7 papers
MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories
Jian Zhao, Shenao Wang, Qingyang Wu +3
The widespread adoption of open source software (OSS) has introduced significant security risks, with malicious code poisoning attacks increasingly targeting public package registr…
Flow Sensitivity without Control Flow Graph: An Efficient Andersen-Style Flow-Sensitive Pointer Analysis
Jiahao Zhang, Xiao Cheng, Yuxiang Lei
Flow-sensitive pointer analysis constitutes an essential component of precise program analysis for accurately modeling pointer behaviors by incorporating control flows. Flow-sensit…
Neuro-Symbolic Reasoning for Vulnerability Detection
Yanjie Zhao, Hongjie Chen, Li Lu +3
Ask a large language model (LLM) whether a pointer dereference is safe, and it can often produce a plausible justification for ``yes''. The difficulty is that a fluent justificatio…
AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs
Shenao Wang, Xinyi Hou, Yanjie Zhao +2
LLM agents are increasingly developed as source-code applications built on agent frameworks. These agent programs combine conventional host-language code with framework-defined sem…
Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions
Shenao Wang, Xinyi Hou, Zhao Liu +5
GitHub Actions is increasingly used to deploy LLM-based agents for repository-centric tasks such as issue triage, pull-request review, code modification, and release assistance. Th…
As If We've Met Before: LLMs Exhibit Certainty in Recognizing Seen Files
Haodong Li, Jingqi Zhang, Xiao Cheng +3
The remarkable language ability of Large Language Models (LLMs) stems from extensive training on vast datasets, often including copyrighted material, which raises serious concerns…