When Code Becomes an LLM Call: An Empirical Study of Call-Site Contracts in Agentic Systems
Software quality has long rested on specifications that state what code must do, and on testing and verification that ch
#cs.SE
共收录 457 条相关情报。
← 返回所有主题Effective Construction of Feature Database of Fingerprinting Functions for Code-Clone SCA
In contemporary software development, the extensive adoption of third-party libraries has become standard practice to av
Towards an Intelligent Decision Engine for Smart Contract Deployment
Layer 2 (L2) blockchain solutions emerged in recent years, predominantly in the Ethereum ecosystem, as a viable option f
Monitor-Validity Failures: LLM Safety Evidence Paths at Evolving Framework Boundaries
Modern LLM applications rely on runtime monitors that inspect tool calls, traces, streams, detector outputs, and verifie
VulnSAGE: Adjudicating SAST Reports by Connecting LLM Reasoning to Program Structure
Static Application Security Testing (SAST) reports flag operations whose safety depends on project-specific context, and
Evaluating and Improving Static Application Security Testing Tools for Rust
Rust has become a popular systems programming language in recent years because of its strong guarantees on memory and co
Combining LLM and Dynamic Analysis for Universal Testing of Static Application Security Testing Tools
Static application security testing (SAST) tools help detect potential software vulnerabilities, but they themselves con
P2Patch: Exploit-Guided Vulnerability Repair
Large language models are increasingly deployed as autonomous agents for automated program repair, patching software vul
Mission (Im)Possible: Towards Autonomous Discovery of Autopilot Logic Flaws in Open-Source Drone Frameworks
Autonomous drones are increasingly deployed in safety-critical tasks, yet their autopilot software can still contain sub
X.js: A Live Benchmark for Node.js Taint-Style Vulnerabilities
JavaScript vulnerabilities in npm packages pose a significant risk to the Node$.$js ecosystem, and a growing body of wor
VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green
Software composition analysis (SCA) tools report far more vulnerable dependencies than teams fix: in Snyk Open Source pr
CWE-bench: Refocusing Agentic Security from Exploitation to Defense
Cybersecurity evaluations of AI agents have focused largely on offense, yet a working exploit does not show that an agen
LLM-based Code Auditing by Inferring and Evaluating Developer Assumptions
When we see a null pointer check, we know that the developer believes that the pointer may not be initialized. If the sa
To Cache or Not to Cache: Understanding and Mitigating Safety Incompatibility in Cross-Model KV Cache Reuse
Cross-model KV cache sharing reduces prefill computation by allowing a receiver model to reuse prefix KV states generate
Security in LLM-Assisted Coding: A Systematic Literature Review
Large Language Models accelerate software development but introduce severe security vulnerabilities. This systematic rev
Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition
Agent skills extend the capabilities of AI agents by bundling instructions, code, and resources into reusable packages.
Understanding Verification Vulnerabilities in Cross-chain Bridges: An Empirical Study
With the rapid development of blockchain technology, numerous heterogeneous blockchains have emerged, each featuring dis
CAPE - Context-Aware Prioritization Engine for Vulnerability Scoring and Management
Vulnerability patching is critical for safeguarding an enterprise's software ecosystem from cyber attacks. However, patc
Vulnerable Models in the AI Supply Chain: An Empirical Study of Adoption, Propagation, and Usage Patterns
The rapid integration of Artificial Intelligence (AI) models has established a complex supply chain, but many of these s
Protecting CPU AI On Edge TEEs: WebAssembly's Promise and Practical Challenges
AI models on edge hardware contain important intellectual property (IP), but an adversary can steal it when they achieve