{"id":"https://openalex.org/W7223939282","doi":"https://doi.org/10.48550/arxiv.2610.34928","title":"Beyond Compilation Feedback: Refining Vulnerability Checkers with Program-Analysis Evidence","display_name":"Beyond Compilation Feedback: Refining Vulnerability Checkers with Program-Analysis Evidence","publication_year":2026,"publication_date":"2026-10-26","ids":{"openalex":"https://openalex.org/W7223939282","doi":"https://doi.org/10.48550/arxiv.2610.34928"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2610.34928","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.34928","pdf_url":"https://arxiv.org/pdf/2610.34928","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2610.34928","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5159957892","display_name":"Chengzhi Yi","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yi, Chengzhi","raw_affiliation_strings":["Huazhong University of Science and Technology , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology , China","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159759203","display_name":"Shenao Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Shenao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159968691","display_name":"Yanjie Zhao","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhao, Yanjie","raw_affiliation_strings":["Huazhong University of Science and Technology , China ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology , China ,","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159982697","display_name":"Xiao Cheng","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I99043593","display_name":"Macquarie University","ror":"https://ror.org/01sf06y89","country_code":"AU","type":"education","lineage":["https://openalex.org/I99043593"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Cheng, Xiao","raw_affiliation_strings":["Macquarie University , Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Macquarie University , Australia","institution_ids":["https://openalex.org/I99043593"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5159832111","display_name":"Haoyu Wang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wang, Haoyu","raw_affiliation_strings":["Huazhong University of Science and Technology , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology , China","institution_ids":["https://openalex.org/I47720641"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.4097000062465668,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.4097000062465668,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.4004000127315521,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.14810000360012054,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/static-analysis-warnings","display_name":"static analysis warnings","score":0.38100001215934753},{"id":"https://openalex.org/keywords/false-positive-reduction","display_name":"false positive reduction","score":0.5519999861717224}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8755999803543091},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.6344000101089478},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5830000042915344},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.5236999988555908},{"id":"https://openalex.org/C158007255","wikidata":"https://www.wikidata.org/wiki/Q1055222","display_name":"Spectrum analyzer","level":2,"score":0.4607999920845032},{"id":"https://openalex.org/C111498074","wikidata":"https://www.wikidata.org/wiki/Q173326","display_name":"Formal verification","level":2,"score":0.3977999985218048},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3767000138759613},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.37209999561309814},{"id":"https://openalex.org/C204495577","wikidata":"https://www.wikidata.org/wiki/Q1205349","display_name":"Callback","level":2,"score":0.3407000005245209},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.3395000100135803},{"id":"https://openalex.org/C2779982483","wikidata":"https://www.wikidata.org/wiki/Q6094420","display_name":"Iterative refinement","level":2,"score":0.3257000148296356},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3190999925136566},{"id":"https://openalex.org/C119907115","wikidata":"https://www.wikidata.org/wiki/Q6815725","display_name":"Memory errors","level":3,"score":0.31040000915527344},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.30559998750686646},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.2973000109195709},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.29260000586509705},{"id":"https://openalex.org/C121329065","wikidata":"https://www.wikidata.org/wiki/Q185612","display_name":"Regular expression","level":2,"score":0.29170000553131104},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.29109999537467957},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.2840000092983246},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2818000018596649},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.27880001068115234},{"id":"https://openalex.org/C193702766","wikidata":"https://www.wikidata.org/wiki/Q1414548","display_name":"Concurrency","level":2,"score":0.2777000069618225},{"id":"https://openalex.org/C75606506","wikidata":"https://www.wikidata.org/wiki/Q1049183","display_name":"Formal methods","level":2,"score":0.2736999988555908},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.2734000086784363},{"id":"https://openalex.org/C2780654840","wikidata":"https://www.wikidata.org/wiki/Q333341","display_name":"Abstract interpretation","level":2,"score":0.2734000086784363},{"id":"https://openalex.org/C39920170","wikidata":"https://www.wikidata.org/wiki/Q693083","display_name":"Soundness","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C188434589","wikidata":"https://www.wikidata.org/wiki/Q1478762","display_name":"Logic analyzer","level":3,"score":0.2705000042915344},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.26440000534057617},{"id":"https://openalex.org/C37926939","wikidata":"https://www.wikidata.org/wiki/Q7449061","display_name":"Semantic equivalence","level":4,"score":0.25119999051094055},{"id":"https://openalex.org/C53833338","wikidata":"https://www.wikidata.org/wiki/Q1061424","display_name":"Context switch","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2610.34928","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.34928","pdf_url":"https://arxiv.org/pdf/2610.34928","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2610.34928","doi":"https://doi.org/10.48550/arxiv.2610.34928","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2610.34928","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2610.34928","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.34928","pdf_url":"https://arxiv.org/pdf/2610.34928","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7223939282.pdf","grobid_xml":"https://content.openalex.org/works/W7223939282.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7223288870","https://openalex.org/W7168267510","https://openalex.org/W7164905750","https://openalex.org/W7213306442","https://openalex.org/W7202039998","https://openalex.org/W7133356982","https://openalex.org/W7212135959","https://openalex.org/W4393191843","https://openalex.org/W7134960475","https://openalex.org/W4415088968"],"abstract_inverted_index":{"Recent":[0],"work":[1],"shows":[2],"that":[3,74,114,152,211],"LLMs":[4],"can":[5],"synthesize":[6],"static-analysis":[7],"checkers":[8,35,169],"from":[9,170,192],"security":[10],"patches,":[11],"but":[12,102],"a":[13,19,110,129,149,227,230,251,258],"compilable":[14],"checker":[15,67,95,139,208,253],"is":[16,31,109],"not":[17,27],"necessarily":[18],"correct":[20],"one.":[21],"A":[22,238],"patch":[23],"reveals":[24],"what":[25,65],"changed,":[26],"why":[28],"the":[29,39,44,66,70,75,81,100,138,142,212],"change":[30,249],"safe,":[32],"so":[33],"generated":[34],"often":[36],"match":[37],"only":[38],"surface":[40],"edit":[41],"and":[42,55,94,119,125,144,188,205,234],"miss":[43],"deeper":[45],"semantic":[46],"condition.":[47],"Existing":[48],"refinement":[49,106,112,177],"loops":[50],"feed":[51],"back":[52],"compilation":[53],"errors":[54],"validation":[56,126],"reports,":[57],"yet":[58],"these":[59],"signals":[60],"describe":[61],"symptoms":[62],"without":[63],"explaining":[64],"misunderstands":[68],"about":[69],"code.":[71],"We":[72,162],"observe":[73],"analysis":[76],"framework":[77],"itself":[78],"already":[79],"computes":[80],"information":[82],"needed":[83],"to":[84,194,250],"close":[85],"this":[86],"gap.":[87],"Control-flow":[88],"graphs,":[89],"symbolic":[90],"values,":[91],"memory":[92],"regions":[93],"callbacks":[96],"are":[97],"available":[98],"inside":[99],"analyzer":[101,117,175],"unused":[103],"by":[104,148],"current":[105],"strategies.":[107],"SemWeaver":[108,164],"plug-in":[111],"layer":[113],"extracts":[115],"patch-relevant":[116],"evidence":[118,200,214],"assembles":[120],"it":[121],"with":[122],"source":[123],"context":[124],"feedback":[127],"into":[128],"structured,":[130],"provenance-labelled":[131],"bundle.":[132],"An":[133,196],"iterative":[134],"editing":[135],"loop":[136],"refines":[137],"on":[140,165,226,241],"both":[141],"vulnerable":[143,181],"fixed":[145],"revisions,":[146],"guarded":[147],"retention":[150],"gate":[151],"accepts":[153],"warning":[154],"recovery":[155],"or":[156,261],"false-positive":[157],"reduction":[158],"while":[159],"preventing":[160],"over-pruning.":[161],"evaluate":[163],"39":[166],"KNighter-derived":[167],"CSA":[168],"Linux":[171],"kernel":[172],"fixes.":[173],"With":[174],"evidence,":[176],"reaches":[178],"23":[179],"warning-positive":[180],"revisions":[182],"(vs.":[183],"15":[184],"for":[185],"KNighter's":[186],"loop)":[187],"raises":[189],"version-level":[190],"$F_1$":[191],"0.448":[193],"0.575.":[195],"ablation":[197],"removing":[198],"internal":[199],"recovers":[201],"fewer":[202],"silent":[203],"cases":[204],"produces":[206],"different":[207],"edits,":[209],"indicating":[210],"two":[213],"configurations":[215],"address":[216],"complementary":[217],"recognition":[218],"gaps.":[219],"Additional":[220],"experiments":[221],"cover":[222],"three":[223],"editor":[224],"models":[225],"12-subject":[228],"subset,":[229],"CodeQL":[231],"query":[232],"refinement,":[233],"controlled":[235],"source-form":[236],"variations.":[237],"qualitative":[239],"follow-up":[240],"all":[242],"11":[243],"non-tied":[244],"comparisons":[245],"traces":[246],"each":[247],"warning-count":[248],"specific":[252],"repair,":[254],"such":[255],"as":[256],"recognizing":[257],"lowered":[259],"callback":[260],"unwrapping":[262],"an":[263],"expression":[264],"cast.":[265]},"counts_by_year":[],"updated_date":"2026-10-31T12:09:11.096373","created_date":"2026-10-28T00:00:00"}