Using LLMs to Adjudicate Static-Analysis Alerts with Error Reduction Techniques

2024-08-06 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Software Development & Engineering, Cybersecurity & Data Privacy · Depth: Advanced, extended

Summary

LASAA, an open-source, analyzer-agnostic pipeline, uses large language models (LLMs) to adjudicate static-analysis alerts, classifying them as real bugs or false alarms. It incorporates two mistake-mitigation methods: a Consistency Check (CC) that runs the LLM multiple times for consistent verdicts, and an LLM Reasoning Evaluation (LRE) that asks the LLM to choose a verdict after evaluating its own discordant reasoning. Evaluated on Juliet, FormAI, and SV-COMP test suites, mid-tier reasoning LLMs (o4-mini, gpt-oss-120b, gpt-oss-20b) achieved at least 98% recall and 94.8% specificity across all suites with mistake mitigation. A dynamic trigger test, which synthesizes code to manifest flaws, proved strong evidence for real bugs, never yielding a valid trigger for a false positive.

Key takeaway

For AI Security Engineers managing static analysis alerts, integrating LASAA can drastically reduce manual review burden. You should prioritize using reasoning LLMs and tune consistency check settings to balance false positive/negative rates, considering your project's risk tolerance and token budget. Leverage the dynamic trigger test for high-confidence bug confirmation, moving validated flaws to the front of your repair queue. Always audit LLM justifications, as they can reveal subtle errors in your own ground truth assumptions.

Key insights

Reasoning LLMs, enhanced by consistency checks and reasoning evaluation, significantly improve static analysis alert adjudication accuracy.

Principles

• Reasoning LLMs surpass non-reasoning models for code analysis.
• Multiple LLM runs with reconciliation reduce errors.
• Dynamic execution-based triggers validate true positives reliably.

Method

LASAA builds queries with alert data and code, iteratively fetching definitions. It applies CC (multiple runs, threshold voting) and LRE (LLM evaluates discordant reasoning) to finalize verdicts.

In practice

• Implement LRE+CC to lower "uncertain" alert rates.
• Adjust CC thresholds to balance false positives/negatives.
• Review LLM justifications to refine ground truth.

Topics

• LLM Adjudication
• Static Analysis
• Software Security
• False Positive Reduction
• Consistency Check
• Dynamic Trigger Test

Code references

• cmu-sei/lasaa
• universal-ctags/ctags
• ryan-allen/car-wash-evals

Best for: AI Architect, AI Engineer, Research Scientist, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• Calibration Without Comprehension: Diagnosing the Limits of Fine-Tuning LLMs for Vulnerability Detection in Systems Software — LLMs fine-tuned for vulnerability detection achieve "calibration without comprehension," adapting outputs without true security reasoning.
• Spoon-feeding a Monster — Autonomous security testing requires separating LLM reasoning from deterministic execution to ensure ground truth and prevent hallucinations.
• Decoupled Smart Contract Audits: Lightweight LLM Framework via Distillation and Aggregation — Lightweight LLMs can achieve high accuracy in smart contract auditing by decoupling tasks and employing distillation and aggregation strategies.
• The Hitchhiker's Guide to Program Analysis, Part III: Mostly Harmless LLMs — Program behavior decisions must be grounded in formal analysis, with LLMs assisting context construction, not verdicts.
• Online Evals Done Right: Runtime Scoring and Review Queues for Production LLM Systems — Effective online LLM evaluation prioritizes deterministic checks and structured escalation over early tooling adoption.
• Monitoring LLM behavior: Drift, retries, and refusal patterns — Robust AI evaluation requires a two-layered stack combining deterministic and model-based assertions within offline and online pipelines.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.