Field Programmable Gate Array (FPGA) is essential in mission-critical fields like aerospace. It offers high flexibility and deterministic real-time response. With the increase in development demands and system complexity, the traditional design paradigm that relies on manual expertise has become inefficient. Although large language models (LLMs) provide a potential pathway for automated code generation, a significant semantic gap remains between the linear reasoning patterns of LLMs and the inherent parallelism of FPGA hardware logic. Current methods encounter difficulties in decomposing complex tasks, low-resource code generation, and resolving simulation errors.

To address these issues, we present Spec2V, an agent framework for the generation of Verilog code. Spec2V incorporates two key complementary components: (i) we propose a task planning method based on a dual-layer Tree of Thought. It decouples complex specifications into macro-topology and micro-logic structures to mitigate logical drift from linear reasoning and to improve the accuracy of initial solutions. (ii) During validation and debugging, Spec2V reformulates failure analysis as a structured attribution task with an LLM-as-a-Judge paradigm. It utilizes the reasoning capabilities of LLMs and multi-source evidence to localize the sources of simulation errors. Furthermore, the framework introduces a multi-temperature hedged sampling strategy and a waveform mismatch rate filtering mechanism to identify correct implementations efficiently from extensive candidate spaces. On the public VerilogEval Machine and Human benchmarks, Spec2V achieves Pass@1 accuracies of up to 99.8% and 99.4%, respectively. Case studies on representative RTL design tasks further demonstrate that Spec2V significantly reduces the manual effort required for implementation and mitigates the overhead of iterative engineering through closed-loop planning, validation, and debugging.

Large language model (LLM)-based multi-agent systems have shown promise in automating software development tasks. However, most vibe-coding systems focus on completing small tasks and incremental code changes, leaving persistent, continuous software development largely unexplored. We present TheBotCompany, an open-source orchestration framework for continuous multi-agent software development. TheBotCompany introduces three key innovations: (1) a three-phase state machine (Strategy to Execution to Verification) for milestone-driven development, (2) self-organizing agent teams where manager agents dynamically hire, assign, and retire worker agents based on project needs, and (3) asynchronous human oversight. We evaluate TheBotCompany on real-world software projects over multiple days of continuous development, measuring team adaptation patterns, milestone completion rates, cost efficiency, and code quality. Our results demonstrate that the self-organizing approach enables effective long-term software development with measurable progress, while the verification phase catches defects that would otherwise persist.

Formal verification via theorem proving enables rigorous proofs of software correctness, but it is difficult to scale due to the significant manual effort and expertise required. While Large Language Models (LLMs) have shown potential in automating proof generation, they frequently produce incorrect proofs on the first attempt that require iterative refinement to fix. However, most existing approaches employ fixed refinement strategies and cannot dynamically choose an effective strategy, which limits their performance. To overcome this limitation, we introduce Adapt, a novel proof refinement framework that leverages an LLM-guided decision-maker to dynamically select a suitable refinement strategy according to the state of the proof assistant and available context of an incorrect proof. We evaluate Adapt on two benchmark suites against five existing methods and find that it significantly outperforms the best baseline on both by proving 11.26% and 18.58% more theorems, respectively. Furthermore, we demonstrate Adapt’s generalizability by evaluating it across six different LLMs. We also conduct ablation studies to measure the contribution of each component and compare the trade-offs of alternative decision-maker designs.

Jupyter Notebooks have become the de-facto choice for data scientists and machine learning (ML) engineers for prototyping and experimenting with ML pipelines. Notebooks provide a rich interactive interface with support for code, data, and visualization in one place. However, notebooks provide limited support for testing. As a result, during continuous development, many silent (non-crashing) regressions often go unnoticed and make notebooks unreliable and results hard to reproduce. To enable more systematic testing of ML notebooks, we introduce NBTestGen – the first automated assertion generation approach for ML notebooks. NBTestGen generates regression-based assertions that check properties related to data processing, model building, and model evaluation steps in a typical ML notebook. To support systematic integration of such assertions in notebooks, we introduce the first regression testing framework (called NBTest) that can be used as a Jupyter plugin and allows developers to write cell-scoped assertions in notebooks. Three key features of such assertions are that they are 1) cell-scoped: they are linked to specific notebook cells and execute only after those cells are executed, 2) non-intrusive: they do not block notebook execution (in a Jupyter session), so that development can continue when they fail, and 3) they integrate with pytest and CI pipelines, allowing developers to easily do regression testing of their notebooks. We evaluate NBTestGen on a corpus of 585 notebooks from the popular Kaggle platform. NBTestGen generates a total of 21542 assertions (36.82 on average per notebook). The generated assertions kill 72.21% of ML-specific mutations, while maintaining a high passrate of 100.00%. We also show that NBTestGen can detect 69.68% of historical regressions in 531 older versions of Kaggle notebooks. A popular ML library, SHAP, integrated NBTest into their CI. Further, we perform a user study with 17 ML developers that shows that such users find NBTest highly intuitive and useful.

Software requirement ambiguity is ubiquitous in real-world development, stemming from the inherent imprecision of natural language and the varying interpretations of stakeholders. While Large Language Models (LLMs) have demonstrated impressive capabilities in generating code from precise specifications, such ambiguity poses a significant obstacle to reliable automated code generation. Existing benchmarks typically assume clear and unambiguous requirements, leaving an empirical gap in understanding how LLMs behave when faced with the inherent uncertainty of real-world software requirements.

In this paper, we introduce Orchid, a code generation benchmark specifically designed with ambiguous requirements. It comprises 1,304 function-level tasks covering four distinct types of ambiguity: lexical, syntactic, semantic, and vagueness. Leveraging this dataset, we conduct the first systematic empirical study to evaluate the impact of requirement ambiguity on LLM-based code generation. Our results demonstrate that ambiguity consistently degrades the performance of all evaluated LLMs, with the most pronounced negative effects observed in highly advanced models. Furthermore, we observe that LLMs frequently produce functionally divergent implementations for the same ambiguous requirement and lack the capability to identify or resolve such ambiguity autonomously. These findings reveal a significant performance gap between clear and ambiguous requirements, underscoring the urgent need for ambiguity-aware techniques in the next generation of automated software engineering tools. The Orchid benchmark is publicly available at https://huggingface.co/datasets/SII-YDD/Orchid.

Verifying whether two implementations of the same large language model are equivalent across frameworks is difficult in practice. Even when they implement the same computation, the graphs may differ in operator decomposition, tensor layout, and the use of fused or opaque kernels, making manual rewrite rules hard to build and maintain. We present Emerge, a framework for checking Implementation Equivalence over computation graphs extracted from model implementations. Instead of writing rules manually, Emerge infers candidate relations from execution values, and synthesizes rewrite rules on demand when existing rules are insufficient. Each synthesized rule is then validated using SMT solving when possible and constraint-aware randomized testing for opaque kernels. As these local equivalences accumulate, Emerge eventually establishes whether the two implementations are equivalent. Our implementation targets inference computation graphs captured from HuggingFace Transformers and vLLM. Our evaluation shows that Emerge establishes equivalence for correct implementation pairs at practical cost. It also detects 10 of 13 known implementation bugs, uncovers 8 previously unknown implementation issues that were later confirmed by developers, and localizes the first mismatch when equivalence cannot be established.

Black-box models are increasingly deployed in high-stakes domains such as education, personnel hiring, and credit assessment, making systematic and auditable fairness testing particularly important. In such settings, black-box fairness testing is typically modeled as a search problem aiming to discover biases in the target model as much as possible. However, existing methods offer limited support for verifiable evaluation on a clearly stated, data-supported test domain: which reasonable regions have been tested, which have not, and whether exploration is balanced across the test domain remain unclear.

This paper redefines black-box fairness testing as an auditable process on a data-supported, reasonable input domain. We first construct a reasonable region from the reference data and divide it into a finite set of local coverage units. Then, we introduce a coverage scheduler that distributes testing work among the units and explicitly records tested and untested regions, thus achieving reproducible and verifiable sufficient testing. To improve discriminative discovery capabilities without compromising the coverage foundation, we further design a structure-aware intra-unit search mechanism that combines a structure-aware discriminative field (SDF) and directional influence refinement (DIR).

Experiments on multiple real-world tabular datasets show that our method enables auditable unit-level coverage accounting and achieves more balanced coverage, higher sample naturalness, and higher discrimination discovery effectiveness than representative black-box fairness testing baselines. Moreover, the discovered instances are effective for mitigating individual fairness violations through retraining.

Understanding software evolution at the repository level is essential for tasks such as release management, code review, and regression testing. However, existing change summarization techniques are largely confined to single commits or functions, failing to capture cross-commit evolutionary context, while recent repository-level understanding tools focus on static documentation of single-version codebases, overlooking evolution over time. To bridge this gap, we propose ChangeWiki, an architecture semantic-augmented approach for repository-level change summarization. ChangeWiki first constructs hierarchical, multi-granularity change entity trees enriched with multi-source contexts to infer change intent and impact. It then recovers modular structures across versions and employs a bidirectional context-guided aggregation mechanism, synthesizing code-level changes from the bottom up while injecting architectural semantics as top-down constraints. ChangeWiki finally generates coherent, traceable summaries that capture both local modifications and system-level evolution. We construct comprehensive benchmarks and evaluate ChangeWiki on real-world projects. Experimental results demonstrate significant improvements in semantic accuracy, completeness, and cross-granularity traceability. A prototype of ChangeWiki has been deployed in an industrial setting for upstream-downstream code evolution, where developers reported that the hierarchical summaries significantly reduced manual effort in issue localization caused by upstream changes and show potential for automating version release notes.

Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants.

Suboptimal SQL queries can significantly degrade the performance of cloud systems, motivating the extraction and auditing of SQL statements before deployment. However, Go ORM frameworks construct SQL imperatively through scattered method-call sequences, making it difficult to statically recover the resulting SQL templates. We present AutoSQL, a system that reconstructs SQL templates from Go ORM code. AutoSQL constructs a Code Index, a directed graph that captures structural dependencies between functions, types, and global variables as navigable edges. It then traces upstream call chains from ORM invocation sites to identify database-interacting functions as entry points. For each entry point, an LLM agent traverses the Code Index to collect code slices that influence SQL generation, switching to pattern-based search when the graph cannot resolve a retrieval goal. We call this strategy Hybrid Context Retrieval. Once sufficient context is collected, the agent synthesizes SQL templates. Evaluation on a benchmark of 579 test-covered entry points and 1,186 runtime-traced SQL statements from five large-scale Go repositories shows that AutoSQL achieves 68.04% to 72.18% recall, exceeding the static reachability baseline by 11.80% to 15.94% and outperforming existing methods by 8.52% to 21.50%.

Large Language Model (LLM)-based Automated Program Repair systems are advancing rapidly, yet their performance remains inconsistent. Even when provided with the same contextual information, an LLM may generate a correct patch for one bug but fail on another closely related bug. Why this happens remains poorly understood, and it is unclear how LLMs prioritize the diverse information in bug reports and whether model attention affects repair success. In this paper, we present the first empirical study of attention patterns in LLM-based program repair, providing interpretable insights into how models process bug reports and where their attention is concentrated during repair. We analyze 319 real-world Python and Java bugs from SWE-bench Verified and Multi-SWE-bench to study (RQ1) how model attention is distributed across bug report sections, (RQ2) how attention patterns within each section differ between successful and unsuccessful repairs, and (RQ3) how these patterns compare to information developers consider important for bug fixing. We find that successful repairs are characterized by diffused attention across multiple diagnostic components such as bug descriptions, stacktraces, and test cases, while failures often exhibit over-localized attention toward metadata such as version information. We further observe that stronger alignment between model attention and developer-identified key sections and phrases is associated with higher repair success. Our results provide the first empirical evidence that attention misallocation is a key factor in LLM-based APR failures, and offer actionable insights for designing more interpretable and reliable future APR systems.

Reactive synthesis automatically derives correct-by-construction controllers from temporal logic specifications. GR(1) synthesis is widely adopted due to its polynomial-time complexity and practical expressiveness. In practice, however, a significant proportion of GR(1) specifications are unrealizable. Conventional synthesis tools report failure in such cases, yet real-world environments are often governed by their own objectives rather than purely adversarial behavior, presenting opportunities for the system to leverage environmental cooperation toward satisfying its justice guarantees.

For unrealizable GR(1) specifications, this paper proposes best-effort GR(1) synthesis. The approach requires the system strategy to satisfy two properties: best-effort extensibility, which preserves at every state reached by the play the possibility of satisfying all system justice guarantees, and persistent satisfiability of environment assumptions, which ensures that environmental cooperation does not preclude the environment from satisfying its own justice assumptions. For unrealizable but well-separated specifications, we construct a 3-nested µ-calculus fixpoint formula that characterizes the best-effort system winning region and prove its soundness and completeness. The resulting algorithm performs O(n|Q|) symbolic next-state computations, compared with O(mn|Q|²) for standard GR(1) synthesis. We further analyze the relationship between the best-effort and standard GR(1) winning regions through finite cooperative reachability, yielding a hierarchical classification of dependence on environmental cooperation at the region and initial-state levels for well-separated but unrealizable specifications, thereby quantifying the degree of unrealizability.

We implement best-effort checking, controller construction, and classification in the Spectra GR(1) synthesizer and evaluate the approach on a diversified corpus of SYNTECH, AMBA, and GenBuf specifications. Experimental results demonstrate that best-effort realizability is common among well-separated but unrealizable specifications and that all top-level unrealizability categories occur in the combined benchmark corpus.

Modern generator-based fuzzing techniques combine lightweight input generators with coverage-guided mutation as a method of exploring deep execution paths in a target program. A complementary approach in prior research focuses on creating highly customized, domain-specific generators that encode structural and semantic logic sufficient enough to reach deep program states; the challenge comes from the overhead of writing and testing these complex generators. We investigate whether AI coding agents can automatically synthesize such target-specific generators, and whether the resulting generators are strong enough to obviate the need for coverage guidance and mutation entirely. Our approach, Gentoo, is comprised of an LLM coding agent (provided terminal access and source code of the fuzz target and its library) instructed to iteratively synthesize and refine an input generator, and optionally provided fine-grained predicate-level coverage feedback. We evaluate three configurations of Gentoo against human-written generators on fuzz targets for 7 real-world Java libraries. Our findings show that agent-synthesized generators achieve statistically significantly higher branch coverage than human-written baseline generators on 4 of 7 benchmarks. Critically, the use of coverage guidance and mutation strategies is not statistically significantly beneficial for agent-synthesized generators, but is significant for all human-written generators, suggesting that structural and semantic logic encoded in the agent generators makes coverage guidance largely unnecessary.

Large language model (LLM)-based agents have achieved notable success in repository-level issue resolution, yet existing frameworks still face two key bottlenecks: insufficient diversity among candidate repair solutions and limited ability to combine complementary strengths across candidate solutions. To address these challenges, we introduce Prism, a multi-solution reasoning and synthesis framework that adopts a coarse-to-fine paradigm to systematically generate, refine, and integrate diverse repair solutions. Prism comprises three stages: (1) a global exploration mechanism with contrastive semantic constraints that broadens the search space by encouraging divergence across historical solutions; (2) an A* algorithm-inspired local exploration mechanism that identifies suitable branching points to generate divergent sub-solutions; and (3) a multi-agent collaborative solution synthesis process where reviewer and judge agents jointly evaluate, complement, and integrate partially correct candidate solutions. We evaluate Prism on SWE-bench Verified and SWE-bench-Live Lite. With Claude-4.6-Sonnet and DeepSeek-V3.2-Reasoner, Prism achieves Pass@1 rates of 82.0% and 80.0% on SWE-bench Verified, respectively, outperforming the compared baselines. On SWE-bench-Live Lite, designed to reduce data leakage concerns, Prism outperforms the reported baselines. Further analyses show that Prism expands the solution space and that its solution synthesis stage uniquely resolves 15 issues unaddressed by isolated candidates.

While Large Language Models (LLMs) have demonstrated exceptional performance in code generation, their autoregressive decoding paradigm typically results in low inference efficiency. Speculative decoding has emerged as a solution to speed up inference through its draft–verification mechanism, where multiple draft tokens are generated efficiently and then verified in parallel by LLMs. Current speculative decoding approaches for code generation are broadly categorized into two types: model-based approaches that generate drafts using a lightweight draft model, and retrieval-based approaches that reuse code snippets from external corpora. In this work, we first conduct empirical experiments to analyze the strengths and weaknesses of retrieval-based and model-based drafting. We find that retrieval-based approach is efficient but usually low-quality, while model-based one is high-quality but the drafting time increases with inference steps of the draft model. Inspired by the cache mechanism in computer architecture, we propose a novel framework CacheCoder. In our design, retrieval acts as a high-speed Level-1 (L1) cache for rapid draft acquisition, while the draft model functions as a more capable Level-2 (L2) cache to compensate for L1 misses, enabling us to capitalize on the speed of reuse when possible and rely on the precision of generation when necessary. To combine these two hierarchical processes, we propose two customized strategies, i.e., Preliminary Prediction and Draft Expansion, which utilize the draft model to pre-filter retrieved contents and expand them with tokens generated by the draft model to form drafts with higher length. Experimental results show that CacheCoder achieves up to a 2.64× speedup compared to autoregressive decoding, significantly outperforming state-of-the-art approaches.

Abstract interpretation provides a generic framework to design static analysis, and has been widely applied in analysis of real-world programs. The scalability and precision of these analyses depend largely on the chosen abstract domain. The template polyhedra domain is well-known for offering a compelling trade-off between scalability and precision. However, designing effective templates currently requires intensive manual effort and domain expertise. In this paper, we propose a bottom-up approach based on Large Language Models (LLMs) to automatically generate linear templates for the template polyhedral analysis. By leveraging the advanced code comprehension capabilities of LLMs, our approach automatically generates highly relevant templates. Based on this approach, we have implemented IKOSplus, a program analyzer supporting fully automated context-sensitive and interprocedural template polyhedral analysis, on top of IKOS. We evaluated IKOSplus on a variety of small-scale benchmark programs and complex real-world programs. Experimental results demonstrate that IKOSplus effectively balances analytical precision and scalability in the template polyhedral analysis.

Failing test generation is an important yet challenging task in software engineering. It involves searching a vast space to identify fault-triggering test inputs and the oracles that assert these faulty executions. Several approaches have been proposed for generating failing tests. Specifically, given a program-under-test (PUT) and its requirements, these approaches leverage large language models (LLMs) to generate alternative implementations of the PUT that comply with the requirements, followed by differential testing between the PUT and the alternative implementations. Failing tests can be constructed by adopting the inconsistency-revealing inputs as the test inputs and treating the outputs returned by the alternative implementations as expected outputs. As alternative implementations may also contain faults and thus return incorrect outputs, current methods rely on either output consistency across alternative implementations or pre-constructed test cases for validation. However, the former is susceptible to LLM training biases or stochasticity, while the latter can be impractical due to the scarcity or unavailability of pre-constructed test cases in real-world scenarios. To address existing works’ limitations, we employ LLM as an alternative oracle for output validation, and calibrate its reasoning steps to reduce its susceptibility to LLM training biases or stochasticity. One critical challenge is that the calibration process inherently requires correct input-output pairs for the output validation task as ground-truth for reference when validating/calibrating LLMs’ reasoning, yet correct input-outputs (i.e., passing tests) are often scarce or unavailable in real-world scenarios. To address this challenge, our insight is that outputs consistently returned by both the PUT and all alternative implementations have a high probability of being the correct outputs of the PUT, as the PUT and alternative implementations are generated by independent agents (i.e., human developers and LLMs). Based on this insight, we propose FAiLGen, a novel approach that calibrates LLM’s reasoning for failing tests generation via a representative reasoning calibration paradigm, Monte Carlo Tree Search. We evaluate FAiLGen on 100 subjects from CodeForces and 100 subjects from SWE-Bench-Live. Our evaluation results show that FAiLGen achieves a recall of 58.1%, which is 62.4% higher than that of the best baseline (35.8%). Meanwhile, FAiLGen attains a precision of 75.2%, favorably compared to the best baseline (61.1%).

Wi-Fi is a widely used wireless protocol, and mobile hotspot functionality has become essential for on-the-go connectivity. Bugs in the hotspot protocol stack can cause crashes, performance degradation, and semantic inconsistencies. Fuzzing is a promising technique for detecting such vulnerabilities. However, existing fuzzers typically test by modeling protocol inputs but ignore some critical dependencies among Wi-Fi fields, leading to inefficient testing.

In this work, we present WiDepFuzz, a fuzzing framework designed to detect bugs in Mobile Hotspot implementations by modeling field dependencies in the Wi-Fi protocol. First, WiDepFuzz automatically identifies the semantic dependencies among Wi-Fi fields based on the IEEE 802.11 standard and constructs a Field Dependency Model (FDModel) to characterize various direct and indirect dependencies. Second, leveraging the FDModel, WiDepFuzz utilizes dependency-combination guided fuzzing to constantly generate Wi-Fi test frames that efficiently explore deep paths and trigger hidden bugs. Finally, we propose liveness and dependency detectors that enable real-time monitoring to identify abnormal states and uncover potential bugs in mobile hotspots. We implemented WiDepFuzz and evaluated it in six widely used mobile hotspots, covering major smartphone manufacturers, including Samsung, Xiaomi, OPPO, Honor, Huawei, and Nokia. Compared to SOTA Wi-Fi fuzzers like Peach, OwFuzz, wpaspy, and Greyhound, WiDepFuzz detects 15 more bugs and improves bug detection speed by 37% on average. In total, it uncovered 20 new bugs.

Software configuration plays a critical role in modern software systems, yet it also frequently leads to severe failures. Existing approaches, whether static analysis or LLM-based validation, struggle to capture implicit semantic constraints and validate configuration-code interactions. Leveraging existing unit tests is also insufficient due to their lack of configuration-specific focus. Thus, we present CTForge, an LLM-powered framework that automatically generates configuration-specific test suites. Its core innovation is a three-stage configuration-aware optimization pipeline that moves beyond vanilla test generation, specifically using parameter semantics to improve LLM outputs. This optimization pipeline iteratively aligns tests through: (1)enhance configuration-related code coverage to ensure relevance, (2) assertion validation across valid parameter values to eliminate false assertions, and (3) configuration-sensitivity verification to select tests that semantically exercise the intended configuration behavior. Evaluated on five large-scale systems, CTForge detects 63 out of 79 real-world configuration issues and achieves an F1-score of 0.88 in misconfiguration detection. CTForge also uncovers six previously unknown defects. Our work demonstrates that structured configuration-aware refinement is essential for LLM to produce effective test suites.

Existing autoscaling approaches primarily leverage direct service calls to model the propagation effects of scaling decisions across inter-service dependencies. However, the intricate and implicit service interactions (i.e., latent dependencies) often go beyond such direct invocations, rendering suboptimal scaling actions and poor adaptability. To address these limitations, we propose Panorama, a novel autoscaling framework that explicitly unveils and exploits indirect service interactions. In particular, we formalize two fundamental categories of latent dependencies, i.e., resource interference dependencies (RIDs), which emerge from shared infrastructure resources, and execution blocking dependencies (EBDs), which stem from temporal constraints in the execution logic of business workflows. Panorama employs a hybrid attention mechanism to model these multifaceted service dependencies alongside temporal dynamics. We also design a meta-learning paradigm to enable rapid adaptation to evolving workload patterns and dependency structures without extensive retraining. Evaluation across four representative microservice benchmarks shows that Panorama consistently outperforms state-of-the-art baselines, achieving up to 68% reduction in resource consumption while improving response time by 42%. This highlights the critical importance of explicitly modeling latent dependencies for effective microservice resource management.

Automated Program Repair (APR) has advanced rapidly on managed languages such as Java and Python, yet C—the bedrock of systems software—remains far harder to repair safely. The difficulty is specific to C: as an unmanaged language with manual memory management, a patch can compile and pass every functional test while silently introducing a memory-safety defect (a leak, use-after-free, or double free) that managed-language tests would never expose, making such “fixes” potentially worse than no fix. Existing LLM-based repair offers little defense, as it learns from impoverished feedback—no execution at all (APPATCH), binary pass/fail signals (ChatRepair), or loosely-structured, unscored sanitizer text (VRpilot). We present CiL-Agent (Compiler-in-the-Loop Agent), which tightly integrates GCC, the Clang Static Analyzer, and Valgrind into the LLM generation loop, parsing their diagnostics into structured, three-dimensional feedback: compilation reachability, static provability, and dynamic memory safety. A two-phase strategy first samples and composite-scores candidate patches (Best-of-N), then refines the best under precise tool feedback. On 1,000 real-world C vulnerabilities spanning 11 CWE categories, CiL-Agent attains 88.2% Pass@1 with 87.3% memory-safe patches, outperforming five repair baselines (by 8.3–58.4pp, all p<0.001, McNemar’s test) and five modern coding agents by a wide margin. A full 1,000-task ablation shows toolchain integration and iterative refinement are independently essential (−44.3 and −35.2 percentage points), with toolchain integration the single most critical component, and a post-cutoff benchmark confirms the gains are not due to training-data memorization.

Mobile bug reproduction is essential to effective debugging in software engineering. Recent methods leveraging Large Language Models (LLMs) have shown significant performance gains over traditional techniques in automating this task. However, existing LLM-based methods remain constrained by two major limitations. First, they lack robustness to unreliable or inconsistent LLM outputs due to overreliance on a single LLM-suggested action without principled planning. Second, substantial token overhead arises from frequent LLM queries and the limited utilization of each query’s output capacity. To address these limitations, we propose ReproPilot, a lightweight framework that combines global planning with LLM-based semantic reasoning to reproduce mobile bugs. Specifically, the LLM provides diverse, reusable long-horizon guidance beyond step-wise action suggestions. This guidance is integrated with heuristic signals by a global planning mechanism to reason about reproduction progress and globally determine where to explore (i.e., which reproduction states) and what trajectories to explore, rather than merely executing actions on the current UI page at each iteration. As a result, ReproPilot improves the consistency and cost-efficiency of bug reproduction while maintaining competitive effectiveness. Evaluation on 74 real-world Android crash reports shows that our approach delivers the best reliability–cost trade-off among the evaluated methods, attaining the highest consistency (80.14%) with competitive effectiveness (86.49%), reducing reproduction time by 2.32%–14.07%, and lowering LLM token consumption by 65.39%–83.96% compared with state-of-the-art LLM-based baselines.

Price manipulation is one of the most damaging vulnerability classes in decentralized finance (DeFi) protocols. Existing approaches mainly stop at warning generation or rely on rigid attack templates, and therefore struggle to determine whether a victim protocol is profitably exploitable under a concrete chain state. This problem is challenging because the attack-relevant victim-side steps are highly protocol-specific, while successful exploitation further depends on brittle runtime conditions such as reserve states, token-specific guards, and narrow numeric ratios. In this paper, we present SPSYN, a DeFi price-manipulation exploit synthesizer that combines semantic recovery with state-guided search. SPSYN first extracts structured cross-contract contexts and uses an LLM to recover attack-relevant victim-side function roles. It then organizes the recovered functions into stage-consistent candidates and scenario-guided initial seeds. Finally, it synthesizes exploit witnesses on a concrete chain snapshot through state-guided search under a semantic-aware state machine. Runtime observations reveal whether the transformed sequence has established a meaningful anomaly, whether it should continue to be expanded, and how later mutations should be refined. In this design, semantic recovery narrows the search to the right victim-side actions, while exploitability is validated through actual execution on the target snapshot. On 29 historical incidents, SPSYN synthesizes profitable exploit witnesses for 27 cases (93.1%), outperforming ItyFuzz (11/29), CPMMX (19/29), and FlashSyn (7/29), with a median time-to-first witness of 114 seconds on successful cases. During on-chain deployment across Ethereum and Binance Smart Chain, SPSYN further discovers 9 previously unreported profitable vulnerabilities with a cumulative potential profit of $35.1K.

Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space.

In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190%–205% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers.

Programming tutorial videos on YouTube are a widely used learning resource, but their length often makes content review inefficient. AI-based summarization tools can produce shorter versions of these videos, yet existing evaluation relies almost exclusively on similarity-based metrics that measure surface overlap rather than whether the summaries actually support learning. We present VidSumEval, a web platform and benchmark for evaluating AI-generated programming tutorial summaries from a learning-centered perspective. The benchmark pairs 10 tutorials in C, Java, and Python with summaries from two commercial engines (VEED and NotebookLM) and auto-generated comprehension quizzes; users can also submit new YouTube tutorials for offline review. We validate the benchmark with a within-subject study (n=20) measuring both quiz-based comprehension and Likert-scale ratings on completeness, clarity, and coherence; learning effectiveness is reported as the per-participant difference between summarized- and original-video quiz scores. The platform is available at https://progsumeval.onrender.com; the source code and dataset are archived at https://doi.org/10.5281/zenodo.21763079; and the screencast is available at https://youtu.be/iBB-5HfRVSk.

Existing fairness analysis tools predominantly operate as post-training evaluation frameworks, requiring practitioners to complete the full model development lifecycle before assessing bias. We present FairLint-DL, a Visual Studio Code extension that implements a shift-left approach to fairness testing by enabling pre-training, IDE-native bias detection directly on tabular datasets. FairLint-DL trains a configurable deep neural network as a proxy model and applies information-theoretic Quantitative Individual Discrimination (QID) metrics. Grounded in Shannon and min-entropy, QID quantifies the causal influence of protected attributes on predictions. The system implements a two-phase gradient-guided search algorithm for discovering discriminatory instances, a causal de- bugging pipeline that localizes bias to specific network layers and neurons via sensitivity analysis, and dual explainability engines using SHAP and LIME for feature-level attribution. Evaluation on three tabular benchmarks (Adult Census Income, German Credit, and Bank Marketing) reveals fairness concerns that vary widely across datasets: on Adult, 96.0% of analyzed instances exhibit QID above the 0.1-bit significance threshold, with a mean QID of 0.619 bits and a disparate impact ratio of 0.581, violating the four-fifths legal rule. FairLint-DL produces these results within 12 seconds on cached models, demonstrating the feasibility of integrating fairness analysis into the developer workflow without significant overhead.

Artificial Intelligence (AI) systems are increasingly implemented through Machine Learning (ML) pipelines and Large Language Model (LLM) integrations, where design and implementation choices are scattered across data preprocessing code, model configuration, training scripts, provider APIs, and prompt/output logic. Poorly designed choices may form AI code smells, namely recurring implementation patterns that can undermine reproducibility, robustness, maintainability, and trustworthy behavior. Yet, evaluating AI code smell detection approaches remains difficult due to the lack of reusable benchmarks with validated ground truth. We present AISmellBench, a benchmark for AI code smells built through a reproducible pipeline combining GitHub repository mining, eligibility filtering, tool-assisted identification of potential code smell instances, and manual annotation with adjudicated validation artifacts. AISmellBench brings together 1,221 AI-based Python repositories, including 888 ML repositories and 333 LLM-based repositories. The released benchmark contains 1,265 annotated Python files with 3,714 validated AI code smell instances across 31 AI code smell types.

Demonstration video: https://youtu.be/xepUUGSHaiU Dataset availability: https://doi.org/10.5281/zenodo.20085308

Dafny is a verification-aware language whose adoption is hindered by the heavy manual effort of writing formal specifications and proof artefacts—a critical bottleneck for safety-critical software development. While Large Language Models (LLMs) can synthesise Dafny code, they routinely hallucinate domain-specific constructs and stagnate in repetitive generate–verify–fail cycles, because Dafny is severely under-represented in pre-training corpora. We present DafnyRAG, an open-source tool that turns any general-purpose LLM into a verification-aware Dafny repair agent. DafnyRAG ships with (i) a heterogeneous Dafny knowledge base—a static Syntax Rule Library, a static Error Theory Library, and a dynamic Repair Case Library; (ii) an error-aware retrieval router that selects the appropriate library based on the verifier diagnostic; and (iii) a verification-driven iterative repair loop that backfills every successful repair into the case library, growing the tool’s expertise over time. Across three production LLM backends (GPT-4, DeepSeek-V3, Claude-4.5-Sonnet) on the MBPP-DFY-178 benchmark, DafnyRAG consistently outperforms a strong few-shot baseline on verify@5, peaking at 83.71% with Claude-4.5-Sonnet.

The tool source code, knowledge base, and evaluation scripts are available at https://doi.org/10.5281/zenodo.21372059.

A screencast demo is available at https://youtu.be/s-QBaGj8tK8.

Graph-based code indexing can improve context retrieval for LLM-based code agents by preserving call chains and dependency relationships that keyword search and similarity retrieval often miss. ABCoder is an open-source framework that parses codebases into a function-level code index called UniAST. Its existing parsers combine lightweight AST parsers for syntactic analysis with language servers for semantic resolution, but because such resolution requires a JSON-RPC call for each symbol lookup, these per-symbol calls become a bottleneck on large TypeScript repositories. We present abcoder-ts-parser, a TypeScript parser built on the TypeScript Compiler API that works directly with the compiler's AST, semantic information, and module resolution logic. We evaluate the parser on three open-source TypeScript projects with up to 1.2 million lines of code and find that it produces reliable indexes significantly more efficiently than the existing architecture. For a live demonstration, watch: https://youtu.be/ryssr7ouvdE

Large language models (LLMs) have shown promise in code generation, but generating formally verifiable Rust programs from natural-language descriptions remains highly challenging. We present a benchmark called NL2VBench for generating verifiable Rust programs from natural-language descriptions using Verus.NL2VBench contains 762 verifier-checked tasks derived from five public sources and curated through filtering, deduplication, canonicalization, LLM-assisted drafting, and human revision. Each task provides a natural-language description, task-defining interface information, and a verifier-checked reference solution. To demonstrate its utility, we evaluate five representative LLMs on a direct NL-to-Verus baseline. The results show that current LLMs achieve low verification success and even lower strict semantic correctness, demonstrating that NL2VBench is a challenging and reusable benchmark for future research on LLM-based verified code generation. A demonstration video of NL2VBench is available at https://youtu.be/CNOXHejni1c.

Interactive LLM and agent evaluations often rely on oracle users or ground-truth-aware simulators that provide complete and unambiguous answers once the system asks a relevant question. This idealized assumption makes evaluation scalable and reproducible, but can overestimate robustness when real users omit information, give vague answers, or use unclear references. We present FallibleUser, a pluggable fallible-user simulation toolkit for evaluating interactive AI systems under imperfect user answers. FallibleUser preserves the original oracle-user pipeline, but inserts a configurable answer-rewriting layer before the answer is returned to the evaluated system. The current toolkit supports three representative fallibility operators: slot omission, specificity reduction, and referential ambiguity. It also pairs rewriting with a strict post-answer Q&A-level hit judge, so that a target is credited only when the final interaction actually elicits complete, specific, and unambiguous information. We demonstrate FallibleUser in a requirements-elicitation evaluation setting and show that oracle-user evaluation can substantially overestimate the robustness of the same interviewer agent. FallibleUser is open-sourced at https://doi.org/10.5281/zenodo.20136882, with a demonstration video available at https://youtu.be/T8-I9pb8rAI.

Interactive Theorem Provers (ITPs) like F* provide robust mathematical guarantees for software correctness, but their steep learning curves, specialized syntax, and complex proof mechanics severely limit their mainstream adoption. To lower this entry barrier, we propose StarFuse, an LLM-assisted developer tool that automatically synthesizes fully verified F* programs from mixed-format source files. StarFuse allows developers to express their intents using a combination of natural language, pseudocode, imperative code (C), functional code (OCaml), and F* sketches. It employs a context-aware, compiler-guided repair loop that iteratively queries a Large Language Model (LLM) and utilizes F* compiler diagnostics to refine and fix the generated code. Additionally, it integrates a "fuzz first" mechanism for functional snippets to quickly filter out shallow bugs before invoking the expensive verification process. To evaluate StarFuse, we created a benchmark suite based on instances from the F* repository. Our evaluations demonstrate the ability of StarFuse at successfully verifying implementations across various modalities, thereby offering a practical bridge from informal intent to rigorous formal verification.

Model-driven design often requires the same model to support multiple downstream tasks, such as simulation, testing, verification, and deployment. However, existing tools usually build separate translation workflows for different tasks, causing repeated model parsing, redundant semantic reconstruction, and limited reuse across toolchains. In this paper, we present UCT, a versatile code translation framework based on a unified intermediate representation (CIR). UCT translates models into CIR once, preserves executable semantics, structural information, scheduling relations, and model-code mappings, and then generates task-specific code through unified instrumentation and backend translation. We implemented UCT and evaluated it on Simulink benchmark models. The results show that UCT can generate usable customized code for simulation, testing, verification, and deployment. The generated binary artifacts also provide additional benefits, improving model testing coverage by 85.9% on average and accelerating simulation by 19.8× on average over Simulink Rapid Accelerator. The video is presented at https://youtu.be/CCu5iO853p4. The implementation is available at https://github.com/CodeGen123/UCT.

Internet of Things (IoT) tutorial videos describe the parts a learner must purchase verbally rather than visually, which makes them invisible to frame-based mining techniques developed for programming screencasts. We present IoTutorMine, a tool that recovers structured hardware Bills of Materials (BoMs) from IoT tutorial videos by combining YouTube’s auto-generated transcripts with large language models in a zero-shot setting. IoTutorMine-Web, a public prototype, exposes the pipeline as an interactive IoT tutorial catalog: users paste a YouTube URL to get an on-demand BoM, or browse a pre-indexed library searchable by component (e.g., “every tutorial that uses a DHT11”). We also release a benchmark of 20 manually annotated YouTube tutorials covering Arduino and Raspberry Pi at two difficulty levels, with 131 ground-truth components from 16 distinct creators, together with an expert-curated alias dictionary and evaluation scripts. Under a two-tier entity-resolution strategy that combines syntactic matching with semantic canonicalization, Gemini 3 Flash reaches 𝐹1 = 0.933, GPT-5.5 𝐹1 = 0.887, and Claude Opus 4.7 𝐹1 = 0.868, with Gemini significantly outperforming Claude on per-video 𝐹1 (Wilcoxon 𝑝 = 0.028). The results demonstrate that transcript-only BoM extraction is feasible for practical IoT cataloging applications, and that a semantic mapping layer is essential to resolve hardware nomenclature variations.

We present OpenStack-RCA-Bench, an open dataset of 64 chaos-engineering incidents for benchmarking RCA methods in OpenStack IaaS. It features a 9-phase pipeline integrating four fault injection methods (service stop, port block, process kill, config corruption), automated log collection via Loki, and ground truth defined by programmatic injection metadata. The benchmark comprises 64 validated incidents across 37 services and 46 fault scenarios spanning controller, compute, network, storage, and critical infrastructure—totalling 145,133 log lines (8.4 MB). A rule-based baseline achieves 92% F1 overall, with 100% on controller-backend and OVN-network categories and 84% on extended fault types. We additionally evaluate state-of-the-art LLMs using zero-shot prompting: Top-1 accuracy reaches 10–16% across models, highlighting the difficulty of log-based RCA. The benchmark and framework are publicly available. The artifact ships as a Docker Compose setup enabling one-click deployment and dry-run validation without external dependencies.

Operating system migration requires validating thousands of software packages for behavioral compatibility on the target distribution. Differential testing is the dominant industrial approach. OS level outputs contain many benign differences that are unrelated to package compatibility. These differences produce many false positives. They also bury real compatibility issues under heavy triage load. To address this issue, we first conduct a study of false positive root causes on industrial enterprise Linux migration data. This study yields a five-category taxonomy and a share–cost decision matrix. These findings guide our design. We propose FPSieve, a cost routed filtering pipeline for OS migration validation. FPSieve integrates rule based filtering, semantic similarity filtering, case library retrieval, package level LLM reasoning with confidence based routing, and closed loop container based verification. We evaluate FPSieve on a large scale OS migration differential testing dataset collected from industrial practice. FPSieve reduces the overall manual review queue to 5.9% of its original size while preserving 86.7% recall. It also improves review queue precision from 3.16% to 46.0%. After deduplication, FPSieve surfaced 66 compatibility issues submitted upstream. Of these, 14 received maintainer feedback, and 6 have been fixed. These results show that FPSieve can reduce false positives, reduce manual effort, and improve OS migration validation throughput.

While significant progress has been made in automating various aspects of software development through coding agents, there is still significant room for improvement in their bug fixing capabilities. Debugging and investigation of runtime behavior remains largely a manual, developer-driven process. Popular coding agents typically rely on either static analysis of the code or iterative test-fix cycles, which is akin to trial and error debugging. We believe that there is a wealth of rich runtime information that developers routinely access while debugging code, which agents are currently deprived of due to design limitations. Despite how prevalent debuggers are in modern IDEs and command-line tools, they have surprisingly not made their way into coding agents. In this work, we introduce Debug2Fix, a novel framework that incorporates interactive debugging as a core component of a software engineering agent via a subagent architecture. We incorporate debuggers for Java and Python into our agent framework and evaluate against GitBug-Java and SWE-Bench-Live and achieve >20% improvement in performance compared to the baseline for certain models. Furthermore, using our framework, we're able to make weaker models like GPT-5 and Claude Haiku 4.5 match or exceed the performances of stronger models like Claude Sonnet 4.5, showing that better tool design is often just as important as switching to a more expensive model. Finally, we conduct systematic ablations demonstrating the importance of both the subagent architecture and debugger integration.

Push notification services are widely used in mobile apps to deliver time-sensitive content. In the fragmented Android ecosystem, however, no single push service works reliably across all devices and markets, leading developers to integrate multiple push SDKs from device manufacturers and third-party providers. Despite their widespread use, prior studies have focused mainly on Google’s Firebase Cloud Messaging, leaving the security risks of other push services largely unexplored. In this paper, we present a systematic security assessment of the Android push notification ecosystem, covering 11 mainstream push SDKs and 52,748 apps across multiple Android app markets. Our analysis reveals three classes of security risks across the push notification workflow: server secret leakage, notification hijacking, and plaintext exposure of notification payloads. Specifically, we identify 517 apps that leak server secrets, accounting for at least 78.79 billion cumulative installs. These leaks enable attackers to forge notifications with attacker-controlled titles and bodies, redirect users to arbitrary URLs after a click, and, in 9 of the 11 evaluated push services, broadcast such notifications to all users. We further show that four widely used push SDKs are vulnerable to notification hijacking, enabling attackers to reroute victim notifications. In addition, among the 110 communication-oriented apps we evaluated, none protects notification payloads before they enter push service infrastructure, leaving sensitive content exposed in plaintext. These findings show that securing real-world push services requires stronger protections from both app developers and push service providers, highlighting the need for more secure push deployment in industry practice. We responsibly disclosed the issues to push service providers and app developers, and received acknowledgments from affected parties.

Root cause analysis (RCA) for incidents in large-scale cloud systems is a complex, knowledge-intensive task that often requires significant manual effort from on-call engineers (OCEs). Improving RCA is vital for accelerating the incident resolution process and reducing service downtime and manual efforts. Recent advancements in Large-Language Models (LLMs) have proven to be effective in solving different stages of the incident management lifecycle including RCA. However, existing LLM-based RCA recommendations typically leverage default finetuning or retrieval augmented generation (RAG) methods with static, manually designed prompts, which lead to sub-optimal recommendations. In this work, we leverage 'PromptWizard', a state-of-the-art prompt optimization technique, to automatically identify the best optimized prompt instruction that is combined with semantically similar historical examples for querying underlying LLMs during inference. Moreover, by utilizing more than 180K historical incident data from Microsoft, we developed cost-effective finetuned small language models (SLMs) for RCA recommendation generation and demonstrate the power of prompt optimization on such domain-adapted models. Our extensive experimental results show that prompt optimization can improve the accuracy of RCA recommendations by 21% and 13% on 3K test incidents over RAG-based LLMs and finetuned SLMs, respectively. Lastly, our human evaluation with incident owners have demonstrated the efficacy of prompt optimization on RCA recommendation tasks. These findings underscore the advantages of incorporating prompt optimization into AI for Operations (AIOps) systems, delivering substantial gains without increasing computational overhead.

For architecture, engineering, and manufacturing organizations, the inability to inspect AutoCAD's compiled script formats (FAS and VLX) has become a consequential security blind spot: every publicly available analysis tool fails on them, while threat actors have repeatedly used them to weaponize shared drawing files in documented industrial espionage campaigns. Today, when a security analyst encounters a suspicious FAS or VLX file, the manual practice is either to upload it to a cloud service (often prohibited by confidentiality policies), to attempt ad hoc byte-level inspection (ineffective due to per-file encryption), or to simply skip the file. This paper reports on CADscanner, a tool that automates the analysis of compiled AutoCAD scripts by recovering their behavioral content locally, without requiring AutoCAD installation, cloud submission, or manual reverse engineering.

We describe the engineering of a recovery pipeline that handles two proprietary formats: the FAS4 binary, which is protected by rolling-XOR encryption, and the VLX (VRTLIB-1) archive container. The pipeline lifts both into a normalized intermediate representation suitable for automated rule matching and analyst review. On a 201-script consistency benchmark, behavioral API recovery reaches 79.3% recall at 97.8% precision, with security-critical indicators (persistence, network, propagation) preserved at 85--94%. A rule-based detector over the recovered surface achieves 95.8% TPR at 2.2% FPR on a family-disjoint held-out set, processing files in under 15,ms each. We report deployment experience integrating CADscanner into a security vendor's OT analysis workflow, discuss the engineering trade-offs encountered, and distill lessons learned for practitioners building format-recovery tooling in industrial contexts.

Before a full smart contract audit begins, security teams must decide whether a project should be escalated, scoped more care- fully, or declined, yet these triage decisions are still made largely through manual inspection. Existing tools provide limited sup- port for this stage: vulnerability analyzers focus on low-level ex- ploitability, while access-control analyses enumerate privileged functions without recovering the benefit-level semantics needed to assess participation-dependent logic or concentrated administrative power. We present RiskScope, a pre-audit triage framework that identifies two classes of risk signals in smart contracts: incentive risk, when a user-facing benefit depends on non-local participation, and control risk, when privileged roles can later alter or disable that benefit. RiskScope introduces Benefit Formation Graphs (BFGs), which connect benefit surfaces, governing predicates, update paths, and privileged control surfaces into a unified structure that ex- plains how user-visible outcomes are formed and who can reshape them. A static analysis stage recovers these structures from contract source code, and an LLM-guided triage stage interprets the recov- ered evidence into structured, auditor-facing findings. We evaluate RiskScope on three public corpora totaling over 2,500 parsed con- tracts. On an incentive-heavy corpus, RiskScope achieves 92.1% recall at 79.5% precision for contract-level triage, while producing zero triage findings on a corpus of widely used library contracts. RiskScope provides compact, interpretable evidence for early audit prioritization.

In modern software development, accurately assessing the impact scope of requirement changes is crucial for software quality, yet this task faces two major challenges. First, highly simplified requirement descriptions (one-sentence requirements) tend to conceal complex business logic and extensive system dependencies. Second, commits often intertwine code changes for multiple requirements, leading to impact assessments that are both incomplete and time-consuming. Traditional manual assessment methods are not only inefficient but also prone to cognitive biases, which often result in the omission of critical impact points.

To address these problems, this paper proposes AIST (Analysis of the Impact Scope of the Task), an automated impact scope analysis approach based on Large Language Models (LLMs). AIST leverages the semantic understanding and planning capabilities of LLMs to automatically parse requirement descriptions, retrieve relevant code context from the codebase, and integrate code change information, thereby generating a comprehensive impact scope assessment report.

We evaluated AIST on 40 historical requirement changes from three real-world industrial projects. The experimental results show that it achieves a precision of $80.19\%$, a recall of $94.95\%$, and an F1-score of 86.35 %, thereby significantly improving the completeness of impact scope identification and demonstrating high sensitivity in detecting tangled code changes. In a user survey, the novelty score was 6.32 out of 7.00, and the overall satisfaction score was 6.36 out of 7.00, indicating that users perceive that the tool effectively improves efficiency and reduces the risk of omissions.

Android lite apps are intended for resource-constrained environments and are commonly assumed to be safer because they expose less functionality than full-featured apps. However, recurring reports of crashes, broken features, and excessive advertising suggest that this assumption may be false. We present the first systematic differential study of Android lite apps on an artifact-complete cohort of 500 lite-full app pairs across a diverse set of app categories. The results reveal a fundamental security paradox: lite apps simplify little in practice, yet often inherit substantial risk from their full counterparts while introducing new problems of their own. On this unified 500-pair subset, the median APK size ratio is 0.99, yet 47.0% of lite apps are actually larger than their full counterparts, while still retaining 71–91% of exported attack-surface components. We further identify 130 unique lite-app crashes, including 61 logic modification failures, 40 validation omissions, and 29 residual code hazards. These failures are not confined to niche apps: the affected lite apps account for at least 633.1 million lower-bound installs in our retained market metadata, and physical-device replay reproduces immediate lite-only fatal launch failures in at least 6 of the 45 crash-app pairs whose lite and full APKs both install on a current device. The same pattern appears in the surrounding security ecosystem: lite apps more often declare ad support, embed ad libraries, and fall into our adware-only category than full apps. In addition, 27.2% of lite apps introduce dangerous permissions absent in their full counterparts. These findings indicate that lite apps often amplify, rather than reduce, risk for the users they are meant to serve, especially in emerging markets. We conclude with recommendations for developers, marketplaces, and researchers, and release our dataset and analysis artifacts to support future work on this underexplored threat landscape.

Developer-AI conversations, through coding assistants and chat-based programming aids, produce rich architectural decision traces (trigger, context, alternatives considered, decision, rationale) that are lost when the chat session ends. Conversation logs are unstructured, not indexed for retrieval, and disconnected from one another, so a team member joining weeks later cannot recover why a technology was chosen or what alternatives were considered. We present Continuum, an end-to-end system that captures and serves software decision knowledge from developer-AI conversation logs. The system integrates five engineered stages: (1) LLM-based decision extraction with chain-of-thought prompting, (2) a 7-stage cascading entity resolution pipeline combining cached lookups, a curated canonical dictionary (534 technology-name mappings), fuzzy matching, and embedding similarity, (3) a Neo4j knowledge graph with polyglot persistence across PostgreSQL and Redis, (4) a GraphRAG retrieval layer combining BM25 fulltext and NV-EmbedQA vector search via Reciprocal Rank Fusion with K-hop subgraph expansion, and (5) an agent integration layer via the Model Context Protocol (MCP) that enables coding agents to both query prior decisions and contribute new ones. The contribution is the end-to-end integration: prior work has explored individual pieces (decision extraction, knowledge graphs, GraphRAG), but not a deployable system that ties them together for developer-AI conversations. We report a preliminary evaluation on a synthetic corpus of 200 generated developer-AI conversations across 9 technical domains, using a held-out train/test methodology. On our synthetic dataset, the 7-stage entity resolver attains 97.2% accuracy on 981 test mentions (95% CI: [96.2%, 98.3%]), outperforming exact-match (74.6%) and fuzzy-only (76.7%) baselines under McNemar's test (p < 0.001), with B-cubed F1 = 0.979. Two of the authors independently judged 40 sampled decision traces, yielding extraction precision of 75.0% (all categories) and 97.3% when exploratory non-decisions are excluded; on the 10-item overlap, Cohen's kappa = 0.07 reflects genuine disagreement on what qualifies as a "decision" in open-ended AI chat. On 40 graph-derived queries, hybrid GraphRAG retrieval achieves full recall across decision-search, tech-comparison, and entity-lookup query types (MRR = 0.775); a manual relevance assessment by the two reviewers on 10 natural-language queries yielded a mean rating of 2.2/3.0. As a real-log case study, we apply the pipeline to the full Claude Code session history from the build of Vibe Voyager, a public agent-built browser game (github.com/shehral/vibe); from 77 segmented and scrubbed sub-conversations the system extracts 379 decision traces and 290 unique canonical entities, with the decisions splitting 65% agent-made vs. 35% human-made (Section 4.2). We are transparent about the limitations of this evaluation (synthetic corpus, small annotator pool, proxy ground truth for 150 conversations, graph-derived queries) and discuss them in Section 4.3. Overall, these results indicate that architectural decision knowledge can be recovered from developer-AI conversations with high entity-resolution accuracy and demonstrated feasibility on real logs, while robust measurement of extraction quality and generalization to multi-developer settings remain open.

Fuzz testing is highly effective at exposing individual faults, yet it systematically fails to reveal how faults interact within execution. A crash at one program point can mask, trigger, or alter the manifestation of others, leaving critical interactions undiscovered. We present CoFuzz, an interaction-aware fuzzing framework that shifts fuzzing from collecting isolated crashes to uncovering fault interaction structure. CoFuzz employs a probe-based mechanism that incrementally constructs a fault interaction map M during fuzzing: upon detecting a crash at site f_i, CoFuzz temporarily neutralizes f_i and re-fuzzes to expose previously masked faults, classifying relationships as masking, cascading, or synergistic. These interaction signals guide corpus prioritization and mutation, steering exploration toward fault combinations rather than coverage alone. We further introduce interaction coverage, a metric complementing code coverage, and outline a research agenda for scalable interaction-aware fuzzing that exposes the full fault topology of real software.

Modern automated software engineering (ASE) techniques for testing, localization, and repair often treat fault interactions as stable, input-driven semantic effects. This assumption is largely adequate in sequential settings, where execution order is fixed, but breaks down in concurrent programs where thread interleavings reshape observable behavior. We show that concurrent fault interaction is fundamentally schedule-dependent: identical inputs can induce different interaction classes under different schedules. To capture this effect, we introduce Concurrent Fault Interaction (CFI), which lifts classical interaction relations to the schedule space Σ via a schedule-indexed map M_σ. This perspective exposes interaction ambiguity, where causal relationships between faults, such as masking or synergy, vary across the scheduling manifold.

We show that this ambiguity gives rise to phantom fixes: patches that eliminate observed failures through schedule-dependent masking rather than genuine semantic correction, thereby rendering standard test-based repair oracles fundamentally unsound in concurrent settings. Finally, we introduce the Interaction Invariance Problem (IIP), conjecture its PSPACE-hardness via a reduction from NFA language inclusion, and outline its broader implications for schedule-aware and compositional program synthesis.

Public PRs and CVE advisories are valuable sources for Go concurrency-bug research, but rarely provide executable benchmark samples because historical projects are difficult to rebuild and many fixes lack reusable triggering tests. We present PR2Trigger, a semi-automated pipeline that reconstructs PR-localized triggering tests from fix-PR diffs. To address historical build difficulty, PR2Trigger extracts a self-contained package of PR-modified symbols and their in-project dependencies, and executes it in a pinned Docker environment. To address missing triggering tests, PR2Trigger uses a large language model to synthesize support code and a concurrency-driving test entry, while deterministic scripts handle execution, failure detection, and localization matching. On 100 Go race-fix candidate PRs, PR2Trigger improves the gate-passing rate from 2% to 15%, a 7.5× improvement over developer-supplied tests.

We propose a transformation‑oriented design viewpoint that treats LLM‑mediated data transformations as the primary runtime abstractions. The viewpoint captures actual intent through computational roles, distinguishes designed from emergent transformations, and introduces coupling motifs as recurrent architectural tactics. We show how this vocabulary enables systematic high‑level comparison across disparate designs. Beyond human design reasoning, we conjecture that the viewpoint provides the semantic infrastructure needed for AI‑assisted architectural synthesis.

Compiler fuzzing is critical for ensuring the reliability of modern optimizing compilers. However, traditional generators and raw Large Language Model (LLM) outputs often yield syntactically invalid or low-value programs, incurring significant computational overhead. In this paper, we present BanditFuzz, an end-to-end synergistic differential fuzzing framework integrating four core mechanisms: (1) a coverage-feedback-driven dynamic prompt scheduler that alternates strategies to generate diverse corpora; (2) a lightweight repair module (CompileFix) that heuristically recovers near-compilable raw LLM outputs; (3) a deterministic AST mutation engine (ASTMutate) that systematically expands high-quality seeds to compensate for inference latency; and (4) a sanitizer-enhanced differential testing oracle utilizing an unoptimized baseline (-O0) to precisely identify miscompilations while filtering Undefined Behavior (UB). Extensive evaluations on GCC and Clang demonstrate that BanditFuzz significantly improves backend coverage over state-of-the-art baselines under identical budgets, successfully identifying 28 realworld compiler bugs.