never sees. In a pilot on real-world Python projects, queries induced from code available before a vulnerability was introduced detect 10 of 19 subsequent CVEs, including 9 detected by rules written for the same repository. The resulting detector is a set of executable, human-readable queries that engineers can inspect, modify, and run independently. These results suggest that LLM agents can turn static-analysis rule maintenance from a manually authored process into an iterative process of automated discovery and repair.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Software Engineering (cs.SE).
Pagina del lavoro: https://arxiv.org/abs/2610.30184 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-25T20:47:56.961Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).