Soundness Checking of Taint Flow Models

2026-09-23

AI Summary

This study addresses the error-proneness of manually constructing taint flow models and the inefficiency of automated analysis by proposing a "guess-and-check" framework. The approach leverages large language model agents to generate candidate taint flow models and integrates symbolic execution, type systems, and pointer analysis techniques. By deriving must-not-occur flows for recursive verification, it effectively circumvents the overhead of whole-program static analysis. Experimental results demonstrate that this method successfully validates the reliability of 93% of the models in Go codebases without introducing additional false positives, significantly improving both the precision and efficiency of taint analysis.

Abstract

Existing state-of-the-art static taint flow analyses for imperative programming languages can scale to large applications by using precise user-provided taint flow models of library methods. However, manually and precisely modeling a method's taint flows is tedious and potentially unsound. Furthermore, automatically modeling the method via an inter- procedural taint analysis can be inefficient. To solve this problem, we propose a guess-and-check approach: (1) an LLM agent that generates a precise taint flow model of a method and (2) a symbolic algorithm to check the soundness of the model. The algorithm deduces which taint flows must not occur in the method for the LLM's taint flow model to be sound, and uses lightweight static analyses (e.g., type system and pointer analysis) to prove these must-not-flows. When these analyses are insufficient, the algorithm deduces maximally-general callee models and recursively verifies their soundness, avoiding a full inter-procedural taint analysis in most cases. Since a more precise model requires fewer must-not-flows to be verified, the precision of the LLM's model directly determines the efficiency of our approach. We evaluate our approach on 97 LLM-generated taint flow models for methods in 6 large Go codebases and prove the models sound for 93% of the methods they cover. The proven-sound LLM-generated models are also precise, resulting in no new false-positives when proving taint flow properties.

Problem

• taint flow analysis
• soundness checking
• taint flow models
• static analysis

Innovation

• Taint Flow Models
• Soundness Checking
• LLM Agent
• Symbolic Algorithm
• Static Analysis