ISSTA 2025
Wed 25 - Sat 28 June 2025 Trondheim, Norway

Modern software systems are becoming increasingly complex, requiring not only correctness but also interpretability and trustworthiness. The First Workshop on EXPlainable and REliable Software Systems (EXPRESS 2025) aims to address the growing demand for techniques that enhance the transparency, dependability, and usability of software systems. Beyond traditional software reliability, EXPRESS 2025 will also focus on trustworthy AI, ensuring the reliability, fairness, and robustness of AI-generated outputs. This workshop will bring together researchers, practitioners, and developers to explore innovative approaches for improving software explainability, reliability, and security. A key focus is on bridging the gap between academic research and industrial applications, ensuring that advanced verification, testing, and analysis techniques are both practical and trustworthy for real-world adoption. By fostering discussions and collaborations between academia and industry, EXPRESS 2025 seeks to pave the way for next-generation software engineering frameworks that are both powerful and user-friendly.

Plenary
You're viewing the program in a time zone which is different from your device's time zone change time zone

Sat 28 Jun

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

09:00 - 10:30
Trustworthy AI for CodeEXPRESS at Cosmos 3B
Chair(s): Peng Di Ant Group & UNSW Sydney, Puzhuo Liu Ant Group & Tsinghua University
09:00
10m
Day opening
Opening and Welcome
EXPRESS

09:10
60m
Keynote
Human-like AI Auditor for Code Repositories
EXPRESS
Xiangyu Zhang Purdue University
10:10
20m
Talk
FuseApplyBench: Multilingual Benchmark for Trustworthy Code Edit Applying Task
EXPRESS
Ming Liang Ant Group, Qingyu Zhang the University of Hong Kong, Zhipeng Zuo Ant Group, Shaoqiang Zheng Ant Group, Dajun Chen Ant Group, Wei Jiang Ant Group, Yong Li Ant Group
10:30 - 11:00
Coffee BreakCatering at Foyer
10:30
30m
Coffee break
Break
Catering

11:00 - 12:30
Intelligence and PrivacyEXPRESS at Cosmos 3B
Chair(s): Peng Di Ant Group & UNSW Sydney, Puzhuo Liu Ant Group & Tsinghua University
11:00
20m
Talk
Patch the Leak: Strengthening CodeLLMs Against Privacy Extraction Threats
EXPRESS
Yongjian Guo Tsinghua University & Ant Group, Wanlun Ma Swinburne University of Technology, Xi Xiao Tsinghua University, Sheng Wen Swinburne University of Technology, Peng Di Ant Group & UNSW Sydney, Xiaogang Zhu The University of Adelaide
11:20
20m
Talk
From Large Language Models to Adversarial Malware: How far are we
EXPRESS
Shuai He Huazhong University of Science and Technology, Hao Yan Huazhong University of Science and Technology, Wenke Li Huazhong University of Science and Technology, Sheng Hong Huazhong University of Science and Technology, Xiaowei Guo Huazhong University of Science and Technology, Xiaofan Liu Huazhong University of Science and Technology, Cai Fu Huazhong University of Science and Technology
11:40
20m
Talk
Towards Source Mapping for Zero-Knowledge Smart Contracts: Design and Preliminary Evaluation
EXPRESS
Pei Xu University of Technology Sydney, Yulei Sui University of New South Wales, Mark Staples Digital Finance CRC
12:00
20m
Talk
TestFlow: Advancing Mobile UI Testing through Multi-Step Reinforcement Learning
EXPRESS
Xiaoxuan Tang Ant Group, Xinfang Chen Ant Group, Dajun Chen Ant Group, Sheng Zhou Zhejiang University, Wei Jiang Ant Group, Yong Li Ant Group
12:20
10m
Day closing
Discussion and Conclusion
EXPRESS

13:00 - 14:00
LunchCatering at Foyer
13:00
60m
Lunch
Lunch
Catering

Call for Papers

Topics of Interest

We invite submissions on topics including, but not limited to:

  • Dependability, safety, and reliability in software systems
  • Analysis, testing, and verification techniques for trustworthy software
  • Trustworthy AI for software systems and software systems for AI
  • Interpretability and explainability of machine learning models and software systems
  • Explainability of LLM-based verification, testing, and analysis techniques
  • Dependency and complexity analysis, discovery, and mining
  • Software and systems visualization for enhanced explainability
  • Runtime analysis, monitoring, and error recovery

Submission Guidelines

Submission Link: https://express25.hotcrp.com/

All papers will be submitted via HotCRP and be reviewed in a double-blinded manner.

We welcome the following types of submissions:

  • Work-in-progress papers (max. 4 pages): Novel, high-potential research not yet fully validated.
  • Industry & tool papers (max. 4 pages): Practical challenges, solutions, or tools facilitating industry adoption of academic techniques.
  • Full papers (max. 8 pages): Original, complete, and validated research.

All submissions allow unlimited references and appendices.

At least one author of each accepted paper must register and present at EXPRESS 2025 for the paper to be included in the accompanying proceedings of ISSTA’25.

Requirements

Originality: All submissions must be original and not under review elsewhere.
Submission Format:
- Submissions must be in English and PDF format, adhering to the specified page limits.
- Authors should use the ACM Primary Article Template from the ACM Proceedings Template page. Word users should use the Interim Template, while LaTeX users should follow the sample-sigconf.tex example. Use the following LaTeX code at the start of your document:

\documentclass[sigconf,screen,review,anonymous]{acmart}

Sat 28 Jun 2025 - EXPRESS

Title: Human-like AI Auditor for Code Repositories

Xiangyu Zhang

Abstract: LLMs show promise for automated code analysis, but fall short in auditing real-world repositories due to context limitations and hallucinations. I present RepoAudit, an autonomous LLM-driven agent designed to perform precise, repository-level code auditing with high efficiency and accuracy. RepoAudit mimics expert auditors through demand-driven, path-sensitive reasoning over control and data-flow graphs—enabled by abstraction, pointer tracking, and validation mechanisms. Tested on 15 real-world projects in a controlled experiment, RepoAudit detected 38 true bugs with 65% precision, outperforming tools like Meta INFER and Amazon CodeGuru while costing only $2.54 per audit. A wider field-test has found 300 various kinds of zero-day bugs, ranging from classic bugs such as null pointer dereferences to functional bugs, in high-profile Github codebases, including Linux Kernel. This work represents a major step toward IDE-time, LLM-based auditing of large-scale software systems.

Bio: Xiangyu Zhang is a Samuel Conte professor at Purdue specializing in AI security, software analysis and cyber forensics. His work involves developing techniques to detect bugs, including security vulnerabilities, in traditional software systems as well as AI models and systems, and to leverage AI techniques to perform software engineering and cybersecurity tasks. He has served as the Principal Investigator (PI) for numerous projects funded by organizations such as DARPA, IARPA, ONR, NSF, AirForce, and industry.

Questions? Use the EXPRESS contact form.