8 papers
FloatDoor: Platform-Triggered Backdoors in LLMs
Nils Loose, Jonas Sander, Felix Mächtle +1
Large language models (LLMs) are increasingly deployed in sensitive settings such as software engineering, where their outputs directly shape downstream artifacts. Recent work has…
Steganography Without Modification: Hidden Communication via LLM Seeds
Felix Mächtle, Jonas Sander, Sebastian Berndt +3
We demonstrate that widely deployed Large Language Model (LLM) inference stacks harbor a steganographic channel that requires no modification to model weights, sampling code, or ou…
A Comprehensive Evaluation of Code Language Models for Security Patch Detection
Nils Loose, Joseph Bienhüls, Kristoffer Hempel +2
Automated detection of vulnerability-fixing commits (\vfcs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and ma…
Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing
Nils Loose, Nico Winkel, Kristoffer Hempel +3
Coverage-guided fuzzing has proven effective for software testing, but targeting library code requires specialized fuzz harnesses that translate fuzzer-generated inputs into valid…
Prompt Pirates Need a Map: Stealing Seeds helps Stealing Prompts
Felix Mächtle, Ashwath Shetty, Jonas Sander +3
Diffusion models have significantly advanced text-to-image generation, enabling the creation of highly realistic images conditioned on textual prompts and seeds. Given the consider…
AutoStub: Genetic Programming-Based Stub Creation for Symbolic Execution
Felix Mächtle, Nils Loose, Jan-Niclas Serr +2
Symbolic execution is a powerful technique for software testing, but suffers from limitations when encountering external functions, such as native methods or third-party libraries.…
Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction
Felix Mächtle, Nils Loose, Tim Schulz +4
As the number of web applications and API endpoints exposed to the Internet continues to grow, so does the number of exploitable vulnerabilities. Manually identifying such vulnerab…
OCEAN: Open-World Contrastive Authorship Identification
Felix Mächtle, Jan-Niclas Serr, Nils Loose +2
In an era where cyberattacks increasingly target the software supply chain, the ability to accurately attribute code authorship in binary files is critical to improving cybersecuri…