Metraipolis › archive › dc_5dfbbf313441

Self-Evolving Static Analysis via LLM Pseudo-Labeling — arXiv:2610.30184

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.30184
License (as archived): CC0-1.0
Archived: 2026-10-23T15:14:43.792Z
SHA-256 of the archived text: 36a4c73c9660f0b046e0abe6e8175fff4b3e3b6606862ab5f3e7c20f48d76aef
Stable URL of this page: https://metraipolis.com/documento/dc_5dfbbf313441

How to cite

Self-Evolving Static Analysis via LLM Pseudo-Labeling — arXiv:2610.30184 — arXiv (en), https://arxiv.org/abs/2610.30184 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_5dfbbf313441 (Metraipolis archive dc_5dfbbf313441, sha256 36a4c73c9660f0b046e0abe6e8175fff4b3e3b6606862ab5f3e7c20f48d76aef)

BibTeX

@misc{dc5dfbbf313441,
  title = {Self-Evolving Static Analysis via LLM Pseudo-Labeling — arXiv:2610.30184},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.30184},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_5dfbbf313441; sha256 36a4c73c9660f0b046e0abe6e8175fff4b3e3b6606862ab5f3e7c20f48d76aef},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.30184. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Security bugs often slip past static analysis not because they are impossible to detect, but because detection rules have not yet been written for the code in front of us. New frameworks, APIs, and coding idioms continually create such gaps, leaving developers to discover failures and manually encode new rules. We present SESAA, a framework in which an Large Language Model (LLM) agent starts from no rules and iteratively evolves a set of readable and auditable joern queries. The agent receives feedback only from a second LLM critic, which inspects flagged and unflagged code to identify likely false alarms and suspected misses, without access to ground-truth labels. The agent then uses this feedback to revise its queries. On the OWASP Benchmark for Python, SESAA reaches a mean F1 of 0.742 across 8 independent runs, well above the default configurations of five widely used tools and comparable to the strongest of them once it is tuned with access to ground-truth labels that SESAA never sees. In a pilot on real-world Python projects, queries induced from code available before a vulnerability was introduced detect 10 of 19 subsequent CVEs, including 9 detected by rules written for the same repository. The resulting detector is a set of executable, human-readable queries that engineers can inspect, modify, and run independently. These results suggest that LLM agents can turn static-analysis rule maintenance from a manually authored process into an iterative process of automated discovery and repair.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Software Engineering (cs.SE).
Pagina del lavoro: https://arxiv.org/abs/2610.30184 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-23T15:09:08.487Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).