Enhancing Semantic Understanding in Pointer Analysis using Large Language Models

Baijun Cheng; Ding Li; Haoyu Wang; Kailong Wang; Ling Shi; Xiangqun Chen; Yao Guo

REVIEW 5 major objections 5 minor 37 references

Enhancing Semantic Understanding in Pointer Analysis using Large Language Models

T0 review · 5 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes LMPA, an LLM-enhanced pointer analysis framework that turns user-defined API-like functions, field-sensitive parameter initialization, and natural-language summaries into fewer incorrect pointer facts and better scalabili

desk verdict A clear, honest workshop vision for LLM-assisted pointer analysis; the unsupported NL summary decode step is the load-bearing risk, and there is no evaluation to back the precision/scalability claims. read the letter →

arxiv 2508.21454 v1 pith:QCO73SHS submitted 2025-08-29 cs.SE

Baijun Cheng , Kailong Wang , Ling Shi , Haoyu Wang , Yao Guo , Ding Li , Xiangqun Chen This is my paper

classification cs.SE

keywords pointeranalysisLLMsemanticunderstandingsummary-basednaturallanguagesummariesfieldsensitivityprogramcode

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes LMPA, a vision for adding LLM semantic understanding to traditional pointer analysis. It argues that three persistent sources of imprecision—user-defined functions that mimic system APIs, ignored fields of struct/array parameters, and summaries that cannot handle path- or flow-sensitive behavior—can be addressed by LLM-driven modeling. If LMPA works as described, existing analyses would propagate fewer wrong facts and scale better. The paper is a position proposal: it identifies the mechanisms and the challenges, without yet reporting an implementation or evaluation.

What carries the argument

The load-bearing mechanism is the natural-language summary encode/decode loop. A function's side effects are encoded into a concise natural-language description, optionally augmented with a condition, and later decoded by the LLM into concrete pointer operations at the caller. Two supporting mechanisms carry the rest of the argument: behavior analysis classifies user-defined functions as system-API lookalikes, and parameter-specification inference builds field-sensitive initial points-to sets for struct/array parameters before local analysis runs.

What would settle it

Take a set of C functions with hand-verified points-to relations, run the proposed encode/decode loop, and compare the decoded pointer facts against a sound baseline; if even one decoded summary omits or alters a real points-to relation, the proposal's central soundness claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that LLMs can supply the semantic layer missing from four decades of pointer analysis. LMPA treats a user-defined function that behaves like a standard system API as an equivalent API list, so callers do not propagate pointer facts through its body. For parameters that point to structs or arrays, it uses an LLM to infer which fields actually point to objects and initializes only those points-to sets. For functions with genuine side effects, it replaces instruction-level summaries with natural-language summaries, annotated with conditional clauses, that are decoded at call sites into low-level pointer operations such as p = &o and pool->large = o. The precision gain comes

Load-bearing premise

Everything hinges on the LLM's decode step: if a natural-language summary cannot be translated into the correct low-level pointer operations, the analysis will silently miss pointer facts and the promised precision becomes unsound.

Editorial extensions

If this is right

If a user-defined function is recognized as a system-API lookalike, pointer facts no longer flow through its body across calling contexts, removing a known source of wrong aliases.
With field-sensitive initial points-to sets, analyses no longer assume every struct or array field starts as NULL, preserving aliasing and field-relation information.
Natural-language summaries with conditional clauses let callers apply path- and flow-sensitive effects without running a full path- or flow-sensitive analysis.
Fewer incorrect facts would reduce false positives and false negatives in downstream value-flow, alias, and vulnerability-detection tools.
More precise summaries reduce the need for extensive cloning and inlining, improving scalability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The encode/decode step, if made reliable, would likely transfer to other summary-based interprocedural analyses such as taint analysis, value-flow analysis, and resource-leak detection, not just pointer analysis.
Hallucination is the central risk; a conservative bounding rule that never drops a pointer fact a classical analysis would keep would convert the precision gain into at worst no-loss behavior.
A natural testbed is functions like ngx_palloc_large that manipulate linked-list structures, where code-transformation-based summaries fail; the false-negative rate of decoded summaries there would be the decisive measurement.
API-lookalike classification could also guide demand-driven analysis by deciding which functions to expand intra-procedurally and which to summarize.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague, two things to know about arXiv:2508.21454. It is a 6-page workshop position paper, not a measured result. And its load-bearing assumption is in §3.4: an LLM decodes natural-language summaries of function side effects back into low-level pointer operations. If that decode ever drops a real points-to fact, the analysis becomes unsound—missing facts, not just imprecise ones. The paper concedes exactly this in §4 with the malloc/free false-negative example. The stress-test note is correct that bounding by an Andersen superset only reins in over-approximation; it cannot re-add a fact the LLM never generated.

Now credit where due. The package—identifying user-defined functions that behave like system APIs, inferring field-sensitive initial points-to sets, and using NL summaries to capture path-sensitivity—is a sensible combination not, as far as I know, assembled elsewhere. The three motivating examples (copy_argv, ngx_set_user, ngx_palloc) clearly illustrate real limitations in current pointer analyses. The paper is well organized, the related work is on point, and Section 4 is unusually candid about hallucinations and unsoundness. For a position paper, this is solid.

Soft spots are real and proportional. No implementation, no pilot study, no formal argument. The biggest hole is the encode/decode channel: the paper says a new intermediate representation is needed (§3.4, Challenge 1) but does not define it, so there is no well-specified object whose correctness could be checked. In §3.1, the claim that side effects of API-lookalike functions can be 'safely ignored' is asserted without support; some such functions do mutate caller-relevant state. The suggested mitigations (self-validation, heuristic checks, bounding by traditional supersets) are reasonable directions, but the paper itself says they are not foolproof. That is an acceptable admission in a workshop paper; it would be a blocking gap in a full research contribution. The citations look honest; the only self-reference is to the authors' earlier indirect-call work, used as background.

Who is this for? Researchers interested in LLM-plus-static-analysis directions, especially those working on pointer analysis. It is not a results paper. But it deserves a serious referee in a workshop setting—not a desk reject—because it is coherent, cites the relevant work, and frames testable hypotheses. My recommendation: engage with it as a roadmap, and if you have students, suggest they try the encode/decode step on a small C corpus. That is the part that will make or break the whole idea.

Referee Report

5 major / 5 minor

Summary. The paper proposes LMPA, a vision framework that integrates LLMs into pointer analysis to improve precision and scalability. It identifies three limitations in existing analyses: (L1) user-defined functions that mimic system APIs are not abstracted, causing imprecise cross-calling-context propagation; (L2) summary-based analyses ignore internal field-level points-to relations of structured parameters; and (L3) existing summary strategies are either costly or ineffective for irregular side effects. The proposed solution consists of LLM-based behavior analysis and API-list generation, LLM-inferred parameter initial points-to sets, and an encode/decode summary strategy in which natural-language summaries are generated from and decoded into low-level pointer operations. The paper discusses challenges including hallucination, output nondeterminism, and the need for a new intermediate representation. It contains no implementation, no formal correctness argument, and no experimental evaluation; the text is consistently framed as a vision and research roadmap.

Significance. The proposal targets a genuine and important gap: traditional pointer analysis is semantically blind to user-defined functions that behave like library APIs, and summary-based approaches remain expensive or imprecise for complex data structures and side effects. If LMPA could be realized with sound decoding, it would offer a new way to inject semantic information into a foundational analysis, with downstream benefits for bug detection and value-flow analysis. The paper also deserves credit for being explicit about the major pitfalls, especially hallucination-induced unsoundness in Section 4. However, as a journal submission the central claim is prospective: there is no machine-checked proof, no prototype, no benchmark, and no falsifiable measurement. The value at this stage is the research agenda, not a validated result, and the acknowledged unsoundness of the natural-language channel must be resolved before the claimed enhancement can be credited.

major comments (5)

[§3.4 and §4] The central claim that LMPA enhances pointer-analysis precision depends on the semantic fidelity of decoding natural-language summaries into low-level pointer operations (e.g., p = &o; pool->large = o). Section 4 explicitly concedes that hallucinations can omit critical facts, causing false negatives, and that the proposed mitigation strategies are 'not foolproof.' Bounding the output by a traditional Andersen superset does not repair missing facts; it only constrains over-approximation. Since pointer analysis feeds downstream bug detectors, this is not a precision/scalability trade-off but a soundness loss. The paper must either prove a preservation invariant for the decode step (e.g., decoded points-to facts are a superset of the true facts) or explicitly reposition LMPA as an unsound heuristic and evaluate the resulting false-negative rate.
[§3.4, Challenge 1] The manuscript states that realizing LMPA 'may require defining a novel intermediate representation' but leaves that IR unspecified. Without a formal definition of the IR and of the encode/decode functions, there is no well-defined object whose correctness can be stated, tested, or verified. Please specify the IR, the mapping from natural-language summaries to IR operations, and the conditions under which decoding preserves all points-to facts (or at least a conservative over-approximation). This is a load-bearing omission, because the paper's precision claim cannot be evaluated until this translation step has precise semantics.
[§3.1] The claim that side effects of user-defined functions that mimic system APIs 'typically do not intersect with the points-to sets relevant to most pointer analysis tasks and can therefore be safely ignored' is unsupported. Global or non-local state can be aliased through function parameters, return values, or externally visible data structures; for example, a global memory-pool pointer could be relevant to the caller's points-to state. Ignoring such side effects can change the analysis result. The paper should either characterize the 'relevant points-to sets' formally or provide a concrete invariant under which the abstraction is safe; otherwise the API abstraction is unsound.
[§3.3] The parameter-specification step selectively initializes only fields whose points-to sets are 'likely to be non-empty.' If the LLM classifies a non-NULL field as NULL, the resulting initial points-to set is a strict subset of the true set, producing false negatives. The paper does not discuss this failure mode or provide a conservative fallback (e.g., initializing all fields as a safety net, or bounding with Andersen). This is the same unsoundness pattern as the summary-decode problem and must be addressed before the precision claim can be sustained.
[Abstract and §5] The manuscript provides no implementation, no benchmarks, and no measurements supporting the claimed precision and scalability improvements. For a journal-level claim, a prototype evaluated on standard C pointer-analysis benchmarks (e.g., SVF test suites or real-world programs) with precision, scalability, and false-negative/unsoundness metrics is necessary. As written, the abstract's assertion that LMPA 'enhances both precision and scalability' is a prediction, not a demonstrated result.

minor comments (5)

[Figure 2] Typo: 'RetriveA Function' should be 'Retrieve a Function.' The diagram also does not clearly label the direction of the raw summary, normal analysis, and decoded summary flow; adding arrows or captions would improve readability.
[§3.4] The text says the summary of ngx_palloc is augmented with the condition 'size > pool->size', but Figure 1, Example 3 shows the branch condition 'size <= pool->max'. The variable/field names should be made consistent (pool->max versus pool->size).
[Figure 1] Minor formatting: 'parameters ofngx_set_user' is missing a space between 'of' and 'ngx_set_user'.
[§2.2, Example 2] The example text says 'the points-to sets of fields such as value and ccf->user are imprecisely treated as NULL,' but the code fragment shows a chain cf->args->elts. A short explanation of how the field chain is derived would help readers follow the example.
[§2.1] The description of LLM-assisted static analysis is broad; it would be useful to state explicitly how LMPA differs from the authors' earlier semantic-enhanced indirect call analysis in [5], since that prior work also uses LLMs for semantic understanding in program analysis.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LMPA is a vision/proposal paper with no fitted inputs or derived predictions; the sole self-citation appears only in background.

full rationale

The paper is a position paper describing a proposed framework, LMPA, rather than presenting a derivation, experiment, or fitted model. Its central claims—identifying user-defined functions that resemble system APIs (§3.1), inferring parameter specifications (§3.3), and using natural-language summaries (§3.4)—are architectural proposals, not results computed from the framework's own outputs. There is no equation in which an output quantity is defined in terms of the same quantity, no fitted parameter relabeled as a prediction, and no uniqueness theorem invoked from the authors' prior work to force a conclusion. The only self-citation is reference [5] in the related-work survey ('such as call graph construction [5]'), which is background context and is not load-bearing for the paper's proposed contributions. Section 4's admission that LLM hallucinations may omit critical points-to facts and cause unsoundness is a feasibility/correctness concern, not circularity: it does not make the proposal's claims reduce to their inputs by construction. Because the paper is self-contained as a vision statement and makes no empirical or formal derivation whose input and output could coincide, the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new entities such as particles, forces, or dimensions; it proposes a software framework, which is not an invented entity in the ledger sense. The load-bearing assumptions are all domain assumptions about LLM reliability and the existence of a sound encode/decode mapping.

assumptions (4)

domain assumption LLMs can reliably determine whether a user-defined function semantically resembles a system API.
Invoked in Section 3.1 Behavior Analysis; the paper proposes using LLMs for this classification but provides no accuracy data, so the classification is an input assumption of the vision.
domain assumption Natural-language summaries can be decoded into sound pointer operations via an intermediate representation.
Invoked in Section 3.4 Encode and Decode Summary; the paper calls for a new IR but does not define one, so the existence of a reliable bidirectional mapping is assumed.
domain assumption Side effects of API-like functions can be safely ignored when confined to global state.
Invoked in Section 3.1 Challenge 2; the paper argues side effects are safely ignorable but provides no formal soundness argument.
domain assumption LLM-generated summaries can be conservatively bounded by traditional analyses to prevent unsoundness.
Invoked in Section 4; the paper suggests bounding outputs by Andersen supersets but notes it is not foolproof, so the bound is a stated mitigation rather than a proven guarantee.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Enhancing Semantic Understanding in Pointer Analysis using Large Language Models." pith.science (2026). https://pith.science/paper/QCO73SHS

@misc{pith2026250821454,
  author       = {Pith},
  title        = {Pith review of: Enhancing Semantic Understanding in Pointer Analysis using Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QCO73SHS}},
  note         = {Machine review of arXiv:2508.21454}
}

read the original abstract

Pointer analysis has been studied for over four decades. However, existing frameworks continue to suffer from the propagation of incorrect facts. A major limitation stems from their insufficient semantic understanding of code, resulting in overly conservative treatment of user-defined functions. Recent advances in large language models (LLMs) present new opportunities to bridge this gap. In this paper, we propose LMPA (LLM-enhanced Pointer Analysis), a vision that integrates LLMs into pointer analysis to enhance both precision and scalability. LMPA identifies user-defined functions that resemble system APIs and models them accordingly, thereby mitigating erroneous cross-calling-context propagation. Furthermore, it enhances summary-based analysis by inferring initial points-to sets and introducing a novel summary strategy augmented with natural language. Finally, we discuss the key challenges involved in realizing this vision.

Figures

Figures reproduced from arXiv: 2508.21454 by the authors.

**Figure 1.** , where: 1. In Example 1, the user-defined function copy_args behaves similarly to a combination of system API malloc and memcpy. Existing analysis frameworks treat their callers conservatively, causing the return value newargv to imprecisely point to the argument argv of all callers. As a result, each caller may incorrectly receive argv values from others. 2. In Example 2, both parameters of ngx_set_user are stru… view at source ↗

**Figure 2.** Overview of LMPA. call statements, after retrieving the callee’s natural languagebased summary, LMPA first invokes the LLM to decode it into a format suitable for pointer analysis. As the summary may already encode partial path- and flow-sensitive information, standard path- and flow-sensitive rules are not required. After completing the analysis of the current function, LMPA generates a raw summary, which is then… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 33 canonical work pages

[1]

Lars Ole Andersen. 1994. Program analysis and specialization for the C programming language. (1994)

work page 1994
[2]

Domagoj Babic and Alan J. Hu. 2008. Calysto: scalable and precise extended static checking. In Proceedings of the 30th International Con- ference on Software Engineering (Leipzig, Germany) (ICSE ’08) . As- sociation for Computing Machinery, New York, NY, USA, 211–220. doi:10.1145/1368088.1368118

work page arXiv 2008
[3]

Mohamad Barbar, Yulei Sui, and Shiping Chen. 2021. Object versioning for flow-sensitive pointer analysis. In 2021 IEEE/ACM International Symposium on Code Generation and Optimization (CGO) . IEEE, 222– 235

work page 2021
[4]

Rastisalv Bodík and Sadun Anik. 1998. Path-sensitive value-flow anal- ysis. In Proceedings of the 25th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (San Diego, California, USA) (POPL ’98). Association for Computing Machinery, New York, NY, USA, 237–251. doi: 10.1145/268946.268966

work page arXiv 1998
[5]

Baijun Cheng, Cen Zhang, Kailong Wang, Ling Shi, Yang Liu, Haoyu Wang, Yao Guo, Ding Li, and Xiangqun Chen. 2024. Semantic-enhanced indirect call analysis with large language models. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering. 430–442. LMPL ’25, October 12–18, 2025, Singapore, Singapore Baijun Cheng, Kai...

work page 2024
[6]

Manuvir Das, Ben Liblit, Manuel Fähndrich, and Jakob Rehof. 2001. Estimating the impact of scalable pointer analysis on optimization. In International Static Analysis Symposium. Springer, 260–278

work page 2001
[7]

Xueying Du, Geng Zheng, Kaixin Wang, Jiayi Feng, Wentai Deng, Mingwei Liu, Bihuan Chen, Xin Peng, Tao Ma, and Yiling Lou. 2024. Vul-rag: Enhancing llm-based vulnerability detection via knowledge- level rag. arXiv preprint arXiv:2406.11147 (2024)

arXiv 2024
[8]

Github. 2024. CodeQL. https://codeql.github.com/

work page 2024

Show all 37 references

[9]

Jinyao Guo, Chengpeng Wang, Xiangzhe Xu, Zian Su, and Xiangyu Zhang. 2025. RepoAudit: An Autonomous LLM-Agent for Repository- Level Code Auditing. InProceedings of the 42nd International Conference on Machine Learning

2025
[10]

Nevin Heintze and Olivier Tardieu. 2001. Demand-driven pointer analysis. ACM SIGPLAN Notices 36, 5 (2001), 24–34

2001
[11]

Minseok Jeon, Myungho Lee, and Hakjoo Oh. 2020. Learning graph- based heuristics for pointer analysis without handcrafting application- specific features. Proceedings of the ACM on Programming Languages 4, OOPSLA (2020), 1–30

2020
[12]

Yuchen Ji, Ting Dai, Zhichao Zhou, Yutian Tang, and Jingzhu He. 2025. Artemis: Toward Accurate Detection of Server-Side Request Forgeries through LLM-Assisted Inter-Procedural Path-Sensitive Taint Analysis. Proceedings of the ACM on Programming Languages 9, OOPSLA1 (2025), 1349–1377

2025
[13]

Yuxiang Lei and Yulei Sui. 2019. Fast and precise handling of positive weight cycles for field-sensitive pointer analysis. In Static Analysis: 26th International Symposium, SAS 2019, Porto, Portugal, October 8–11, 2019, Proceedings 26. Springer, 27–47

2019
[14]

Haonan Li, Yu Hao, Yizhuo Zhai, and Zhiyun Qian. 2024. Enhancing static analysis for practical bug detection: An llm-integrated approach. Proceedings of the ACM on Programming Languages 8, OOPSLA1 (2024), 474–499

2024
[15]

Yue Li, Tian Tan, Anders Møller, and Yannis Smaragdakis. 2018. Precision-guided context sensitivity for pointer analysis. Proceedings of the ACM on Programming Languages 2, OOPSLA (2018), 1–29

2018
[16]

Yue Li, Tian Tan, Anders Møller, and Yannis Smaragdakis. 2018. Scalability-first pointer analysis with self-tuning context-sensitivity. In Proceedings of the 2018 26th ACM joint meeting on european software engineering conference and symposium on the foundations of software en...

2018
[17]

Ziyang Li, Saikat Dutta, and Mayur Naik. 2025. IRIS: LLM-assisted static analysis for detecting security vulnerabilities. In The Thirteenth International Conference on Learning Representations

2025
[18]

Peiming Liu, Yanze Li, Brad Swain, and Jeff Huang. 2022. PUS: A fast and highly efficient solver for inclusion-based pointer analysis. In Proceedings of the 44th International Conference on Software Engineering. 1781–1792

2022
[19]

Puzhuo Liu, Chengnian Sun, Yaowen Zheng, Xuan Feng, Chuan Qin, Yuncheng Wang, Zhenyang Xu, Zhi Li, Peng Di, Yu Jiang, and Limin Sun. 2025. LLM-Powered Static Binary Taint Analysis. ACM Trans. Softw. Eng. Methodol. 34, 3, Article 83 (Feb. 2025), 36 pages. doi: 10. 1145/3711816

2025
[20]

Fernando Magno Quintao Pereira and Daniel Berlin. 2009. Wave propa- gation and deep propagation for pointer analysis. In 2009 International Symposium on Code Generation and Optimization . IEEE, 126–135

2009
[21]

Qingkai Shi, Xiao Xiao, Rongxin Wu, Jinguo Zhou, Gang Fan, and Charles Zhang. 2018. Pinpoint: Fast and precise sparse value flow anal- ysis for million lines of code. In Proceedings of the 39th ACM SIGPLAN Conference on Programming Language Design and Implementation. 693– 706

2018
[22]

Johannes Späth, Lisa Nguyen Quang Do, Karim Ali, and Eric Bodden
[23]

Yulei Sui and Jingling Xue. 2016. On-demand strong update analysis via value-flow refinement. InProceedings of the 2016 24th ACM SIGSOFT international symposium on foundations of software engineering . 460– 473

2016
[24]

Yulei Sui and Jingling Xue. 2016. SVF: interprocedural static value-flow analysis in LLVM. In Proceedings of the 25th International Conference on Compiler Construction (Barcelona, Spain) (CC ’16). Association for Computing Machinery, New York, NY, USA, 265–266. doi: 10.1145/ 2...

2016
[25]

Yulei Sui and Jingling Xue. 2018. Value-flow-based demand-driven pointer analysis for C and C++. IEEE Transactions on Software Engi- neering 46, 8 (2018), 812–835

2018
[26]

Weisong Sun, Yun Miao, Yuekang Li, Hongyu Zhang, Chunrong Fang, Yi Liu, Gelei Deng, Yang Liu, and Zhenyu Chen. 2024. Source code summarization in the era of large language models. arXiv preprint arXiv:2407.07959 (2024)

2024 arXiv
[27]

Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Haijun Wang, Zhengzi Xu, Xiaofei Xie, and Yang Liu. 2024. Gptscan: Detecting logic vulnera- bilities in smart contracts by combining gpt with program analysis. In Proceedings of the IEEE/ACM 46th International Conference on Software E...

2024
[28]

Chong Wang, Jianan Liu, Xin Peng, Yang Liu, and Yiling Lou. 2025. Boosting static resource leak detection via llm-based resource-oriented intention inference. In 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE) . IEEE Computer Society, 668–668

2025
[29]

Jianxun Wang and Yixiang Chen. 2023. A review on code genera- tion with llms: Application and evaluation. In 2023 IEEE International Conference on Medical Artificial Intelligence (MedAI) . IEEE, 284–289

2023
[30]

Yichen Xie and Alex Aiken. 2005. Scalable error detection using boolean satisfiability. InProceedings of the 32nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Long Beach, Cal- ifornia, USA) (POPL ’05). Association for Computing Machinery, New York, NY, ...

2005
[31]

Chenyuan Yang, Zijie Zhao, Zichen Xie, Haoyu Li, and Lingming Zhang. 2025. Knighter: Transforming static analysis with llm- synthesized checkers. arXiv preprint arXiv:2503.09002 (2025)

2025 arXiv
[32]

Peisen Yao, Jinguo Zhou, Xiao Xiao, Qingkai Shi, Rongxin Wu, and Charles Zhang. 2024. Falcon: A Fused Approach to Path-Sensitive Sparse Data Dependence Analysis. Proceedings of the ACM on Pro- gramming Languages 8, PLDI (2024), 567–592

2024
[33]

Zhiqiang Yuan, Weitong Chen, Hanlin Wang, Kai Yu, Xin Peng, and Yiling Lou. 2024. Transagent: An llm-based multi-agent system for code translation. arXiv preprint arXiv:2409.19894 (2024)

2024 arXiv
[34]

Yizhuo Zhai, Yu Hao, Hang Zhang, Daimeng Wang, Chengyu Song, Zhiyun Qian, Mohsen Lesani, Srikanth V Krishnamurthy, and Paul Yu. 2020. UBITect: a precise and scalable method to detect use-before- initialization bugs in Linux kernel. InProceedings of the 28th ACM Joint Meeting o...

2020
[35]

Jiaxu Zhao, Yuekang Li, Yanyan Zou, Zhaohui Liang, Yang Xiao, Yet- ing Li, Bingwei Peng, Nanyu Zhong, Xinyi Wang, Wei Wang, et al
[2016]

In 30th European Conference on Object-Oriented Pro- gramming (ECOOP 2016)

Boomerang: Demand-driven flow-and context-sensitive pointer analysis for java. In 30th European Conference on Object-Oriented Pro- gramming (ECOOP 2016). Schloss Dagstuhl–Leibniz-Zentrum fuer In- formatik, 22–1

2016
[2024]

In 33rd USENIX Security Symposium (USENIX Security 24)

Leveraging semantic relations in code and data to enhance taint analysis of embedded systems. In 33rd USENIX Security Symposium (USENIX Security 24). 7067–7084. accepted 2025-08-08

2025

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Lars Ole Andersen. 1994. Program analysis and specialization for the C programming language. (1994)

work page 1994

[2] [2]

Domagoj Babic and Alan J. Hu. 2008. Calysto: scalable and precise extended static checking. In Proceedings of the 30th International Con- ference on Software Engineering (Leipzig, Germany) (ICSE ’08) . As- sociation for Computing Machinery, New York, NY, USA, 211–220. doi:10.1145/1368088.1368118

work page arXiv 2008

[3] [3]

Mohamad Barbar, Yulei Sui, and Shiping Chen. 2021. Object versioning for flow-sensitive pointer analysis. In 2021 IEEE/ACM International Symposium on Code Generation and Optimization (CGO) . IEEE, 222– 235

work page 2021

[4] [4]

Rastisalv Bodík and Sadun Anik. 1998. Path-sensitive value-flow anal- ysis. In Proceedings of the 25th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (San Diego, California, USA) (POPL ’98). Association for Computing Machinery, New York, NY, USA, 237–251. doi: 10.1145/268946.268966

work page arXiv 1998

[5] [5]

Baijun Cheng, Cen Zhang, Kailong Wang, Ling Shi, Yang Liu, Haoyu Wang, Yao Guo, Ding Li, and Xiangqun Chen. 2024. Semantic-enhanced indirect call analysis with large language models. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering. 430–442. LMPL ’25, October 12–18, 2025, Singapore, Singapore Baijun Cheng, Kai...

work page 2024

[6] [6]

Manuvir Das, Ben Liblit, Manuel Fähndrich, and Jakob Rehof. 2001. Estimating the impact of scalable pointer analysis on optimization. In International Static Analysis Symposium. Springer, 260–278

work page 2001

[7] [7]

Xueying Du, Geng Zheng, Kaixin Wang, Jiayi Feng, Wentai Deng, Mingwei Liu, Bihuan Chen, Xin Peng, Tao Ma, and Yiling Lou. 2024. Vul-rag: Enhancing llm-based vulnerability detection via knowledge- level rag. arXiv preprint arXiv:2406.11147 (2024)

arXiv 2024

[8] [8]

Github. 2024. CodeQL. https://codeql.github.com/

work page 2024