3 citations · 4 across the 23 of their papers we have counts for
25 papers
Knowledge as Code
Martin Monperrus
For millennia, knowledge has been carried by language, and large language models still put language at the center. Yet the coding agents built on these models mostly write code. Th…
Smart Contract Invariants Protect Against Cybercriminals
Sofia Bobadilla, Humaira Afrin, Angela Novelli +1
Blockchains are among the most adversarial environments in computing. Billions are stolen by cybercriminals who exploit vulnerabilities. This is an open problem and no concept or t…
Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation
Julien Malka, Aman Sharma, Martin Monperrus +2
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regar…
Latent Programming Horizons in Coding Agents
André Silva, Han Tu, Martin Monperrus
A coding agent solving a software-engineering task spends dozens of steps reasoning, editing code, and running tests, yet little is known about what the underlying language model i…
AICID: Unique Identifiers for AI Scientists
Clément Vidal, Martin Monperrus
AI scientists are now a reality, with the ability to generate complete research papers, maintain scholarly profiles, receive citations, and attract peer review invitations. Yet no…
Agentic Generation of AST Transformation Rules for Fixing Breaking Updates
Frank Reyes, Benoit Baudry, Martin Monperrus
Modern software projects depend on third-party libraries that evolve continuously, introducing breaking API changes that prevent client code from compiling after a dependency updat…
N-Version Programming with Coding Agents
Javier Ron, Benoit Baudry, Martin Monperrus
This paper revisits the classical concept on N-version programming in the setting of contemporary AI coding agents. Revisiting the seminal Knight-Leveson experiment, we study wheth…
zkSBOM: Privacy-Preserving SBOM Sharing with Zero-Knowledge Sets
Tom Sorger, Eric Cornelissen, Aman Sharma +3
Software Bills of Materials (SBOMs) are increasingly mandated by regulators, yet existing sharing mechanisms impose a binary choice between full disclosure and full opacity. This e…
Evaluating Cryptographic API Misuse Detectors for Go
Vivi Andersson, Martin Monperrus
Cryptographic API misuse represents a critical vulnerability class that undermines the security foundations of modern software. Yet, it remains largely unexplored in Go despite its…
FIKA: Expanding Dependency Reachability with Executability Guarantees
Yogya Gamage, Meriem Ben Chaaben, Martin Monperrus +1
Automated third-party library analysis tools help developers by addressing key dependency management challenges, such as automating version updates, detecting vulnerabilities, and…
Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management
Larissa Schmid, Diogo Gaspar, Raphina Liu +3
Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells…
On Randomness in Agentic Evals
Bjarni Haukur Bjarnason, André Silva, Martin Monperrus
Agentic systems are evaluated on benchmarks where agents interact with environments to solve tasks. Most papers report a pass@1 score computed from a single run per task, assuming…
Verifiable Provenance of Software Artifacts with Zero-Knowledge Compilation
Javier Ron, Martin Monperrus
Verifying that a compiled binary originates from its claimed source code is a fundamental security requirement, called source code provenance. Achieving verifiable source code prov…
Project Rachel: Can an AI Become a Scholarly Author?
Martin Monperrus, Benoit Baudry, Clément Vidal
This paper documents Project Rachel, an action research study that created and tracked a complete AI academic identity named Rachel So. Through careful publication of AI-generated…
Software Supply Chain Security of Web3
Martin Monperrus
Web3 applications, built on blockchain technology, manage billions of dollars in digital assets through decentralized applications (dApps) and smart contracts. These systems rely o…
PoCo: Agentic Proof-of-Concept Exploit Generation for Smart Contracts
Vivi Andersson, Sofia Bobadilla, Harald Hobbelhagen +1
Smart contracts operate in a highly adversarial environment, where vulnerabilities can lead to substantial financial losses. Thus, smart contracts are subject to security audits. I…
FLAMES: Fine-tuning LLMs to Synthesize Invariants for Smart Contract Security
Mojtaba Eshghie, Gabriele Morello, Matteo Lauretano +2
Smart contract vulnerabilities cost billions of dollars annually, yet existing automated analysis tools fail to generate deployable defenses. We present FLAMES, a novel automated a…
Maven-Lockfile: High Integrity Rebuild of Past Java Releases
Larissa Schmid, Elias Lundell, Yogya Gamage +2
Modern software projects depend on many third-party libraries, complicating reproducible and secure builds. Several package managers address this with the generation of a lockfile…
Classport: Designing Runtime Dependency Introspection for Java
Serena Cofano, Daniel Williams, Aman Sharma +1
Runtime introspection of dependencies, i.e., the ability to observe which dependencies are currently used during program execution, is fundamental for Software Supply Chain securit…
Prometheus: Towards Long-Horizon Codebase Navigation for Repository-Level Problem Solving
Yue Pan, Zimin Chen, Siyu Lu +8
Large Language Models (LLMs) have shown remarkable capabilities in automating software engineering tasks, spurring the emergence of coding agents that scaffold LLMs with external t…
GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement
Carmine Cesarano, Martin Monperrus, Roberto Natella
Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a pa…
Gradient-Based Program Repair: Fixing Bugs in Continuous Program Spaces
André Silva, Gustav Thorén, Martin Monperrus
Automatic program repair seeks to generate correct code from buggy programs, with most approaches searching the correct program in a discrete, symbolic space of source code tokens.…
Byam: Fixing Breaking Dependency Updates with Large Language Models
Frank Reyes, May Mahmoud, Federico Bono +3
Application Programming Interfaces (APIs) facilitate the integration of third-party dependencies within the code of client applications. However, changes to an API, such as depreca…
The Design Space of Lockfiles Across Package Managers
Yogya Gamage, Deepika Tiwari, Martin Monperrus +1
Software developers reuse third-party packages that are hosted in package registries. At build time, a package manager resolves and fetches the direct and indirect dependencies of…