static analysis

This work addresses a common yet critical issue in machine learning code: semantic errors arising from mismatches between data properties and model assumptions—such as applying scale-sensitive models to unnormalized data—which traditional debugging approaches can only detect after training, resulting in inefficiency. To enable early and automatic error detection, the authors propose a novel data-aware static analysis method that integrates dataflow and control-flow analysis with API specifications, thereby incorporating data semantics directly into the static analysis framework for the first time. Evaluation on real-world machine learning notebooks demonstrates that the approach effectively identifies subtle semantic bugs that conventional techniques fail to catch, highlighting its practical utility and methodological innovation.

Traditional fault localization approaches struggle to handle semantic errors, while existing large language model (LLM)-based methods often produce stochastic, unverifiable outputs that conflate root causes with cascading effects. This work proposes SemLoc, a novel framework that introduces structured semantic grounding for LLM-based reasoning: it anchors free-form LLM-generated explanations to program-specific reference points, constructs a semantic violation spectrum via dynamic instrumentation, and incorporates a counterfactual verification mechanism to identify critical causal constraints. The approach enables runtime validation and cross-test attribution, achieving a Top-1 accuracy of 42.8% (Top-3: 68%) on the SemFault-250 benchmark while inspecting only 7.6% of code lines; ablation studies show that counterfactual verification contributes a 12% absolute gain in accuracy.

Novice programmers often struggle due to misconceptions about Python’s control flow and scoping mechanisms. To address this, we propose a pedagogical tool integrating formal operational semantics with static program analysis. Our approach explicitly annotates operational semantics with source line numbers, enabling precise step-to-location mapping during execution; it further combines statically generated control-flow graphs with lexical scoping analysis to dynamically visualize runtime environments, call stacks, and control transfers. Implemented as an interactive, web-based debugger, the tool supports real-time exploration of program behavior. Its key innovation lies in the first unified integration of line-number-annotated operational semantics, static structural analysis, and pedagogically grounded visualization—thereby significantly enhancing beginners’ comprehension of dynamic program behavior and their efficiency in tracing execution.

This work addresses the challenge that existing program analyses struggle to bridge the semantic gap between natural language (NL) and programming language (PL), leading to ineffective dataflow analysis in code involving large language model (LLM) invocations. The paper proposes the first cross-modal information flow analysis framework that spans the NL/PL boundary, introducing a taxonomy of 24 labels to characterize the degree of information preservation and output modality between LLM inputs and outputs. Building on quantitative information flow theory, the approach integrates manual annotation, Cohen’s κ validation, two-phase taint propagation, and backward program slicing to enable computable modeling of LLM call behaviors. Evaluation on 353 expert-annotated samples achieves an F₁ score of 0.923, successfully detects six real-world prompt injection attacks, reduces average program slice size by 15% for non-propagating placeholder files, and identifies four critical blocking label categories.

Existing program behavior prediction models struggle to effectively capture dynamic inter-statement dependencies, limiting their performance in code coverage prediction and runtime error detection. To address this, we propose a dual-path joint modeling framework: (1) a static path that encodes control dependencies via control flow graphs (CFGs) and graph neural networks; and (2) a dynamic path that learns temporal execution dependencies from program execution traces. Crucially, we introduce node-level dual-path embedding to enable fine-grained, unified representation of both static and dynamic dependencies. To the best of our knowledge, this is the first work to jointly and coherently model static control-flow dependencies and dynamic execution-time dependencies within a single framework. Evaluated on code coverage prediction and runtime error localization tasks, our approach achieves significant improvements over state-of-the-art methods—yielding a 12.3% gain in prediction accuracy and an 18.7% increase in error localization precision.

This work addresses the challenge of statically verifying semantic consistency between natural language business requirements and their code implementations. It proposes a two-stage, runtime-free approach: first leveraging large language models to extract structured rules from requirements while identifying ambiguous or contradictory statements, and then performing static code auditing based on this intermediate representation. By integrating natural language processing with static analysis, the method mitigates hallucination and context loss in large models through rule structuring, enabling requirement-aware early validation. Evaluated on an automotive cybersecurity case study, the approach successfully detects semantic deviations, offers a novel solution to the test oracle problem, and significantly enhances left-shifted verification capabilities.

This work proposes a unified framework that integrates graph neural networks with large language models (LLMs) to jointly detect, explain, and repair software maintainability and security issues. Addressing the high false-positive rates and maintenance overhead of existing code smell and vulnerability detection tools—stemming from their lack of structured contextual awareness—the approach uniquely fuses multi-dimensional program graphs, including abstract syntax trees (ASTs), control flow graphs (CFGs), and program dependence graphs (PDGs), with deep code embeddings. The resulting model is cross-lingual, interpretable, and readily integrable into CI/CD pipelines. Empirical evaluation on multilingual datasets demonstrates significant improvements over conventional rule-based analyzers and single-model baselines, achieving higher detection accuracy and generating more practical repair suggestions.

Existing change impact analysis approaches rely solely on semantic similarity or structural dependencies, limiting their ability to comprehensively identify affected artifacts across heterogeneous software assets such as requirements, configurations, services, and tests. This work proposes a novel, training-free, and interpretable method that uniquely integrates semantic priors with multi-hop graph propagation. Specifically, it constructs a typed heterogeneous graph via static analysis, derives semantic priors from embedding-based cosine similarity, and diffuses impact through a row-normalized, decay-weighted propagation matrix controlled by a single parameter λ to balance precision and recall. Evaluation on five real-world change scenarios in a payment subsystem demonstrates the method’s capability to capture both structurally reachable yet textually disjoint artifacts and semantically related but structurally isolated ones, with demonstrated extensibility to operational assets such as container images and monitoring metrics.

Static analysis struggles to reconstruct complete control flow graphs for binaries employing dynamic loading techniques—such as packed programs and modern malware—due to unresolved indirect calls. This work proposes a novel approach that integrates symbolic execution with speculative library preloading. By deploying custom hooks during symbolic execution, the method intercepts dynamic loading operations in real time, speculatively preloads required libraries, and synchronously tracks instructions while managing intercepted functions—all without executing potentially malicious code. Consequently, it safely recovers accurate control flow graphs. Experimental evaluation on 16 synthetic benchmarks demonstrates that, compared to pure static analysis, the proposed technique recovers on average 29.8% more nodes and 26.5% more edges, while achieving 100% precision and recall in library identification.

This work addresses the inherent limitations of individual program analysis techniques—particularly their constrained precision, coverage, and insight—which hinder comprehensive software reliability assurance. Through a systematic mapping study of 248 relevant publications, the paper presents the first taxonomy of combined program analysis approaches explicitly centered on synergistic effects and interaction patterns. The proposed multidimensional classification framework is structured around three core dimensions: collaboration objectives, workflow architectures, and types of mapping functions. This framework systematically uncovers commonalities and distinctions in the design of existing methods, offering a clear conceptual foundation for understanding, comparing, and developing novel combined analysis techniques. Furthermore, it delineates current research trends and identifies promising directions for future investigation.