3 citations · 10 across the 27 of their papers we have counts for
31 papers
Trustworthy Runtime Error Healing in Real-World Repositories: A Benchmark and Guardrail
Gou Tan, Pengfei Chen, Zhensu Sun +9
Runtime error healing lets a crashed program continue by generating code that repairs its live runtime state. Recent work shows that LLMs can generate such healing code, but it is…
VulContextBench: A Benchmark for Security Context Retrieval in Coding Agents
Yikun Li, Jinfeng Jiang, Yuheng Yieh +6
Vulnerability-detection benchmarks score the verdict an agent reaches, not the evidence it gathered. A model that recalls a CVE from pretraining therefore scores the same as one th…
Towards Scalable and Cost-Efficient Vulnerability Detection: A Study on Automatic Query Generation
Ivana Clairine Irsan, Ratnadira Widyasari, Huihui Huang +6
Static analysis remains a cornerstone of software security, yet the effectiveness of tools such as CodeQL is often limited by the substantial manual effort required to develop high…
CoSA: Context-Aware Severity Assessment via Context Analysis with Large Language Models
Jinfeng Jiang, Yikun Li, Chengran Yang +6
Accurate vulnerability severity assessment is essential for prioritizing remediation, yet manually assessing Common Vulnerability Scoring System (CVSS) base metrics remains labor-i…
AgentChaos: Chaos Engineering for Agent Systems via Programmatic Fault Injection
Gou Tan, Zhensu Sun, Jieke Shi +10
Agent systems rely on LLM APIs for every response, but these APIs can return server errors, truncated responses, or corrupted content that propagates through downstream agents and…
Vul4Py: Benchmarking Automated Vulnerability Repair in Python with Paired Exploit and Functional Oracles
Tan Bui, Ting Zhang, Ferdian Thung +4
Automated Vulnerability Repair (AVR) has advanced rapidly across program analysis, machine learning, and Large Language Models (LLMs), but a verifiable, head-to-head comparison of…
Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection
Yikun Li, Ting Zhang, Jiakun Liu +9
Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.7% of vul…
PoCEvolve: Generating Proof-of-Concept Exploits from Security Patches with Vulnerability-Aware Prompt Evolution
Duc Manh Tran, Ratnadira Widyasari, Ivana Clairine Irsan +6
Ideally, the detailed information about a vulnerability should be made available together with the fixing commit. In practice, however, such details often become available only lon…
How Agentic AI Coding Assistants Become the Attacker's Shell
Yue Liu, Yanjie Zhao, Yunbo Lyu +3
Agentic AI coding assistants can edit files, run commands, and access the internet on behalf of developers. However, their reliance on unvetted external artifacts introduces a new…
An Execution-Verified Multi-Language Benchmark for Code Semantic Reasoning
Yikun Li, Jinfeng Jiang, Ting Zhang +7
Evaluating whether large language models (LLMs) can recover execution-relevant program structure, rather than only produce code that passes tests, remains an open problem. Existing…
Deep-Research Agents Can Be Poisoned via User-Generated Content
Tingwei Zhang, Harold Triedman, Vitaly Shmatikov
Deep-research agents are an alternative to conventional Web search. They use multi-agent pipelines to issue multiple Web searches related to user queries, retrieve relevant content…
Revisiting Vulnerability Patch Identification on Data in the Wild
Ivana Clairine Irsan, Ratnadira Widyasari, Ting Zhang +7
Attacks can exploit zero-day or one-day vulnerabilities that are not publicly disclosed. To detect these vulnerabilities, security researchers monitor development activities in ope…
Beyond Function-Level Analysis: Context-Aware Reasoning for Inter-Procedural Vulnerability Detection
Yikun Li, Ting Zhang, Jieke Shi +10
Recent progress in ML and LLMs has improved vulnerability detection, and recent datasets have reduced label noise and unrelated code changes. However, most existing approaches stil…
Autoregressive, Yet Revisable: In Decoding Revision for Secure Code Generation
Chengran Yang, Zichao Wei, Heminghao Deng +6
Large Language Model (LLM) based code generation is predominantly formulated as a strictly monotonic process, appending tokens linearly to an immutable prefix. This formulation con…
PenForge: On-the-Fly Expert Agent Construction for Automated Penetration Testing
Huihui Huang, Jieke Shi, Junkai Chen +6
Penetration testing is essential for identifying vulnerabilities in web applications before real adversaries can exploit them. Recent work has explored automating this process with…
LIDL: LLM Integration Defect Localization via Knowledge Graph-Enhanced Multi-Agent Analysis
Gou Tan, Zilong He, Min Li +8
LLM-integrated software, which embeds or interacts with large language models (LLMs) as functional components, exhibits probabilistic and context-dependent behaviors that fundament…
Aligning Academia with Industry: An Empirical Study of Industrial Needs and Academic Capabilities in AI-Driven Software Engineering
Hang Yu, Yuzhou Lai, Li Zhang +6
The rapid advancement of large language models (LLMs) is fundamentally reshaping software engineering (SE), driving a paradigm shift in both academic research and industrial practi…
Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework
Chengran Yang, Ting Zhang, Jinfeng Jiang +9
Current learning-based Automated Vulnerability Repair (AVR) approaches, while promising, often fail to generalize effectively in real-world scenarios. Our diagnostic analysis revea…
PatchSeeker: Mapping NVD Records to their Vulnerability-fixing Commits with LLM Generated Commits and Embeddings
Huu Hung Nguyen, Anh Tuan Nguyen, Thanh Le-Cong +8
Software vulnerabilities pose serious risks to modern software ecosystems. While the National Vulnerability Database (NVD) is the authoritative source for cataloging these vulnerab…
SecureVibeBench: Benchmarking Secure Vibe Coding of AI Agents via Reconstructing Vulnerability-Introducing Scenarios
Junkai Chen, Huihui Huang, Yunbo Lyu +10
Large language model-powered code agents are rapidly transforming software engineering, yet the security risks of their generated code have become a critical concern. Existing benc…
Out of Distribution, Out of Luck: How Well Can LLMs Trained on Vulnerability Datasets Detect Top 25 CWE Weaknesses?
Yikun Li, Ngoc Tan Bui, Ting Zhang +16
Automated vulnerability detection research has made substantial progress, yet its real-world impact remains limited. Prior work found that current vulnerability datasets suffer fro…
Back to the Basics: Rethinking Issue-Commit Linking with LLM-Assisted Retrieval
Huihui Huang, Ratnadira Widyasari, Ting Zhang +8
Issue-commit linking, which connects issues with commits that fix them, is crucial for software maintenance. Existing approaches have shown promise in automatically recovering thes…
Mapping NVD Records to Their Vulnerability-fixing Commits: How Hard is It?
Huu Hung Nguyen, Ting Zhang, Duc Manh Tran +7
Mapping National Vulnerability Database (NVD) records to vulnerability-fixing commits (VFCs) is crucial for vulnerability analysis but challenging due to sparse explicit links in N…
An LLM-as-Judge Metric for Bridging the Gap with Human Evaluation in SE Tasks
Xin Zhou, Kisub Kim, Ting Zhang +6
Large Language Models (LLMs) and other automated techniques have been increasingly used to support software developers by generating software artifacts such as code snippets, patch…