ASE 2026 – Author Index

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

	Abbas, Zaheer	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Abualhaija, Sallam	ASE '26: "End-to-End Regulatory Compliance ..." End-to-End Regulatory Compliance Evolution Pipeline: From Legal Requirements to Developer Tests Carolin Brandt and Sallam Abualhaija (Delft University of Technology, Netherlands; University of Luxembourg, Luxembourg) As artificial intelligence agents become more prevalent, software systems are becoming even more deeply integrated in our lives while also growing in complexity. In response to societal concerns about safety and privacy, new regulations are being regularly introduced, posing significant compliance challenges for software engineers. This challenge is multifaceted, spanning the interpretation of legal texts, determination of how regulations apply to a specific software product, validation of end-to-end compliance, and, at the lowest level, the need to guide developers throughout this process. This challenge is exacerbated by the constant changes in regulations, requirements, and software systems. We posit that an end-to-end integration of requirements engineering and software testing, down to developer practices, could advance regulatory compliance for software systems. In this vision paper, we present a workflow that operationalizes constantly evolving regulatory requirements into automated developer-focused tests. The novelty of our approach lies in the orchestration of requirements elicitation, regulatory interpretation, traceability, test generation, and developer feedback into a continuous compliance workflow. Article Search Article: ase26nier-p13-p doi:10.1145/3832783.3834541
	Acher, Mathieu	ASE '26: "Code Transformation Rule Synthesis ..." Code Transformation Rule Synthesis using LLMs: Potential and Limits Axel Allain, Aymeric Blot, Djamel Eddine Khelladi, and Mathieu Acher (INSA, France; University of Rennes, France; Inria, France; CNRS, France; IRISA, France) Due to their black-box nature, LLMs suffer from limited explain- ability and a lack of determinism. Their usage cost can also rise, particularly with repetitive tasks on large codebases. Code transfor- mation rules mitigate those challenges. This paper fills this gap, with a novel empirical study targeting three domain-specific languages for transformation rules, namely Comby, GritQL, and Ast-Grep We evaluate three LLMs (GPT-5.4, GPT-oss-120B, and Llama3.1-8B) on six diverse datasets covering four software-evolution tasks: API misuse correction, program repair, API migration, and language ver- sion migration. Our results provide evidence that transformation rule synthesis moves beyond proof-of-concept with strong frontier models. GPT-5.4 achieves consistently high rule applicability rates and produces transformations closest to the ground truth across most benchmarks. Smaller and open-weight GPT-oss-120B and Llama3.1-8B models remain effective for simpler, localized changes but struggle with complex migration scenarios. We also observe non-negligible generalizability through the usage of meta-variables and through a high reuse score in the first quartile of many datasets. Finally, when compared to the anti-unification algorithm, LLMs outperform it in correctness, but underperform in rule applicabil- ity. Overall, our results show great potential for LLMs to generate sound, correct, generalizable, and reusable rules. Article Search Artifacts Available Article: ase26main-p1631-p doi:10.1145/3832783.3837504
	Adam, Justus	ASE '26: "Kani: A Model Checker for ..." Kani: A Model Checker for Rust Rémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech (Amazon Web Services, USA; Amazon Web Services, UK; Queen Mary University, UK; Brown University, USA; Datadog, USA; Massachusetts Institute of Technology, USA) Rust's ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust's Mid-level Intermediate Representation (MIR) into CBMC's bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign. Article Search Artifacts Available Article: ase26ind-p163-p doi:10.1145/3832783.3834499
	Adamietz, Leon	ASE '26: "ReproBreak: A Dataset of Reproducible ..." ReproBreak: A Dataset of Reproducible Web Locator Breaks Thiago Santos de Moura, Leon Adamietz, Samra Mehboob, and Yannic Noller (Ruhr University Bochum, Germany) Automated GUI testing frameworks such as Cypress and Playwright rely on locators to find and interact with web elements. A locator break occurs when a structural change in the application under test causes a locator to no longer find its target element, resulting in test breakages even when the underlying functionality remains unchanged. Despite its impact on test maintenance, no dataset exists to evaluate locator fragility in Cypress and Playwright at scale. In this paper, we present ReproBreak, a dataset of reproducible locator breaks in web GUI tests. We analyzed 359 open-source repositories to identify commits that contain locator changes. To confirm whether these changes are indeed locator breaks, we reproduced them in the top 4 projects with the largest number of locator changes and found 449 locator breaks, which are provided in the dataset along with scripts for automated reproduction. We believe ReproBreak serves as a valuable artifact to support research on locator fragility, repair techniques, and test robustness. The video is available at: https://youtu.be/fM6qQhoTjqY. The dataset is at https://github.com/rub-sq/ReproBreak. Article Search Artifacts Available Article: ase26tool-p118-p doi:10.1145/3832783.3834638
	Agarwal, Shyam	ASE '26: "A Few Pages of Markdown: Committed ..." A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, and Sanmi Koyejo (Stanford University, USA; Carnegie Mellon University, USA; Grid Dynamics, USA) Coding agents increase development velocity but also technical debt. Prior work reports only average effects across adopters, hiding wide differences between teams. We introduce RAMP (Repository AI Maturity Profile), a four-level cumulative maturity model grounded in version-controlled artifacts that teams commit to configure AI tools. RAMP runs from behavioral rules and coding standards through named agent definitions to multi-agent orchestration, with observed practice concentrated in the first three levels. Across 441 repositories the levels behave as a cumulative scale, and independent human annotation reproduces RAMP’s repository-level labels on 97 Article Search Article: ase26main-p2970-p doi:10.1145/3832783.3837546
	Agrawal, Khushboo	ASE '26: "StarFuse: LLM Guided Multimodal ..." StarFuse: LLM Guided Multimodal Interactive Theorem Proving Sharvil Athaley, Samyak Singhania, Khushboo Agrawal, and Subhajit Roy (IIT Kanpur, India) Interactive Theorem Provers (ITPs) like F* provide robust mathematical guarantees for software correctness, but their steep learning curves, specialized syntax, and complex proof mechanics severely limit their mainstream adoption. To lower this entry barrier, we propose StarFuse, an LLM-assisted developer tool that automatically synthesizes fully verified F* programs from mixed-format source files. StarFuse allows developers to express their intents using a combination of natural language, pseudocode, imperative code (C), functional code (OCaml), and F* sketches. It employs a context-aware, compiler-guided repair loop that iteratively queries a Large Language Model (LLM) and utilizes F* compiler diagnostics to refine and fix the generated code. Additionally, it integrates a "fuzz first" mechanism for functional snippets to quickly filter out shallow bugs before invoking the expensive verification process. To evaluate StarFuse, we created a benchmark suite based on instances from the F* repository. Our evaluations demonstrate the ability of StarFuse at successfully verifying implementations across various modalities, thereby offering a practical bridge from informal intent to rigorous formal verification. Article Search Article: ase26tool-p81-p doi:10.1145/3832783.3834627
	Aguirre, Nazareno	ASE '26: "TORI: A Tool for Oracle Quality ..." TORI: A Tool for Oracle Quality Assessment Facundo Molina, Nazareno Aguirre, and Alessandra Gorla (Complutense University of Madrid, Spain; University of Rio Cuarto, Argentina; CONICET, Argentina; Guangdong Technion-Israel Institute of Technology, China; IMDEA Software Institute, Spain) Oracle quality is a critical factor in software testing, directly influencing the fault-detection capability and overall effectiveness of test suites. Despite its importance, assessing oracle quality remains challenging: existing techniques predominantly rely on dynamic analysis, which incurs substantial computational overhead and limits adoption in large-scale or time-constrained development settings. In this tool demo paper, we present Tori, a lightweight static analysis tool designed to help testers evaluate oracle quality efficiently. Tori operates by analyzing assertion-based oracles within test cases and generating a quality report based on the state field coverage metric, a measure of how comprehensively the assertions exercise the internal state fields of the software under test. A demonstration video showcasing the use of Tori is available at https://youtu.be/neb3B-Dyacw. Article Search Article: ase26tool-p238-p doi:10.1145/3832783.3834653
	Ahmed, Muhammad Ejaz	ASE '26: "RamFuzz: LLM-Guided Greybox ..." RamFuzz: LLM-Guided Greybox Fuzzing for Spatial Memory Corruption via Valid Range Violation Shangzhi Xu, Wei Song, Yuekang Li, Nan Sun, Muhammad Ejaz Ahmed, Willy Susilo, Benjamin Turnbull, Xiao Cheng, and Siqi Ma (University of New South Wales, Australia; CSIRO's Data61, Australia; University of Wollongong, Australia; Macquarie University, Australia) Spatial memory corruptions remain among the most prevalent software vulnerabilities, consistently ranking among the top CWE categories. These vulnerabilities are closely tied to the values processed by the program: when input-derived values fall outside expected ranges, memory operations may be performed beyond their allocated bounds, leading to corruption. Our pilot study on 132 realworld CVEs shows that 72.7% of spatial memory corruptions stem from such valid value violations. Although fuzzing is widely used to expose exploitable memory corruptions, systematically detecting spatial memory corruptions through fuzzing remains challenging, as it requires generating inputs that conform to complex structural formats while violating valid value ranges. Recent work leverages LLMs to generate structured inputs based on format knowledge, yet LLMs exhibit a strong bias toward well-formed outputs, leaving systematic range violations largely unexplored. In this paper, we propose RamFuzz, an approach that exploits rather than mitigates this bias to guide the fuzzing process. RamFuzz prompts LLMs to enumerate valid ranges of target file formats and deliberately assigns invalid values to seeds during fuzzing, systematically triggering spatial memory corruptions. We evaluated RamFuzz on 15 popular real-world projects with more than 1,000 stars on GitHub, RamFuzz discovered 104 previously unknown memory corruptions, of which 39 have been confirmed, and 33 have been fixed by developers. Article Search Article: ase26main-p540-p doi:10.1145/3832783.3837447
	Akhond, Mostafijur Rahman	ASE '26: "“Impossible to Hide Secret ..." “Impossible to Hide Secret ...”: Uncovering Security and Privacy Issues in LLM-Native IDEs Mostafijur Rahman Akhond, Md Afif Al Mamun, Gias Uddin, and Song Wang (York University, Canada; University of Calgary, Canada) LLM-native IDEs (Integrated Development Environments), aka LIDEs, are designed from the ground up to work with Large Language Models (LLMs). LIDEs have found remarkable success in Software Engineering (SE) tasks such as coding, debugging, and program comprehension. LIDEs are software systems, and, like any system, they can exhibit vulnerabilities. In this paper, we study the security and privacy issues that developers reported while using popular LIDEs in their development tasks. We collected 1.1M posts from 29 popular subreddits related to LIDEs. We identified 446 posts and analyzed over 6K comments to the posts that discussed security and privacy issues in almost all popular LIDEs, such as Cursor, Copilot, Codex, etc. Using a mix of qualitative and quantitative methods, we constructed a taxonomy of the reported security and privacy issues. Our results show that most issues in LIDEs stem from system-level design choices, rather than the underlying LLMs, such as user data access, unchecked autonomous actions, etc. To overcome these issues, developers frequently relied on external safeguards like code sandboxing and manual reviewing, highlighting prevalent mistrust among developers about LIDEs. We share lessons from our study to support future design of secure and privacy-aware LIDEs. Article Search Article: ase26main-p234-p doi:10.1145/3832783.3837429
	Alahmadi, Abdullah A.	ASE '26: "IoTutorMine: A Tool for Mining ..." IoTutorMine: A Tool for Mining Hardware Bills of Materials from IoT Tutorial Videos Abdullah A. Alahmadi, Ahmed O. Bahaj, and Mohammad D. Alahmadi (University of Jeddah, Saudi Arabia) Internet of Things (IoT) tutorial videos describe the parts a learner must purchase verbally rather than visually, which makes them invisible to frame-based mining techniques developed for programming screencasts. We present IoTutorMine, a tool that recovers structured hardware Bills of Materials (BoMs) from IoT tutorial videos by combining YouTube's auto-generated transcripts with large language models in a zero-shot setting. IoTutorMine-Web, a public prototype, exposes the pipeline as an interactive IoT tutorial catalog: users paste a YouTube URL to get an on-demand BoM, or browse a pre-indexed library searchable by component (e.g., “every tutorial that uses a DHT11”). We also release a benchmark of 20 manually annotated YouTube tutorials covering Arduino and Raspberry Pi at two difficulty levels, with 131 ground-truth components from 16 distinct creators, together with an expert-curated alias dictionary and evaluation scripts. Under a two-tier entity-resolution strategy that combines syntactic matching with semantic canonicalization, Gemini 3 Flash reaches F1 = 0.933, GPT-5 F1 = 0.887, and Claude Opus 4.7 F1 = 0.868, with Gemini significantly outperforming Claude on per-video F1 (Wilcoxon p = 0.028). The results demonstrate that transcript-only BoM extraction is feasible for practical IoT cataloging applications, and that a semantic mapping layer is essential to resolve hardware nomenclature variations. Article Search Article: ase26tool-p160-p doi:10.1145/3832783.3834647
	Alahmadi, Mohammad D.	ASE '26: "VidSumEval: A Web Platform ..." VidSumEval: A Web Platform and Benchmark for Evaluating AI-Generated Programming Video Summaries Osama AlGhamdi, Ameer AlGhamdi, Faisal Alorabi, Mohammad D. Alahmadi, Abdulmalik Alzahrani, and Abdullah Almazroui (University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are a widely used learning resource, but their length often makes content review inefficient. AI-based summarization tools can produce shorter versions of these videos, yet existing evaluation relies almost exclusively on similarity-based metrics that measure surface overlap rather than whether the summaries actually support learning. We present VidSumEval, a web platform and benchmark for evaluating AI-generated programming tutorial summaries from a learning-centered perspective. The benchmark pairs 10 tutorials in C, Java, and Python with summaries from two commercial engines (VEED and NotebookLM) and auto-generated comprehension quizzes; users can also submit new YouTube tutorials for offline review. We validate the benchmark with a within-subject study (n=20) measuring both quiz-based comprehension and Likert-scale ratings on completeness, clarity, and coherence; learning effectiveness is reported as the per-participant difference between summarized- and original-video quiz scores. The platform is available at https://progsumeval.onrender.com; the source code and dataset are archived at https://doi.org/10.5281/zenodo.21763079; and the screencast is available at https://youtu.be/iBB-5HfRVSk. Article Search Artifacts Available Article: ase26tool-p3-p doi:10.1145/3832783.3834594 ASE '26: "VidTutorAssistant: Automating ..." VidTutorAssistant: Automating Responses to Programming Tutorial Questions Ahmad Tayeb, Sonia Haiduc, and Mohammad D. Alahmadi (King Abdulaziz University, Saudi Arabia; Florida State University, USA; University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are an important information resource for software developers and students, and their comment sections have evolved into active spaces where viewers ask follow-up questions. The volume of these questions, however, often exceeds what content creators can address, leaving learners without the clarifications they need. We present VidTutorAssistant, a web platform that automates responses to viewer questions on programming video tutorials. VidTutorAssistant implements a retrieval-augmented generation pipeline that extracts a video’s transcript, then segments it and embeds it. It then classifies each viewer comment as being a question or non-question, retrieves the most relevant transcript segments to each identified question via cosine similarity, and then generates an answer to the question using an LLM (GPT-4), while grounding the response using the retrieved transcript segments as context. We validate VidTutorAssistant through a study on a subset of 440 user comments selected from a larger dataset of 105,553 comments extracted from 7,522 Python and Java tutorials. VidTutorAssistant is evaluated on various criteria: a) its ability to identify the programming language in a video, achieving a 0.99 accuracy; b) its ability to classify comments into questions and non-questions, reaching a 0.96 accuracy; and c) its ability to produce correct and complete answers to questions, producing 98% correct and 99.5% complete responses, compared with 89% and 90% for the original creators’ answers. Article Search Article: ase26tool-p17-p doi:10.1145/3832783.3834599 ASE '26: "IoTutorMine: A Tool for Mining ..." IoTutorMine: A Tool for Mining Hardware Bills of Materials from IoT Tutorial Videos Abdullah A. Alahmadi, Ahmed O. Bahaj, and Mohammad D. Alahmadi (University of Jeddah, Saudi Arabia) Internet of Things (IoT) tutorial videos describe the parts a learner must purchase verbally rather than visually, which makes them invisible to frame-based mining techniques developed for programming screencasts. We present IoTutorMine, a tool that recovers structured hardware Bills of Materials (BoMs) from IoT tutorial videos by combining YouTube's auto-generated transcripts with large language models in a zero-shot setting. IoTutorMine-Web, a public prototype, exposes the pipeline as an interactive IoT tutorial catalog: users paste a YouTube URL to get an on-demand BoM, or browse a pre-indexed library searchable by component (e.g., “every tutorial that uses a DHT11”). We also release a benchmark of 20 manually annotated YouTube tutorials covering Arduino and Raspberry Pi at two difficulty levels, with 131 ground-truth components from 16 distinct creators, together with an expert-curated alias dictionary and evaluation scripts. Under a two-tier entity-resolution strategy that combines syntactic matching with semantic canonicalization, Gemini 3 Flash reaches F1 = 0.933, GPT-5 F1 = 0.887, and Claude Opus 4.7 F1 = 0.868, with Gemini significantly outperforming Claude on per-video F1 (Wilcoxon p = 0.028). The results demonstrate that transcript-only BoM extraction is feasible for practical IoT cataloging applications, and that a semantic mapping layer is essential to resolve hardware nomenclature variations. Article Search Article: ase26tool-p160-p doi:10.1145/3832783.3834647
	Alair, Miyriee	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Al-Bataineh, Omar I.	ASE '26: "Beyond the First Crash: Interaction-Aware ..." Beyond the First Crash: Interaction-Aware Multi-fault Fuzzing Omar I. Al-Bataineh (Gran Sasso Science Institute, Italy) Fuzz testing is highly effective at exposing individual faults, yet it systematically fails to reveal how faults interact within execution. A crash at one program point can mask, trigger, or alter the manifestation of others, leaving critical interactions undiscovered. We present CoFuzz, an interaction-aware fuzzing framework that shifts fuzzing from collecting isolated crashes to uncovering fault interaction structure. CoFuzz employs a probe-based mechanism that incrementally constructs a fault interaction map M during fuzzing: upon detecting a crash at site fi, CoFuzz temporarily neutralizes fi and re-fuzzes to expose previously masked faults, classifying relationships as masking, cascading, or synergistic. These interaction signals guide corpus prioritization and mutation, steering exploration toward fault combinations rather than coverage alone. We further introduce interaction coverage, a metric complementing code coverage, and outline a research agenda for scalable interaction-aware fuzzing that exposes the full fault topology of real software. Article Search Article: ase26nier-p2-p doi:10.1145/3832783.3834538 ASE '26: "Phantom Fixes: Fault Interaction ..." Phantom Fixes: Fault Interaction Ambiguity in Multi-fault Concurrent Programs Omar I. Al-Bataineh (Gran Sasso Science Institute, Italy) Modern automated software engineering (ASE) techniques for testing, localization, and repair often treat fault interactions as stable, input-driven semantic effects. This assumption is largely adequate in sequential settings, where execution order is fixed, but breaks down in concurrent programs where thread interleavings reshape observable behavior. We show that concurrent fault interaction is fundamentally schedule-dependent: identical inputs can induce different interaction classes under different schedules. To capture this effect, we introduce Concurrent Fault Interaction (CFI), which lifts classical interaction relations to the schedule space Σ via a schedule-indexed map Mσ. This perspective exposes interaction ambiguity, where causal relationships between faults, such as masking or synergy, vary across the scheduling manifold. We show that this ambiguity gives rise to phantom fixes: patches that eliminate observed failures through schedule-dependent masking rather than genuine semantic correction, thereby rendering standard test-based repair oracles fundamentally unsound in concurrent settings. Finally, we introduce the Interaction Invariance Problem (IIP), conjecture its PSPACE-hardness via a reduction from NFA language inclusion, and outline its broader implications for schedule-aware and compositional program synthesis. Article Search Article: ase26nier-p3-p doi:10.1145/3832783.3834539
	Aldrich, Jonathan	ASE '26: "Barista: Synthesizing Typestate ..." Barista: Synthesizing Typestate Specifications with LLM Agents Catarina Gamboa, Paulo Canelas, Ricardo Costa, Márcio Caetano, Jonathan Aldrich, and Alcides Fonseca (Carnegie Mellon University, USA; University of Lisbon, Portugal) Object-oriented classes encode implicit protocols that clients must follow, such as connecting a socket before sending data or opening a stream before reading. Mainstream programming languages like Java cannot validate the correct use of these protocols, but more advanced type systems, such as typestate systems, can detect these violations at compile time. However, these systems require a formalization of these implicit protocols. To overcome this limitation, we propose to extract object protocols from documentation using a combination of LLMs and test generation. We developed Barista, an agentic workflow that transforms class documentation into verifiable LiquidJava specifications through DFA-guided protocol extraction, test synthesis, and verification-driven refinement. We evaluated our approach on 35 Java classes with expert-written ground truth, achieving 87.0% precision and 68.3% recall, with 75% of specifications usable directly or with minor edits. Barista bootstraps these specifications for well-documented libraries, reducing the manual annotation burden and enabling compile-time protocol safety without specialized expertise. Article Search Article: ase26main-p2950-p doi:10.1145/3832783.3834427
	Aleti, Aldeida	ASE '26: "Requirements-Augmented Generation ..." Requirements-Augmented Generation for Trustworthy Acceptance Testing of LLM-Based Software Fanyu Wang, Chetan Arora, Zhenping Xie, Yonghui Liu, Kla Tantithamthavorn, Aldeida Aleti, and Siwei Jiang (Monash University, Australia; Jiangnan University, China; Australian National University, Australia; Yiwuyishi Intelligent Technology (Nantong), China; Tianjin University, China) LLM-based software (LBS) integrates large language models as core components to deliver flexible and personalised responses. Unlike traditional software with deterministic outputs, LBSs exhibit context-dependent, stochastic behaviour that renders classical acceptance testing and test oracles insufficient: the same query may require fundamentally different responses depending on users' personas and software context. This gap creates an urgent need for automated acceptance testing frameworks that can autonomously interpret users' instructions, while also raising the challenge of how we can reliably interpret users' intentions in a changing environment. In this paper, we present an automated acceptance testing framework for LBS with calibrated verdict reliability through two technical contributions. First, we introduce REquirements-Augmented Generation (REAG), which interprets user intentions by retrieving relevant software requirements, domain knowledge, and personas via adaptive RAG and self-reasoning to generate context-aware test oracles. Second, recognising that oracle generation may retrieve irrelevant constraints, misinterpret intent, or hallucinate requirements, we introduce a confidence-calibrated cascade judgment that quantifies verdict reliability via simulated expert agreement, accepting high-confidence verdicts, escalating ambiguous cases, or abstaining when uncertain, with empirical reliability guarantees backed by conformal risk control. An industrial case study on a production nutrition advisory application demonstrates that REAG achieves a 3.91/5 oracle quality score, successfully achieving qualified or marginal oracle quality in 82% of cases. The confidence-calibrated cascade achieves 98.8% accuracy, improves oracle quality from 3.91 to 4.30 by filtering unqualified outputs, and delivers a 31.7% cost-efficiency improvement over single-judge baselines, validating industrial viability. Article Search Article: ase26ind-p113-p doi:10.1145/3832783.3834491
	AlGhamdi, Ameer	ASE '26: "VidSumEval: A Web Platform ..." VidSumEval: A Web Platform and Benchmark for Evaluating AI-Generated Programming Video Summaries Osama AlGhamdi, Ameer AlGhamdi, Faisal Alorabi, Mohammad D. Alahmadi, Abdulmalik Alzahrani, and Abdullah Almazroui (University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are a widely used learning resource, but their length often makes content review inefficient. AI-based summarization tools can produce shorter versions of these videos, yet existing evaluation relies almost exclusively on similarity-based metrics that measure surface overlap rather than whether the summaries actually support learning. We present VidSumEval, a web platform and benchmark for evaluating AI-generated programming tutorial summaries from a learning-centered perspective. The benchmark pairs 10 tutorials in C, Java, and Python with summaries from two commercial engines (VEED and NotebookLM) and auto-generated comprehension quizzes; users can also submit new YouTube tutorials for offline review. We validate the benchmark with a within-subject study (n=20) measuring both quiz-based comprehension and Likert-scale ratings on completeness, clarity, and coherence; learning effectiveness is reported as the per-participant difference between summarized- and original-video quiz scores. The platform is available at https://progsumeval.onrender.com; the source code and dataset are archived at https://doi.org/10.5281/zenodo.21763079; and the screencast is available at https://youtu.be/iBB-5HfRVSk. Article Search Artifacts Available Article: ase26tool-p3-p doi:10.1145/3832783.3834594
	AlGhamdi, Osama	ASE '26: "VidSumEval: A Web Platform ..." VidSumEval: A Web Platform and Benchmark for Evaluating AI-Generated Programming Video Summaries Osama AlGhamdi, Ameer AlGhamdi, Faisal Alorabi, Mohammad D. Alahmadi, Abdulmalik Alzahrani, and Abdullah Almazroui (University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are a widely used learning resource, but their length often makes content review inefficient. AI-based summarization tools can produce shorter versions of these videos, yet existing evaluation relies almost exclusively on similarity-based metrics that measure surface overlap rather than whether the summaries actually support learning. We present VidSumEval, a web platform and benchmark for evaluating AI-generated programming tutorial summaries from a learning-centered perspective. The benchmark pairs 10 tutorials in C, Java, and Python with summaries from two commercial engines (VEED and NotebookLM) and auto-generated comprehension quizzes; users can also submit new YouTube tutorials for offline review. We validate the benchmark with a within-subject study (n=20) measuring both quiz-based comprehension and Likert-scale ratings on completeness, clarity, and coherence; learning effectiveness is reported as the per-participant difference between summarized- and original-video quiz scores. The platform is available at https://progsumeval.onrender.com; the source code and dataset are archived at https://doi.org/10.5281/zenodo.21763079; and the screencast is available at https://youtu.be/iBB-5HfRVSk. Article Search Artifacts Available Article: ase26tool-p3-p doi:10.1145/3832783.3834594
	Aljaberi, Ali	ASE '26: "AIALIB: A Threat Library for ..." AIALIB: A Threat Library for AI-Generated Code Ali Aljaberi, Jian Kang, and Youcheng Sun (MBZUAI, United Arab Emirates) Large language models (LLMs) are increasingly integrated into software development workflows, yet a growing body of evidence shows that the code they generate often contains security vulnerabilities. Prior work has primarily focused on measuring the prevalence of such issues, providing useful evidence of risk but limited support for understanding their causes, tracking how they propagate through development workflows, or integrating this knowledge into practical security processes. To address these gaps, we present aialib, an annotated threat library for AI-generated code. aialib systematically generates, analyzes, and structures potential vulnerabilities from LLM-produced code, enriching each finding with conventional security taxonomies (CWE and OWASP) together with AI-specific information describing why the vulnerability was generated, how it propagates through code reuse and refactoring, and how it relates to AI-system threat models. Article Search Article: ase26tool-p295-p doi:10.1145/3832783.3834655
	Allain, Axel	ASE '26: "Code Transformation Rule Synthesis ..." Code Transformation Rule Synthesis using LLMs: Potential and Limits Axel Allain, Aymeric Blot, Djamel Eddine Khelladi, and Mathieu Acher (INSA, France; University of Rennes, France; Inria, France; CNRS, France; IRISA, France) Due to their black-box nature, LLMs suffer from limited explain- ability and a lack of determinism. Their usage cost can also rise, particularly with repetitive tasks on large codebases. Code transfor- mation rules mitigate those challenges. This paper fills this gap, with a novel empirical study targeting three domain-specific languages for transformation rules, namely Comby, GritQL, and Ast-Grep We evaluate three LLMs (GPT-5.4, GPT-oss-120B, and Llama3.1-8B) on six diverse datasets covering four software-evolution tasks: API misuse correction, program repair, API migration, and language ver- sion migration. Our results provide evidence that transformation rule synthesis moves beyond proof-of-concept with strong frontier models. GPT-5.4 achieves consistently high rule applicability rates and produces transformations closest to the ground truth across most benchmarks. Smaller and open-weight GPT-oss-120B and Llama3.1-8B models remain effective for simpler, localized changes but struggle with complex migration scenarios. We also observe non-negligible generalizability through the usage of meta-variables and through a high reuse score in the first quartile of many datasets. Finally, when compared to the anti-unification algorithm, LLMs outperform it in correctness, but underperform in rule applicabil- ity. Overall, our results show great potential for LLMs to generate sound, correct, generalizable, and reusable rules. Article Search Artifacts Available Article: ase26main-p1631-p doi:10.1145/3832783.3837504
	Almazroui, Abdullah	ASE '26: "VidSumEval: A Web Platform ..." VidSumEval: A Web Platform and Benchmark for Evaluating AI-Generated Programming Video Summaries Osama AlGhamdi, Ameer AlGhamdi, Faisal Alorabi, Mohammad D. Alahmadi, Abdulmalik Alzahrani, and Abdullah Almazroui (University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are a widely used learning resource, but their length often makes content review inefficient. AI-based summarization tools can produce shorter versions of these videos, yet existing evaluation relies almost exclusively on similarity-based metrics that measure surface overlap rather than whether the summaries actually support learning. We present VidSumEval, a web platform and benchmark for evaluating AI-generated programming tutorial summaries from a learning-centered perspective. The benchmark pairs 10 tutorials in C, Java, and Python with summaries from two commercial engines (VEED and NotebookLM) and auto-generated comprehension quizzes; users can also submit new YouTube tutorials for offline review. We validate the benchmark with a within-subject study (n=20) measuring both quiz-based comprehension and Likert-scale ratings on completeness, clarity, and coherence; learning effectiveness is reported as the per-participant difference between summarized- and original-video quiz scores. The platform is available at https://progsumeval.onrender.com; the source code and dataset are archived at https://doi.org/10.5281/zenodo.21763079; and the screencast is available at https://youtu.be/iBB-5HfRVSk. Article Search Artifacts Available Article: ase26tool-p3-p doi:10.1145/3832783.3834594
	Alorabi, Faisal	ASE '26: "VidSumEval: A Web Platform ..." VidSumEval: A Web Platform and Benchmark for Evaluating AI-Generated Programming Video Summaries Osama AlGhamdi, Ameer AlGhamdi, Faisal Alorabi, Mohammad D. Alahmadi, Abdulmalik Alzahrani, and Abdullah Almazroui (University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are a widely used learning resource, but their length often makes content review inefficient. AI-based summarization tools can produce shorter versions of these videos, yet existing evaluation relies almost exclusively on similarity-based metrics that measure surface overlap rather than whether the summaries actually support learning. We present VidSumEval, a web platform and benchmark for evaluating AI-generated programming tutorial summaries from a learning-centered perspective. The benchmark pairs 10 tutorials in C, Java, and Python with summaries from two commercial engines (VEED and NotebookLM) and auto-generated comprehension quizzes; users can also submit new YouTube tutorials for offline review. We validate the benchmark with a within-subject study (n=20) measuring both quiz-based comprehension and Likert-scale ratings on completeness, clarity, and coherence; learning effectiveness is reported as the per-participant difference between summarized- and original-video quiz scores. The platform is available at https://progsumeval.onrender.com; the source code and dataset are archived at https://doi.org/10.5281/zenodo.21763079; and the screencast is available at https://youtu.be/iBB-5HfRVSk. Article Search Artifacts Available Article: ase26tool-p3-p doi:10.1145/3832783.3834594
	Alzahrani, Abdulmalik	ASE '26: "VidSumEval: A Web Platform ..." VidSumEval: A Web Platform and Benchmark for Evaluating AI-Generated Programming Video Summaries Osama AlGhamdi, Ameer AlGhamdi, Faisal Alorabi, Mohammad D. Alahmadi, Abdulmalik Alzahrani, and Abdullah Almazroui (University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are a widely used learning resource, but their length often makes content review inefficient. AI-based summarization tools can produce shorter versions of these videos, yet existing evaluation relies almost exclusively on similarity-based metrics that measure surface overlap rather than whether the summaries actually support learning. We present VidSumEval, a web platform and benchmark for evaluating AI-generated programming tutorial summaries from a learning-centered perspective. The benchmark pairs 10 tutorials in C, Java, and Python with summaries from two commercial engines (VEED and NotebookLM) and auto-generated comprehension quizzes; users can also submit new YouTube tutorials for offline review. We validate the benchmark with a within-subject study (n=20) measuring both quiz-based comprehension and Likert-scale ratings on completeness, clarity, and coherence; learning effectiveness is reported as the per-participant difference between summarized- and original-video quiz scores. The platform is available at https://progsumeval.onrender.com; the source code and dataset are archived at https://doi.org/10.5281/zenodo.21763079; and the screencast is available at https://youtu.be/iBB-5HfRVSk. Article Search Artifacts Available Article: ase26tool-p3-p doi:10.1145/3832783.3834594
	An, Gabin	ASE '26: "Disassembly-Augmented Root ..." Disassembly-Augmented Root Cause Analysis for C/C++ Segmentation Faults in SAP HANA Jihoon Jung, Chansong You, Jingun Hong, Thomas Bach, and Gabin An (SAP Labs Korea, Republic of Korea; SAP, Germany; Korea University, Republic of Korea) Production failures in large-scale systems are inherently difficult to diagnose, and crash dumps are often the only artifact available for debugging. In C++ programs, this difficulty is further compounded by misleading crash locations in stack traces caused by compiler optimizations such as function inlining. In our dataset of production SIGSEGV crashes from SAP HANA, 66% exhibit such misleading crash locations, which can misdirect both developers and LLM-based debugging agents to the source code of inlined functions rather than the true execution context of the faulting instruction. In this work, we investigate whether explicitly providing disassembly information that reveals the faulting instruction and recovers inlining chains improves bug diagnosis quality in both autonomous agent and tool-disabled LLM modes. Experiments on 91 real-world SIGSEGV crashes show that disassembly context improves root cause analysis quality and generally improves fault localization, especially for misleading crash locations. Moreover, in agent mode, the additional disassembly context does not increase total session cost of diagnosis, as its added input-token cost is offset by reduced exploration of the codebase. Article Search Artifacts Available Article: ase26ind-p32-p doi:10.1145/3832783.3834461 ASE '26: "Is Three the Magic Number? ..." Is Three the Magic Number? An Empirical Evaluation of LLM-Based Repair Loops Tobias Kiecker, Eik Reichmann, Hosung Kang, Gabin An, and Lars Grunske (Humboldt-Universität zu Berlin, Germany; Korea University, Republic of Korea) Iterative repair loops have become a core design pattern in LLM-based software engineering systems. These workflows repeatedly generate, validate, and repair artifacts using feedback such as compiler errors or test failures. Despite their widespread use, the impact of repair-loop iteration limits remains poorly understood, as most prior work adopts fixed, often arbitrary, repair budgets. We study repair-loop effectiveness across multiple software engineering tasks, including code generation, test generation, and code translation. Across several representative workflows, datasets, and contemporary low-cost LLMs, we observe a consistent pattern of diminishing returns: the first three to four repair iterations account for most achievable gains, while later iterations contribute only marginal improvements. Across the evaluated models, repair behavior is influenced more strongly by workflow orchestration and feedback design than by the underlying model itself. These results suggest that repair budgets should be treated as an explicit experimental variable, as they directly affect evaluation outcomes, computational cost, runtime, and reproducibility in LLM-based software engineering research. Article Search Article: ase26nier-p58-p doi:10.1145/3832783.3834547
	An, Yifan	ASE '26: "DepUpgrade: Automating Dependency ..." DepUpgrade: Automating Dependency Upgrade through State-Path Exploration Xiangxi Ma, Yifan An, Wentong Tian, Xuanqi Wang, Qingao Dong, Xiang Gao, and Hailong Sun (Beihang University, China) Third-party dependencies frequently introduce API breaking changes, and upgrading them causes compilation or runtime failures in client applications. Existing approaches have explored automating dependency upgrades, but struggle with fixing complex issues. This is mainly because traditional methods lack semantic adaptability, while recent prompt-only LLM-based migration approaches often suffer from hallucinations and fail to navigate multi-step, cascading repairs. To solve this problem, in this paper, we propose DepUpgrade, a framework that models dependency upgrade as a state-path exploration problem. A state is a snapshot of the client codebase at a particular point during migration. Transitions between states are validated via compiler feedback and rolled back if regressions occur. Instead of performing a single-pass generation, DepUpgrade systematically explores a search space of intermediate states with the goal of reaching a successful state. DepUpgrade achieves this goal in three steps: API migration knowledge extraction, repair task formulation and state-path exploration. We evaluate DepUpgrade on a benchmark of 123 migration tasks and 18 real-world projects. Experimental results demonstrate that our framework achieves an unprecedented 96.7% full repair rate on the benchmark, outperforming other baselines. On the real-world projects, DepUpgrade fully repairs 15 of the 18 projects and leaves 31 of the 1,085 initial compilation errors unresolved. Article Search Article: ase26main-p442-p doi:10.1145/3832783.3837442
	Anderson, Angie	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Angermeir, Florian	ASE '26: "From Backlog Items to Security ..." From Backlog Items to Security Guidance: Towards Continuous Security Compliance Ignacio García Núñez, Florian Angermeir, and Fabiola Moyón Constante (Technical University of Munich, Germany; fortiss, Germany; Blekinge Institute of Technology, Sweden; Siemens Technology, Germany) Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief, free-form descriptions and often lack timely guidance on applicable requirements. We present an NLP-based backlog enrichment system that detects security-relevant backlog items and links them to relevant security requirements. The approach combines a security-relevance classifier with a retrieval-augmented generation (RAG) pipeline over security requirements documents. The approach was developed and evaluated in the context of a large enterprise in highly regulated domains. We present three contributions. First, we release a dataset of 288 backlog items labeled for security relevance by nine security practitioners, with substantial agreement (Fleiss’ κ=0.787). Second, a recall-oriented classifier achieving F2=0.774 in-distribution and mean zero-shot G-measure ≈ 0.65 across five established benchmarks, matching or outperforming most published classical-ML and open-source GPT baselines. Third, we preliminarily evaluated a four-stage security requirements document-grounded RAG pipeline with two practitioners on industrial backlogs using company-internal security policies and CIS Benchmarks. Of the retrieved 24 clauses, 12 were rated at least 4/5 for relevance. Our findings provide first indicators that NLP-based product backlog enrichment can support engineers in identifying security requirements early in the development process. With this work we aim to facilitate continuous security compliance through proactive introduction of security requirements in continuous software engineering. Article Search Artifacts Available Article: ase26ind-p344-p doi:10.1145/3832783.3834527
	Antal, Gábor	ASE '26: "JavaVulBench: A Java Vulnerability ..." JavaVulBench: A Java Vulnerability Benchmark with Realistic Splits, a Unified Multi-backend Harness, and a Leakage-Aware Evaluation Mode Norbert Sándor Szolnoki and Gábor Antal (University of Szeged, Hungary) We release JavaVulBench, a benchmark dataset and evaluation harness for Java vulnerability detection. The dataset contains ∼30,600 Java methods spanning 1,740 CVEs and 700+ projects, labelled at both method and line granularity, with per-CVE publication dates and five realistic split strategies: random, project-disjoint, temporal, deduplicated, and unseen CWE-family. The harness provides a single LlmPrediction schema across three backend families (encoder classifiers, local generative models served by Ollama, and API-served LLMs routed through OpenRouter) so that twelve reference detectors CodeBERT, GraphCodeBERT, UniXcoder, DeepSeek-Coder-1.3B, and eight API/open-weight LLMs (GPT-4o, GPT-4.1-mini, Claude Sonnet 4, DeepSeek-v3, DeepSeek-Coder-v2, Qwen-2.5-Coder-14B/7B, CodeLlama-13B) are evaluated under identical conditions from a single command. A pre-training contamination audit is shipped alongside every model so users can separate test CVEs published after the documented model cutoff from potentially memorised ones. Data, code, and fine-tuned checkpoints are archived on Zenodo [] and short demonstration video is available on YouTube (https://www.youtube.com/watch?v=nMTX_hqkuoM)1. Article Search Article: ase26tool-p190-p doi:10.1145/3832783.3834649
	Apel, Sven	ASE '26: "Assessing Uncertainty in Performance ..." Assessing Uncertainty in Performance Modeling: Conformal Prediction vs. Bayesian Regression Stefan Jahns, Johannes Dorn, Max Weber, Sven Apel, and Norbert Siegmund (Leipzig University, Germany; Saarland University, Germany) Most software systems today are configurable. As a consequence, predicting performance is inherently challenging due to the sheer number of configurations exhibiting individual performance variations. When predicting the performance of unseen configurations, it is imperative to know how reliable such predictions are. Bayesian methods have been shown to be able to quantify the uncertainty in their estimates, but require prior information about performance distributions and, more importantly, are constrained in their learning technique, effectively limiting their practical applicability. Conformal prediction, an entirely novel approach to uncertainty quantification in this area, augments existing learning algorithms via a statistical post-hoc analysis. This allows us to provide uncertainty estimates even for point-estimate algorithms, such as random forests or deep neural networks. The goal of this study is to evaluate how assumptions of conformal predictions regarding sample size and distribution, as well as the heterogeneity of learning algorithms, affect their applicability to software performance prediction. We conduct a comprehensive study comparing four conformal prediction variants against P4, the current standard for uncertainty-aware performance prediction, analyzing accuracy, scalability, and uncertainty quantification. Our results show that conformal prediction consistently outperforms the state of the art across six out of eight real world scenarios, producing correct confidence intervals that are 46–75 % narrower, and thus more certain. Notably, conformal prediction can be used to enrich existing techniques, with post-hoc uncertainty quantification in a plug and play fashion. Article Search Article: ase26main-p207-p doi:10.1145/3832783.3837425 ASE '26: "FlightRecorder: Tracing Fine-Grained ..." FlightRecorder: Tracing Fine-Grained Development with AI Assistants Tobias Dick, Benedict Bliem, Kallistos Weis, Alisa Welter, and Sven Apel (Saarland University, Germany) AI coding assistants like GitHub Copilot are transforming software development. Yet fundamental questions remain about how code evolves as developers collaborate with AI agents, particularly at fine-grained levels of interaction -- a gap that persists partly because existing telemetry cannot distinguish agent-generated changes from inline completions and human edits, nor precisely track when and where they occur. To address this gap, we present FlightRecorder, a lightweight VSCode extension that collects fine-grained code evolution data without disrupting the workflows of developers. Our extension integrates three data sources: snapshots of agent-mode edits, inline completions, and chat history, all timestamped for precise attribution. Researchers can export these data in structured formats alongside anonymization and basic visualization functionality. By making such fine-grained evolution data accessible, FlightRecorder enables researchers to investigate fundamental questions about AI-assisted development. We provide a replication package, including the code for FlightRecorder and the data used throughout our paper, at https://doi.org/10.5281/zenodo.20134365. We further provide a screencast demo of our tool at https://youtu.be/bZR6aPROVMU. Article Search Artifacts Available Article: ase26tool-p38-p doi:10.1145/3832783.3834607
	Arceri, Vincenzo	ASE '26: "GoLiSA: An Advanced Static ..." GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts Luca Olivieri, Luca Negrini, Vincenzo Arceri, Pietro Ferrara, Fausto Spoto, and Agostino Cortesi (Ca’ Foscari University of Venice, Italy; University of Parma, Italy; University of Verona, Italy) GoLiSA is a static analysis tool that allows the verification of smart contracts written in Go, the most widely used language for developing smart contracts in Hyperledger Fabric. GoLiSA relies on abstract interpretation to model program semantics and identify potential risks and vulnerabilities in smart contracts. It supports advanced analyses such as information flow tracking and numerical and string value analysis, enabling the approximation of semantic program behaviors. Building on these analyses, GoLiSA implements a suite of checks for detecting non-trivial issues and potential risks in Hyperledger Fabric, including non-determinism, phantom reads, untrusted cross-contract invocations, read-after-write and over-write issues, cross-channel invocation risks, numerical issues, and unhandled errors. GoLiSA is publicly available at https://github.com/lisa-analyzer/go-lisa. A demonstration video showcasing the tool is available at https://youtu.be/WqkYOpWc9oE. Article Search Artifacts Available Article: ase26tool-p147-p doi:10.1145/3832783.3834644
	Argyros, George	ASE '26: "From Security Findings to ..." From Security Findings to Verified Fixes: Automated Repair of Infrastructure-as-Code Misconfigurations Ying Li, Tamjid Al Rahat, Yingjun Lyu, Omer Tripp, and George Argyros (University of California at Los Angeles, USA; Amazon Web Services, USA) Traditional Infrastructure as Code misconfiguration remediation requires manual analysis, a labor-intensive approach that cannot meet the scale and speed demands of modern cloud deployments. We present IacFix, an agentic tool that combines LLM-based agents with formal methods to enable automated IaC security remediation from security findings to validated patches. IacFix introduces end-to-end remediation capabilities across CDK and CloudFormation packages, leveraging historical fix patterns and iterative refinement to produce validated patches for complex misconfigurations. For example, IacFix achieves 80.9% end-to-end success rate with 97.7% fault localization precision and 7.12 minutes average processing time, demonstrating comparable effectiveness to manual fixes while delivering automated solutions significantly faster. Notably, IacFix outperforms LLM-only baselines by 45 percentage points in real-world scenarios such as dangling hostclass remediation. The system exhibits one-sided error: it either produces a validated patch or safely declines to patch, ensuring that no incorrect patch is surfaced to developers. Our approach shows promising potential for addressing diverse misconfiguration types at scale. Article Search Article: ase26ind-p211-p doi:10.1145/3832783.3834509
	Arora, Chetan	ASE '26: "Requirements-Augmented Generation ..." Requirements-Augmented Generation for Trustworthy Acceptance Testing of LLM-Based Software Fanyu Wang, Chetan Arora, Zhenping Xie, Yonghui Liu, Kla Tantithamthavorn, Aldeida Aleti, and Siwei Jiang (Monash University, Australia; Jiangnan University, China; Australian National University, Australia; Yiwuyishi Intelligent Technology (Nantong), China; Tianjin University, China) LLM-based software (LBS) integrates large language models as core components to deliver flexible and personalised responses. Unlike traditional software with deterministic outputs, LBSs exhibit context-dependent, stochastic behaviour that renders classical acceptance testing and test oracles insufficient: the same query may require fundamentally different responses depending on users' personas and software context. This gap creates an urgent need for automated acceptance testing frameworks that can autonomously interpret users' instructions, while also raising the challenge of how we can reliably interpret users' intentions in a changing environment. In this paper, we present an automated acceptance testing framework for LBS with calibrated verdict reliability through two technical contributions. First, we introduce REquirements-Augmented Generation (REAG), which interprets user intentions by retrieving relevant software requirements, domain knowledge, and personas via adaptive RAG and self-reasoning to generate context-aware test oracles. Second, recognising that oracle generation may retrieve irrelevant constraints, misinterpret intent, or hallucinate requirements, we introduce a confidence-calibrated cascade judgment that quantifies verdict reliability via simulated expert agreement, accepting high-confidence verdicts, escalating ambiguous cases, or abstaining when uncertain, with empirical reliability guarantees backed by conformal risk control. An industrial case study on a production nutrition advisory application demonstrates that REAG achieves a 3.91/5 oracle quality score, successfully achieving qualified or marginal oracle quality in 82% of cases. The confidence-calibrated cascade achieves 98.8% accuracy, improves oracle quality from 3.91 to 4.30 by filtering unqualified outputs, and delivers a 31.7% cost-efficiency improvement over single-judge baselines, validating industrial viability. Article Search Article: ase26ind-p113-p doi:10.1145/3832783.3834491 ASE '26: "Specifying the Delegated-Autonomy ..." Specifying the Delegated-Autonomy Boundary: Requirements Engineering for Agentic AI Chetan Arora, Andreas Vogelsang, and Abbi Sharma (Monash University, Australia; University of Duisburg-Essen, Germany) Agentic AI systems do not just predict or recommend; they plan, maintain state, and act in external environments with varying degrees of autonomy. This changes the requirements engineering problem in a specific and under-addressed way: it introduces what we call the delegated-autonomy boundary - the set of decisions about what may be delegated to the system, under what graduated authority, with what oversight, and how control is returned. Current practices bury these decisions inside prompts, tool schemas, and runtime policies, even though they are requirements-level commitments. This paper proposes two complementary artifacts. First, an Agency Justification Record (AJR) helps teams decide when an agent is warranted over simpler alternatives. Second, an Agentic Delegation Policy (ADP) captures what must be specified for safe and effective development: purpose, authority, information, coordination, assurance, and evolution. Crucially, authority in the ADP is modelled as graduated, i.e., a tiered structure. We illustrate the framework with two contrasting examples: a safety-critical hospital discharge coordination agent and an automated code review agent. Article Search Article: ase26nier-p67-p doi:10.1145/3832783.3834551
	Arp, Benjamin	ASE '26: "xDECAF: An Extensible Data ..." xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security Benjamin Arp, Felix Schwickerath, Alexander Vogt, Tom Hüller, Nils Niehues, and Nicolas Boltz (KIT, Germany) xDECAF is an extensible tool for architecture-based data flow analysis with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domain-specific constraint language with different flow operations, and a browser-based editor backed by an analysis engine. In this paper, we present the xDECAF tool library and a curated catalog of over 20 example models with documented constraints and expected violations, intended as a reusable dataset for the community. The tool has already been adopted by several research lines, providing concrete evidence of its utility. The tool, dataset, and a hosted online editor are publicly available. Screencast: https://youtu.be/L-PGdWoPtlw Code & Dataset: https://github.com/DataFlowAnalysis • https://doi.org/10.5281/zenodo.20083877 Article Search Article: ase26tool-p34-p doi:10.1145/3832783.3834604
	Arrepu, Anirudh	ASE '26: "Towards Multilingual AI-Assisted ..." Towards Multilingual AI-Assisted Software Engineering Shivadharshan S, Anirudh Arrepu, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) India produces about 1.5 million Computer Science undergraduates each year, yet software engineering tooling remains predominantly in English. As the industry transitions to AI-assisted development, this English-centric assumption fails a significant portion of the global developer workforce. While AI and Large Language Models (LLMs) provide a multilingual foundation, their unconstrained application often suffers from semantic drift in low-resource Indian languages and may not consistently reinforce the English terminology commonly used in professional software development contexts. To address this gap, we propose Vocabulary Bridge: a terminology contract for bilingual code explanation. Unlike generic translation tools, this protocol aims at explaining code logic in the developer’s native language while explicitly retaining standard technical English terms. As early feasibility evidence, we present BhashaSE, a Visual Studio Code extension implementing this protocol for Telugu, Hindi, Tamil, and Kannada. By formalizing this approach, we aim to guide LLM generation to support the transition from native understanding to professional English proficiency, establishing a new direction for multilingual AI-assisted software engineering. All tool-related artifacts are open-sourced at https://github.com/rishalab/BhashaSE Article Search Article: ase26nier-p100-p doi:10.1145/3832783.3834558
	Arvan, Erfan	ASE '26: "On the Reliability of Code ..." On the Reliability of Code Comprehension Proxies Erfan Arvan, Nadeeshan De Silva, Oscar Chaparro, and Martin Kellogg (New Jersey Institute of Technology, USA; William & Mary, USA) Prior work on code comprehension uses different comprehension proxies—for example, Likert-scale ratings or answers to input-output questions about program snippets, usually collected from students, to approximate whether code is comprehensible to software engineers, but the relative reliability of these proxies is not known. This paper investigates the relative reliability of a collection of proxies common in the extant literature with a pair of human studies. First, we conducted an expert-consensus study with a panel of five professional software engineers to establish a ground-truth comprehensibility ranking of eight code snippets by adapting the Delphi expert-consensus protocol. The Delphi protocol is widely used for expert consensus under conditions of uncertainty in other domains such as medicine and national-security forecasting, but to our knowledge, this is its first application to code comprehension research. Second, we conducted a study with 44 student participants who completed comprehension tasks, allowing us to measure 14 comprehension proxies derived from the literature on the same set of eight code snippets. Finally, we conducted a correlation analysis on the results, concluding that proxies 1) derived from input-output questions and 2) that measure response time rather than accuracy are especially reliable. We also found that proxies derived from questions about program syntax (rather than semantics) are especially unreliable, regardless of measurement strategy, which draws into question the reliability of parts of the existing comprehensibility literature. Article Search Artifacts Available Article: ase26main-p2877-p doi:10.1145/3832783.3834425
	Asare, Eric	ASE '26: "All or Nothing: How Library ..." All or Nothing: How Library Type Annotations Affect Client-Side Errors in Python Eric Asare, Luca Di Grazia, and Sarah Nadi (New York University Abu Dhabi, United Arab Emirates; University of St. Gallen, Switzerland) Python’s gradual typing promises that library-side type annotations will propagate safety benefits to downstream clients. Despite over 83% of popular libraries now containing annotations, no empirical evidence exists on whether these efforts actually reduce type errors in client code. We present the first large-scale empirical study of this downstream impact, analyzing the interaction between 13,751 actively maintained client repositories and over 4,178 distinct third-party libraries using the Pyright static type checker. Our results show that (i) 70% of client repositories contain at least one type error stemming from third-party API usage, (ii) the error distribution is heavily skewed, with a small subset of widely used libraries, i.e., numpy, django, pandas, and pytorch, accounting for a disproportionate share of the ecosystem-wide error burden, (iii) measurable benefits of reduced error risks and propagation can only be seen with near-complete annotation coverage (≥ 90%), and (iv) although 60% of library-client pairs are aligned in their typing efforts, only 10% achieve the ideal scenario where highly annotated libraries meet client-side static type checking. Our findings expose a pervasive ecosystem gap: client adoption of static type checking outpaces library annotation efforts, with 19% of cases representing missed opportunities where clients use type checkers but their dependencies lack sufficient annotations. These results call for prioritizing comprehensive annotation of widely used libraries to unlock the full potential of Python’s gradual typing. Article Search Artifacts Available Article: ase26main-p3300-p doi:10.1145/3832783.3834434
	Asharindavida, Fayas	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Astekin, Merve	ASE '26: "To Think or Not to Think: ..." To Think or Not to Think: Evaluating LLM Reasoning and Agents in Vulnerability Detection Hua Beng Tan, Ratnadira Widyasari, Merve Astekin, Arda Goknil, Hasan Sözer, Yan Naing Tun, Erik Johannes Husom, Lwin Khin Shar, and Lingxiao Jiang (Singapore Management University, Singapore; SINTEF, Norway; Ozyegin University, Türkiye) Large language models (LLMs) are increasingly studied for software vulnerability detection, but the benefits of recent reasoning-enabled (“thinking”) modes remain unclear. At the same time, agentic LLM designs aim to enhance analysis through structured collaboration, while practical software security workflows require explanations that facilitate inspection, validation, and remediation. Because prior studies often examine these dimensions separately or under heterogeneous settings, their individual effects on vulnerability detection remain difficult to disentangle. This paper addresses the gap through a phased, factor-separated empirical study on the PrimeVul Pair benchmark. In the first phase, we compare instruct and thinking variants of four open models under zero- and few-shot prompting without agents. In the second phase, we evaluate single-, dual-, and multi-agent (SA, DA, and MA) designs alongside call-matched single-agent baselines, alert-burden metrics, and cost analysis. In the third, we assess explanations through blinded human and calibrated LLM evaluation across correct and incorrect predictions, controlling for response length and model family. Thinking improves non-agent (NA) F1 in 7 of 8 settings, mainly through recall, while DA achieves the highest F1/recall but flags 88.2% of functions as vulnerable. MA performs better on pairwise discrimination, although call-matched self-revision achieves the best Pair-wise Correct Prediction (P-C) overall. Thinking also uses 2.7–4.4× more energy, and its F1 benefit declines with greater orchestration. Explanation gains are model-specific, partly length-mediated, and do not distinguish correct from incorrect predictions. Article Search Article: ase26main-p2084-p doi:10.1145/3832783.3837521
	Athaley, Sharvil	ASE '26: "StarFuse: LLM Guided Multimodal ..." StarFuse: LLM Guided Multimodal Interactive Theorem Proving Sharvil Athaley, Samyak Singhania, Khushboo Agrawal, and Subhajit Roy (IIT Kanpur, India) Interactive Theorem Provers (ITPs) like F* provide robust mathematical guarantees for software correctness, but their steep learning curves, specialized syntax, and complex proof mechanics severely limit their mainstream adoption. To lower this entry barrier, we propose StarFuse, an LLM-assisted developer tool that automatically synthesizes fully verified F* programs from mixed-format source files. StarFuse allows developers to express their intents using a combination of natural language, pseudocode, imperative code (C), functional code (OCaml), and F* sketches. It employs a context-aware, compiler-guided repair loop that iteratively queries a Large Language Model (LLM) and utilizes F* compiler diagnostics to refine and fix the generated code. Additionally, it integrates a "fuzz first" mechanism for functional snippets to quickly filter out shallow bugs before invoking the expensive verification process. To evaluate StarFuse, we created a benchmark suite based on instances from the F* repository. Our evaluations demonstrate the ability of StarFuse at successfully verifying implementations across various modalities, thereby offering a practical bridge from informal intent to rigorous formal verification. Article Search Article: ase26tool-p81-p doi:10.1145/3832783.3834627
	Avellaneda, Florent	ASE '26: "AISmellBench: A Reusable Benchmark ..." AISmellBench: A Reusable Benchmark of AI Code Smells in ML and LLM-Based Systems Brahim Mahmoudi, Naouel Moha, Quentin Stiévenart, and Florent Avellaneda (École de Technologie Supérieure de Montréal, Canada; Université du Québec à Montréal, Canada) Artificial Intelligence (AI) systems are increasingly implemented through Machine Learning (ML) pipelines and Large Language Model (LLM) integrations, where design and implementation choices are scattered across data preprocessing code, model configuration, training scripts, provider APIs, and prompt/output logic. Poorly designed choices may form AI code smells, namely recurring implementation patterns that can undermine reproducibility, robustness, maintainability, and trustworthy behavior. Yet, evaluating AI code smell detection approaches remains difficult due to the lack of reusable benchmarks with validated ground truth. We present AISmellBench, a benchmark for AI code smells built through a reproducible pipeline combining GitHub repository mining, eligibility filtering, tool-assisted identification of potential code smell instances, and manual annotation with adjudicated validation artifacts. AISmellBench brings together 1,221 AI-based Python repositories, including 888 ML repositories and 333 LLM-based repositories. The released benchmark contains 1,265 annotated Python files with 3,714 validated AI code smell instances across 31 AI code smell types. Demonstration video: https://youtu.be/xepUUGSHaiU Dataset availability: https://doi.org/10.5281/zenodo.20085308 Article Search Artifacts Available Article: ase26tool-p35-p doi:10.1145/3832783.3834605
	Aydemir, Fatma Başak	ASE '26: "Can Large Language Models ..." Can Large Language Models Decompose User Stories into Tasks? Exploring the Role of Prompting Strategies and Models Delina Ly, Fatma Başak Aydemir, and Fabiano Dalpiaz (VX Company, Netherlands; Utrecht University, Netherlands) Refining user stories (USs) into tasks is an important step in agile software development, as it translates software requirements into project management artifacts that are assigned to team members. This story-to-task decomposition can be tedious. In this paper, we propose and evaluate DELTA, a Large Language Model (LLM)-based approach that automatically generates tasks from USs and assesses the quality of the resulting decompositions. We conduct a two-phase empirical study to evaluate DELTA. In the first phase, we identify the best-performing DELTA configuration by comparing different prompting strategies, LLM families, and sizes using text similarity metrics on human-created and LLM-generated decompositions. The comparison based on these metrics did not identify a single consistently best-performing configuration. Therefore, in the second phase, we conducted an expert evaluation to determine whether the observed differences in text similarity are reflected in expert judgments and whether DELTA’s criteria-based evaluation module, which uses LLM judges, aligns with expert judgments. Our results show that DELTA’s evaluation module produces rankings that align more closely with expert judgments than text similarity metrics. Moreover, experts generally prefer the top three LLM-generated decompositions, as ranked by LLM judges, over those created by humans, and they express a willingness to adopt DELTA. Article Search Artifacts Available Article: ase26main-p4215-p doi:10.1145/3832783.3837558
	Azaletskiy, Pavel	ASE '26: "A Few Pages of Markdown: Committed ..." A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, and Sanmi Koyejo (Stanford University, USA; Carnegie Mellon University, USA; Grid Dynamics, USA) Coding agents increase development velocity but also technical debt. Prior work reports only average effects across adopters, hiding wide differences between teams. We introduce RAMP (Repository AI Maturity Profile), a four-level cumulative maturity model grounded in version-controlled artifacts that teams commit to configure AI tools. RAMP runs from behavioral rules and coding standards through named agent definitions to multi-agent orchestration, with observed practice concentrated in the first three levels. Across 441 repositories the levels behave as a cumulative scale, and independent human annotation reproduces RAMP’s repository-level labels on 97 Article Search Article: ase26main-p2970-p doi:10.1145/3832783.3837546
	Bach, Thomas	ASE '26: "Disassembly-Augmented Root ..." Disassembly-Augmented Root Cause Analysis for C/C++ Segmentation Faults in SAP HANA Jihoon Jung, Chansong You, Jingun Hong, Thomas Bach, and Gabin An (SAP Labs Korea, Republic of Korea; SAP, Germany; Korea University, Republic of Korea) Production failures in large-scale systems are inherently difficult to diagnose, and crash dumps are often the only artifact available for debugging. In C++ programs, this difficulty is further compounded by misleading crash locations in stack traces caused by compiler optimizations such as function inlining. In our dataset of production SIGSEGV crashes from SAP HANA, 66% exhibit such misleading crash locations, which can misdirect both developers and LLM-based debugging agents to the source code of inlined functions rather than the true execution context of the faulting instruction. In this work, we investigate whether explicitly providing disassembly information that reveals the faulting instruction and recovers inlining chains improves bug diagnosis quality in both autonomous agent and tool-disabled LLM modes. Experiments on 91 real-world SIGSEGV crashes show that disassembly context improves root cause analysis quality and generally improves fault localization, especially for misleading crash locations. Moreover, in agent mode, the additional disassembly context does not increase total session cost of diagnosis, as its added input-token cost is offset by reduced exploration of the codebase. Article Search Artifacts Available Article: ase26ind-p32-p doi:10.1145/3832783.3834461
	Baek, Doehyun	ASE '26: "Automated Table Reproduction ..." Automated Table Reproduction via Code Generation Doehyun Baek and Michael Pradel (CISPA Helmholtz Center for Information Security, Germany) Reproducibility is an important goal in computer science research, e.g., for artifact evaluation and to build upon experimental results of prior work. Recently, LLM agents are being used to automatically reproduce research results, but they fail to provide executable evidence of reproduction and do not consider the method of reproduction, which limits their usefulness. We present Artisan, an LLM agent that reproduces tables of numeric results, given a paper and its artifact. The approach is enabled by two key contributions: First, we frame the reproduction problem as a code generation task, enabling users to audit and re-run the resulting reproduction script independently of the agent. Second, we design automated judging mechanisms that steer the agent toward correct results without exposing them, while preventing shortcuts like copying precomputed results. To evaluate Artisan, we introduce Artisan-Bench, the first benchmark assessing the ability to generate code that reproduces research results. Artisan-Bench comprises 60 tasks derived from 23 software engineering papers. Our experiments show that Artisan is effective and efficient, with the added benefit of aiding the discovery of 20 new errors in either the paper or artifact. Article Search Artifacts Available Article: ase26main-p3621-p doi:10.1145/3832783.3834440
	Baek, Geunwoo	ASE '26: "ThreatCraft: Automated Attack ..." ThreatCraft: Automated Attack Scenario Generation via Hybrid Rule-Based and LLM-Driven Reasoning Dohee Kang, Jiwon Kwak, Geunwoo Baek, and Seungjoo Kim (Korea University, Republic of Korea) Recently, the growing complexity of modern Information Technology (IT) systems has made it increasingly difficult to identify realistic attack scenarios. Although various automated approaches have been proposed, challenges such as dependence on expert knowledge and hallucinations in LLM-based methods remain unresolved. We develop ThreatCraft, an attack-scenario generation tool that combines a rule-based engine with Large Language Models (LLMs). ThreatCraft constructs system-level attack paths using a Unified Kill Chain (UKC) and leverages them to guide LLMs in generating detailed attack scenarios. Experimental results across automotive, Industrial Control Systems (ICS), and enterprise domains show that ThreatCraft achieves an average F1-score of 0.984 and a semantic similarity score of 0.893, improving attack-path reconstruction accuracy and semantic similarity by up to 8.3% and 10.7%, respectively, compared with other tools. These results demonstrate that ThreatCraft can consistently generate realistic and structurally coherent attack scenarios across various domains. GitHub:https://github.com/HackProof/2026_ASE_ThreatCraft.git Demo:https://youtu.be/nrIHEKDLp2E Article Search Artifacts Available Article: ase26tool-p39-p doi:10.1145/3832783.3834608
	Baek, Jihun	ASE '26: "Safe Multi-site Binary Instrumentation ..." Safe Multi-site Binary Instrumentation of Running x86-64 Programs Jihun Baek, Sanghoon Han, and Hyungon Moon (UNIST, Republic of Korea) Applying binary instrumentation to a running x86-64 process is difficult because variable-length instructions and weak alignment guarantees prevent safe in-place code modification under concurrent execution. Existing run-time approaches either trap concurrent threads on every overwrite or require global synchronization, limiting scalability. This paper presents DIBE, a run-time binary editing framework that safely instruments running x86-64 programs without trapping in the common case. An admin process resolves all instrumentation decisions, including multi-site patching tactics and trampoline placement, and exports them as metadata. A lightweight runtime inside the target process replays these edits, safely activating E9Patch's multi-site rewriting tactics on the live process by applying their dependent overwrites in an order that keeps every intermediate program state correct under concurrent execution, a guarantee that single-site punning and offline rewriting do not provide. It applies 77-90% of overwrites using hardware atomic primitives invisible to concurrent threads, with a trap-based fallback only for the remaining cross-boundary cases. We evaluate DIBE on 28 SPEC CPU2006 benchmarks and a multi-process Nginx server, and demonstrate it at browser scale on a running Chrome renderer and as a live memory-safety checker. DIBE matches static E9Patch on both instrumentation coverage (near-complete) and execution time overhead (within 0.5% at the geometric mean), keeps per-instruction overwrite latency sub-microsecond, and records zero trap hits across all Nginx configurations under sustained load. Article Search Article: ase26main-p1407-p doi:10.1145/3832783.3837494
	Bagheri, Hamid	ASE '26: "Formal Verification-Integrated ..." Formal Verification-Integrated Reinforcement Learning for Automated ORM Schema Synthesis Md Rashedul Hasan and Hamid Bagheri (University of Nebraska-Lincoln, USA) Object-relational mapping (ORM) frameworks are widely used to bridge object-oriented models and relational databases, but conventional tools generate only single point solutions and often miss optimal trade-offs between performance and storage consumption. Exhaustive tradespace analysis can discover Pareto-optimal database designs, but it is computationally prohibitive for realistic systems. This paper introduces ReinforceORM, an automated and scalable framework that formulates ORM schema synthesis as a multi-objective optimization problem solved via reinforcement learning with formal verification. Our approach integrates multiple RL algorithms to efficiently search the vast space of mapping strategies, balancing insertion time, query performance, and storage consumption, while employing Alloy-based formal analysis to provide bounded verification of structural and semantic correctness in generated schemas. Evaluation across fifteen diverse, real-world software systems shows that ReinforceORM identifies over 80% of ground-truth Pareto-optimal ORM configurations—an 18-fold improvement over leading ORM frameworks such as Hibernate, Django ORM, SQLAlchemy, and Entity Framework. Compared to state-of-the-art specification-driven search, ReinforceORM reduces analysis runtime and memory usage by four and five orders of magnitude, respectively, while maintaining near-optimal solution quality. Article Search Artifacts Available Article: ase26main-p1565-p doi:10.1145/3832783.3837501 ASE '26: "Self-Discovering Security ..." Self-Discovering Security Oracles: Meta-learning Vulnerability Detection Strategies through Adversarial Self-Play Md Rashedul Hasan and Hamid Bagheri (University of Nebraska-Lincoln, USA) Current Large Language Model (LLM) based vulnerability detection systems rely on static prompting strategies and fixed analysis pipelines that fail to adapt to evolving threat landscapes. These approaches struggle to discover unknown vulnerability patterns beyond their training distributions, limiting their effectiveness against emerging security threats. This paper explores adversarial meta-learning where foundation models autonomously discover vulnerability detection strategies through reinforcement learning and competitive self-play. We present MetaMorphSES, a framework that enables Foundational models to evolve in terms of both vulnerability generation capabilities (as a red team) and detection strategies (as a blue team) through adversarial co-evolution without predetermined prompts or fixed architectures. The system learns to generate increasingly sophisticated synthetic vulnerabilities while simultaneously developing detection strategies that generalize to real-world security flaws. Through a dual-loop optimization process, the inner loop generates and detects vulnerabilities while the outer meta-learning loop discovers optimal detection strategies through reinforcement learning. Our experiments on six real-world vulnerability corpora demonstrate that meta-learned security strategies yield substantially stronger detection of unseen vulnerabilities (up to 0.90 F1) against nine strong baselines spanning rule-based static analysis, zero-shot and fine-tuned LLMs, and recent vulnerability detectors, with the system reaching a stable equilibrium. While training remains resource-intensive, the approach establishes adversarial meta-learning as a novel and effective way to discover security vulnerabilities with foundational models through self-directed adaptation without explicit programming of detection rules. Article Search Artifacts Available Article: ase26main-p1822-p doi:10.1145/3832783.3837512
	Bahaj, Ahmed O.	ASE '26: "IoTutorMine: A Tool for Mining ..." IoTutorMine: A Tool for Mining Hardware Bills of Materials from IoT Tutorial Videos Abdullah A. Alahmadi, Ahmed O. Bahaj, and Mohammad D. Alahmadi (University of Jeddah, Saudi Arabia) Internet of Things (IoT) tutorial videos describe the parts a learner must purchase verbally rather than visually, which makes them invisible to frame-based mining techniques developed for programming screencasts. We present IoTutorMine, a tool that recovers structured hardware Bills of Materials (BoMs) from IoT tutorial videos by combining YouTube's auto-generated transcripts with large language models in a zero-shot setting. IoTutorMine-Web, a public prototype, exposes the pipeline as an interactive IoT tutorial catalog: users paste a YouTube URL to get an on-demand BoM, or browse a pre-indexed library searchable by component (e.g., “every tutorial that uses a DHT11”). We also release a benchmark of 20 manually annotated YouTube tutorials covering Arduino and Raspberry Pi at two difficulty levels, with 131 ground-truth components from 16 distinct creators, together with an expert-curated alias dictionary and evaluation scripts. Under a two-tier entity-resolution strategy that combines syntactic matching with semantic canonicalization, Gemini 3 Flash reaches F1 = 0.933, GPT-5 F1 = 0.887, and Claude Opus 4.7 F1 = 0.868, with Gemini significantly outperforming Claude on per-video F1 (Wilcoxon p = 0.028). The results demonstrate that transcript-only BoM extraction is feasible for practical IoT cataloging applications, and that a semantic mapping layer is essential to resolve hardware nomenclature variations. Article Search Article: ase26tool-p160-p doi:10.1145/3832783.3834647
	Bahrami, Mehdi	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Bai, Guangdong	ASE '26: "SPSYN: Synthesizing DeFi Price-Manipulation ..." SPSYN: Synthesizing DeFi Price-Manipulation Exploits via Semantic Recovery and State-Guided Search Bosi Zhang, Ningyu He, Guangdong Bai, and Haoyu Wang (Huazhong University of Science and Technology, China; Hong Kong Polytechnic University, Hong Kong; City University of Hong Kong, Hong Kong) Price manipulation is one of the most damaging vulnerability classes in decentralized finance (DeFi) protocols. Existing approaches mainly stop at warning generation or rely on rigid attack templates, and therefore struggle to determine whether a victim protocol is profitably exploitable under a concrete chain state. This problem is challenging because the attack-relevant victim-side steps are highly protocol-specific, while successful exploitation further depends on brittle runtime conditions such as reserve states, token-specific guards, and narrow numeric ratios. In this paper, we present SPSYN, a DeFi price-manipulation exploit synthesizer that combines semantic recovery with state-guided search. SPSYN first extracts structured cross-contract contexts and uses an LLM to recover attack-relevant victim-side function roles. It then organizes the recovered functions into stage-consistent candidates and scenario-guided initial seeds. Finally, it synthesizes exploit witnesses on a concrete chain snapshot through state-guided search under a semantic-aware state machine. Runtime observations reveal whether the transformed sequence has established a meaningful anomaly, whether it should continue to be expanded, and how later mutations should be refined. In this design, semantic recovery narrows the search to the right victim-side actions, while exploitability is validated through actual execution on the target snapshot. On 29 historical incidents, SPSYN synthesizes profitable exploit witnesses for 27 cases (93.1%), outperforming ItyFuzz (11/29), CPMMX (19/29), and FlashSyn (7/29), with a median time-to-first witness of 114 seconds on successful cases. During on-chain deployment across Ethereum and Binance Smart Chain, SPSYN further discovers 9 previously unreported profitable vulnerabilities with a cumulative potential profit of $35.1K. Article Search Article: ase26main-p2062-p doi:10.1145/3832783.3837520
	Bai, Ruiqi	ASE '26: "Aligning User Requirement ..." Aligning User Requirement with Large Language Model in Code Generation Jia Li, Ruiqi Bai, Yangkang Luo, Yiran Zhang, Wentao Yang, Zeyu Sun, Tiankuo Zhao, Dongming Jin, Lei Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Institute of Software at Chinese Academy of Sciences, China; Peking University, China; University of Hong Kong, Hong Kong) Code generation refers to automatically producing executable programs from user requirements. Recently, researchers have explored approaches to enhance the correctness of generated code with advanced large language models. Although achieving improvements, existing approaches focus on designing reasoning strategies or post-refinement methods to enhance code generation performance. Despite their differences, all these methods share a common assumption: the LLM can correctly understand the given requirement. However, this assumption does not always hold. To fill this gap, we propose REA-Coder, a requirement alignment approach to enhance the code generation performance of LLMs. REA-Coder involves first identifying the requirement content that does not align with LLMs and aligning the requirements. Then, based on the aligned requirements, LLMs generate code and further verify whether the generated code aligns with the requirements, iterating this process of requirement alignment and code generation until generating correct code or achieving the maximum number of iterations. Experimental results show that REA-Coder outperforms all advanced baselines on four LLMs across five programming benchmarks. Concretely, REA-Coder achieves average improvements of 7.93%, 30.25%, 26.75%, 8.59%, and 8.15% on the five benchmarks, demonstrating the effectiveness of requirement alignment for improving the code generation performance of LLMs. Article Search Article: ase26main-p1298-p doi:10.1145/3832783.3837487
	Ban, Younghoon	ASE '26: "RAVEN: Measuring Detection ..." RAVEN: Measuring Detection Instability in Anti-virus Engines under Semantics-Preserving Perturbations Younghoon Ban, Beomjin Jin, Doowon Kim, Hyoungshick Kim, and Haehyun Cho (Soongsil University, Republic of Korea; Ajou University, Republic of Korea; University of Tennessee, Knoxville, USA; Sungkyunkwan University, Republic of Korea) Real-world anti-virus (AV) engines continue to rely heavily on signature-based detection, whereas academic adversarial research has largely focused on ML-based models, leaving an evaluation gap. To better understand signature-based detection behavior, we analyze ClamAV’s open-source signature database as a white-box reference point. Our analysis shows that raw byte-level signatures account for 94.54 Article Search Article: ase26main-p1356-p doi:10.1145/3832783.3837492
	Bansal, Chetan	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472 ASE '26: "eARCO: Efficient Automated ..." eARCO: Efficient Automated Root Cause Analysis with Prompt Optimization Drishti Goel, Raghav Magazine, Supriyo Ghosh, Akshay Nambi, Prathamesh Deshpande, Xuchao Zhang, Chetan Bansal, and Saravan Rajmohan (University of Illinois at Urbana-Champaign, USA; Microsoft Research, India; Inception, United Arab Emirates; Microsoft, India; Microsoft Research, USA; Microsoft, USA; Microsoft 365, USA) Root cause analysis (RCA) for incidents in large-scale cloud systems is a complex, knowledge-intensive task that often requires significant manual effort from on-call engineers (OCEs). Improving RCA is vital for accelerating the incident resolution process and reducing service downtime and manual efforts. Recent advancements in Large-Language Models (LLMs) have proven to be effective in solving different stages of the incident management lifecycle including RCA. However, existing LLM-based RCA recommendations typically leverage default finetuning or retrieval augmented generation (RAG) methods with static, manually designed prompts, which lead to sub-optimal recommendations. In this work, we leverage 'PromptWizard', a state-of-the-art prompt optimization technique, to automatically identify the best optimized prompt instruction that is combined with semantically similar historical examples for querying underlying LLMs during inference. Moreover, by utilizing more than 180K historical incident data from Microsoft, we developed cost-effective finetuned small language models (SLMs) for RCA recommendation generation and demonstrate the power of prompt optimization on such domain-adapted models. Our extensive experimental results show that prompt optimization can improve the accuracy of RCA recommendations by 21% and 13% on 3K test incidents over RAG-based LLMs and finetuned SLMs, respectively. Lastly, our human evaluation with incident owners have demonstrated the efficacy of prompt optimization on RCA recommendation tasks. These findings underscore the advantages of incorporating prompt optimization into AI for Operations (AIOps) systems, delivering substantial gains without increasing computational overhead. Article Search Article: ase26ind-p86-p doi:10.1145/3832783.3834477 ASE '26: "Debugging the Debuggers: Failure-Anchored ..." Debugging the Debuggers: Failure-Anchored Structured Recovery for Software Engineering Agents Chenyu Zhao, Shenglin Zhang, Yihang Lin, Wenwei Gu, Zhimin Chen, Yongqian Sun, Dan Pei, Chetan Bansal, Saravan Rajmohan, and Minghua Ma (Nankai University, China; Tsinghua University, China; Microsoft, USA; Microsoft 365, USA) Software engineering agents are increasingly deployed in evaluable engineering environments, yet post-failure recovery remains costly, manual, and largely ad hoc. Existing systems expose traces for inspection or generate follow-up feedback, but they do not turn heterogeneous runtime evidence into grounded, bounded recovery guidance for a subsequent attempt. We present PROBE, a failure-anchored framework for structured recovery in software engineering agents. PROBE organizes failed-run telemetry into structured evidence, structured diagnosis, and bounded recovery guidance, realized by a Telemetry Layer, a Diagnosis Layer, and a Guidance Gate. The Telemetry Layer preserves fine-grained runtime signals, the Diagnosis Layer fuses cross-signal evidence into a grounded diagnosis, and the Guidance Gate constructs diagnosis-derived recovery guidance only when it is evidence-grounded, actionable, and within the scope of agent-side behavior. We evaluate PROBE across three software engineering settings spanning repository-level software repair, enterprise workflow recovery, and AIOps service mitigation. On 257 initially unresolved cases, PROBE achieves 65.37% Top-1 diagnosis accuracy and a 21.79% recovery rate, outperforming the strongest non-PROBE baseline by 43.58 and 12.45 percentage points, respectively. The results reveal a substantial diagnosis-recovery gap: accurate diagnosis is necessary but not sufficient unless it can be translated into bounded guidance that the subsequent attempt can execute and verify. Beyond controlled evaluation, a Microsoft IcM prototype shows that PROBE can attach as a non-intrusive side channel to existing service-diagnosis agent workflows without changing the agent policy, toolset, or execution budget. These results suggest that telemetry-grounded, failure-anchored recovery is a practical path to improving post-failure recoverability of software engineering agents under realistic engineering constraints. Article Search Article: ase26ind-p114-p doi:10.1145/3832783.3834492 ASE '26: "When Does AI Actually Help ..." When Does AI Actually Help in Incident Response? Identifying Good First Messages in Cloud Service Incidents Minghua Ma, Rujia Wang, Chetan Bansal, Saravan Rajmohan, Yingnong Dang, and Hongyu Zhang (Microsoft, USA; Chongqing University, China) Modern cloud services increasingly rely on agentic software operations, where AI agents, rule-based automation (monitoring alerts, health checks, template runbooks), and human engineers coordinate incident response through shared discussion threads. As these systems mature, the on-call engineer faces a growing volume of machine-generated messages and must quickly identify which ones actually help, under minutes-level time pressure where every moment spent reading noise delays mitigation. We study this problem across thousands of production incidents from 5 cloud services over four years (2022 to 2026). We define a good first message (GFM): the first machine-generated message in an incident discussion thread whose specific content demonstrably influences the on-call engineer’s next investigation action. Three findings emerge. First, incident threads grew 7× longer (from a median of 4 to 30 messages) as AI agents were introduced, yet noise (messages lacking substantive technical content) decreased: among the three actor types, AI agents, rule-based automation, and humans, AI produces the lowest noise rate. Second, AI agents and automation are complementary, covering different workflow roles (e.g., diagnosis vs. monitoring) rather than duplicating each other. Third, only about one in five incidents contains a GFM; influence varies dramatically by functional role but far less by actor type: what a message says matters more than who posted it. We further show that GFMs can be surfaced automatically: σ-rank, an LLM ranker whose prompt encodes domain knowledge from the empirical study, places the GFM in the top 3 of ∼20 machine messages 89% of the time, reducing the engineer’s noise-reading burden by 7×. These results provide the first empirical evidence of how deployed AI output is actually consumed during live incidents and offer a practical mechanism to cut through information overload in time-critical incident response. Article Search Article: ase26main-p860-p doi:10.1145/3832783.3837473
	Baral, Talank	ASE '26: "TDRepro: A Neurosymbolic Approach ..." TDRepro: A Neurosymbolic Approach to Reproducing Timing-Dependent Flaky Test Failures Shanto Rahman, Talank Baral, August Shi, and Wing Lam (University of Texas at Austin, USA; George Mason University, USA) Tests that nondeterministically pass or fail on the same version of code are known as flaky tests, and their failures substantially hinder regression testing and debugging. Reproducing failures from timing-dependent (TD) flaky tests is particularly challenging because these failures depend on rare thread interleavings that may not occur even after running the test many times. Prior techniques reproduce such failures by searching for locations at which to inject delays during execution, but this search process can be expensive. We present TDRepro, an automated approach that leverages large-language models (LLMs) and program analysis to efficiently reproduce TD test failures. TDRepro first identifies relevant methods by collecting executed methods during the test run and identifying those that execute concurrently with other methods. It then ranks these methods by computing the embedding similarity between each method’s code and the observed failure log. Finally, TDRepro uses an LLM to identify candidate locations for delay injection within the top-ranked methods. TDRepro validates these candidates by injecting delays and rerunning the test, iteratively refining the candidate locations based on unsuccessful attempts until the target failure is reproduced or the maximum number of iterations is reached. We evaluate TDRepro on 82 TD tests across 25 modules from open-source Java Maven projects. TDRepro reproduces 100% more failures than prior state-of-the-art technique, FlakeRake, and achieves more reliable reproduction, with 55 tests reaching a failure reproduction rate of >99%, compared with 30 tests for FlakeRake. Repeatedly reproducing failures with TDRepro requires 1482.11× and 36.5× less time and incurs 1104.2× and 26.9× lower cost than repeatedly rerunning tests and using FlakeRake, respectively. Article Search Article: ase26main-p1337-p doi:10.1145/3832783.3834384
	Barnes, Marcia	ASE '26: "Toward Inclusive Programming ..." Toward Inclusive Programming Support for Novice Programmers with Dyslexia: Insights from a Comparative Study Zihan Fang, Janice Chung, Ruijia Chen, Marcia Barnes, Yuhang Zhao, and Yu Huang (Vanderbilt University, USA; University of Wisconsin-Madison, USA) Programming attracts a diverse range of learners, including individuals with dyslexia, a learning difficulty that affects reading, writing, and spelling despite average intelligence and educational opportunities. Although prior work has examined dyslexia in natural-language and code comprehension, we still know little about how dyslexic learners engage with code relative to natural language, and what this implies for inclusive programming environments. This gap is especially important in the AI era, as novice programmers increasingly rely on AI-powered coding and learning tools that may not address the distinct comprehension and cognitive support needs of learners with dyslexia. To address this gap, we conducted an eye-tracking study with a mixed-methods design involving 24 novice programmers (12 with dyslexia, 12 without) who completed paired code-comprehension and English-comprehension tasks. We found that although the two groups showed similar overall visual scanning patterns, eye-gaze features suggest higher cognitive effort among dyslexic novices during code comprehension. We also found that the performance gap between dyslexic and neurotypical learners was smaller in code comprehension than in English comprehension, suggesting that programming-specific representations may reshape, rather than eliminate, dyslexia-related challenges. In addition, dyslexic novices reported lower confidence, viewed general training methods as less effective, and described difficulties with symbolic elements and structurally complex code. These findings provide an empirical basis for designing AI-assisted programming tools that can detect cognitive overload and adapt explanations, feedback, and task support to better support dyslexic novices. Article Search Article: ase26main-p2412-p doi:10.1145/3832783.3834414
	Barr, Earl T.	ASE '26: "Evaluating Inference-Time ..." Evaluating Inference-Time Defenses against Package Hallucination in LLM-Generated Code Alberick Euraste Djire, Iyiola E. Olatunji, Melissa Tessa, Earl T. Barr, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg; University College London, UK) LLMs are increasingly used for code generation, yet they frequently hallucinate non-existent software packages, creating exploitable entry points into the software supply chain. We make four contributions to this problem. First, we show that prior evaluation methodologies systematically inflate hallucination rates by misclassifying standard-library modules as hallucinations in some languages. For Python, the overestimation reaches 9.4 percentage points. Second, we evaluate seven inference-time defenses for mitigating package hallucinations, including five guided decoding strategies (Greedy, Contrastive, DoLa, Nudging, and Active Layer-Contrastive Decoding), an iterative self-refinement approach (Self-Refine), and a Retrieval-Augmented Generation (RAG)-based defense. Across eight models spanning five families and four programming languages (Python, JavaScript, Ruby, Rust), RAG reduces the package hallucination rate (PHR) in 18 of 32 model–language configurations. Third, we introduce Package Utility (PU) to assess whether defenses preserve valid and task-relevant recommendations. Among strategies evaluated, Greedy decoding provides the strongest average mitigation–utility trade-off. Fourth, we stress-test all strategies under adversarial prompts seeded with fabricated package names and find that PHR surges by up to 45 percentage points relative to standard prompts, with Ruby consistently the most vulnerable language (80.9–95.2%). Under adversarial conditions, RAG and Self-Refine outperform all decoding-only strategies, indicating that robust defense requires either external grounding or iterative self-verification when prompts are actively hostile. Our results recast package hallucination as both a measurement problem and a decoding-time control problem, and they demonstrate that the choice of defense must be matched to the threat model and recommendation utility. Article Search Article: ase26main-p3592-p doi:10.1145/3832783.3837555 ASE '26: "Compressing Code Context for ..." Compressing Code Context for LLM-Based Issue Resolution Haoxiang Jia, Earl T. Barr, and Sergey Mechtaev (Peking University, China; University College London, UK) Large Language Models (LLMs) are now capable of resolving real-world GitHub issues. However, current approaches overapproximate the code context and suffer from two compounding problems: the prohibitive cost of processing massive inputs, and low effectiveness as noise floods the context window and distracts the model from the bug-fixing signal. Existing compression techniques fail to resolve this tension: generic compressors compromise the semantic integrity of code, while code-specific tools lack awareness of code structure and task context to preserve essential patch ingredients. To address this, we propose a novel framework consisting of two components. First, Oracle-guided Context Distillation (OCD), a context distillation algorithm that combines genetic search and delta debugging to systematically reduce code contexts to their minimal sufficient subsequence — retaining only the ingredients required for a successful fix. We use this distilled data to fine-tune , a lightweight model that learns to compress code context at inference time, filtering noise and combating distraction while preserving fix ingredients. Evaluated on SWE-bench Verified across three frontier LLMs, maintains a stable compression rate of about 6× across models, reduces the total token budget by 51.8%–71.3% relative to the uncompressed setting, improves issue resolution rates by 5.0%–9.2%, and delivers the best overall balance among effectiveness, compression ratio, and latency compared with state-of-the-art context compression baselines. Article Search Article: ase26main-p1597-p doi:10.1145/3832783.3834397
	Basciani, Francesco	ASE '26: "Don’t Retest Everything: ..." Don’t Retest Everything: Auditable Regression Scoping for Safety-Critical Systems Francesco Basciani, Daniele Masti, Patrizio Pelliccione, Alberto Petrucci, Franco Raimondi, Emerson Sales, and Paolo Serri (Gran Sasso Science Institute, Italy; Gran Sasso Tech, Italy; Thales Alenia Space Italia, Italy) In safety-critical software development, changes often span technical and organisational boundaries, e.g., repositories, interfaces, libraries, and teams. Under certification and traceability requirements, these changes create a difficult regression-testing problem: organisations must determine what must be revalidated and provide an auditable justification for those decisions. In practice, the resulting uncertainty often drives overly conservative strategies, where large portions of the system are retested after changes or updates, even when a narrower scope would suffice. In this paper, we present CoCoS, an automated regression-testing approach for safety-critical systems written in C and developed under traceability and certification constraints. Developed end-to-end with Thales Alenia Space Italia, a large international aerospace company, and grounded in avionics practice, CoCoS addresses real certification-driven needs rather than an abstract setting. It combines semantic differencing, abstract syntax tree analysis, and function-level call-graph propagation to identify semantically relevant changes across repository and component boundaries, and to derive conservative regression scopes with human-readable justifications. CoCoS prioritizes conservativeness, explainability, and auditability, thereby supporting defensible regression-scoping decisions in regulated workflows. We evaluate CoCoS in an industrial setting with Thales Alenia Space Italia, using a realistic multi-repository aerospace software environment involving application code and external libraries. The results show that CoCoS supports the conservative bounding of regression scopes while preserving compliance-oriented reasoning and providing practical evidence for test planning in safety-critical environments. Article Search Article: ase26main-p115-p doi:10.1145/3832783.3837416
	Basu, Shrutarshi	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Batole, Fraol	ASE '26: "RefineAct: Automatic Runtime ..." RefineAct: Automatic Runtime Verification of LLM Agent Actions Fraol Batole, Foutse Khomh, and Hridesh Rajan (Tulane University, USA; Polytechnique Montréal, Canada) LLM-based agents that invoke external tools can cause irreversible harm when their actions diverge from user intent, from deleting critical files to exposing private data or executing untrusted code. Unlike traditional software, where test suites and contracts define expected behavior, LLM agents operate without a specification: there is no artifact against which to check their actions before execution. Existing safeguards rely on prompt engineering or post-hoc evaluation, neither of which closes this gap. We present RefineAct, a runtime verification framework that automatically derives a task-specific specification from the user’s natural-language instruction and enforces it during agent execution. RefineAct operates in three stages: (1) intent formalization translates instructions into first-order Prolog predicates capturing the user’s goal and safety requirements; (2) refinement-based planning decomposes the specification into a concrete action plan with pre-/postcondition chains and risky-action patterns; and (3) runtime verification intercepts each agent-proposed action, queries the Prolog knowledge base to verify precondition satisfaction and constraint compliance, and returns a disposition state that determines whether the action proceeds, requires user confirmation, or is blocked with corrective feedback. We evaluate RefineAct on 144 agent tasks across five domains from the ToolEmu benchmark. RefineAct reduces failure incidence from 77% to 39% while improving task completion quality from 1.0 to 1.9 on a 0–3 scale, demonstrating that deriving and enforcing specifications at runtime can improve both safety and helpfulness of LLM agent behavior. Article Search Article: ase26main-p2301-p doi:10.1145/3832783.3834409
	Bayat, Akram	ASE '26: "Continuum: Automated Construction ..." Continuum: Automated Construction and Retrieval of Software Decision Knowledge Graphs from Developer-AI Conversations Mohammad Ali Shehral, Karthik Ravi, Nikhil Trivedi, and Akram Bayat (Northeastern University, USA) Developer-AI conversations, through coding assistants and chat-based programming aids, produce rich architectural decision traces (trigger, context, alternatives considered, decision, rationale) that are lost when the chat session ends. Conversation logs are unstructured, not indexed for retrieval, and disconnected from one another, so a team member joining weeks later cannot recover why a technology was chosen or what alternatives were considered. We present Continuum, an end-to-end system that captures and serves software decision knowledge from developer-AI conversation logs. The system integrates five engineered stages: (1) LLM-based decision extraction with chain-of-thought prompting, (2) a 7-stage cascading entity resolution pipeline combining cached lookups, a curated canonical dictionary (534 technology-name mappings), fuzzy matching, and embedding similarity, (3) a Neo4j knowledge graph with polyglot persistence across PostgreSQL and Redis, (4) a GraphRAG retrieval layer combining BM25 fulltext and NV-EmbedQA vector search via Reciprocal Rank Fusion with K-hop subgraph expansion, and (5) an agent integration layer via the Model Context Protocol (MCP) that enables coding agents to both query prior decisions and contribute new ones. The contribution is the end-to-end integration: prior work has explored individual pieces (decision extraction, knowledge graphs, GraphRAG), but not a deployable system that ties them together for developer-AI conversations. We report a preliminary evaluation on a synthetic corpus of 200 generated developer-AI conversations across 9 technical domains, using a held-out train/test methodology. On our synthetic dataset, the 7-stage entity resolver attains 97.2% accuracy on 981 test mentions (95% CI: [96.2%, 98.3%]), outperforming exact-match (74.6%) and fuzzy-only (76.7%) baselines under McNemar's test (p < 0.001), with B-cubed F1 = 0.979. Two of the authors independently judged 40 sampled decision traces, yielding extraction precision of 75.0% (all categories) and 97.3% when exploratory non-decisions are excluded; on the 10-item overlap, Cohen's kappa = 0.07 reflects genuine disagreement on what qualifies as a "decision" in open-ended AI chat. On 40 graph-derived queries, hybrid GraphRAG retrieval achieves full recall across decision-search, tech-comparison, and entity-lookup query types (MRR = 0.775); a manual relevance assessment by the two reviewers on 10 natural-language queries yielded a mean rating of 2.2/3.0. As a real-log case study, we apply the pipeline to the full Claude Code session history from the build of Vibe Voyager, a public agent-built browser game (github.com/shehral/vibe); from 77 segmented and scrubbed sub-conversations the system extracts 379 decision traces and 290 unique canonical entities, with the decisions splitting 65% agent-made vs. 35% human-made (Section 4.2). We are transparent about the limitations of this evaluation (synthetic corpus, small annotator pool, proxy ground truth for 150 conversations, graph-derived queries) and discuss them in Section 4.3. Overall, these results indicate that architectural decision knowledge can be recovered from developer-AI conversations with high entity-resolution accuracy and demonstrated feasibility on real logs, while robust measurement of extraction quality and generalization to multi-developer settings remain open. Article Search Artifacts Available Article: ase26ind-p465-p doi:10.1145/3832783.3834535
	Bechet, François	ASE '26: "EnergyTrackr: A Modular Energy ..." EnergyTrackr: A Modular Energy Regressions Detection Tool François Bechet, Jérôme Maquoi, Luís Cruz, Benoît Vanderose, and Xavier Devroey (University of Namur, Belgium; TU Delft, Netherlands) Energy efficiency is increasingly recognized as an important dimension of software quality. As systems evolve rapidly, tracking how energy consumption changes across versions can provide valuable insights for developers and researchers. Although detecting energy regressions (i.e., unintended increases in energy consumption) remains challenging due to measurement variability and complex execution environments, recent advances now make systematic analysis practical. Still, dedicated support for monitoring energy behavior over a project's history is missing. This paper presents EnergyTrackr, a modular, open-source tool for automatically detecting, classifying, and visualizing energy regressions across a commit history. EnergyTrackr traverses a specified set of commits, builds each revision, and measures application-level energy consumption by executing the test suite using the RAPL-based Linux perf utility. It applies established best practices for measurements such as warm-up, randomized execution, repetition, and thermal control. The resulting data are analyzed through a statistical pipeline that filters outliers and classifies energy changes using multiple criteria (e.g., significance, practical impact, ...). EnergyTrackr generates interactive reports that provide a comprehensive view of energy evolution and is designed for easy integration into existing Linux workflows. A preliminary evaluation on large Java projects shows that EnergyTrackr can produce stable measurements at scale and effectively identify energy regressions. Source: https://github.com/snail-unamur/energytrackr. Screencast: https://doi.org/10.5281/zenodo.21507425. Article Search Article: ase26tool-p125-p doi:10.1145/3832783.3834640
	Becker, Steffen	ASE '26: "Evaluating the Maintainability ..." Evaluating the Maintainability of ViewModel Tests using Multi-modal DSLs: An Industrial Mixed-Methods Study Mario Fuksa, Sandro Speth, and Steffen Becker (University of Stuttgart, Germany; TU Munich, Germany) As in many modern software engineering domains, the quality of an application's Graphical User Interface (GUI) is fundamentally verified by automated testing. One established approach to mitigate testing challenges is to leverage architectural patterns, such as Model-View-ViewModel (MVVM), to decouple presentation logic and test it in isolation. However, developing these ViewModel tests in general-purpose languages (GPLs) often forces engineers to write excessive boilerplate code for test setup and complex assertion chains. While multi-modal domain-specific languages (DSLs) show promise in mitigating these GPL-related issues, empirical evidence of their impact on test maintainability in practice is lacking. To address this gap, we present an industrial mixed-methods study evaluating how abstracting GUI tests to the ViewModel level via multi-modal DSLs impacts maintenance overhead in practice, using the ViMoTest method as our representative realization. After establishing industrial applicability via a pre-study comprising action research and a case study, we conducted a task-based evaluation with industry experts, triangulated with semi-structured interviews and a questionnaire. Quantitative results indicate that the ViMoTest method shows a strong tendency to reduce test specification effort and size compared to a C++ engineering baseline. Furthermore, qualitative expert feedback indicates that visual assertions and robust refactoring capabilities reduce cognitive load during structural test evolution. Overall, this study provides empirical evidence that multi-modal DSLs positively impact the maintainability of ViewModel tests. Article Search Article: ase26main-p892-p doi:10.1145/3832783.3834370
	Beckert, Bernhard	ASE '26: "Can Formal Specifications ..." Can Formal Specifications Be Synthesized from Tests Alone? Tianhai Liu, Maximilian Müller, Tobias Hey, Vitus Lüntzel, Muhammad Minhas, Anne Koziolek, and Bernhard Beckert (KIT, Germany) Formal specifications offer strong guarantees, but remain costly to write manually. Recent LLM-based approaches automate this by inferring specifications from source code, yet their reliance on white-box access poses barriers to industrial adoption due to intellectual property risks and deployment costs. Our approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden. Candidate specifications are validated locally using bounded model checking, with feedback guiding iterative refinement. Initial results on the SpecGenBench benchmark suggest that tests can guide LLMs towards meaningful Java Modeling Language specifications, while also highlighting checker compatibility and diagnostic feedback as key challenges for reliable refinement. Article Search Artifacts Available Article: ase26nier-p62-p doi:10.1145/3832783.3834549
	Benavides, David	ASE '26: "Feature-Focused Test Generation ..." Feature-Focused Test Generation José Antonio Zamudio Amaya, Gaetano Sapia, Alexi Turcotte, David Benavides, Marcel Böhme, and Andreas Zeller (CISPA Helmholtz Center for Information Security, Germany; MPI-SP, Germany; Universidad de Sevilla, Spain) Specification-based test generators use input specifications to produce valid tests for complex systems, covering the entire input space of the system under test. This broad generation capability, however, can become a burden when one wants to focus test generation on a particular subset of the input space, say, a feature whose implementation has recently changed or is particularly critical. In this paper, we propose Feature-Focused Test Generation (FFTG), an approach that treats specification-based test generation as a configuration problem. From the input specification, FFTG first extracts a feature model that represents alternate and optional expansions as possible feature values. After the tester selects which features to focus upon, FFTG specializes the specification accordingly, generating inputs in which only the focused features vary. We implement FFTG in a prototype named Compás. In our evaluation, we find that Compás-generated slices (1) effectively focus test generation on specific features, preserving validity; (2) exercise unique code locations associated with the targeted features and thus enable traceability of features; and (3) enable test suite minimization, with a small set of slices retaining the aggregate coverage of the full suite while requiring fewer tests. To the best of our knowledge, this is the first work to apply product line engineering techniques to specification-based testing. Article Search Article: ase26main-p1023-p doi:10.1145/3832783.3837479
	Bengtsson, Jacob	ASE '26: "Agent-HAnS: Maintaining Feature ..." Agent-HAnS: Maintaining Feature and Code Traceability in Agentic Development Johan Martinson, Jacob Bengtsson, Moltas Hultin, Kevin Hermann, and Thorsten Berger (Ruhr University Bochum, Germany; University of Gothenburg and Chalmers University of Technology, Sweden) Agentic coding tools using LLMs enable developers to quickly generate software. However, developers quickly lose the overview over their increasingly complex codebases. During code generation, no knowledge about what features exist or where they are implemented is documented. We present Agent-HAnS, an agentic workflow which instructs the LLM to update a feature model and generate embedded feature annotations after each code-generation step. It visualizes the evolving structure on a live dashboard served via a Model Context Protocol server. We demonstrate Agent-HAnS on a C#/.NET 9 web API evolved through 27 prompts across 10 evolution steps, with most annotations maintained automatically and no active annotation effort from the developer. In a manual audit, 92% of fragment annotations and 70% of file mappings remain correct, with errors concentrating at feature merges and splits. In a user study, Agent-HAnS scored 73.9 on the System Usability Scale. Tool video: https://youtu.be/Nb-eDrGokI8 Article Search Article: ase26tool-p225-p doi:10.1145/3832783.3834652
	Bensoussan, Avner	ASE '26: "Quantum Squeeziness: An Information ..." Quantum Squeeziness: An Information Theoretical Metric for Quantum Software Testability Avner Bensoussan, Hector Menendez, and Mohammad Reza Mousavi (King's College London, UK) Testability—the degree to which faults can be revealed and diagnosed—has long been fundamental in software engineering but remains largely unexplored for quantum software. This work presents the first formalisation of testability for quantum programs, adapting classical concepts to quantum computation. We introduce Quantum Squeeziness, an information-theoretic metric inspired by classical squeeziness, to quantify how faults are masked and prevented from propagating to observable outcomes. We treat it as an inverse measure of testability: higher squeeziness implies stronger fault masking and reduced detectability. We propose an efficient method to compute Quantum Squeeziness and validate it through large-scale quantum mutation analysis. Across more than 50k mutants, we observe a strong negative correlation between squeeziness and mutation score, showing that higher squeeziness predicts lower testability. We further introduce a technique that constrains where and how perturbations are injected, reducing cost while preserving accuracy. The computation is 15% faster than a standard error-propagation baseline, while the optimised variant, FastSqueeziness, reduces mean runtime from 3200s to 189s (16.9 times speedup) with 95% accuracy. By establishing a rigorous foundation of testability for quantum software, this work opens new directions at the intersection of software engineering, quantum information theory, and testing. Beyond testing and debugging, it also supports applications in quantum error mitigation and correction, enabling principled assessment and improvement of program robustness. Article Search Artifacts Available Article: ase26main-p151-p doi:10.1145/3832783.3834341
	Berger, Thorsten	ASE '26: "Agent-HAnS: Maintaining Feature ..." Agent-HAnS: Maintaining Feature and Code Traceability in Agentic Development Johan Martinson, Jacob Bengtsson, Moltas Hultin, Kevin Hermann, and Thorsten Berger (Ruhr University Bochum, Germany; University of Gothenburg and Chalmers University of Technology, Sweden) Agentic coding tools using LLMs enable developers to quickly generate software. However, developers quickly lose the overview over their increasingly complex codebases. During code generation, no knowledge about what features exist or where they are implemented is documented. We present Agent-HAnS, an agentic workflow which instructs the LLM to update a feature model and generate embedded feature annotations after each code-generation step. It visualizes the evolving structure on a live dashboard served via a Model Context Protocol server. We demonstrate Agent-HAnS on a C#/.NET 9 web API evolved through 27 prompts across 10 evolution steps, with most annotations maintained automatically and no active annotation effort from the developer. In a manual audit, 92% of fragment annotations and 70% of file mappings remain correct, with errors concentrating at feature merges and splits. In a user study, Agent-HAnS scored 73.9 on the System Usability Scale. Tool video: https://youtu.be/Nb-eDrGokI8 Article Search Article: ase26tool-p225-p doi:10.1145/3832783.3834652
	Bian, Chong	ASE '26: "Optimization-Free Repair of ..." Optimization-Free Repair of Code LLMs: A Closed-Form Fisher-Guided Bayesian Approach Zhiyu Duan, Chong Bian, Yizhuo Zhang, and Shunkun Yang (Beihang University, China; China Mobile, China) Large language models (LLMs) are increasingly used in software engineering, yet their code generations remain vulnerable to subtle functional errors, making reliable post-hoc repair essential. Existing repair methods typically apply localized parameter updates without explicitly accounting for the heterogeneous importance of pre-trained knowledge, which can entangle targeted correction with unintended changes to general coding ability. We propose Fisher-Informed Semantic Repair (FISR), a principled framework that treats code LLM repair as a Bayesian posterior update constrained by pre-trained prior knowledge. It estimates parameter-wise semantic importance through the Fisher Information Matrix, using local curvature information to identify high-confidence directions that should be preserved during repair. It then introduces Fisher-weighted structural constraints to guide corrective updates away from knowledge-critical parameters and toward more adaptable regions of the parameter space. To make this process scalable, we combine structured curvature approximation with low-rank precision decomposition, enabling efficient closed-form updates within a safe repair subspace rather than relying on iterative retraining. Extensive experiments on three backbone code models and six software engineering benchmarks show that FISR achieves the best overall trade-off among repair accuracy, stability, and efficiency. It reaches up to 95.8% Exact Match, improving Exact Match by up to 3.1% and Pass@1 by up to 3.4% over strong prior repair methods. It also demonstrates stronger held-out stability while substantially reducing repair cost, requiring only 40%-67% of the end-to-end repair time and 14%-20% of the update-time cost of competitive editing-based baselines. These results demonstrate that the proposed method enables accurate, safe, and efficient semantic repair for code LLMs. Article Search Article: ase26main-p3860-p doi:10.1145/3832783.3834442
	Bienhüls, Joseph	ASE '26: "A Comprehensive Evaluation ..." A Comprehensive Evaluation of Code Language Models for Security Patch Detection Nils Loose, Joseph Bienhüls, Kristoffer Hempel, Felix Mächtle, and Thomas Eisenbarth (University of Lübeck, Germany) Automated detection of vulnerability-fixing commits (VFCs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and many fixes never receive advisories. Code language models are increasingly adopted for identifying , yet whether they can recognize a security fix from the code change itself remains unclear, as reported performance is shaped by commit messages, project-level data leakage, and uncertain data quality. We present a rigorous re-evaluation that jointly controls these factors through a unified framework consolidating 20 fragmented datasets spanning more than 180000 commits. Training 270 models from 125M to 80B parameters, we isolate the code signal under group-stratified code-only evaluation and assess the impact of model capacity and additional code context, ranging from intra-procedural enrichment to inter-procedural repository context. Model capacity yields clear but insufficient gains, and the evaluated context signals provide no reliable improvement under strict false positive budgets. At a false positive rate of 0.5 Article Search Article: ase26main-p2677-p doi:10.1145/3832783.3837538
	Biesdorf, Andreas	ASE '26: "IP-Preserving Enterprise System ..." IP-Preserving Enterprise System Modernization via LLM-Driven Specification Extraction and Multi-target Code Generation Andreas Biesdorf, Eckhard Seibert, Nicole Wengatz, Bart Carpels, and Tom Schoonbaert (Trier University of Applied Sciences, Germany; Siemens, Germany; Euroports, Belgium) We report on the automated modernization of a business-critical terminal operating system deployed across multiple sites of a major European port infrastructure company, comprising a heterogeneous technology stack accumulated over many years of continuous development: over 22,000 source files, about 10,000 of them C#, a multi-layered web forms UI, a complex Oracle database, and extensive operational documentation. Most current LLM-assisted modernization approaches rely on cloud-based models, raising intellectual property and security concerns that prevent adoption in industrial settings. We present a hybrid pipeline in which local LLMs extract a formal four-view specification that keeps proprietary source code entirely on-premises, while cloud models generate target implementations from specifications only, never accessing the legacy codebase. The pipeline extracts structural domain models, behavioral rules, process state machines, and screen presentations across 48 bounded contexts via a two-pass LLM extraction approach. Against a curated reference on a CRM probe, the best local model reaches a structural fidelity of 0.83, while two of seven candidates fail to emit parseable JSON at all; prompt engineering raises the semantic purity of the extracted domain model from 0.71 to 0.94, whereas legacy documentation adds almost nothing. Following a test-first approach, 5,451 behavioral tests were generated from specifications alone before any target implementation, and two runnable application stacks (Python/FastAPI and .NET 8 Blazor) were produced. We report concrete lessons on prompt engineering, structured output generation, and the practical boundaries between automation and manual intervention. Article Search Article: ase26ind-p443-p doi:10.1145/3832783.3834533
	Bifolco, Daniele	ASE '26: "AIGen: Automating AI Bill ..." AIGen: Automating AI Bill of Materials Generation through Hybrid MLOps Integration Federica Pepe, Daniele Bifolco, Costantino Martignetti, Aureliano D'Amici, Fabiano Izzo, Damian Andrew Tamburri, and Massimiliano Di Penta (University of Sannio, Italy; Smart Shaped, Italy) The responsible development and deployment of artificial intelligence (AI) systems requires rigorous documentation of their constituent artifacts, e.g., datasets, model weights, training pipelines, and runtime dependencies. Although the Software Package Data Exchange (SPDX) 3.0 standard introduced native support for AI and dataset profiles, practical tooling capable of generating standards-compliant AI Bills of Materials (AIBoMs) in an automated and extensible manner remains scarce. This paper presents AIGen, a modular AIBoM generator that produces machine-readable, interoperable inventories of AI system components that comply with the SPDX 3.0 AI profile. AIGen works on top of the MLflow MLOps framework and combines mining heuristics with Large Language Models to generate AIBoMs. A plugin interface allows practitioners to extend the tool with domain-specific collectors without modifying the core codebase, supporting heterogeneous AI frameworks such as Hugging Face, PyTorch, and TensorFlow. AIGen is designed to facilitate compliance with the European Union AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001, providing a concrete, reusable foundation for transparent, accountable AI supply chain governance. Tool URL: https://github.com/danielebifolco/AIGen Tool Video: https://youtu.be/_nAbXDWfVL4 Article Search Article: ase26tool-p57-p doi:10.1145/3832783.3834615
	Bisceglia, Nunzio Marco	ASE '26: "Test Suite Generation for ..." Test Suite Generation for Simulink Models: An Experience with Reactis Andrea Bombarda, Nunzio Marco Bisceglia, Marco Saini, Federico Formica, Angelo Gargantini, and Claudio Menghi (University of Bergamo, Italy; Gran Sasso Science Institute, Italy; McMaster University, Canada) Testing Simulink models is a widely recognized, relevant, and challenging problem for automated software engineering. It is relevant to industry practitioners since Simulink is a development and simulation language widely used by the Cyber-Physical System (CPS) industry. It is challenging since CPS are usually complex, entail many components, and failures are not easily identifiable without automated support. This paper reports our experience in applying Reactis, an industrial tool for testing Simulink models, to the ten Cyber-Physical Challenges Simulink models from Lockheed Martin. We considered 48 requirements from these challenge models. We assess the effectiveness of Reactis in identifying failure-revealing test cases and its efficiency. We compare our results and those from an academic testing tool (HC), and two model checking tools (QVtrace and CoCoSim). Our results show that Reactis could return a failure-revealing test case for a requirement that was considered correct. They also show that the efficiency of Reactis is comparable to that of existing tools. Article Search Article: ase26ind-p98-p doi:10.1145/3832783.3834483
	Bissyandé, Tegawendé F.	ASE '26: "Evaluating Inference-Time ..." Evaluating Inference-Time Defenses against Package Hallucination in LLM-Generated Code Alberick Euraste Djire, Iyiola E. Olatunji, Melissa Tessa, Earl T. Barr, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg; University College London, UK) LLMs are increasingly used for code generation, yet they frequently hallucinate non-existent software packages, creating exploitable entry points into the software supply chain. We make four contributions to this problem. First, we show that prior evaluation methodologies systematically inflate hallucination rates by misclassifying standard-library modules as hallucinations in some languages. For Python, the overestimation reaches 9.4 percentage points. Second, we evaluate seven inference-time defenses for mitigating package hallucinations, including five guided decoding strategies (Greedy, Contrastive, DoLa, Nudging, and Active Layer-Contrastive Decoding), an iterative self-refinement approach (Self-Refine), and a Retrieval-Augmented Generation (RAG)-based defense. Across eight models spanning five families and four programming languages (Python, JavaScript, Ruby, Rust), RAG reduces the package hallucination rate (PHR) in 18 of 32 model–language configurations. Third, we introduce Package Utility (PU) to assess whether defenses preserve valid and task-relevant recommendations. Among strategies evaluated, Greedy decoding provides the strongest average mitigation–utility trade-off. Fourth, we stress-test all strategies under adversarial prompts seeded with fabricated package names and find that PHR surges by up to 45 percentage points relative to standard prompts, with Ruby consistently the most vulnerable language (80.9–95.2%). Under adversarial conditions, RAG and Self-Refine outperform all decoding-only strategies, indicating that robust defense requires either external grounding or iterative self-verification when prompts are actively hostile. Our results recast package hallucination as both a measurement problem and a decoding-time control problem, and they demonstrate that the choice of defense must be matched to the threat model and recommendation utility. Article Search Article: ase26main-p3592-p doi:10.1145/3832783.3837555 ASE '26: "Do Not Copy/Paste: Soft Barriers ..." Do Not Copy/Paste: Soft Barriers for Copying in AI-Assisted Programming Iyiola E. Olatunji, Alberick Euraste Djire, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg) Copying a function from a chat window into an editor takes less than a second. For many uses of AI coding tools, that speed is the point; in settings such as programming education, code review, and security-sensitive development, it can also be the problem. This paper frames copy-paste as an AI code handoff problem: the moment model-generated text crosses from a conversational context into executable or committed software is a design boundary that current tools leave largely unmanaged. We argue that AI coding assistants should not only be evaluated by the code they generate, but also by how they mediate the transfer of that code into software artifacts. We propose soft barriers as one class of handoff-aware mechanisms. Soft barriers preserve access to AI assistance while making unexamined transfer less frictionless. As an initial technical probe, we instantiate this idea using Unicode output perturbations that preserve visual readability but disrupt naive copy-paste execution. We introduce Copy-Paste Resistance (CPR), the fraction of functionally correct clean solutions that become syntactically invalid after perturbation. Across HumanEval and MBPP with four LLMs and four perturbation families, we find that output-level barriers can achieve high copy-paste resistance, but their effectiveness is highly model- and task-dependent. An exploratory pilot with 18 participants provides early evidence that soft barriers can shift users from direct transfer toward editing and reconstruction. We do not present Unicode perturbations as a deployment-ready solution; rather, we use them as a minimal probe for a broader research agenda on practical, transparent, and policy-aware AI code handoff. Article Search Article: ase26nier-p79-p doi:10.1145/3832783.3834554
	Biswas, Sumon	ASE '26: "What Breaks When LLMs Code? ..." What Breaks When LLMs Code? Characterizing Operational Safety Failures of Agentic Code Assistants Alif Al Hasan and Sumon Biswas (Case Western Reserve University, USA) Autonomous coding agents built on large language models (LLMs) are rapidly being integrated into development workflows, yet their operational safety properties remain poorly understood beyond evaluations of explicitly malicious inputs. In practice, high-impact failures arise during benign, goal-directed use through environment breakage, fabricated success reports, etc. that current benchmarks do not capture. What categories of operational safety failures actually occur when coding agents are used for everyday development tasks and what is their impact? We present an incident-driven empirical study grounded in two complementary evidence streams. We screen 68,816 papers from 22 premier venues, curating 185 safety-relevant studies, and mine 16,586 GitHub issues from widely deployed LLM-powered coding tools, manually confirming 547 genuine safety failures. Applying systematic open coding over both corpora, we derive a multi-dimensional safety taxonomy of 33 operational risk types organized across seven dimensions, and annotate each incident with contributing factors, task context, severity, and downstream impact. Our findings show that coding-agent failures are often severe, with 326 of 547 incidents rated high or critical. The dominant risks are constraint violations, destructive operations, authorization bypasses, and deception, and over 65% of incidents arise in bug fixing and setup or configuration, patterns largely missing from prior literature. These results have direct implications for SE tool designers and benchmark developers: guardrails must go beyond adversarial-prompt defenses to enforce environmental constraints, failure transparency, and safe-halt behaviors. Article Search Artifacts Available Article: ase26main-p1517-p doi:10.1145/3832783.3834393
	Błażowski, Jakub	ASE '26: "Towards Diagnostic Explainability ..." Towards Diagnostic Explainability in Workflow Verification via Shapley Attribution Radosław Klimek and Jakub Błażowski (AGH University of Krakow, Poland) Workflow mining produces hierarchical workflow models from event logs, yet it is often unclear why such models satisfy or violate logical properties, or how individual model elements influence these outcomes. This work explores diagnostic explainability in workflow verification through the lens of attribution. We outline an approach that translates mined workflow models into logical specifications, checks properties, such as satisfiability, liveness and safety using automated theorem provers and interprets verification outcomes via Shapley values from the cooperative game theory. This attribution-based perspective provides a diagnostic view of how different parts of a workflow model contribute to property satisfaction or violation, highlighting elements that are critical, redundant or potentially harmful with respect to formal properties. Preliminary results suggest that Shapley-based attribution may support an interpretable workflow analysis while revealing limitations and trade-offs relevant to future research in explainable verification. Article Search Article: ase26nier-p15-p doi:10.1145/3832783.3834542
	Bliem, Benedict	ASE '26: "FlightRecorder: Tracing Fine-Grained ..." FlightRecorder: Tracing Fine-Grained Development with AI Assistants Tobias Dick, Benedict Bliem, Kallistos Weis, Alisa Welter, and Sven Apel (Saarland University, Germany) AI coding assistants like GitHub Copilot are transforming software development. Yet fundamental questions remain about how code evolves as developers collaborate with AI agents, particularly at fine-grained levels of interaction -- a gap that persists partly because existing telemetry cannot distinguish agent-generated changes from inline completions and human edits, nor precisely track when and where they occur. To address this gap, we present FlightRecorder, a lightweight VSCode extension that collects fine-grained code evolution data without disrupting the workflows of developers. Our extension integrates three data sources: snapshots of agent-mode edits, inline completions, and chat history, all timestamped for precise attribution. Researchers can export these data in structured formats alongside anonymization and basic visualization functionality. By making such fine-grained evolution data accessible, FlightRecorder enables researchers to investigate fundamental questions about AI-assisted development. We provide a replication package, including the code for FlightRecorder and the data used throughout our paper, at https://doi.org/10.5281/zenodo.20134365. We further provide a screencast demo of our tool at https://youtu.be/bZR6aPROVMU. Article Search Artifacts Available Article: ase26tool-p38-p doi:10.1145/3832783.3834607
	Blot, Aymeric	ASE '26: "Code Transformation Rule Synthesis ..." Code Transformation Rule Synthesis using LLMs: Potential and Limits Axel Allain, Aymeric Blot, Djamel Eddine Khelladi, and Mathieu Acher (INSA, France; University of Rennes, France; Inria, France; CNRS, France; IRISA, France) Due to their black-box nature, LLMs suffer from limited explain- ability and a lack of determinism. Their usage cost can also rise, particularly with repetitive tasks on large codebases. Code transfor- mation rules mitigate those challenges. This paper fills this gap, with a novel empirical study targeting three domain-specific languages for transformation rules, namely Comby, GritQL, and Ast-Grep We evaluate three LLMs (GPT-5.4, GPT-oss-120B, and Llama3.1-8B) on six diverse datasets covering four software-evolution tasks: API misuse correction, program repair, API migration, and language ver- sion migration. Our results provide evidence that transformation rule synthesis moves beyond proof-of-concept with strong frontier models. GPT-5.4 achieves consistently high rule applicability rates and produces transformations closest to the ground truth across most benchmarks. Smaller and open-weight GPT-oss-120B and Llama3.1-8B models remain effective for simpler, localized changes but struggle with complex migration scenarios. We also observe non-negligible generalizability through the usage of meta-variables and through a high reuse score in the first quartile of many datasets. Finally, when compared to the anti-unification algorithm, LLMs outperform it in correctness, but underperform in rule applicabil- ity. Overall, our results show great potential for LLMs to generate sound, correct, generalizable, and reusable rules. Article Search Artifacts Available Article: ase26main-p1631-p doi:10.1145/3832783.3837504
	Blouin, Arnaud	ASE '26: "UltraInstinctVR: A Model-Based ..." UltraInstinctVR: A Model-Based Tool for Automated System Testing of VR Applications Gerry Longfils, Maxime Cauz, Arnaud Blouin, and Xavier Devroey (University of Namur, Belgium; INSA Rennes, France) Virtual Reality (VR) applications are increasingly used in domains such as surgical training and industrial marketing, yet their longterm adoption remains limited by the lack of effective, systematic, and reproducible testing approaches tailored to VR. To address this gap, we present UltraInstinctVR, a novel tool that automates the generation and execution of concrete system-level tests for VR applications, helping developers efficiently validate interactions and behaviors. We evaluated UltraInstinctVR against state-of-the-art automated VR testing tools across 10 open-source VR applications, where it outperformed existing approaches in detecting unique failures and uncovering real-world bugs. In this paper, we further extended this evaluation through an empirical user study with ten VR developers. Results highlight strong dependability and efficiency while identifying opportunities for improvement in other user experience dimensions. Overall, these findings position UltraInstinctVR as a promising step toward more practical, effective, and scalable VR testing. The tool is publicly available at https://github.com/snailunamur/UltraInstinctVR, with a demonstration video available at https://youtu.be/U8DWTmXmeh4. Article Search Article: ase26tool-p141-p doi:10.1145/3832783.3834642
	Bock, Thomas	ASE '26: "The Ground Is Shifting: A ..." The Ground Is Shifting: A Reflection on the Foundations of Software Measurement Thomas Bock, Audris Mockus, and Bogdan Vasilescu (Carnegie Mellon University, USA; University of Tennessee, USA) For most of the past six decades, software measurement relied on labor-intensive manual collection of proprietary data, which hampered progress. The shift to repurposing traces from version control and related tools dramatically expanded data availability—especially with the rise of open-source software—but hinged on an often unstated assumption: that these tools are used by professional developers to build genuine software systems. However, as trace-generating tools, data types and scale, and empirical methods have all evolved, it has become clear that changes in data generation and analytical approaches affect many prior findings about software development, maintenance, and evolution. With AI agents now actively using these same tools, the resulting traces frequently violate the original assumption of human origin. To preserve the relevance of software measurement research, immediate action is needed: We must detect when foundational assumptions are violated in contemporary data and develop new methodologies that remain valid under changed circumstances. To this end, we propose a systematic AI-assisted replication program that revisits key findings using modern techniques, aiming for methods that yield consistent results on current data to keep software measurement meaningful. Article Search Artifacts Available Article: ase26nier-p76-p doi:10.1145/3832783.3834553
	Bogomolov, Igor	ASE '26: "OpenStack-RCA-Bench: A Reproducible ..." OpenStack-RCA-Bench: A Reproducible IaaS Root Cause Analysis Dataset Igor Bogomolov and Oleg Borisenko (Trusted AI Research Center, RAS, Russian Federation; System Solutions, Russian Federation) We present OpenStack-RCA-Bench, an open dataset of 64 chaos-engineering incidents for benchmarking RCA methods in OpenStack IaaS. It features a 9-phase pipeline integrating four fault injection methods (service stop, port block, process kill, config corruption), automated log collection via Loki, and ground truth defined by programmatic injection metadata. The benchmark comprises 64 validated incidents across 37 services and 46 fault scenarios spanning controller, compute, network, storage, and critical infrastructure—totalling 145,133 log lines (8.4 MB). A rule-based baseline achieves 92% F1 overall, with 100% on controller-backend and OVN-network categories and 84% on extended fault types. We additionally evaluate state-of-the-art LLMs using zero-shot prompting: Top-1 accuracy reaches 10–16% across models, highlighting the difficulty of log-based RCA. The benchmark and framework are publicly available. The artifact ships as a Docker Compose setup enabling one-click deployment and dry-run validation without external dependencies. Article Search Artifacts Available Article: ase26tool-p197-p doi:10.1145/3832783.3834650
	Böhme, Marcel	ASE '26: "Feature-Focused Test Generation ..." Feature-Focused Test Generation José Antonio Zamudio Amaya, Gaetano Sapia, Alexi Turcotte, David Benavides, Marcel Böhme, and Andreas Zeller (CISPA Helmholtz Center for Information Security, Germany; MPI-SP, Germany; Universidad de Sevilla, Spain) Specification-based test generators use input specifications to produce valid tests for complex systems, covering the entire input space of the system under test. This broad generation capability, however, can become a burden when one wants to focus test generation on a particular subset of the input space, say, a feature whose implementation has recently changed or is particularly critical. In this paper, we propose Feature-Focused Test Generation (FFTG), an approach that treats specification-based test generation as a configuration problem. From the input specification, FFTG first extracts a feature model that represents alternate and optional expansions as possible feature values. After the tester selects which features to focus upon, FFTG specializes the specification accordingly, generating inputs in which only the focused features vary. We implement FFTG in a prototype named Compás. In our evaluation, we find that Compás-generated slices (1) effectively focus test generation on specific features, preserving validity; (2) exercise unique code locations associated with the targeted features and thus enable traceability of features; and (3) enable test suite minimization, with a small set of slices retaining the aggregate coverage of the full suite while requiring fewer tests. To the best of our knowledge, this is the first work to apply product line engineering techniques to specification-based testing. Article Search Article: ase26main-p1023-p doi:10.1145/3832783.3837479 ASE '26: "Accurate and Low-Cost Residual ..." Accurate and Low-Cost Residual Risk Assessment via Sampled Profiling and Structure-Aware Coverage Amplification Seongmin Lee, Işıl Özgü, Marcel Böhme, and Miryung Kim (University of California at Los Angeles, USA; MPI-SP, Germany) Estimating the residual risk of undiscovered bugs—and thus when to stop fuzzing—is critical for determining testing adequacy. Traditionally, this assessment relies on coverage instrumentation, which records complete coverage of every execution but imposes a 60-70% performance slowdown, reducing fuzzing throughput and delaying bug discovery. This overhead raises a fundamental question: can partial observation provide high-fidelity confidence at a fraction of the coverage instrumentation cost? We propose a risk assessment method in the context of black-box fuzzing that leverages hardware-enabled performance profiling—replacing coverage instrumentation with instruction pointer (IP) sampling—as the core mechanism for low-overhead observation. To recover the accuracy inevitably lost to the sparse nature of sampling, we employ must-execute analysis, a static control-flow analysis that identifies all statements and basic blocks that must have executed to reach, or must execute after, an observed sample, effectively reconstructing missing execution paths from partial observations. Despite the partial coverage inherent to profiler-based sampling, our risk estimation method achieves 4.27× higher throughput than complete-coverage instrumentation, enabling fuzzing campaigns to reach stopping thresholds 2× faster while maintaining high accuracy (1.73 average relative error compared to the ground truth). Ultimately, this efficiency translates into superior bug discovery, triggering more bugs with speedups of up to 10× within the same time budget. Article Search Article: ase26main-p2006-p doi:10.1145/3832783.3837519 ASE '26: "LLM-Based Agents for Identifying ..." LLM-Based Agents for Identifying Bug-Introducing Commits Niklas Risse and Marcel Böhme (MPI-SP, Germany; CISPA Helmholtz Center for Information Security, Germany) Śliwerski, Zimmermann, and Zeller (SZZ) just won the 2026 ACM SIGSOFT Impact Award for asking: When do changes induce fixes? Their paper from 2005 served as the foundation for a wide array of approaches aimed at identifying bug-introducing changes (or commits) from fix commits in software repositories. But even after two decades of progress, the best-performing approach from 2025 yields a modest increase of 10 percentage points in F1-score on the most popular Linux kernel dataset. In this paper, we uncover how and why LLM-based agents can substantially advance the state-of-the-art in identifying bug-introducing commits from fix commits. We propose a simple agentic workflow based on searching a set of candidate commits and find that it raises the F1-score from 0.64 to 0.81 on the most popular Linux kernel dataset, a bigger jump than between the original 2005 method (0.54) and the previous SOTA (0.64). We also uncover why agents are so successful: They derive short greppable patterns from the fix commit diff and message and use them to effectively search and find bug-introducing commits in large candidate sets. Finally, we also discuss how these insights might enable further progress in root cause understanding and repair. Article Search Article: ase26main-p90-p doi:10.1145/3832783.3834337 ASE '26: "Empirical Computation: Prompting ..." Empirical Computation: Prompting versus Programming Eric Tang, Jing Liu, and Marcel Böhme (Carnegie Mellon University, USA; MPI-SP, Germany; CISPA Helmholtz Center for Information Security, Germany) Large Language Models (LLMs) can solve any computational problem without an algorithm in a runtime independent of the computational complexity of that problem. Instead of specifying precisely how to solve problem instance using programming, we ask an LLM or agent to solve the problem instance using prompting. Outputs are sampled from a distribution rather than generated procedurally. In this vision paper, we explore the challenges and opportunities of this new form of computation and observe that its capabilities and limits cannot be understood within the classic, rationalist framework of computation. Hence, we appeal to the software engineering (SE) community to develop the foundations and techniques required to analyze the properties of this "empirical computation" as it generates solutions to computational problems: How can we analyze and improve the correctness of LLMs solving a computational problem in the general, in the problem-specific, or in the instance-specific? What are the properties and fundamental limits of empirical computation? This paper aims to establish empirical computation as a field in SE that is timely and rich with interesting problems. Article Search Article: ase26nier-p11-p doi:10.1145/3832783.3834540
	Boltz, Nicolas	ASE '26: "xDECAF: An Extensible Data ..." xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security Benjamin Arp, Felix Schwickerath, Alexander Vogt, Tom Hüller, Nils Niehues, and Nicolas Boltz (KIT, Germany) xDECAF is an extensible tool for architecture-based data flow analysis with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domain-specific constraint language with different flow operations, and a browser-based editor backed by an analysis engine. In this paper, we present the xDECAF tool library and a curated catalog of over 20 example models with documented constraints and expected violations, intended as a reusable dataset for the community. The tool has already been adopted by several research lines, providing concrete evidence of its utility. The tool, dataset, and a hosted online editor are publicly available. Screencast: https://youtu.be/L-PGdWoPtlw Code & Dataset: https://github.com/DataFlowAnalysis • https://doi.org/10.5281/zenodo.20083877 Article Search Article: ase26tool-p34-p doi:10.1145/3832783.3834604
	Bombarda, Andrea	ASE '26: "Test Suite Generation for ..." Test Suite Generation for Simulink Models: An Experience with Reactis Andrea Bombarda, Nunzio Marco Bisceglia, Marco Saini, Federico Formica, Angelo Gargantini, and Claudio Menghi (University of Bergamo, Italy; Gran Sasso Science Institute, Italy; McMaster University, Canada) Testing Simulink models is a widely recognized, relevant, and challenging problem for automated software engineering. It is relevant to industry practitioners since Simulink is a development and simulation language widely used by the Cyber-Physical System (CPS) industry. It is challenging since CPS are usually complex, entail many components, and failures are not easily identifiable without automated support. This paper reports our experience in applying Reactis, an industrial tool for testing Simulink models, to the ten Cyber-Physical Challenges Simulink models from Lockheed Martin. We considered 48 requirements from these challenge models. We assess the effectiveness of Reactis in identifying failure-revealing test cases and its efficiency. We compare our results and those from an academic testing tool (HC), and two model checking tools (QVtrace and CoCoSim). Our results show that Reactis could return a failure-revealing test case for a requirement that was considered correct. They also show that the efficiency of Reactis is comparable to that of existing tools. Article Search Article: ase26ind-p98-p doi:10.1145/3832783.3834483
	Bonomo-Braberman, Flavia	ASE '26: "Let’s Chat about Design: ..." Let’s Chat about Design: A Transformation-Oriented Viewpoint for LLM-Native Software Víctor A. Braberman and Flavia Bonomo-Braberman (University of Buenos Aires, Argentina; CONICET, Argentina) We propose a transformation‑oriented design viewpoint that treats LLM‑mediated data transformations as the primary runtime abstractions. The viewpoint captures actual intent through computational roles, distinguishes designed from emergent transformations, and introduces coupling motifs as recurrent architectural tactics. We show how this vocabulary enables systematic high‑level comparison across disparate designs. Beyond human design reasoning, we conjecture that the viewpoint provides the semantic infrastructure needed for AI‑assisted architectural synthesis. Article Search Article: ase26nier-p44-p doi:10.1145/3832783.3834545
	Borisenko, Oleg	ASE '26: "OpenStack-RCA-Bench: A Reproducible ..." OpenStack-RCA-Bench: A Reproducible IaaS Root Cause Analysis Dataset Igor Bogomolov and Oleg Borisenko (Trusted AI Research Center, RAS, Russian Federation; System Solutions, Russian Federation) We present OpenStack-RCA-Bench, an open dataset of 64 chaos-engineering incidents for benchmarking RCA methods in OpenStack IaaS. It features a 9-phase pipeline integrating four fault injection methods (service stop, port block, process kill, config corruption), automated log collection via Loki, and ground truth defined by programmatic injection metadata. The benchmark comprises 64 validated incidents across 37 services and 46 fault scenarios spanning controller, compute, network, storage, and critical infrastructure—totalling 145,133 log lines (8.4 MB). A rule-based baseline achieves 92% F1 overall, with 100% on controller-backend and OVN-network categories and 84% on extended fault types. We additionally evaluate state-of-the-art LLMs using zero-shot prompting: Top-1 accuracy reaches 10–16% across models, highlighting the difficulty of log-based RCA. The benchmark and framework are publicly available. The artifact ships as a Docker Compose setup enabling one-click deployment and dry-run validation without external dependencies. Article Search Artifacts Available Article: ase26tool-p197-p doi:10.1145/3832783.3834650
	Borovica-Gajic, Renata	ASE '26: "InsightQL: A Unified Code ..." InsightQL: A Unified Code Database for Fuzz Blocker Analysis Wentao Gao, Renata Borovica-Gajic, Sang Kil Cha, Michael Fu, Tian Qiu, and Van-Thuan Pham (University of Melbourne, Australia; KAIST, Republic of Korea) Fuzzing is a highly effective automated testing method for uncovering software vulnerabilities. Despite advances in fuzzing techniques, many fuzzers still struggle with coverage plateaus caused by fuzz blockers, which limit their ability to discover deeper vulnerabilities. We introduce InsightQL, the first human-assisted tool for fuzz blocker analysis. InsightQL is powered by a unified database, an intuitive parameterised query interface, and a VS Code plugin. It enables developers to reason about the root causes of fuzz blockers, often with a simple right-click in the plugin. The framework is extensible and it could support C/C++ projects in OSS-Fuzz. It can also be easily extended with custom queries. A screencast of the tool is available at https://youtu.be/mFxYhmikXs8. Article Search Article: ase26tool-p98-p doi:10.1145/3832783.3834633
	Bose, Dibyendu Brinto	ASE '26: "Repository-Aware Metamorphic ..." Repository-Aware Metamorphic Relation Generation for Augmented Reality Applications using Large Language Models Dibyendu Brinto Bose, Jiawei Qin, and Chris Brown (Virginia Tech, USA) Metamorphic Testing (MT) provides a promising approach for testing software without defined test oracles by specifying expected relations between inputs and outputs, instead of relying on exact outputs. For example, testing Augmented Reality (AR) applications is challenging due to dynamic interactions between virtual content, physical environments, and code, which make traditional test oracles difficult to define. However, formulating metamorphic relations (MRs) is time-consuming and burdensome. We introduce a context-aware pipeline that generates and refines MRs using repository-level context and reasoning orchestration, evaluated on a dataset of 142 mobile AR system repositories. Across three context configurations generating 14,916 candidate MRs, hierarchical context yielded the broadest coverage (7,004 MRs across 142 repositories and 5,167 class–method pairs) and lower redundancy. An agentic deliberation process then reconciled conflicting candidates—observed in 79.0% of cases—reducing duplication and selecting context-aware relations in 88.2% of outcomes. A manual oracle study shows refined relations (n = 141) are both logically valid and sufficiently concrete to be directly translated into test assertions, and a preliminary case study reveals converting generated MRs (n = 5) into executable tests can detect non-equivalent mutations in real-world code. Overall, our results show that combining repository-aware MR generation with reasoning-based refinement enables scalable construction of reliable, domain-relevant test oracles. Article Search Article: ase26main-p1578-p doi:10.1145/3832783.3837502
	Braberman, Víctor A.	ASE '26: "Let’s Chat about Design: ..." Let’s Chat about Design: A Transformation-Oriented Viewpoint for LLM-Native Software Víctor A. Braberman and Flavia Bonomo-Braberman (University of Buenos Aires, Argentina; CONICET, Argentina) We propose a transformation‑oriented design viewpoint that treats LLM‑mediated data transformations as the primary runtime abstractions. The viewpoint captures actual intent through computational roles, distinguishes designed from emergent transformations, and introduces coupling motifs as recurrent architectural tactics. We show how this vocabulary enables systematic high‑level comparison across disparate designs. Beyond human design reasoning, we conjecture that the viewpoint provides the semantic infrastructure needed for AI‑assisted architectural synthesis. Article Search Article: ase26nier-p44-p doi:10.1145/3832783.3834545
	Brandt, Carolin	ASE '26: "End-to-End Regulatory Compliance ..." End-to-End Regulatory Compliance Evolution Pipeline: From Legal Requirements to Developer Tests Carolin Brandt and Sallam Abualhaija (Delft University of Technology, Netherlands; University of Luxembourg, Luxembourg) As artificial intelligence agents become more prevalent, software systems are becoming even more deeply integrated in our lives while also growing in complexity. In response to societal concerns about safety and privacy, new regulations are being regularly introduced, posing significant compliance challenges for software engineers. This challenge is multifaceted, spanning the interpretation of legal texts, determination of how regulations apply to a specific software product, validation of end-to-end compliance, and, at the lowest level, the need to guide developers throughout this process. This challenge is exacerbated by the constant changes in regulations, requirements, and software systems. We posit that an end-to-end integration of requirements engineering and software testing, down to developer practices, could advance regulatory compliance for software systems. In this vision paper, we present a workflow that operationalizes constantly evolving regulatory requirements into automated developer-focused tests. The novelty of our approach lies in the orchestration of requirements elicitation, regulatory interpretation, traceability, test generation, and developer feedback into a continuous compliance workflow. Article Search Article: ase26nier-p13-p doi:10.1145/3832783.3834541
	Brockschmidt, Marc	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Broide, Lior	ASE '26: "HyTri: Hybrid Triage of CI ..." HyTri: Hybrid Triage of CI Failures via LLM Guided Semantic Reasoning and Change Attribution Lior Broide, Argaman Mordoch, and Roni Stern (Ben-Gurion University of the Negev, Israel) Continuous Integration (CI) builds execute large test suites that often yield multiple simultaneous failures, many originating from a common underlying fault. Test failure triage -- grouping failing tests by their root cause -- is therefore critical for reducing debugging effort. Existing approaches work poorly in CI builds with multiple faults, and either lack semantic reasoning or ignore highly informative structural and change-aware signals. To address these limitations, we propose HyTri, a framework that integrates LLM-guided causal reasoning into test failure triage. HyTri derives similarity signals that consider failure semantics and hypothesized root causes. It fuses these signals using confidence weighting and error-type adjustment into a unified similarity measure that is used to cluster the failing tests. To evaluate HyTri we created Multi-Fault CI Build Benchmark (MFCI-Benchmark), a novel benchmark for test failure triage algorithms comprising synthesized multi-fault CI builds from well-known bug repositories. Experimental results over MFCI-Benchmark and the multifault Defects4J fault localization benchmark showed that HyTri outperforms existing baselines, maintaining strong performance even in datasets where stack traces are shallow and uninformative. Article Search Article: ase26main-p811-p doi:10.1145/3832783.3837467
	Brown, Chris	ASE '26: "Repository-Aware Metamorphic ..." Repository-Aware Metamorphic Relation Generation for Augmented Reality Applications using Large Language Models Dibyendu Brinto Bose, Jiawei Qin, and Chris Brown (Virginia Tech, USA) Metamorphic Testing (MT) provides a promising approach for testing software without defined test oracles by specifying expected relations between inputs and outputs, instead of relying on exact outputs. For example, testing Augmented Reality (AR) applications is challenging due to dynamic interactions between virtual content, physical environments, and code, which make traditional test oracles difficult to define. However, formulating metamorphic relations (MRs) is time-consuming and burdensome. We introduce a context-aware pipeline that generates and refines MRs using repository-level context and reasoning orchestration, evaluated on a dataset of 142 mobile AR system repositories. Across three context configurations generating 14,916 candidate MRs, hierarchical context yielded the broadest coverage (7,004 MRs across 142 repositories and 5,167 class–method pairs) and lower redundancy. An agentic deliberation process then reconciled conflicting candidates—observed in 79.0% of cases—reducing duplication and selecting context-aware relations in 88.2% of outcomes. A manual oracle study shows refined relations (n = 141) are both logically valid and sufficiently concrete to be directly translated into test assertions, and a preliminary case study reveals converting generated MRs (n = 5) into executable tests can detect non-equivalent mutations in real-world code. Overall, our results show that combining repository-aware MR generation with reasoning-based refinement enables scalable construction of reliable, domain-relevant test oracles. Article Search Article: ase26main-p1578-p doi:10.1145/3832783.3837502
	Bu, Hao	ASE '26: "Sound and Efficient Statistical ..." Sound and Efficient Statistical Model Checking for Probabilities and Bounded Rewards Hao Bu, Lin Huang, Tao Wei, and Jingyi Wang (Ant Group, China; Zhejiang University, China) Statistical model checking estimates quantitative properties of stochastic systems, such as the probability that a given property holds and the expected rewards. Ideally, an estimation algorithm should be both sound (i.e. satisfying the given confidence bound) and efficient (i.e. using fewer simulations or producing narrower confidence intervals). However, many existing algorithms are either unsound (e.g. relying on asymptotic approximations like the central limit theorem) or inefficient (e.g. using conservative bounds like the Hoeffding bound). In this paper, we present sound and efficient algorithms for estimating probabilities and bounded expected rewards under three settings: point estimation with absolute error, point estimation with relative error, and interval estimation, yielding six problems in total. For estimating probabilities, we employ a hybrid strategy integrating two existing algorithms in the point estimation with absolute error setting. We adopt suitable existing algorithms in the other two settings. For estimating bounded expected rewards, the unknown distribution shape makes it challenging to design sound and efficient algorithms. To address this, we propose a lifting framework to lift the three algorithms for estimating probabilities to three new algorithms for estimating bounded expected rewards. We formally prove the soundness of the three lifted algorithms and demonstrate their efficiency through experiments. Article Search Article: ase26main-p914-p doi:10.1145/3832783.3834371
	Bu, Lei	ASE '26: "From Vibe to Spec: An Empirical ..." From Vibe to Spec: An Empirical Study to Demystify Specifications in Code Generation Ruirui He, Hanqing Lu, Lezhi Ma, Kai Ye, Qiong Wu, Shangqing Liu, Lei Bu, and Xuandong Li (Nanjing University, China) Recent advances in large language models (LLMs) for code generation have given rise to vibe coding, a programming practice in which developers interact with LLMs through unstructured natural language and primarily validate implementations by inspecting overall execution outputs. However, the inherent ambiguity and inconsistency of natural language present substantial challenges for generating complex and large-scale software systems. To mitigate these limitations, an emerging AI programming paradigm—specification-driven development—advocates providing LLMs with precise and consistent specifications to guide code generation. Despite its promise, fundamental questions regarding the appropriate forms of specifications and the granularity at which they should be supplied to LLMs remain largely unexplored. To address this gap, we present the first empirical study that systematically investigates the impact of two orthogonal dimensions of specifications—form and granularity—on the effectiveness of LLM-based code generation. We construct a dataset comprising five medium-sized software projects, ranging from several hundred to over one thousand lines of code, implemented in multiple programming languages and spanning diverse application domains (e.g., system utilities and games). For each project, we design specifications in three forms—natural language, coarse-grained pseudocode, and fine-grained pseudocode—to capture the form dimension. To examine granularity, we further decompose the fine-grained pseudocode into four levels of input granularity: line-level, function-level, module-level, and project-level. Using this dataset, we evaluate code generated by three representative models, GPT-5, DeepSeek-V3.1, and Qwen-3.7. Evaluation is conducted using a comprehensive set of metrics, including text-similarity-based metrics (e.g., BLEU-4 and CodeBLEU), test-based metrics (e.g., accuracy), and human-centered metrics (e.g., usability and logical consistency). Our results demonstrate that using fine-grained, structured pseudocode specifications significantly enhances generation stability and quality. Regarding granularity, while coarser-grained specifications (project and module level) generally achieve higher code quality, organizing specifications at the module level provides the best overall balance between quality, stability, and token efficiency. Moreover, additional analyses indicate that this module-level granularity yields the most user-friendly outcome for human developers. Article Search Article: ase26main-p1876-p doi:10.1145/3832783.3837515
	Buratti, Luca	ASE '26: "How Do LLMs Read Bug Reports? ..." How Do LLMs Read Bug Reports? An Empirical Study of Attention in LLMs for Automated Program Repair Ramtin Ehsani, Irene Manotas, Saurabh Pujar, Luca Buratti, and Preetha Chatterjee (Drexel University, USA; IBM Research, USA) Large Language Model (LLM)-based Automated Program Repair systems are advancing rapidly, yet their performance remains inconsistent. Even when provided with the same contextual information, an LLM may generate a correct patch for one bug but fail on another closely related bug. Why this happens remains poorly understood, and it is unclear how LLMs prioritize the diverse information in bug reports and whether model attention affects repair success. In this paper, we present the first empirical study of attention patterns in LLM-based program repair, providing interpretable insights into how models process bug reports and where their attention is concentrated during repair. We analyze 319 real-world Python and Java bugs from SWE-bench Verified and Multi-SWE-bench to study (RQ1) how model attention is distributed across bug report sections, (RQ2) how attention patterns within each section differ between successful and unsuccessful repairs, and (RQ3) how these patterns compare to information developers consider important for bug fixing. We find that successful repairs are characterized by diffused attention across multiple diagnostic components such as bug descriptions, stacktraces, and test cases, while failures often exhibit over-localized attention toward metadata such as version information. We further observe that stronger alignment between model attention and developer-identified key sections and phrases is associated with higher repair success. Our results provide the first empirical evidence that attention misallocation is a key factor in LLM-based APR failures, and offer actionable insights for designing more interpretable and reliable future APR systems. Article Search Artifacts Available Article: ase26main-p306-p doi:10.1145/3832783.3837434
	Burden, Adam P.	ASE '26: "Prompt Coach: An Empirical ..." Prompt Coach: An Empirical Evaluation of an Agentic Tutor for Learning Prompt Engineering in Software Development Rohit Mehra, Kapil Singi, Vikrant Kaulgud, Vibhu Saujanya Sharma, Swapnajeet Gon Choudhury, Swati Sharma, Adam P. Burden, and Majd Sakr (Accenture Labs, India; Accenture, India; Accenture, USA) Prompt engineering has emerged as a critical yet undertaught skill for software developers, one that traditional learning approaches are ill-equipped to support given its evolving, interactive, and context-dependent nature. In this paper, we introduce Prompt Coach (PC), an agentic tutor that helps developers learn how to craft high-quality code-generation prompts through Socratic guidance embedded in-flow within their IDE. PC evaluates prompt quality across multiple dimensions and surfaces targeted questions to guide self-correction, grounded in the developer's codebase and the behavior of the target LLM. We present an early empirical study with 15 professional developers combining quantitative prompt quality scoring with qualitative perception measures. Participants showed statistically significant improvements after a single 60-minute session, with the largest gains across dimensions commonly overlooked by developers. They also reported strong trust, high adoption readiness, and unanimous agreement that PC improved their prompt-writing skills. Article Search Article: ase26ind-p91-p doi:10.1145/3832783.3834478 ASE '26: "Agents That Teach: Towards ..." Agents That Teach: Towards Designing Incidental Learning Back into AI-Assisted Software Development Rohit Mehra, Samdyuti Suri, Prithviraj K. Tagadinamani, Kapil Singi, Vikrant Kaulgud, and Adam P. Burden (Accenture Labs, India; Accenture, USA) AI coding agents are rapidly reshaping how software is built, with developers increasingly delegating substantial coding tasks to autonomous agents in pursuit of higher productivity. While the gains are real, they come at the cost of incidental learning. Developers historically acquired informal knowledge through effortful problem-solving, and this has long shaped how software engineering expertise develops. However, with over-reliance on agentic coding, unpracticed skills could atrophy silently over time. As this learning pathway is short-circuited, developers risk accruing Knowledge Debt, a developer-level analogue of Technical Debt, where changes the agent executes that the developer cannot fully understand accrue over time. In this paper, we argue that incidental learning will not re-emerge on its own and must be consciously designed back into developer-agent interactions, and propose six design principles to guide such systems. We then present SHIELD, a multi-agent system grounded in the notion of "agents that teach", that operationalizes these principles by leveraging the AI coding agent's own reasoning to surface contextual, out-of-band learning moments without disrupting developer flow. Through this work, we envision a path toward learning-aware development environments where productivity and learning are complementary, not competing. Article Search Article: ase26nier-p97-p doi:10.1145/3832783.3834557
	Burkett, Zachary	ASE '26: "Translation Tag Team: Formal ..." Translation Tag Team: Formal Rules and LLMs Translate More Macros Together Than Apart Brent Pappas, Joseph Zalusky, Zachary Burkett, and Paul Gazzillo (University of Central Florida, USA) Modern critical software infrastructure is largely written in C. Since C lacks memory safety, researchers are investigating automatic translation of C to safer languages like Rust. But real-world C software consists of more than just C code, often using named code fragments called macros which are not part of the C language proper. State-of-the-art techniques avoid translating macros by preprocessing C code first before translating it. But this approach produces translations that are dissimilar to the original C code, because preprocessing inlines all macro definitions. To preserve macro usage in translated code, we study the language features that macros and C share and distill them into the first formally- specified translator, MerC. To evaluate MerC, we introduce the first macro translation benchmark, MacroBench, with test cases based on macros randomly sampled from real-world C programs. We find that MerC supports 50% of MacroBench’s macro test cases. We also use MacroBench to evaluate how effective large language models (LLMs) are at performing the previously-unstudied task of macro translation. LLMs translate 22% to 77% more of MacroBench than MerC, but with 8% and 28% of these translations being incorrect translations requiring additional validation by developers. In contrast, MerC only produces correct translations. Our key insight is that running MerC first then using LLMs on the remainder reaps greater benefits than using either technique alone. This tag team approach has an average failure rate 32% lower than that of LLMs, while also translating an average of 51% more test cases than MerC. Article Search Artifacts Available Article: ase26main-p5-p doi:10.1145/3832783.3837412
	Cabot, Jordi	ASE '26: "BESSER-NN: Visual Neural Network ..." BESSER-NN: Visual Neural Network Design and Automated Code Generation with the BESSER Low-Code Platform Nadia Daoudi, Armen Sulejmani, and Jordi Cabot (Luxembourg Institute of Science and Technology, Luxembourg; University of Luxembourg, Luxembourg) Neural networks (NNs) are a fundamental component of AI-enhanced software systems, often built following model-driven engineering (MDE) / low-code approaches. Yet, while MDE tools support the modelling of most system components, designing and implementing NNs remains a manual, repetitive, and error-prone task that requires expertise in framework-specific APIs such as PyTorch or TensorFlow. In this paper, we address this gap by extending the BESSER web modelling editor to support NN diagram design and automatic code generation. Our tool relies on a formal NN metamodel, which provides a framework-agnostic representation of neural networks that is automatically converted to runnable PyTorch and TensorFlow code, covering both architecture definition and training and test processes. We validate our tool on a set of representative NN architectures and demonstrate correct code generation across both frameworks. By building on the BESSER platform, our work paves the way for treating NNs as modelled artifacts within a unified MDE workflow. Our tool is open-source, released under the MIT license, and accessible at https://editor.besser-pearl.org/. A video demonstration is available at https://youtu.be/DCb6qwnnlQc Article Search Article: ase26tool-p5-p doi:10.1145/3832783.3834595
	Caetano, Márcio	ASE '26: "Barista: Synthesizing Typestate ..." Barista: Synthesizing Typestate Specifications with LLM Agents Catarina Gamboa, Paulo Canelas, Ricardo Costa, Márcio Caetano, Jonathan Aldrich, and Alcides Fonseca (Carnegie Mellon University, USA; University of Lisbon, Portugal) Object-oriented classes encode implicit protocols that clients must follow, such as connecting a socket before sending data or opening a stream before reading. Mainstream programming languages like Java cannot validate the correct use of these protocols, but more advanced type systems, such as typestate systems, can detect these violations at compile time. However, these systems require a formalization of these implicit protocols. To overcome this limitation, we propose to extract object protocols from documentation using a combination of LLMs and test generation. We developed Barista, an agentic workflow that transforms class documentation into verifiable LiquidJava specifications through DFA-guided protocol extraction, test synthesis, and verification-driven refinement. We evaluated our approach on 35 Java classes with expert-written ground truth, achieving 87.0% precision and 68.3% recall, with 75% of specifications usable directly or with minor edits. Barista bootstraps these specifications for well-documented libraries, reducing the manual annotation burden and enabling compile-time protocol safety without specialized expertise. Article Search Article: ase26main-p2950-p doi:10.1145/3832783.3834427
	Cai, Cheng-Hao	ASE '26: "Towards Fully Automated Medical ..." Towards Fully Automated Medical Imaging Code Generation via Validation-Based Context Engineering Zixiao Zhao, Jing Sun, Zhe Hou, Cheng-Hao Cai, Qian Liu, Mengze Li, Zijian Zhang, and Jin Song Dong (University of Auckland, New Zealand; Griffith University, Australia; Monash University, Suzhou, China; Beijing Institute of Technology, China; National University of Singapore, Singapore) Large language models (LLMs) have demonstrated considerable promise in program generation for small-scale and conventional application development; however, they remain limited when applied to complex, domain-specific tasks such as medical image processing. General-purpose models lack explicit domain knowledge and robust validation mechanisms to ensure correctness, often requiring substantial human intervention to produce reliable processing pipelines. To address these limitations, we propose AutoMedImg, a multi-agent framework for fully automated medical image processing code generation. AutoMedImg orchestrates specialised agents across two phases: a Planning Phase that performs dataset analysis and architecture design with semantic and formal verification, and a Coding Phase that generates modules in parallel with static checking, execution testing, and assembly validation. This multi-stage validation mitigates error propagation throughout generation, while comprehensive auto-context engineering combining domain-specific knowledge bases, shared memory, and validation feedback automates context construction without manual prompting. A cross-project adaptive pipeline synthesis mechanism further accumulates validated pipelines and retrieves proven components for new tasks based on project similarity, enhancing generation efficiency through cross-project learning. Extensive evaluation across six diverse and well-established medical imaging datasets with five backbone LLMs demonstrates that AutoMedImg achieves zero human intervention, with Dice scores of up to 0.90 for segmentation tasks and 99% accuracy for classification. Article Search Article: ase26main-p1668-p doi:10.1145/3832783.3834399
	Cai, Sean	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Cai, Yan	ASE '26: "Hybrid Fuzzing in Input Generation ..." Hybrid Fuzzing in Input Generation Logic Siwei Wei, Shihao Zhu, Ruijie Meng, and Yan Cai (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; National University of Singapore, Singapore) The core challenge of fuzzing is to consistently generate test inputs that are both syntactically valid and semantically diverse. However, mutation-based coverage-guided fuzzing often struggles to achieve this, especially for highly structured formats. Two lines of work have emerged to address this challenge: (1) hybrid fuzzing uses constraint solving to drive execution toward hard-to-cover program states to increase semantic diversity, and (2) generator-based fuzzing relies on predefined or synthesized input-generation programs to ensure syntactic validity. Both approaches, however, have significant limitations. (1) In hybrid fuzzing, solved inputs are fed back into the fuzzing queue for byte-level mutation, which often breaks syntactic structure (e.g., checksums and cross-field dependencies) and causes early rejection. (2) In generator-based fuzzing, semantic diversity is constrained by static generators based on domain knowledge; although recent work introduces generator mutations, they remain blind and therefore have limited adaptability to the target program’s logic. In this paper, we present hybrid generator space fuzzing, a method that combines the strengths of hybrid fuzzing and generator-based fuzzing to improve the syntactic validity and semantic diversity of test inputs. The key idea is to treat input generators, rather than test inputs, as the unit of targeted solving, and to use the LLM as constraint solver to derive new generators. This design offers two benefits. First, compared with hybrid fuzzing, it preserves syntactic validity because inputs are generated directly from evolving generators rather than through byte-level mutation of solved seeds. Second, compared with generator-based fuzzing, it overcomes the limitations of static generators and blind generator mutations, enabling the fuzzer to adapt to target program logic and explore a broader semantic space. Building on this concept, we implement GenEvo, an LLM-driven hybrid generator space fuzzer. Our evaluation on a large set of real-world programs shows that GenEvo, using a locally deployed medium-sized LLM, significantly outperforms competitive baselines (including general-purpose, hybrid, structure-aware, and LLM-assisted fuzzers) in both branch coverage (with an average improvement of 98.3%) and vulnerability discovery. Furthermore, GenEvo has discovered 25 previously unknown vulnerabilities in these extensively-tested programs. Article Search Article: ase26main-p2343-p doi:10.1145/3832783.3834412
	Cai, Yuandao	ASE '26: "Understanding the Performance-Effectiveness ..." Understanding the Performance-Effectiveness Trade-Offs of AddressSanitizer in Real-World Programs: An Empirical Study Jiaxin Xi, Cheng Wen, Zhiwei Lin, Yuandao Cai, Jie Su, Bin Yu, Zhuohua Li, and Shengchao Qin (Xidian University, China; Hong Kong University of Science and Technology, China; Chinese University of Hong Kong, China) AddressSanitizer (ASan) is widely deployed in industrial C/C++ development, but its runtime and memory costs can limit routine use in continuous integration and production-like testing. Although many optimized ASan-like sanitizers have been proposed, heterogeneous workloads, configurations, and baselines make their practical trade-offs difficult to compare. We present a unified, deployment-oriented empirical study of ASan and seven representative optimized sanitizers: ASan{-}{-}, SanRazor, GiantSan, RSan, MEDs, ASAP, and LFP. Using 17 SPEC CPU2006 benchmarks, Juliet, MSET, 21 real-world CVEs, and a multi-threaded MySQL case study, we examine component costs, parameter sensitivity, build configurations, detection outcomes, and deployability. In our ordered cumulative ablation, the largest first-step runtime reduction follows removal of memory-access checks, while the largest late-stage RSS reduction occurs at the heap-management step. Parameter tuning identifies lower-memory configurations without additional false negatives relative to default ASan on Juliet, although this result does not establish preservation of delayed-UAF detection. The reported evidence shows distinct efficiency, detection, and deployment outcomes, but unequal completion sets prevent a formal cross-tool ranking. Our results support treating tuned ASan as a necessary, configuration-dependent comparison baseline for sanitizer evaluation and provide bounded evidence for deployment decisions under different resource and risk constraints. Article Search Article: ase26ind-p63-p doi:10.1145/3832783.3834469 ASE '26: "Understanding Real-World Ordering-Related ..." Understanding Real-World Ordering-Related Concurrency Bugs under Weak-Memory and Cross-Architecture Settings Shaohao Wang, Cheng Wen, Yuandao Cai, Shengchao Qin, Jie Su, Mengda He, Xiaoxue Ma, and Cong Tian (Xidian University, China; Hong Kong University of Science and Technology, China; Fermat Labs, China) Modern systems software is increasingly deployed across heterogeneous architectures such as x86, ARM, and RISC‑V, which provide substantially different memory-ordering guarantees. Under weak memory models, hardware and compilers may reorder memory operations or delay their visibility, causing concurrent code that appears correct on x86 to fail in subtle and security-critical ways. In real systems, however, such failures are not limited to instruction-level reorderings: cross-architecture execution can also expose higher-level ordering assumptions about object lifecycle and protocol state. To study this gap, we curate a dataset of 58 manually confirmed real-world concurrency bugs from the Linux Kernel and open-source projects (e.g., MySQL, MariaDB, DPDK, and sofa-pbrpc). We propose Multi-Granularity Ordering (MGO), a taxonomy that organizes these bugs into three layers: micro-instruction, resource lifecycle, and semantic-logic ordering violations. Our analysis shows that micro‑instruction bugs form the largest category in the dataset (32/58, 55.2%) and typically manifest as stale reads or missed signals, whereas resource lifecycle bugs (24/58, 41.4%) are frequently associated with severe memory-safety failures such as use‑after‑free. We further show that these layers differ in architectural exposure and repair strategies: micro-instruction bugs directly capture weak-memory anomalies, while lifecycle and semantic bugs reflect macro-level failures whose manifestation can be amplified in cross-architecture execution. Finally, we identify common mismatches between root causes and repair strategies, and summarize practical implications for future concurrency analysis tools for cross-architecture safety and reliability. Article Search Article: ase26ind-p129-p doi:10.1145/3832783.3834494
	Campos, José	ASE '26: "QUTest: A Native Testing Framework ..." QUTest: A Native Testing Framework for Quantum Programs José Campos (University of Porto, Porto, Portugal; University of Lisbon, Lisbon, Portugal) Quantum programs are often shared as OpenQASM 3 circuits, but tests are still written in host languages such as Python with Qiskit. We present QUTest, a native framework in which both programs and tests are standard .qasm files. Tests follow the Arrange / Act / Assert pattern, while configuration, runtime requirements, and assertions are encoded as pragma comments (//%), preserving compatibility with existing OpenQASM tools. QUTest provides 12 assertion types spanning deterministic, statistical, quantum-state, and structural checks, plus a linter and an environment-aware mode for running the same test across selected runtime versions in isolated environments. Its CLI supports automatic test discovery, runtime compatibility checks, and XML reports for continuous integration. We describe the pragma language, implementation, and a planned evaluation using coverage and mutation testing. Article Search Artifacts Available Article: ase26tool-p42-p doi:10.1145/3832783.3834609
	Canelas, Paulo	ASE '26: "Barista: Synthesizing Typestate ..." Barista: Synthesizing Typestate Specifications with LLM Agents Catarina Gamboa, Paulo Canelas, Ricardo Costa, Márcio Caetano, Jonathan Aldrich, and Alcides Fonseca (Carnegie Mellon University, USA; University of Lisbon, Portugal) Object-oriented classes encode implicit protocols that clients must follow, such as connecting a socket before sending data or opening a stream before reading. Mainstream programming languages like Java cannot validate the correct use of these protocols, but more advanced type systems, such as typestate systems, can detect these violations at compile time. However, these systems require a formalization of these implicit protocols. To overcome this limitation, we propose to extract object protocols from documentation using a combination of LLMs and test generation. We developed Barista, an agentic workflow that transforms class documentation into verifiable LiquidJava specifications through DFA-guided protocol extraction, test synthesis, and verification-driven refinement. We evaluated our approach on 35 Java classes with expert-written ground truth, achieving 87.0% precision and 68.3% recall, with 75% of specifications usable directly or with minor edits. Barista bootstraps these specifications for well-documented libraries, reducing the manual annotation burden and enabling compile-time protocol safety without specialized expertise. Article Search Article: ase26main-p2950-p doi:10.1145/3832783.3834427
	Cao, Jialun	ASE '26: "GraphDroid: Asynchronous LLM-Based ..." GraphDroid: Asynchronous LLM-Based Mobile App GUI Testing via History-Aware Exploration and Hybrid Intent Fulfillment Xiaolei Li, Jialun Cao, Zhijian Hou, Yuzhi Zhao, Yepang Liu, and Shing-Chi Cheung (Hong Kong University of Science and Technology, China; Southern University of Science and Technology, China; Guangzhou HKUST Fok Ying Tung Research Institute, China; City University of Hong Kong, China) Automated GUI testing is a widely adopted technique for ensuring mobile application quality by simulating user interactions to exercise functionalities. Despite the research breakthroughs in the past decades, covering complex functionalities that require multi-step action sequences still remains challenging. Traditional tools lack semantic understanding capability and can rarely synthesize such action sequences. Recent LLM-based tools can generate test intents describing target functionalities and leverage the LLM to fulfill the intents, but suffer from three key limitations: 1) loss of historical context for identifying uncovered functionalities, 2) synchronous intent generation that blocks exploration, and 3) per-step LLM-driven fulfillment incurring high cost and latency. To address these limitations, we propose GraphDroid, an intent-driven GUI testing framework that integrates a cluster-based memory mechanism to effectively identify uncovered functionalities from historically visited states for comprehensive application testing. For improving testing efficiency, GraphDroid adopts an asynchronous intent generation paradigm that eliminates the latency bottleneck and a hybrid intent fulfillment strategy that reserves the LLM for fulfilling complex intents while delegating simple intents to a lightweight heuristic algorithm. We evaluate GraphDroid on 41 real-world Android apps against six state-of-the-art baselines. Results show that GraphDroid outperforms all baselines, achieving up to 36.4% higher code coverage while incurring less than one eighth of the cost of the best pure LLM-based baseline. GraphDroid also exposes 19 bugs in the 41 apps and detects 13 of 52 crashes in the Themis bug benchmark, surpassing all the six baselines. Seven of the 19 bugs were previously unknown and we reported them to the developers. So far, four bugs have been confirmed and fixed. Article Search Article: ase26main-p609-p doi:10.1145/3832783.3837449 ASE '26: "Doc2Feat-Bench: Evaluating ..." Doc2Feat-Bench: Evaluating Documentation-Driven Feature Addition Zhonghao Jiang, Le Deng, Jialun Cao, Michael Pradel, and Zhongxin Liu (Zhejiang University, China; Hong Kong University of Science and Technology, Hong Kong; CISPA Helmholtz Center for Information Security, Germany) Documentation changes in mature software projects often describe newly introduced or modified behavior. This makes them a natural basis for documentation-driven feature addition, where software engineering agents implement features from public-facing documentation updates. However, existing benchmarks for agentic software development primarily rely on issue reports written for maintainer coordination and often contain implementation-level details. Motivated by this observation, this work introduces Doc2Feat-bench, a benchmark for documentation-driven feature addition. Doc2Feat-bench consists of 634 tasks across 10 mature open-source software projects, involving about 114k code changes in total. Each task pairs a documentation change with the corresponding implementation and developer-written tests, enabling evaluation of whether a software engineering agent can implement the feature described by the documentation diff. The benchmark is constructed through a five-phase pipeline, starting from release notes, and offers broad coverage across libraries, developer tools, and frameworks while preserving real-world development settings. To facilitate lightweight and reliable evaluation under limited resources, we further curate a human-validated subset named Doc2Feat-bench Verified. It contains 114 high-quality instances whose task clarity and evaluation validity are manually verified. We use Doc2Feat-bench to assess a range of state-of-the-art software engineering agents with two widely used scaffolds. Experimental results show that despite significant token consumption, the best task success rate remains as low as 37.72% (OpenHands with Qwen3-Coder-480B). Our analysis reveals that software engineering agents face key challenges in performing cross-file edits, understanding existing code modules, and correctly interpreting documentation semantics. Article Search Article: ase26main-p1306-p doi:10.1145/3832783.3837489 ASE '26: "VerusSeek: Retrieval-Augmented ..." VerusSeek: Retrieval-Augmented LLM-Based Proof Synthesis for Rust Programs Yuchen Zhang, Cheng Wen, Jialun Cao, Dugang Liu, Zhiwu Xu, Yuwei Liu, and Shengchao Qin (Xidian University, China; Hong Kong University of Science and Technology, Hong Kong; Shenzhen University, China; Institute of Software at Chinese Academy of Sciences, China) Formal verification of Rust programs with Verus provides strong correctness guarantees, but developing the auxiliary specifications and proofs still requires considerable manual effort. Existing LLM-based proof-synthesis agents can automate part of this process, yet their effectiveness on non-trivial tasks is often limited by the lack of reusable proof patterns that are directly relevant to verification. This paper presents VerusSeek, a retrieval-augmented tool for LLM-assisted Verus proof synthesis for Rust programs. Instead of retrieving entire files or functions, VerusSeek indexes previously verified Verus code as semantic proof constructs, including contracts, assertions, loop invariants, lemmas, and proof blocks. For each verification task, the tool performs type-aware retrieval to select constructs that match the current proof obligation, expands them with bounded hierarchical context, and synthesizes lightweight structural loop-invariant hints for index bounds, frame conditions, and termination arguments. Verus checks each candidate proof, and the resulting diagnostics guide the next repair attempt. On 150 tasks from VerusBench, VerusSeek verifies 122 tasks, compared with 69 for AutoVerus and 85 for RagVerus. A demonstration video of VerusSeek is available at https://youtu.be/p2mb61gj95A. Article Search Article: ase26tool-p29-p doi:10.1145/3832783.3834603 ASE '26: "ACSLBench: A Verified C/ACSL ..." ACSLBench: A Verified C/ACSL Corpus and Benchmark with Compositional Call Chains for Formal Specification Synthesis Junjie Hu, Cheng Wen, Bin Yu, Jialun Cao, Dugang Liu, Weidi Sun, Haokun Li, Shengchao Qin, and Cong Tian (Xidian University, China; Hong Kong University of Science and Technology, Hong Kong; Shenzhen University, China; Peking University, China) Formal specification synthesis for C programs is a key step toward scalable deductive verification, yet current learning-based approaches lack large verified C/ACSL data and evaluation tasks that exercise reasoning across function calls. We present ACSLBench, a reusable dataset artifact for training and evaluating C/ACSL specification synthesis models. ACSLBench contains two resources: a corpus of 504,587 formally verified C/ACSL programs, and a curated benchmark of 495 tasks designed around function-call composition. The corpus is built by translating verified Rust/Verus seeds into C/ACSL via an LLM-guided semantic mapping loop, in which Frama-C/WP feedback repairs failed candidates. The benchmark is synthesized from verified components by constructing caller functions whose specifications depend on multiple callee contracts. Experiments with six LLMs show that performance drops as the number of function calls increases. The dataset is available at https://huggingface.co/datasets/noBuggie/AcslBench, and the video is available at https://youtu.be/kgvvTajX2Mk. Article Search Article: ase26tool-p82-p doi:10.1145/3832783.3834628
	Cao, Liqing	ASE '26: "FlowChecker: One Command to ..." FlowChecker: One Command to Model Check Control-Flow Rules in Industrial Java Qiuye Wang, Liqing Cao, Wei Hu, and Dengcheng He (Alibaba Cloud Computing, China) Industrial correctness rules often remain implicit, enforced only by review and team convention. Many such rules are temporal control-flow obligations: a cache-loading path must not pollute the cache, an error must not be raised before validity is decided, or a failure must remain visible across component boundaries. Existing formal verification and static analysis techniques can support related checks, but routine use remains hard when each team rule must be recast as custom traversal logic, harness-driven execution exploration, or a tool-specific protocol specification. We present FlowChecker, a developer-facing model-checking system for project-specific temporal control-flow rules. Engineers express rules as reviewable CTL formulas over familiar program events; FlowChecker extracts a finite control-flow model, preserves rule-relevant exception and framework-mediated paths, and checks the formula by evaluating CTL fixpoints in Soufflé, an optimized Datalog engine. This makes temporal control-flow checks repeatable locally and in CI, while keeping verdicts explicitly scoped to the extracted model. Across seven public Java projects, we evaluate 42 checks covering reachability, exception propagation, event ordering, and wrapping/capture, with formulas ranging from single temporal obligations to nested compositions. We additionally study synthetic models up to 10 million states and five sanitized internal adoption cases from Alibaba Cloud Computing. Article Search Article: ase26ind-p388-p doi:10.1145/3832783.3834530
	Cao, Ruochen	ASE '26: "Breaking the Isolation: Coordinated ..." Breaking the Isolation: Coordinated Multi-agent Fuzzing for Smart Contracts with Multi-dimensional Objective Learning Ruichao Liang, Ruochen Cao, Jing Chen, Kun He, Yebo Feng, Yue Xue, and Cong Wu (Wuhan University, China; Nanyang Technological University, Singapore; MetaTrust Labs, Singapore) Smart contracts manage critical assets in decentralized systems but are prone to vulnerabilities. While fuzzing has proven effective in software testing, existing contract fuzzers often rely on ad-hoc optimization strategies with limited objective guidance, typically driven by coverage or simple heuristics. This narrow focus leads to high false negative rates, as important perspectives of smart contracts, like semantic, state, and economic effects, are overlooked during transaction sequence generation. Moreover, coordinating these dimensions into fuzzing is challenging because their divergent objectives and complex interactions make ad-hoc adaptations to fitness functions or mutation strategies largely ineffective. To fill the gaps, we propose SynerFuzz, a multi-agent deep reinforcement learning-based fuzzer. We formulate fuzzing as a Decentralized Partially Observable Markov Decision Process, where each agent is assigned a distinct testing objective extracted from the target contract. Through coordinated learning, DRL agents integrate multi-dimensional signals to construct high-quality sequences, enabling SynerFuzz to uncover both subtle semantic flaws and economically profitable behaviors. Compared to 9 SOTA tools, SynerFuzz detects up to 4.2× more vulnerabilities while reducing time and transaction overhead by 70.6% and 86.8%. In real-world scenarios, SynerFuzz reproduces 33 historical DeFi exploits with over $40 million losses and discovers 17 0-day vulnerabilities in 4 projects managing over $179.8 million, earning $3,800 bug bounties. Article Search Article: ase26main-p791-p doi:10.1145/3832783.3837466
	Cao, Yazhuo	ASE '26: "SkillMOO: Multi-objective ..." SkillMOO: Multi-objective Optimization of Agent Skills for Software Engineering Jingzhi Gong, Ruizhen Gu, Zhiwei Fei, Yazhuo Cao, Lukas Twist, Alina Geiger, Shuo Han, Dominik Sobania, Federica Sarro, and Jie M. Zhang (King's College London, UK; Queen's University Belfast, UK; Nanjing University, China; Johannes Gutenberg University Mainz, Germany; University College London, UK; University of Duisburg-Essen, Germany) Agent skills are increasingly used to configure coding agents for software engineering (SE) tasks, yet current practice treats them as static, hand-crafted assets, or evolved on pass rate alone. This is insufficient: a skill can improve task success while substantially raising token cost, or introducing misleading guidance. We argue that SE agent skill bundles can be treated as multi-objective search objects and present SkillMOO, a framework that evolves skill bundles through LLM-proposed edits and NSGA-II Pareto selection on pass rate and inference cost. Evaluated across all 16 SkillsBench SE tasks, SkillMOO achieves the top pass rate rank on 11 of 12 non-zero-pass tasks while achieving cost reductions of up to 31.7% over static bundles, with pass rate gains up to 42 percentage points. Analysis of 38 skill edits shows that pruning and substitution dominate successful operations, offering actionable principles for skill bundle design. Thereby, the current practice of deploying skills without cost-aware validation leaves better skill configurations unexplored, motivating a new class of multi-objective search-based skill engineering. Article Search Article: ase26nier-p65-p doi:10.1145/3832783.3834550
	Carlo Lambertenghi, Stefano	ASE '26: "Real-World Perturbation Testing ..." Real-World Perturbation Testing of Autonomous Driving Systems Stefano Carlo Lambertenghi, Matthias Weil, and Andrea Stocco (TU Munich, Germany; fortiss, Germany) Autonomous Driving Systems (ADS) must operate reliably under diverse conditions, yet representative data for rare or adverse scenarios is difficult to obtain. Perturbation-based testing is widely used to assess robustness, but most studies focus on offline datasets or simulation, leaving open questions about how such results translate to real-world driving. We present a large-scale study of 72 camera and LiDAR perturbations, evaluated across three testing modalities: offline model-level analysis, hardware-in-the-loop execution, and closed-loop system-level testing on a full-scale autonomous vehicle. The study covers both an end-to-end vision-based driving model and a modular LiDAR-based perception and planning stack. Our results reveal a clear gap between testing levels. For camera-based systems, perturbations with limited offline impact can still induce unstable control and failures in real-world driving. For LiDAR-based systems, degradation is more consistent at the perception level but weakly predictive of system-level failures. Across both modalities, model-level metrics alone are insufficient to identify the most harmful perturbations.We further show that real-time feasibility is a key constraint in real-world testing, and that robustness observations obtained from recorded data do not consistently transfer to closed-loop behavior on a physical vehicle, highlighting the importance of complementary real-world, system-level evaluation. Article Search Article: ase26main-p2645-p doi:10.1145/3832783.3834418
	Carpels, Bart	ASE '26: "IP-Preserving Enterprise System ..." IP-Preserving Enterprise System Modernization via LLM-Driven Specification Extraction and Multi-target Code Generation Andreas Biesdorf, Eckhard Seibert, Nicole Wengatz, Bart Carpels, and Tom Schoonbaert (Trier University of Applied Sciences, Germany; Siemens, Germany; Euroports, Belgium) We report on the automated modernization of a business-critical terminal operating system deployed across multiple sites of a major European port infrastructure company, comprising a heterogeneous technology stack accumulated over many years of continuous development: over 22,000 source files, about 10,000 of them C#, a multi-layered web forms UI, a complex Oracle database, and extensive operational documentation. Most current LLM-assisted modernization approaches rely on cloud-based models, raising intellectual property and security concerns that prevent adoption in industrial settings. We present a hybrid pipeline in which local LLMs extract a formal four-view specification that keeps proprietary source code entirely on-premises, while cloud models generate target implementations from specifications only, never accessing the legacy codebase. The pipeline extracts structural domain models, behavioral rules, process state machines, and screen presentations across 48 bounded contexts via a two-pass LLM extraction approach. Against a curated reference on a CRM probe, the best local model reaches a structural fidelity of 0.83, while two of seven candidates fail to emit parseable JSON at all; prompt engineering raises the semantic purity of the extracted domain model from 0.71 to 0.94, whereas legacy documentation adds almost nothing. Following a test-first approach, 5,451 behavioral tests were generated from specifications alone before any target implementation, and two runnable application stacks (Python/FastAPI and .NET 8 Blazor) were produced. We report concrete lessons on prompt engineering, structured output generation, and the practical boundaries between automation and manual intervention. Article Search Article: ase26ind-p443-p doi:10.1145/3832783.3834533
	Carste, Constantin	ASE '26: "Cam2Sim: Neural Scenario Reconstruction ..." Cam2Sim: Neural Scenario Reconstruction for Closed-Loop Autonomous Driving Simulation Davide Jannussi, Stefano Carlo Lambertenghi, Constantin Carste, and Andrea Stocco (Politecnico di Torino, Italy; TU Munich, Germany; fortiss, Germany) Simulation-based testing enables safe and repeatable evaluation of autonomous driving systems, but its effectiveness is limited by the gap between synthetic simulator outputs and real-world camera observations. We present Cam2Sim, a tool that transforms real-world driving recordings into executable CARLA scenarios. Starting from camera images and poses, Cam2Sim reconstructs road geometry, ego trajectories, parked vehicles, and simulation assets, and augments the environment with Gaussian Splatting to render camera observations resembling the original recording. The framework supports ROS-based data extraction, parked-vehicle detection, OpenStreetMap-based map generation, CARLA scenario construction, Gaussian Splatting training, trajectory replay, and closed-loop testing. We validate Cam2Sim on a real urban-driving scenario with an end-to-end driving model, evaluating reconstruction quality, image-generation quality, and closed-loop behavior against a simulation-only baseline and the real-world reference. Results show that Gaussian-Splatting-based rendering reduces the visual gap with respect to simulator rendering and improves behavioral similarity to the real-world reference. The artifact is publicly available at https://github.com/ast-fortiss-tum/cam2sim, and a screencast is available at https://youtu.be/KmZ74l1__lI. Article Search Article: ase26tool-p120-p doi:10.1145/3832783.3834639
	Cassel, Darion	ASE '26: "Learning to Triage Vulnerability ..." Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js Ronghao Ni, Aidan Z.H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, and Kevin Cheang (Carnegie Mellon University, USA; Athanor AI, USA; University of California at Berkeley, USA) Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNNs and LLMs, trained on data derived from program analysis tool outputs (NodeMedic-FINE in our case study). The top LLM achieves F1=0.915, while the best provenance-graph-based method achieves F1=0.904. On the reports that the upstream tool flags but cannot automatically confirm, at a target of recovering 90% of the exploitable reports, the leading model eliminates 75% of the benign reports from manual review. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives among all warnings), our approach can report 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage. Article Search Article: ase26main-p1614-p doi:10.1145/3832783.3837503
	Castiglione, Gianpietro	ASE '26: "VeriSBOM: Secure and Verifiable ..." VeriSBOM: Secure and Verifiable SBOM Sharing via Zero-Knowledge Proofs Gianpietro Castiglione, Shahriar Ebrahimi, and Narges Khakpour (Newcastle University, UK) SBOMs often contain sensitive information that organizations are unwilling to disclose in full. To avoid disruption of privacy and confidentiality in delivering plaintext SBOMs, we present VeriSBOM, a trustless SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs, i.e., third-parties can validate if software contains authentic dependencies distributed by official package managers and that the same dependencies are compliant with policy constraints. The verification process requires no trust in the SBOM publisher beyond the soundness of the underlying primitives, and third parties can independently check proofs against the public cryptographic commitments. We design and implement VeriSBOM, analyze its security, evaluate its performance on real-world package registries and SBOMs, and evaluate its usability. Article Search Artifacts Available Article: ase26main-p3290-p doi:10.1145/3832783.3834432
	Cauz, Maxime	ASE '26: "UltraInstinctVR: A Model-Based ..." UltraInstinctVR: A Model-Based Tool for Automated System Testing of VR Applications Gerry Longfils, Maxime Cauz, Arnaud Blouin, and Xavier Devroey (University of Namur, Belgium; INSA Rennes, France) Virtual Reality (VR) applications are increasingly used in domains such as surgical training and industrial marketing, yet their longterm adoption remains limited by the lack of effective, systematic, and reproducible testing approaches tailored to VR. To address this gap, we present UltraInstinctVR, a novel tool that automates the generation and execution of concrete system-level tests for VR applications, helping developers efficiently validate interactions and behaviors. We evaluated UltraInstinctVR against state-of-the-art automated VR testing tools across 10 open-source VR applications, where it outperformed existing approaches in detecting unique failures and uncovering real-world bugs. In this paper, we further extended this evaluation through an empirical user study with ten VR developers. Results highlight strong dependability and efficiency while identifying opportunities for improvement in other user experience dimensions. Overall, these findings position UltraInstinctVR as a promising step toward more practical, effective, and scalable VR testing. The tool is publicly available at https://github.com/snailunamur/UltraInstinctVR, with a demonstration video available at https://youtu.be/U8DWTmXmeh4. Article Search Article: ase26tool-p141-p doi:10.1145/3832783.3834642
	Ceylan, Halim Abdurrahman	ASE '26: "Mutation Testing of Simulink ..." Mutation Testing of Simulink Cyber-Physical System Models: Challenges and Solutions in Practice Murat Kavak, Onur Kilincceker, Serge Demeyer, Kevin Vandenbroucke, and Halim Abdurrahman Ceylan (University of Antwerp, Belgium; Flanders Make, Belgium; Duco, Belgium; Ege University, Türkiye) Several experience reports illustrate that mutation testing is capable of supporting a "shift-left" testing strategy, especially in industries where late bug discovery incurs very high costs and risks. In the context of cyber-physical systems, a "shift left" implies that engineers need to test the design models used to simulate, prototype, and analyse the feasibility of the system under design. In this paper, we analyse the challenges we encountered and the lessons we learned when incorporating mutation testing in the context of DUCO, a company producing ventilation systems for buildings. The engineers within DUCO have years of experience with model-based engineering centered around Simulink and StateFlow, including unit tests for their models. During a pilot project with our tool prototype MUT4SLX we learned that equivalent mutants, requirement traceability, and mutation testing for StateFlow represent particular challenges not yet reported in the academic literature. Article Search Article: ase26ind-p356-p doi:10.1145/3832783.3834529
	Cha, Sang Kil	ASE '26: "InsightQL: A Unified Code ..." InsightQL: A Unified Code Database for Fuzz Blocker Analysis Wentao Gao, Renata Borovica-Gajic, Sang Kil Cha, Michael Fu, Tian Qiu, and Van-Thuan Pham (University of Melbourne, Australia; KAIST, Republic of Korea) Fuzzing is a highly effective automated testing method for uncovering software vulnerabilities. Despite advances in fuzzing techniques, many fuzzers still struggle with coverage plateaus caused by fuzz blockers, which limit their ability to discover deeper vulnerabilities. We introduce InsightQL, the first human-assisted tool for fuzz blocker analysis. InsightQL is powered by a unified database, an intuitive parameterised query interface, and a VS Code plugin. It enables developers to reason about the root causes of fuzz blockers, often with a simple right-click in the plugin. The framework is extensible and it could support C/C++ projects in OSS-Fuzz. It can also be easily extended with custom queries. A screencast of the tool is available at https://youtu.be/mFxYhmikXs8. Article Search Article: ase26tool-p98-p doi:10.1145/3832783.3834633
	Cha, Sooyoung	ASE '26: "Orbis: Guiding Symbolic Execution ..." Orbis: Guiding Symbolic Execution Techniques to Maximize Option-Related Branch Coverage Minjong Kim, Sungjae Hwang, and Sooyoung Cha (Sungkyunkwan University, Republic of Korea) We present Orbis, a complementary approach that guides symbolic execution techniques toward maximizing option-related branch (OB) coverage. Although state-of-the-art symbolic execution techniques have substantially improved code coverage and bug detection, existing techniques often fail to exercise core program functionalities, which are frequently exposed as program options. To quantify this limitation, we evaluate how effectively current techniques cover option-related branches and find that they reach only 8.0% of the targeted OBs, which are accessible only through specific options. Orbis overcomes this challenge by systematically guiding symbolic execution to improve OB coverage. For a given program, Orbis automatically identifies all defined options and determines their associated branches by analyzing dynamic execution traces. It then iteratively constructs target option arguments by stochastically combining identified options according to their estimated potential, directs symbolic execution to explore states influenced by these arguments, and refines their potential while simultaneously reducing SMT-solver invocations using data accumulated during symbolic execution. Experimental results on 15 open-source C programs show that integrating Orbis with four independent state-of-the-art techniques significantly increases OB coverage to 323.0%, boosts total branch coverage by 112.1%, and detects five additional unique bugs on average compared to the standalone techniques. Article Search Article: ase26main-p2260-p doi:10.1145/3832783.3837526
	Chand, Sivajeet	ASE '26: "DepWareTrans: Dependency-Aware ..." DepWareTrans: Dependency-Aware Incremental Repository Migration across Co-executable Languages Sivajeet Chand, Alexander Pretschner, Steve Haupt, Derui Zhu, and Sushant Kumar Pandey (TU Munich, Germany; andrena objects, Munich, Germany; University of Groningen, Netherlands) Repository-level code translation is critical for modernizing legacy systems, yet existing approaches based on large language models (LLMs) operate at the file level and fail to scale to codebases with complex inter-file dependencies. This limitation is evident in our industrial setting, where we aim to migrate a production repository (STAR) from Java to Kotlin, but file-level approaches produce fragmented results and fail to achieve end-to-end correctness. In this paper, we show that the primary cause of failure at the repository level is dependency inconsistency. Through an empirical study on open-source and industrial systems, we find that most errors arise from unresolved cross-file dependencies that cannot be effectively addressed by iterative feedback alone. We propose a dependency-aware incremental migration framework that elevates the unit of translation from individual files to dependency-consistent batches. Our approach constructs a dependency graph, groups interdependent files, and performs batched translation with iterative compile- and test-driven validation. We evaluate our method on a 51K line of code (LOC) industrial system and multiple repositories across interoperable language pairs (Java–Kotlin, Java–Scala, and C#–F#). On the STAR repository, file-level approaches achieve 38.16% compilation and 9.39% test success, whereas our approach achieves 100% compilation and test success across the evaluated settings, converging within a small number of iterations. These results show that dependency-aware batching improves scalability and reliability in repository-level code translation. Article Search Article: ase26ind-p197-p doi:10.1145/3832783.3834505
	Chandra, Satish	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508 ASE '26: "REAP: Automatic Curation of ..." REAP: Automatic Curation of Coding Agent Benchmarks from Interactive Production Usage Smriti Jha, Matteo Paltenghi, Chandra Maddila, Vijayaraghavan Murali, Shubham Ugare, and Satish Chandra (Meta Platforms, USA) Production deployment of AI coding agents requires fast, reproducible evaluation signals. Existing industrial practices trade off speed and fidelity: online A/B testing takes weeks and risks user experience, shadow deployment yields signals that are not reproducible across runs, and public benchmarks diverge from production workloads in language distribution, prompt style, and codebase structure. This paper presents REAP (Relevance and Execution-Audited Pipeline), an automated curation pipeline that constructs production-derived benchmarks from real developer-agent sessions without manual labeling. Such curation, while in-distribution to production usage, runs into several challenges. Untestable prompts, misaligned tests, and test flakiness all compromise evaluation reliability. While tasks can be manually audited to ensure only high-quality tasks remain in the benchmark, this approach is infeasible in the monorepo setting: the build infrastructure state is often ephemeral in large monorepos and requires the benchmark to be continuously re-curated against the current codebase. As manual verification cannot be sustained at this cadence, REAP adds an automated verification layer using LLM-based task classification, agentic test-relevance validation, and multi-run stability checks to ensure the executable benchmark yields trustworthy signals. We use REAP to curate Harvest, a benchmark where each task feeds the coding agent a real developer prompt and verifies the resulting code change against fail-to-pass tests retrieved from production. Harvest’s distribution spans more than four programming languages with a majority of tasks drawn from Hack, a meaningful divergence from public benchmarks which are skewed towards Python. Model and harness evaluations reveal that solve rates range from 42.9% to 58.2% across five frontier models, surfacing capability differences that inform concrete deployment decisions. The underlying corpus contains proprietary source code and cannot be released publicly; we share our automated curation methodology and case studies to enable other organizations to construct similar production-derived benchmarks at scale. Article Search Artifacts Available Article: ase26ind-p266-p doi:10.1145/3832783.3834519
	Chaparro, Oscar	ASE '26: "On the Reliability of Code ..." On the Reliability of Code Comprehension Proxies Erfan Arvan, Nadeeshan De Silva, Oscar Chaparro, and Martin Kellogg (New Jersey Institute of Technology, USA; William & Mary, USA) Prior work on code comprehension uses different comprehension proxies—for example, Likert-scale ratings or answers to input-output questions about program snippets, usually collected from students, to approximate whether code is comprehensible to software engineers, but the relative reliability of these proxies is not known. This paper investigates the relative reliability of a collection of proxies common in the extant literature with a pair of human studies. First, we conducted an expert-consensus study with a panel of five professional software engineers to establish a ground-truth comprehensibility ranking of eight code snippets by adapting the Delphi expert-consensus protocol. The Delphi protocol is widely used for expert consensus under conditions of uncertainty in other domains such as medicine and national-security forecasting, but to our knowledge, this is its first application to code comprehension research. Second, we conducted a study with 44 student participants who completed comprehension tasks, allowing us to measure 14 comprehension proxies derived from the literature on the same set of eight code snippets. Finally, we conducted a correlation analysis on the results, concluding that proxies 1) derived from input-output questions and 2) that measure response time rather than accuracy are especially reliable. We also found that proxies derived from questions about program syntax (rather than semantics) are especially unreliable, regardless of measurement strategy, which draws into question the reliability of parts of the existing comprehensibility literature. Article Search Artifacts Available Article: ase26main-p2877-p doi:10.1145/3832783.3834425 ASE '26: "Pattern over Pixels: Measuring ..." Pattern over Pixels: Measuring Pattern Completion Bias in Multimodal Code Generation Khai-Nguyen Nguyen, Oscar Chaparro, and Antonio Mastropaolo (William & Mary, USA) Multimodal large language models (MLLMs) are increasingly used to translate webpage screenshots into front-end code, but repeated UI patterns may sway them toward visually incorrect yet pattern-consistent outputs. In this work, we test how repeated webpage patterns hurt MLLM accuracy on an objective screenshot-to-code fill-in-the-blank task. We introduce the first benchmark for visual pattern-completion bias, where one localized element in a repeated UI pattern is perturbed and the model must recover the masked width or font-size value from the screenshot and HTML context. Starting from 30 webpages curated from the Design2Code dataset, we build 1,440 evaluated screenshots spanning structural card and text-style patterns under standard and noise-overlaid conditions. We evaluate five frontier MLLMs and find that all are strongly biased toward the repeated baseline. Mean bias rate reaches 69.78% on card-width perturbations and 80.22% on text font-size perturbations, while mean accuracy is only 21.17% and 7.89%, respectively.  performs best but still drops from 68.61% accuracy on cards to 13.89% on text, while  reaches 96.11% bias on text. Noise, subtler perturbations, and boundary positions further increase bias rate. Reasoning analysis further shows that greater reasoning effort correlates with lower bias, yet qualitative evidence reveals that models can identify the anomalous element and still override it with the pattern-consistent answer. Our results identify a concrete failure mode in multimodal code generation and show that its severity is strongly associated with visual saliency. Article Search Article: ase26main-p3922-p doi:10.1145/3832783.3834443
	Charles, Lucas	ASE '26: "Vulnerability Tracking using ..." Vulnerability Tracking using Normalized Scope+Offset Julian Thome, Hua Yan, Lucas Charles, Craig Smith, and Jason Leasure (GitLab, Luxembourg; GitLab, Australia; GitLab, USA; Independent Researcher, USA) In heterogeneous Static Application Security Testing (SAST) setups, multiple tools continuously monitor code changes to detect security vulnerabilities. Vulnerability Tracking deduplicates and tracks these vulnerabilities throughout a project’s lifetime, reducing futile auditing caused by code volatility and double reporting. In prior work, we introduced the Scope+Offset method which identifies vulnerabilities based on a scope and offset fingerprint, reducing futile auditing by approximately 30%. However, the offset component is sensitive to non-functional code changes such as added comments or whitespace, which can cause spurious duplication. In this paper, we present Scope+OffsetN, an improved method that normalizes the offset computation by excluding non-functional source code lines. We detail the normalization algorithm and demonstrate its correctness on worked examples; on a targeted public benchmark it reduces unique fingerprints by 43%. Scope+OffsetN has been deployed in GitLab since May 2025, providing tracking to thousands of daily security scans. Article Search Article: ase26ind-p239-p doi:10.1145/3832783.3834513
	Charoenwet, Wachiraphan	ASE '26: "AgenticSCR: An Autonomous ..." AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection Wachiraphan Charoenwet, Kla Tantithamthavorn, Patanamon Thongtanunam, Hong Yi Lin, Minwoo Jeong, and Ming Wu (University of Melbourne, Australia; Monash University, Australia; Atlassian, USA) Secure code review is critical during pre-integration, where Atlassian developers rely on lightweight analysis tools, while deep security assessment is deferred to later stages, delaying feedback and increasing remediation costs. Existing static analyzers are often noisy and struggle with context-dependent or partially manifested vulnerabilities, while static large language model (LLM) reviewers are constrained by context windows and lack tool interaction. Agentic AI, which combines LLMs with code navigation, shows promise; however, its effectiveness for early-stage secure code review remains underexplored. We present AgenticSCR, an agentic secure code reviewer augmented with security-focused semantic memory that grounds reasoning in structured security knowledge to detect vulnerabilities before they fully manifest. AgenticSCR achieves at least 153% relative improvement in generating comments with correct localization, vulnerability type, and relevance over static LLM baseline, multi-agent reviewer, and SAST tools. In a shadow deployment, 54% of its comments were validated by security engineers for developer reporting, demonstrating practical utility while underscoring the difficulty of the task. These findings position the security-focused semantic memory as a promising direction for agentic secure code review, enabling early-stage vulnerability identification. Our approach builds an important step toward reliable localization, detection, and explanation in shift-left security practices. Article Search Article: ase26ind-p302-p doi:10.1145/3832783.3834523 ASE '26: "Agentic Code Review in the ..." Agentic Code Review in the Terminal: A Trajectory-Level Analysis of Behavior, Cost, and Human-Alignment Wachiraphan Charoenwet, Kla Tantithamthavorn, Patanamon Thongtanunam, Hong Yi Lin, Minwoo Jeong, and Ming Wu (University of Melbourne, Australia; Monash University, Australia; Atlassian, USA) Agentic code review in terminal-based environments enables early feedback during local development before pull request creation. However, existing evaluations remain performance-centric and fail to capture the dynamic behaviors of repository-grounded agentic reviewers. Understanding these behaviors is critical for identifying how agentic reviewers succeed, fail, and incur hidden operational costs in practice. Then, we analyze the reviewers’ behavior based on their trajectories. Our results show that agentic reviewers achieve higher review precision but incur substantial exploration and validation overhead, while successful reviews are associated with stronger planning and less downstream validation. These findings highlight the potential benefits of trajectory-aware and cost-sensitive evaluation of future agentic code review systems. Article Search Article: ase26nier-p49-p doi:10.1145/3832783.3834546
	Chatterjee, Preetha	ASE '26: "How Do LLMs Read Bug Reports? ..." How Do LLMs Read Bug Reports? An Empirical Study of Attention in LLMs for Automated Program Repair Ramtin Ehsani, Irene Manotas, Saurabh Pujar, Luca Buratti, and Preetha Chatterjee (Drexel University, USA; IBM Research, USA) Large Language Model (LLM)-based Automated Program Repair systems are advancing rapidly, yet their performance remains inconsistent. Even when provided with the same contextual information, an LLM may generate a correct patch for one bug but fail on another closely related bug. Why this happens remains poorly understood, and it is unclear how LLMs prioritize the diverse information in bug reports and whether model attention affects repair success. In this paper, we present the first empirical study of attention patterns in LLM-based program repair, providing interpretable insights into how models process bug reports and where their attention is concentrated during repair. We analyze 319 real-world Python and Java bugs from SWE-bench Verified and Multi-SWE-bench to study (RQ1) how model attention is distributed across bug report sections, (RQ2) how attention patterns within each section differ between successful and unsuccessful repairs, and (RQ3) how these patterns compare to information developers consider important for bug fixing. We find that successful repairs are characterized by diffused attention across multiple diagnostic components such as bug descriptions, stacktraces, and test cases, while failures often exhibit over-localized attention toward metadata such as version information. We further observe that stronger alignment between model attention and developer-identified key sections and phrases is associated with higher repair success. Our results provide the first empirical evidence that attention misallocation is a key factor in LLM-based APR failures, and offer actionable insights for designing more interpretable and reliable future APR systems. Article Search Artifacts Available Article: ase26main-p306-p doi:10.1145/3832783.3837434
	Che, Limei	ASE '26: "Maintaining Control States ..." Maintaining Control States for Initialization-Aware GRPO in Industrial LLM Workflows Chen Liu, Zhenzhao Yuan, Fengyuan Fan, Limei Che, Qiao Qian, Qingyuan Liang, Zeyu Sun, and Lu Zhang (Peking University, China; Tencent, China; Institute of Software at Chinese Academy of Sciences, China) Large language models (LLMs) are increasingly used as components in industrial software workflows, where they are expected to support reliable automation. However, newly introduced workflows often provide only limited data and sparse task-level feedback, making post-deployment adaptation difficult. GRPO-based post-training provides a practical adaptation way in this setting, but its effectiveness depends on the state from which adaptation begins. When the initial behavior of an LLM workflow is poorly aligned with the target workflow, early samples may provide weak reward signals, wasting adaptation budget and delaying workflow onboarding. We propose CoSTAR, an industrial post-deployment adaptation framework that maintains the starting state for downstream GRPO through a lightweight workflow-level control component. CoSTAR performs GRPO-style optimization on this control component while keeping the task model fixed, and alternates this maintenance with downstream GRPO, so that the control state can continue adapting across stages rather than remain a one-shot initialization. Experiments on a company-internal industrial workflow automation task show that CoSTAR substantially improves task-specific post-training, achieving 94.00% exact match and raising performance on complex cases to 80.56%. Overall, our results show that maintaining the starting state of downstream GRPO improves adaptation under limited workflow feedback and provides a more effective path for industrial LLM workflow maintenance. Article Search Article: ase26ind-p22-p doi:10.1145/3832783.3834459
	Cheang, Kevin	ASE '26: "Learning to Triage Vulnerability ..." Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js Ronghao Ni, Aidan Z.H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, and Kevin Cheang (Carnegie Mellon University, USA; Athanor AI, USA; University of California at Berkeley, USA) Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNNs and LLMs, trained on data derived from program analysis tool outputs (NodeMedic-FINE in our case study). The top LLM achieves F1=0.915, while the best provenance-graph-based method achieves F1=0.904. On the reports that the upstream tool flags but cannot automatically confirm, at a target of recovering 90% of the exploitable reports, the leading model eliminates 75% of the benign reports from manual review. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives among all warnings), our approach can report 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage. Article Search Article: ase26main-p1614-p doi:10.1145/3832783.3837503
	Chen, Binbin	ASE '26: "Free Is More: Empowering Software ..." Free Is More: Empowering Software Agents via Issue-Free Trajectory Learning and Entropy-Aware RLVR Training Xin-Cheng Wen, Binbin Chen, Haoxuan Lan, Hang Yu, Peng Di, and Cuiyun Gao (Harbin Institute of Technology, Shenzhen, China; Ant Group, China; Zhejiang University, China; University of New South Wales, Australia) Large language models (LLMs) have transformed the software engineering landscape. Recently, numerous LLM-based agents have been developed to address real-world software issue fixing tasks. These agents are typically equipped with various coding tools, enabling them to autonomously generate action trajectories for end-to-end problem-solving. Despite their state-of-the-art performance, these agents still face two primary challenges: (1) Lack of sufficiently high-quality issue descriptions: Inconsistencies between issue descriptions and their corresponding solutions introduce noise and ambiguity that can mislead automated agents, restricting their ability to derive effective solutions. Furthermore, high-quality issue-PR pairs are difficult to acquire at scale, and the available datasets remain relatively limited in size. (2) Uncertainty introduced by bash tools prevents stable training and sufficient exploration: Bash tools serve as the primary interface for code execution and file manipulation in SWE agents, making them integral to virtually all agent operations. However, bash tools introduce substantial uncertainty into the agent's decision-making process. In reinforcement learning with verifiable rewards (RLVR), the fixed probability ratio clipping mechanism exhibits limited adaptability to such varying uncertainty states. Specifically, when bash tool invocations trigger high-entropy states, excessively restrictive clipping constraints impede both exploration and stable learning, hindering the training efficiency. To address these challenges, we propose SWE-Fuse, an issue-description-aware training framework that fuses issue-description-guided and issue-free samples for training SWE agents. It consists of two key modules: (1) An issue-free-driven trajectory learning module, which comprises: a multi-step trajectory construction component for generating high-quality multi-turn reasoning-action trajectories, a trajectory data filtering process for ensuring data quality, and issue-free-driven supervised fine-tuning to mitigate potentially misleading issue descriptions while enabling the model to learn step-by-step debugging processes; and (2) An entropy-aware RLVR training module, which adaptively adjusts training dynamics through entropy-driven clipping. It applies relaxed clipping under high entropy to encourage exploration, and stricter clipping under low entropy to ensure training stability. We evaluate SWE-Fuse on the widely studied SWE-bench Verified benchmark shows to demonstrate its effectiveness in solving real-world software problems. Specifically, SWE-Fuse outperforms the best 8B and 32B baselines by 41.9% and 59.3% in solve rate, respectively. Furthermore, integrating SWE-Fuse with test-time scaling (TTS) enables further performance improvements, achieving solve rates of 49.8% and 65.2% under TTS@8 for the 8B and 32B models, respectively. Article Search Article: ase26main-p3466-p doi:10.1145/3832783.3834438
	Chen, Boyuan	ASE '26: "When Elo Lies: Hidden Biases ..." When Elo Lies: Hidden Biases in Codeforces-Based Evaluation of Large Language Models in Practice Shenyu Zheng, Ximing Dong, Xiaoshuang Liu, Chun Yong Chong, Gustavo Oliva, Dayi Lin, Boyuan Chen, Shaowei Wang, and Ahmed E. Hassan (Huawei Canada, Canada; Huawei, China; Monash University, Malaysia; Queen's University, Canada; University of Manitoba, Canada) As Large Language Models (LLMs) achieve breakthroughs in complex reasoning, Codeforces-based Elo ratings have emerged as a prominent metric for evaluating competitive programming capabilities in industry. However, these ratings are often reported without critical experimental details, leading to significant discrepancies-illustrated by recent reports where the same model version’s score fluctuated by nearly 500 points (out of 2,029). This paper presents a systematic empirical study on the hidden factors biasing Elo evaluations: (1) the temporal ordering of submissions, (2) contest difficulty selection, and (3) run-to-run stochastic variability of LLMs. Utilizing a controlled benchmark of 37 recent Codeforces contests and 13,691 generated test cases, we demonstrate that Elo scores are highly sensitive to these parameters. Our findings reveal that varying submission orders can shift scores by 394 points, while contest selection can cause differences of up to 1,122 points for the same model. Run-to-run performance exhibits substantial instability, with a maximum difference of 349 points in mean scores observed when evaluating identical contests. We conclude that direct Elo comparisons are unreliable and potentially misleading without strict standardization and transparent reporting of experimental settings. Article Search Article: ase26ind-p20-p doi:10.1145/3832783.3834458 ASE '26: "DCAS: Decoupling CLI Agent ..." DCAS: Decoupling CLI Agent Scaffolding to Internalize Planning across Scaffolds Kishanthan Thangarajah, Boyuan Chen, and Ahmed E. Hassan (Huawei Canada, Canada; Queen's University, Canada) CLI-based software-engineering agents have matured rapidly, yet the open ecosystem has converged on a single training environment: trajectory datasets used to fine-tune open models are collected almost exclusively under OpenHands. Models fine-tuned on this data score well under OpenHands but degrade substantially when deployed under any non-training scaffold. Untrained base models do not show this divergence, indicating the gap is fine-tuning-induced and tied to the conventions of the training scaffold. We argue that a load-bearing scaffold-specific behavior is planning structure, in two senses this paper distinguishes: explicit planning, a pre-execution plan produced as a first-class artifact, and implicit planning, the structural conventions that shape execution throughout the agent loop. Under this hypothesis, closing the gap requires moving planning from a fixed scaffold artifact to a learned model capability. We introduce Decoupling CLI Agent Scaffolding (DCAS), a backend-substitution interception layer that routes API traffic between any CLI scaffold and any backend model without modifying the scaffold, enabling cross-scaffold evaluation and planning-aware trajectory collection. Using DCAS, a controlled plan-source intervention confirms planning quality is a high-leverage component, with gains exceeding the cross-scaffold drops we observe. A model fine-tuned on a small set of DCAS-collected planning-aware trajectories under a single scaffold gains consistently across non-training scaffolds, and the two senses of planning are empirically separable in training data. Article Search Article: ase26ind-p106-p doi:10.1145/3832783.3834485
	Chen, Chaoran	ASE '26: "Programming by Chat: A Large-Scale ..." Programming by Chat: A Large-Scale Behavioral Analysis of 11,579 Real-World AI-Assisted IDE Sessions Ningzhi Tang, Chaoran Chen, Zihan Fang, Gelei Xu, Maria Dhakal, Yiyu Shi, Collin McMillan, Yu Huang, and Toby Jia-Jun Li (University of Notre Dame, USA; Vanderbilt University, USA) IDE-integrated AI coding assistants, which operate conversationally within developers' working codebases with access to project context and multi-file editing, are rapidly reshaping software development. However, empirical investigation of this shift remains limited: existing studies largely rely on small-scale, controlled settings or analyze general-purpose chatbots rather than codebase-aware IDE workflows. We present, to the best of our knowledge, the first large-scale study of real-world conversational programming in IDE-native settings, analyzing 74,998 developer messages from 11,579 chat sessions across 1,300 repositories and 899 developers using Cursor and GitHub Copilot. These chats were committed to public repositories as part of routine development, capturing in-the-wild behavior. Our findings reveal three shifts in how programming work is organized: conversational programming operates as progressive specification, with developers iteratively refining outputs rather than specifying complete tasks upfront; developers redistribute cognitive work to AI, delegating diagnosis, comprehension, and validation rather than engaging with code and outputs directly; and developers actively manage the collaboration, externalizing plans into persistent artifacts, and negotiating AI autonomy through context injection and behavioral constraints. These results provide foundational empirical insights into AI-assisted development and offer implications for the design of future programming environments. Article Search Article: ase26main-p1071-p doi:10.1145/3832783.3834377
	Chen, Chengjun	ASE '26: "SafeDep: Detecting State Mutation ..." SafeDep: Detecting State Mutation Unsoundness in Rust via Dependency Slicing and LLM Reasoning Zihao Rao, Yilin Chen, Chengjun Chen, and Hui Xu (Fudan University, China; Ant Group, China) Rust's type system protects safe code, but many low-level abstractions depend on internal unsafe operations whose correctness rests on memory and logical invariants. In struct-based abstractions, a sibling method may legally modify internal fields while invalidating a precondition required by another method's unsafe operation. We call this defect an unsound state mutation. Traditional pattern-based static analyzers support inter-procedural tracking but may lack the capability to model cross-method state interference. Furthermore, they cannot interpret natural-language safety contracts, making these deep defects difficult to detect. LLMs can reason about these contracts, but whole-crate prompting is expensive and often prone to hallucinated paths. To bridge this gap, we present SafeDep, a vulnerability discovery framework that combines compiler-driven static analysis with LLM-based semantic reasoning. SafeDep analyzes Rust MIR to build a field-sensitive read/write dependency graph and slices the graph to retain methods that may affect safety-critical state. An LLM then reconstructs cross-method state transitions from this compact context and generates PoC candidates. A bounded compiler/Miri feedback loop refines the candidates and their exploitability judgments before manual audit. On our evaluation dataset, SafeDep outperforms static and LLM baselines while reducing prompt context. A scan of the top 4,000 crates.io projects found 24 previously unreported soundness vulnerabilities, 18 of which had been confirmed by maintainers or accepted as RustSec advisories at the time of writing. Article Search Artifacts Available Article: ase26main-p1035-p doi:10.1145/3832783.3837481
	Chen, Chu	ASE '26: "DafnyRAG: A Retrieval-Augmented ..." DafnyRAG: A Retrieval-Augmented and Verification-Driven Tool for Automated Repair of Dafny Code Yanzhen Liu, Xu Lu, Bin Yu, Haoxiang Zhang, Chu Chen, and Meng Wang (Xidian University, China; Qufu Normal University, China; Hebei University, China) Dafny is a verification-aware language whose adoption is hindered by the heavy manual effort of writing formal specifications and proof artefacts—a critical bottleneck for safety-critical software development. While Large Language Models (LLMs) can synthesise Dafny code, they routinely hallucinate domain-specific constructs and stagnate in repetitive generate–verify–fail cycles, because Dafny is severely under-represented in pre-training corpora. We present DafnyRAG, an open-source tool that turns any general-purpose LLM into a verification-aware Dafny repair agent. DafnyRAG ships with (i) a heterogeneous Dafny knowledge base—a static Syntax Rule Library, a static Error Theory Library, and a dynamic Repair Case Library; (ii) an error-aware retrieval router that selects the appropriate library based on the verifier diagnostic; and (iii) a verification-driven iterative repair loop that backfills every successful repair into the case library, growing the tool’s expertise over time. Across three production LLM backends (GPT-4, DeepSeek-V3, Claude-4.5-Sonnet) on the MBPP-DFY-178 benchmark, DafnyRAG consistently outperforms a strong few-shot baseline on verify@5, peaking at 83.71% with Claude-4.5-Sonnet. The tool source code, knowledge base, and evaluation scripts are available at https://doi.org/10.5281/zenodo.21372059. A screencast demo is available at https://youtu.be/s-QBaGj8tK8. Article Search Artifacts Available Article: ase26tool-p44-p doi:10.1145/3832783.3834610
	Chen, Chunyang	ASE '26: "Bridging Stakeholder and Product ..." Bridging Stakeholder and Product Requirements: An Empirical Study of Requirement Engineering in the Automotive Industry Zixu Wang, Shengcheng Yu, Zhenchang Xing, Tobias Wenzel, and Chunyang Chen (TU Munich, Germany; CSIRO's Data61, Australia; Infineon Technologies, Germany) The automotive industry's shift toward software-driven systems has increased complexity while raising the stakes for requirement intake and refinement—critical not only for correctness and compliance, but also for development speed and systematic reuse. While prior research has proposed techniques for improving requirement quality, there is limited empirical understanding of how stakeholder-level requirements are evaluated, refined, and transformed into product-level requirements in industrial automotive practice. This paper presents a large-scale empirical study of requirements engineering based on an industrial dataset from Infineon comprising 8,082 stakeholder requirements and 5,870 product requirements, enriched with traceability links, decision outcomes, deviation rationales, and domain references. Using a mixed-methods approach that combines quantitative analyses of requirement structures, decision distributions, and mapping patterns with qualitative analysis of rationales and referenced specifications, and software- and hardware-related artifacts, we investigate structural and contextual differences between stakeholder and product requirements, factors influencing acceptance, rejection, and approval with deviation, and the nature of stakeholder-to-product requirement refinement. The results reveal systematic differences across abstraction levels and show that refinement complexity is driven primarily by architectural scope and missing contextual information rather than linguistic verbosity. We further derive a taxonomy of stakeholder–product requirement mapping patterns and relate them to differing refinement effort. These findings provide concrete insights into industrial requirements intake and refinement practices and highlight actionable opportunities for improving intake validation, deviation management, and tool-supported contextual enrichment to support faster and more reusable automotive product development. Article Search Article: ase26ind-p9-p doi:10.1145/3832783.3834456 ASE '26: "A Longitudinal Study of Android ..." A Longitudinal Study of Android Apps Signing Key Protection Mark Huasong Meng, Qing Zhang, Weirao Lu, and Chunyang Chen (University College Dublin, Ireland; JD Group, China; TU Munich, Germany) Android app signing relies on developer-managed credentials, making secure key protection essential for the integrity of the software supply chain. A recent platform key leakage incident involving two major OEM manufacturers demonstrates that even robustly designed signing mechanisms can be compromised due to developers' oversight. In this work, we conduct a longitudinal ecosystem study to characterize this threat by mining public repositories for Android signing credentials, recovering compromised keys via exposed passwords, and matching them against signatures from over 4,000 apps collected from major stores and OEM system images. Our analysis identifies 5,673 compromised keystores on GitHub and 26 unique certificates linked to 278 real-world apps. These include 26 third-party apps in public app stores and 252 preinstalled apps from seven manufacturers, collectively affecting over 10 billion users. We demonstrate the practical exploitability of these leaks through a proof-of-concept app replacement attack and identify spillover risks in non-smartphone platforms, including a popular automotive head-unit platform installed in over 1,100 vehicle models. Our results reveal that signing-key mismanagement is a systemic risk, underscoring the need for more rigorous key-management support in Android release engineering and distribution infrastructures. Article Search Article: ase26main-p3058-p doi:10.1145/3832783.3834428 ASE '26: "Piece by Piece: Automating ..." Piece by Piece: Automating Combination Interaction GUI Testing via Planning and Dual Memory Zhe Liu, Oujin Wang, Junjie Wang, Chunyang Chen, Mengzhuo Chen, Boyu Wu, Yuekai Huang, and Qing Wang (Institute of Software at Chinese Academy of Sciences, China; Tsinghua University, China; TU Munich, Germany; University of Chinese Academy of Sciences, Beijing, China) Combination interactions require coordinated operations across multiple GUI widgets within a page to complete a functional task, which are common in modern mobile apps. However, due to widget dependencies, dynamic interface transitions, and context-sensitive execution, existing automated GUI testing approaches based on predefined models or state exploration struggle to reliably complete such interactions. LLM-based GUI testing methods improve semantic understanding but often generate inconsistent actions due to the lack of coordination modeling and interaction context. To address these challenges, this paper proposes COMBDroid, an automated GUI testing approach that enables reliable completion of combination interactions through structured planning and dual memory. COMBDroid first detects combination interaction patterns from GUI structure, then generates page-level interaction plans and grounds them into widget-level executable actions. Inspired by Sudoku solving, COMBDroid maintains a dual-memory mechanism, where context memory preserves execution states within a functionality and experience memory captures reusable interaction patterns. COMBDroid is designed as an integrable module that activates when combination interactions are detected and allows existing testing tools to resume exploration after completion. We evaluate COMBDroid on 100 combination interaction functionalities collected from 100 mobile apps, comparing it with 15 state-of-the-art GUI testing baselines. COMBDroid achieves 103% higher passing rate than the best baseline and improves activity coverage by 65%-100% when integrated with existing testing tools. Furthermore, GUI testing tools integrated with COMBDroid detect 37 new crash bugs in real-world apps, with 26 fixed and the remaining confirmed by developers, demonstrating its effectiveness in improving GUI testing. Article Search Article: ase26main-p3565-p doi:10.1145/3832783.3837553 ASE '26: "A11YRepair: Bridging Web Accessibility ..." A11YRepair: Bridging Web Accessibility Barriers via Knowledge-Enhanced Divide-and-Conquer Repair Kai Huang, Ling Zhu, Jian Zhang, Xiaofei Xie, and Chunyang Chen (TU Munich, Germany; Nanyang Technological University, Singapore; Singapore Management University, Singapore) Web accessibility (A11Y), which ensures web content is perceivable and usable for users with disabilities, is a critical requirement for modern web applications. Yet existing tooling overwhelmingly focuses on detecting A11Y violations rather than repairing them. Automated program repair (APR) techniques appear promising for this setting, but our study shows that state-of-the-art APR systems perform poorly when applied to real-world A11Y violations. Unlike conventional sparse-bug scenarios, web A11Y issues often manifest as multiple structurally related violations per page, requiring coordinated edits across multiple files. Existing repair systems fail to manage this multi-fault scale, as they handle each bug individually without considering their relationships or incorporating domain rules such as the Web Content Accessibility Guidelines (WCAG). We propose A11YRepair, an LLM-based framework designed specifically for web A11Y repair. A11YRepair introduces a divide-and-conquer workflow that first clusters violations requiring coordinated edits to reduce redundant localization, and then decomposes each cluster by root cause so the LLM can generate focused and consistent patches. The framework further incorporates WCAG-driven knowledge to strengthen domain awareness during both fault localization and patch synthesis. To support systematic evaluation, we construct A11YBench, a benchmark of 60 real-world web projects collected from GitHub. Experimental results show that A11YRepair achieves higher repair effectiveness and lower cost than state-of-the-art baselines, and ablation studies confirm the importance of its divide-and-conquer design and selective domain knowledge integration. Specifically, patches generated by A11YRepair have been merged into open-source projects from Google, Microsoft, Facebook, IBM, K8s, Docker, and Alibaba, demonstrating its practical value in real-world dev scenarios. This work demonstrates the promise of LLM-driven accessibility repair and highlights the importance of combining structured repair strategies with domain expertise to advance inclusive software engineering. Article Search Artifacts Available Article: ase26main-p37-p doi:10.1145/3832783.3834334
	Chen, Eric	ASE '26: "DragonCrawl: A Generative, ..." DragonCrawl: A Generative, Intent-Based Framework for Scalable Mobile End-to-End Testing Sowjanya Puligadda, Mengdie Zhang, Ali Zamani, Dhruva Dixith Kurra, Eric Chen, and Juan Marcano (Uber Technologies, USA) As mobile applications grow in complexity, traditional End-to-End (E2E) testing frameworks struggle with UI volatility, maintenance overhead, and cross-platform scalability. This paper presents DragonCrawl, an AI-driven mobile testing system for continuous regression testing that has evolved from embedding-based similarity matching to generative intent-based reasoning using large language models. Unlike prior LLM-based testing research focused on exploratory testing and crash detection, DragonCrawl validates specific user flows on every code change, blocking commits that break critical functionality. By leveraging GPT-4o’s multimodal capabilities, DragonCrawl achieves 91.6% pass rate on iOS and 92.2% on Android across 1,013 automated tests running continuously in CI/CD pipelines. The system reduces test onboarding time from 96-120 hours to under 4 hours and has saved an estimated 27 developer years in test maintenance effort. We present the architectural evolution from V1 (semantic embedding matching) to V2 (generative intent-based reasoning), discuss implementation challenges including token explosion and memory constraints, and report operational experience from production deployment. The integration of multimodal vision for end-state detection and tool calling for backend state transitions enables comprehensive regression testing that bridges UI interactions with system state. Our results demonstrate that AI-driven testing can maintain stability while eliminating the brittleness of traditional automated tests, enabling continuous quality assurance at scale. Article Search Article: ase26ind-p2-p doi:10.1145/3832783.3834455
	Chen, Guoqiang	ASE '26: "Beyond Text Matching: Towards ..." Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering Xiuwei Shang, Li Hu, Xiao Jiang, Jieke Shi, Junda He, Zhou Yang, Shaoyin Cheng, Guoqiang Chen, Weiming Zhang, and David Lo (University of Science and Technology of China, China; Singapore Management University, Singapore; University of Alberta, Canada) Human-Oriented Binary Reverse Engineering (HOBRE) aims to transform decompiled pseudocode into a more human-friendly representation, thereby reducing the cognitive burden of reverse analysis and improving efficiency. However, reliably evaluating HOBRE outputs remains a fundamental challenge. On one hand, human evaluation is costly, time-consuming, as well as difficult to scale. On the other hand, existing automated metrics either rely on executable test cases and runtime environments, which are often unavailable for real-world binaries, or depend on high-quality source code references that are typically inaccessible and fail to capture semantically equivalent but lexically diverse outputs. Although the emerging LLM-as-a-Judge paradigm is naturally well-suited to HOBRE evaluation, its effectiveness has not yet been fully studied. This paper presents the first systematic investigation of the LLM-as-a-Judge paradigm for HOBRE, covering three representative tasks: function name recovery, binary code summarization, and decompilation optimization. We introduce BinJudgeBench, the first expert-annotated, reference-free evaluation benchmark based on multi-dimensional human judgment. Our empirical study reveals that LLM-as-a-Judge achieves an average correlation of 63.20% with human judgment, significantly outperforming traditional automated metrics at 35.04%. By analyzing the impact of various judge configurations, including backbone LLMs, prompting strategies, and decoding temperatures, on both correlation and cost, we find that no “one-size-fits-all” configuration exists, as the optimal setup varies across tasks and individual samples. To address this, we propose BinJudge, which employs a lightweight routing mechanism to adaptively select the optimal judge configuration for each specific task and sample. BinJudge improves correlation with human experts by 4.5%–24.7% and reduces API cost to 0.06×–0.84× of that of static best configurations, providing a scalable, cost-effective, and high-fidelity automated evaluation scheme for HOBRE. Article Search Article: ase26main-p130-p doi:10.1145/3832783.3834339
	Chen, Haiming	ASE '26: "LARA: Static ReDoS Detection ..." LARA: Static ReDoS Detection for Regular Expressions with Lookahead via Matching Automata Mengxi Wang, Chengyao Peng, Weihao Su, Guiyi He, Rongchen Li, Hong Huang, and Haiming Chen (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) with lookahead assertions are widely used in modern software, yet their interaction with backtracking engines can cause Regular expression Denial of Service (ReDoS) vulnerabilities. Existing static methods rely on 𝜀-NFA ambiguity analysis, which cannot capture lookahead evaluation cost, while dynamic and hybrid methods incur high cost or incomplete coverage. We present LARA, a static ReDoS detector for regular expressions with lookahead (REwLA), which subsumes standard regexes. Our core contribution is the matching NFA, which transforms a REwLA into a standard 𝜀-NFA. The matching NFA is not language-equivalent to the original REwLA; however, we prove that its match degree equals the la-match degree of the original REwLA, so the same complexity upper bound is preserved, including lookahead overhead. This reduces lookahead-aware ReDoS detection to standard 𝜀-NFA ambiguity analysis, enabling existing detection techniques to be applied directly to the matching NFA. We evaluate LARA on 42,794 deduplicated real-world REwLA. Among 5,889 vulnerabilities jointly confirmed by multiple tools and validated on real backtracking engines, LARA identifies 5,871, outperforming all baselines. On 400 confirmed vulnerable regexes from 177 real-world ReDoS CVEs, LARA achieves 99.50% recall. LARA successfully exploits 4,468 vulnerabilities on real engines, with a median analysis time of 0.05 s and 7.67 MB memory. Article Search Article: ase26main-p997-p doi:10.1145/3832783.3837475 ASE '26: "ReSEDA: Automatic and Precise ..." ReSEDA: Automatic and Precise Program-Level ReDoS Triage via Interprocedural Taint Analysis and Agentic Exploit Generation Rongchen Li, Weihao Su, Chengyao Peng, Hong Huang, Haiming Chen, and Guiyi He (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) are widely used in computer science, particularly in web services. However, Regular Expression Denial-of-Service (ReDoS) has become a growing security threat. ReDoS is an asymmetric Denial-of-Service attack that exploits the super-linear runtime behavior of regex engines. However, existing ReDoS detection tools only report whether regexes cause the super-linear matching behavior, instead of considering whether the behavior can be triggered in the program context. As a result, triaging such findings remains expensive for developers in practice. We present ReSEDA, an automatic and precise workflow that triages ReDoS alerts and generates executable proofs of concept (PoCs) for vulnerable JavaScript programs. The workflow employs (i) Interprocedural Finite Distributive Subset (IFDS) taint analysis, (ii) Satisfiability Modulo Theories (SMT) solving for supported path-feasibility and ReDoS constraints, and (iii) Large Language Model (LLM) agents for PoC construction with Model Context Protocol (MCP) tools that provide static evidence. From 86 most starred JavaScript projects in GitHub, we confirm that among 637 regexes reported to be vulnerable, there are only 63 regexes which can be exploited by injection through external interfaces, where ReSEDA is able to identify and generate PoCs for 61 of them automatically. We also discover that the assistance of ReSEDA reduces analyst-hours by 8.78× using $2.01 per vulnerability, or by 7.86× for free in a local-LLM setting. Furthermore, ReSEDA uncovered 27 impactful ReDoS vulnerabilities with assigned CVE IDs, including 8 disclosed fully automatically. Article Search Article: ase26main-p2923-p doi:10.1145/3832783.3837545
	Chen, Haoxian	ASE '26: "Smart Contract Synthesis via ..." Smart Contract Synthesis via Multi-modal Specifications Tanglin Chen, Haoxian Chen, Huilin Xiang, and Yuepeng Wang (ShanghaiTech University, China; Simon Fraser University, Canada) Smart contracts manage substantial digital assets on blockchains. Given their transparency and immutability, ensuring their correctness before deployment is essential. While verification tools offer assistance, the iterative nature of the process presents hurdles, especially for less experienced developers. In this paper, we explore a paradigm shift in smart contract development: writing high-level specifications instead of low-level code. To realize this goal, we propose SmartSpec, a synthesizer that generates smart-contract implementations from functional and safety specifications and validates them with integrated verification. To avoid overly restrictive outcomes, SmartSpec employs maximally permissive synthesis, ensuring contracts preserve all safety requirements while remaining as permissive as possible. Its novel algorithm combines deductive and inductive synthesis techniques, balancing precision and generalization. On 27 contracts, synthesis runs in seconds to minutes; 23 match references without interactive refinement (85%), while the remaining four can be corrected with up to four rounds of interactive feedback through extra examples. Mean gas overhead vs. references on the table is +0.7%. Article Search Artifacts Available Article: ase26main-p244-p doi:10.1145/3832783.3837430
	Chen, Haoxin	ASE '26: "TrackTest: Trajectory Generation ..." TrackTest: Trajectory Generation and Prioritization for Testing Multiple Object Tracking System Xinyu Gao, Haoxin Chen, Shuoxiao Zhang, Enyi Tang, Hengrui Xu, Haoxiang Tian, Minghui Wei, and An Guo (Nanjing University, China; Nanyang Technological University, Singapore; Hong Kong Polytechnic University, China) Multiple Object Tracking (MOT) is a fundamental component of the perception stack in Autonomous Driving Systems (ADS), providing essential state estimation for downstream decision-making. Despite the adoption of multi-sensor fusion to enhance reliability, MOT systems remain susceptible to tracking failures, which can lead to catastrophic safety incidents. Current perception testing and evaluation predominantly rely on manually annotated real-world datasets, which are behaviorally imbalanced, prohibitively expensive to scale, and insufficient to cover diverse dynamic interactions. To bridge this gap, we propose TrackTest, an automated testing framework designed to systematically expose tracking failures in MOT systems. TrackTest transforms real-world seed scenarios into challenging test cases by synthesizing physically feasible and behaviorally diverse trajectories. We formulate six representative driving patterns as constraint-based optimization problems for behavior-controllable trajectory generation. To reduce computational overhead, we introduce a trajectory prioritization strategy that identifies high-risk scenarios most likely to trigger tracking failures. We evaluate TrackTest on six state-of-the-art MOT systems. Experimental results show that TrackTest effectively generate behavior-diverse trajectories and uncover diverse tracking failures. Article Search Article: ase26main-p2727-p doi:10.1145/3832783.3837540
	Chen, Jiachi	ASE '26: "Beyond Single-Level PGO: Understanding ..." Beyond Single-Level PGO: Understanding and Harnessing Cross-Level Optimization Effects in Industrial Systems Dong Liu, Yifan Cheng, Yunfeng Cui, Ting Chen, Jiachi Chen, Zhihong Xue, Chong Hu, and Shengyu Cheng (ZTE Corporation, China; University of Electronic Science and Technology of China, China; Zhejiang University, China) Profile-guided optimization (PGO) is used to improve software performance in applications and operating system kernels. However, prior work applies PGO to a single layer in isolation, overlooking cross-layer interactions in systems, where kernel and application are optimized independently using different workloads. This practice is common in production environments and makes its impact on end-to-end performance important to understand. It introduces a mismatch between training and deployment, where profiling workloads may not reflect the final co-executed system. Despite its prevalence, the implications of such cross-layer mismatch remain poorly understood. In this paper, we present a large-scale industrial study of multi-level PGO across three representative products. We evaluate the combined effects of independently optimized kernel and application under realistic deployment conditions. Our results show that multi-level PGO can yield performance gains of up to 17.04%, but may lead to severe regressions of up to 81.90%. Through performance counter analysis, we attribute these effects to microarchitectural factors such as cache contention and branch misprediction arising from mismatched profiling assumptions. These findings show that PGO benefits are not necessarily compositional across software layers. Based on these insights, we propose Multi-Level PGO (ML-PGO), a practical guideline for applying PGO safely across system layers. Our work highlights the importance of workload representativeness and cross-layer awareness for achieving reliable performance improvements. Article Search Article: ase26ind-p100-p doi:10.1145/3832783.3834484
	Chen, Jialuo	ASE '26: "When Ambiguity Meets Atypicality: ..." When Ambiguity Meets Atypicality: Dual-Perspective Test Input Prioritization for DNNs Haoran Li, Shihai Wang, Bin Liu, Jialuo Chen, Wenjing Zhu, Yu Liu, Tengfei Shi, and Shudi Guo (Beihang University, China; Zhejiang University, China) While Deep Neural Networks (DNNs) have achieved remarkable progress in cutting-edge domains, their inherent brittleness has become a growing concern. To ensure the reliability and safety of DNN-enabled software, DNN testing has emerged as an indispensable practice. Within this context, test input prioritization is essential for early fault detection and reducing labeling costs. However, it remains challenging to accurately identify failure-inducing inputs. Although decision ambiguity and distributional atypicality are two widely adopted perspectives for characterizing inter-class competition and intra-class typicality respectively, relying on either perspective in isolation inevitably introduces blind spots. In this paper, we propose DuFP (Dual perspective Feature space Prioritization), a KNN density-based test input prioritization approach for DNNs that jointly incorporates both inter-class and intra-class perspectives. The prioritization framework of DuFP is built upon class-conditional density estimation. Based on the estimation results, prediction correctness is characterized by an ambiguity score and an atypicality score, with the former reflecting decision ambiguity and the latter quantifying distributional atypicality. A hybrid uncertainty score is then constructed by integrating both scores to guide the final prioritization. We evaluate DuFP on prioritization and selection tasks across image and text datasets under clean, corrupted, and adversarial scenarios. Experimental results demonstrate that DuFP effectively and efficiently prioritizes fault-inducing inputs and outperforms state-of-the-art approaches. Article Search Artifacts Available Article: ase26main-p367-p doi:10.1145/3832783.3834351
	Chen, Jiayi	ASE '26: "ARMOR: A Robust Self-Supervised ..." ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality Wenzhuo Qian, Hailiang Zhao, Ziqi Wang, Zhipeng Gao, Jiayi Chen, Zhiwei Ling, and Shuiguang Deng (Zhejiang University, China) Automated incident management is critical for microservice reliability. While recent unified frameworks leverage multimodal data for joint optimization, they unrealistically assume perfect data completeness. In practice, network fluctuations and agent failures frequently cause missing modalities. Existing approaches relying on static placeholders introduce imputation noise that masks anomalies and degrades performance. To address this, we propose ARMOR, a robust self-supervised framework designed for missing modality scenarios. ARMOR features: (i) a modality-specific asymmetric encoder that isolates distribution disparities among metrics, logs, and traces; and (ii) a missing-aware gated fusion mechanism utilizing learnable placeholders and dynamic bias compensation to prevent cross-modal interference from incomplete inputs. By employing self-supervised auto-regression with mask-guided reconstruction, ARMOR jointly optimizes anomaly detection (AD), failure triage (FT), and root cause localization (RCL). AD and RCL require no fault labels, while FT relies solely on failure-type annotations for the downstream classifier. Extensive experiments demonstrate that ARMOR achieves state-of-the-art performance under complete data conditions and maintains robust diagnostic accuracy even with severe modality loss. Article Search Article: ase26main-p102-p doi:10.1145/3832783.3834338
	Chen, Jiming	ASE '26: "Planner-Fuzz: Overcoming Diagnostic ..." Planner-Fuzz: Overcoming Diagnostic Saturation in UAV Planners via Boundary-Oriented Fuzzing Rongbo Chen, Chengcheng Zhao, Peng Cheng, Jiming Chen, and Taegyu Kim (Zhejiang University, China; Pennsylvania State University, USA) UAV planners are safety-critical software components whose behavior depends on high-dimensional, continuously tunable parameters. While existing fuzzing approaches focus on discovering failures, configurations deep inside failure regions are often diagnostically uninformative.Once the planner moves far beyond the safety boundary, parameter sensitivity diminishes, and inter-parameter dependencies become obscured.We refer to this phenomenon as diagnostic saturation and observe that configurations near the safe-unsafe transition preserve informative parameter sensitivity and interaction structure, making them more suitable for root-cause analysis. To this end, we propose Planner-Fuzz, a boundary-oriented fuzzing framework. It steers search toward a narrow band around the safety boundary while preventing convergence to a single configuration to enable the exploration of diverse boundary behaviors. Using the collected boundary configuration, Planner-Fuzz performs three-level diagnosis through sensitivity analysis, interaction mining, and counterfactual validation to identify and validate the parameters responsible for failure behavior. We evaluate the approach on three open-source UAV planners under four anomaly types. The results show that Planner-Fuzz discovers more diverse and diagnostically useful boundary configurations than failure-driven baselines, provides stronger signals for identifying influential parameters and interactions, and yields stronger intervention-based recovery evidence. These findings suggest that fuzzing for safety-critical planners should go beyond failure discovery and explicitly support diagnosis. Article Search Article: ase26main-p1399-p doi:10.1145/3832783.3834389
	Chen, Jinchuan	ASE '26: "Fuzz4DB: A Practice of LLM-Agent-Guided ..." Fuzz4DB: A Practice of LLM-Agent-Guided Fuzzing for Database Feature-Level Delta Testing Chunling Qin, Yong Hu, Xiao Zhang, Jinchuan Chen, Fangtao Gu, Baoxun Wang, Yuxing Chen, Anqun Pan, and Lixiong Zheng (Renmin University of China, China; Tencent, China) Modern database management systems (DBMSs) evolve rapidly via frequent feature commits, yet validating each code delta within a 24-hour Continuous Integration (CI) budget remains an industrial challenge. Traditional manual regression testing is labor-intensive, while existing automated tools fall short: generation-based fuzzers achieve high throughput but are change-unaware, whereas LLM-based agents understand feature deltas but are orders of magnitude too slow for systematic testing. This paper presents Fuzz4DB, an LLM-agent-guided fuzzer designed for targeted DBMS feature testing. Fuzz4DB decouples LLM-based semantic planning from grammar-based test instantiation, bridging the gap between semantic awareness and generation efficiency. The LLM-powered agent of Fuzz4DB analyzes code deltas and coverage feedback to synthesize test directives—structured specifications at three precision levels, namely grammar scopes, derivation paths, and context–query template pairs. A grammar-based fuzzer then expands each directive into batches of valid SQL test cases. A coverage feedback loop escalates directive precision as coverage growth stalls. Running in the TDSQL production environment for over six months, Fuzz4DB has intercepted 74 zero-day bugs, accounting for ∼40% of all SQL-subsystem bugs. In evaluations across 12 feature commits from 5 mainstream DBMSs, Fuzz4DB achieved 86.9% delta code coverage, outperforming the best automated baseline by 36.9%. Over its full lifecycle on four open-source DBMSs, Fuzz4DB discovered a total of 62 unique bugs (45 newly confirmed by upstream communities), 59 of which were undetectable by state-of-the-art tools within the 24-hour CI window. Furthermore, Fuzz4DB reduces per-commit validation effort from ∼5 person-days to ∼1 person-day, an ∼80% reduction. Article Search Article: ase26ind-p161-p doi:10.1145/3832783.3834498
	Chen, Jinfu	ASE '26: "SustainSR: Interpretable OSS ..." SustainSR: Interpretable OSS Sustainability Prediction via Symbolic Regression Yang Deng, Mustafa Misir, Jinfu Chen, and Jifeng Xuan (Wuhan University, China; Duke Kunshan University, China) Open-source software (OSS) has become a foundational component of modern software ecosystems. Early prediction of OSS sustainability is crucial for identifying potential risks and supporting timely intervention.Existing approaches formulate OSS sustainability prediction task as a binary classification problem using Deep Learning (DL) models.However, their black-box nature obscures the decision process and undermines the credibility of the predictions.To address this limitation, we propose SustainSR, an interpretable symbolic regression–based method for OSS sustainability prediction.SustainSR reformulates prediction task as a function-learning problem and uses Genetic Programming (GP) algorithm to learn explicit sustainability expressions.We further apply Taylor expansion to quantify feature importance and pairwise interactions.The quantified results facilitate early risk identification and actionable intervention guidance.We evaluate SustainSR on Apache and GitHub projects from three dimensions: fitting performance, predictive performance, and interpretability.Results show that SustainSR significantly outperforms most baselines, it improves AUC by 1%-4% and F1avg by 3%-7% over the best-performing baseline.Case studies further demonstrate that SustainSR offers actionable sustainability insights to support risk identification, project selection, and community governance.Overall, SustainSR provides an effective and interpretable solution for OSS sustainability analysis, bridging the gap between predictive performance and interpretability. Article Search Article: ase26main-p823-p doi:10.1145/3832783.3834366 ASE '26: "Stop When It Matters: Detectability-Guided ..." Stop When It Matters: Detectability-Guided Microbenchmarking for Performance Regression Testing Zongxiong Chen, Derui Zhu, Jinfu Chen, Kundi Yao, Alexander Pretschner, Weiyi Shang, Manfred Hauswirth, and Sonja Schimmler (Fraunhofer FOKUS, Germany; TU Munich, Germany; Wuhan University, China; Ontario Tech University, Canada; fortiss, Germany; University of Waterloo, Canada) Performance microbenchmarks are widely used for detecting performance regressions in continuous integration, yet existing execution policies remain computationally expensive. We present detectability-guided microbenchmarking, a principled framework that reformulates benchmark execution as a Minimum-Detectable-Effect (MDE) problem, achieving substantial speedups with formal statistical guarantees. Our approach introduces a two-threshold specification: a lower threshold, δ0, for negligible slowdowns, and an upper threshold, δ1, for meaningful regressions. We theoretically and empirically show that this specification enables bounded false-positive rates below δ0 and guaranteed statistical power around δ1, while dramatically reducing execution time. To realize this framework, we propose a two-phase procedure: Phase 1 adaptively controls execution via online sample-size re-estimation guided by minimum detectable effect, enabling early stop when sufficient statistical resolution is reached and futile abort when target detectability is unattainable within the execution budget; Phase 2 performs regression analysis under the same specification, yielding decisions with provable error bounds. Experiments on 1702 microbenchmarks from three large-scale open-source projects demonstrate up to 93% reduction in execution time while empirical false-positive rates and power closely match their theoretical targets. Our findings reveal that detectability-guided execution offers a theoretically grounded yet practical path toward efficient microbenchmark-based regression detection. Article Search Artifacts Available Article: ase26main-p833-p doi:10.1145/3832783.3834367
	Chen, Jing	ASE '26: "Breaking the Isolation: Coordinated ..." Breaking the Isolation: Coordinated Multi-agent Fuzzing for Smart Contracts with Multi-dimensional Objective Learning Ruichao Liang, Ruochen Cao, Jing Chen, Kun He, Yebo Feng, Yue Xue, and Cong Wu (Wuhan University, China; Nanyang Technological University, Singapore; MetaTrust Labs, Singapore) Smart contracts manage critical assets in decentralized systems but are prone to vulnerabilities. While fuzzing has proven effective in software testing, existing contract fuzzers often rely on ad-hoc optimization strategies with limited objective guidance, typically driven by coverage or simple heuristics. This narrow focus leads to high false negative rates, as important perspectives of smart contracts, like semantic, state, and economic effects, are overlooked during transaction sequence generation. Moreover, coordinating these dimensions into fuzzing is challenging because their divergent objectives and complex interactions make ad-hoc adaptations to fitness functions or mutation strategies largely ineffective. To fill the gaps, we propose SynerFuzz, a multi-agent deep reinforcement learning-based fuzzer. We formulate fuzzing as a Decentralized Partially Observable Markov Decision Process, where each agent is assigned a distinct testing objective extracted from the target contract. Through coordinated learning, DRL agents integrate multi-dimensional signals to construct high-quality sequences, enabling SynerFuzz to uncover both subtle semantic flaws and economically profitable behaviors. Compared to 9 SOTA tools, SynerFuzz detects up to 4.2× more vulnerabilities while reducing time and transaction overhead by 70.6% and 86.8%. In real-world scenarios, SynerFuzz reproduces 33 historical DeFi exploits with over $40 million losses and discovers 17 0-day vulnerabilities in 4 projects managing over $179.8 million, earning $3,800 bug bounties. Article Search Article: ase26main-p791-p doi:10.1145/3832783.3837466
	Chen, Junjie	ASE '26: "Finding Typing-Related Bugs ..." Finding Typing-Related Bugs in JVM Implementations Yanzhou Lu, Junjie Chen, Yingquan Zhao, Tianchang Gao, and Zan Wang (Tianjin University, China) As an object-oriented language, Java relies heavily on its type system. Existing testing efforts mainly target type-related implementations in the Java compiler, while the substantially different type-related implementations in the Java Virtual Machine (JVM) remain insufficiently tested. Although many techniques have been proposed for direct JVM testing, they mostly focus on specific components such as the JIT compiler or garbage collector, leaving type-related implementations underexplored. In this paper, we present Caster, the first technique for testing JVM type-related implementations by directly generating bytecode test programs guided by type specifications in the Java Language Specification (JLS). Specifically, Caster designs a set of feature primitives to encapsulate the operations needed for type-related testing, and leverages a Large Language Model (LLM) to identify type-related test scenarios from the JLS and guide primitive composition. Based on these scenarios, Caster organizes the selected primitive combinations into a multi-unit test-program generator, whose Cartesian-product expansion produces a large number of concrete test programs. To support large-scale execution, Caster dynamically loads these generated programs from memory and invokes them via reflection across different JVM implementations, collects their result lists, and compares them to identify inconsistencies and detect potential JVM bugs. Extensive experiments on four Long-Term Support OpenJDK versions of three popular JVM implementations (i.e., HotSpot, OpenJ9, and Dragonwell) demonstrate that Caster outperforms the state-of-the-art techniques in detecting more JVM inconsistencies. Moreover, Caster has uncovered a total of 21 previously unknown defects in the latest JVM releases, among which 18 have been confirmed or fixed by developers. Article Search Article: ase26main-p1588-p doi:10.1145/3832783.3834396
	Chen, Junkai	ASE '26: "AgentExecutor: Partial Code ..." AgentExecutor: Partial Code Execution via Agentic Context Generation Junkai Chen, Chengran Yang, Xing Hu, Zhenhao Li, Xin Xia, and David Lo (Singapore Management University, Singapore; Zhejiang University, China; York University, Canada) Executing code snippets is essential for dynamic program analysis, but it remains challenging to execute an arbitrary code snippet due to issues like missing context and incomplete dependencies. Existing approaches to partial code execution, such as LExecutor and Treefix, leverage the power of language models to infer missing information and enable execution. However, they suffer from (i) limited action spaces and feedback, and (ii) rigid optimization strategies, which restrict their effectiveness and efficiency. In this paper, we propose AgentExecutor, a novel multi-agent framework for partial code execution. Our approach introduces a three-phase design: execution environment preparation, dynamic exploration with iterative refinement, and prefix evolution via program synthesis. Supported by the power of LLM agents who can think, act, and get feedback iteratively, AgentExecutor is able to autonomously explore a richer action space, enabling diverse operations such as creating resource files and resolving environment configuration. Furthermore, it adopts adaptive optimization strategies, including coverage-guided context pruning and prefix evolution via program synthesis, to systematically improve the execution quality of partial code. We evaluate AgentExecutor on two widely used datasets comprising Stack Overflow snippets and open-source project code. The results show that AgentExecutor achieves up to 94% and 90% code coverage, outperforming the state-of-the-art approach Treefix by 19.9% and 13.8%, respectively. In addition, AgentExecutor significantly reduces execution time (by up to 80.3%) and cost (by up to 56.6%). These findings demonstrate that AgentExecutor provides an effective and efficient solution for partial code execution. Article Search Article: ase26main-p477-p doi:10.1145/3832783.3834355
	Chen, Li	ASE '26: "The CodeInverter Suite: Structure- ..." The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs Peipei Liu, Jian Sun, Rongkang Sun, Li Chen, Zhaoteng Yan, Xiaoling Zhang, Dawei Wang, Dapeng Sun, Peizheng Zhang, and Dan Li (Zhongguancun Laboratory, China; Tsinghua University, China) Binary decompilation plays a vital role in various cybersecurity and software engineering tasks. Recently, end-to-end decompilation methods powered by large language models (LLMs) have attracted increasing attention for their ability to generate highly readable source code with minimal human intervention. However, existing LLM-based methods still struggle with reconstructing program structure and logic, achieving accurate data recovery, ensuring data security and privacy, and maintaining computational efficiency. To address these challenges, we propose the CodeInverter Suite, with three main pieces: (1) the CodeInverter Workflow (CIW) is a novel prompt engineering method that incorporates control flow graphs (CFG) and explicit data mappings to enhance structure reconstruction and data recovery during decompilation; (2) building upon CIW, we construct the CodeInverter Dataset (CID), a large-scale domain-specific dataset containing 8.69 million samples enriched with CFGs and data mapping information; (3) we develop CodeInverter Models (CIMs), two lightweight LLMs with 1.3B and 6.7B parameters, enabling efficient inference in privacy-sensitive and resource-constrained environments. Extensive experiments on two benchmark datasets demonstrate that CIW significantly enhances the decompilation performance of various LLMs, with average improvements of 13.07% in re-executability and 23.94% in re-compilability. For our proposed decompilation model, CIM-6.7B achieves state-of-the-art performance in terms of re-executability and readability, outperforming existing LLMs—even with over 100× more parameters—by an average of 11.03% and 6.27%, respectively. Article Search Article: ase26main-p3581-p doi:10.1145/3832783.3837554
	Chen, Liqian	ASE '26: "Fully Automating Template ..." Fully Automating Template Polyhedral Analysis by Leveraging LLMs Renjie Huang, Liqian Chen, Hongfei Fu, Banghu Yin, Dengping Wei, and Ji Wang (National University of Defense Technology, China; Shanghai University of Finance and Economics, China) Abstract interpretation provides a generic framework to design static analysis, and has been widely applied in analysis of real-world programs. The scalability and precision of these analyses depend largely on the chosen abstract domain. The template polyhedra domain is well-known for offering a compelling trade-off between scalability and precision. However, designing effective templates currently requires intensive manual effort and domain expertise. In this paper, we propose a bottom-up approach based on Large Language Models (LLMs) to automatically generate linear templates for the template polyhedral analysis. By leveraging the advanced code comprehension capabilities of LLMs, our approach automatically generates highly relevant templates. Based on this approach, we have implemented IKOSplus, a program analyzer supporting fully automated context-sensitive and interprocedural template polyhedral analysis, on top of IKOS. We evaluated IKOSplus on a variety of small-scale benchmark programs and complex real-world programs. Experimental results demonstrate that IKOSplus effectively balances analytical precision and scalability in the template polyhedral analysis. Article Search Artifacts Available Article: ase26main-p849-p doi:10.1145/3832783.3837472 ASE '26: "CTForge: Automatically Generating ..." CTForge: Automatically Generating Test Suites for Software Configuration Yuanliang Zhang, Zhizheng Zheng, Shanshan Li, Zhouyang Jia, Chaopeng Luo, Liqian Chen, Zhenbang Chen, Ji Wang, and Xiangke Liao (National University of Defense Technology, China) Software configuration plays a critical role in modern software systems, yet it also frequently leads to severe failures. Existing approaches, whether static analysis or LLM-based validation, struggle to capture implicit semantic constraints and validate configuration-code interactions. Leveraging existing unit tests is also insufficient due to their lack of configuration-specific focus. Thus, we present CTForge, an LLM-powered framework that automatically generates configuration-specific test suites. Its core innovation is a three-stage configuration-aware optimization pipeline that moves beyond vanilla test generation, specifically using parameter semantics to improve LLM outputs. This optimization pipeline iteratively aligns tests through: (1)enhance configuration-related code coverage to ensure relevance, (2) assertion validation across valid parameter values to eliminate false assertions, and (3) configuration-sensitivity verification to select tests that semantically exercise the intended configuration behavior. Evaluated on five large-scale systems, CTForge detects 63 out of 79 real-world configuration issues and achieves an F1-score of 0.88 in misconfiguration detection. CTForge also uncovers six previously unknown defects. Our work demonstrates that structured configuration-aware refinement is essential for LLM to produce effective test suites. Article Search Article: ase26main-p1197-p doi:10.1145/3832783.3837484
	Chen, Longfei	ASE '26: "SmartPoC: Validating Smart ..." SmartPoC: Validating Smart Contract Vulnerability Findings through PoC Generation and Execution Longfei Chen, Ruibin Yan, Taiyu Wong, Yiyang Chen, Jialai Wang, and Chao Zhang (Tsinghua University, China; Peking University, China; National University of Singapore, Singapore) Smart contracts are commonly audited through static analysis to explore vulnerabilities. However, static approaches typically produce heterogeneous findings rather than reproducible, executable proof-of-concept (PoC) test cases, leading to costly and ad hoc manual validation. Large language models (LLMs) offer a promising way to translate audit reports into PoC test cases, but face three major challenges: noisy inputs, lack of execution grounding, and missing runtime oracles. We present SmartPoC, an end-to-end approach for validating reported vulnerabilities in audit reports by generating and executing PoC test cases with automated exploitability verification. SmartPoC first extracts a focused function-level slice from each report to reduce noise, centering on the key functions referenced in a finding and augmenting them with execution-relevant neighbors. To improve executability, we wrap LLM-based PoC synthesis in a generate–repair–execute loop, combining deterministic pre-execution sanitization with feedback-driven post-execution debugging. We further use differential verification as an oracle to confirm the exploitability of generated test cases. On the SmartBugs-Vul and FORGE-Vul benchmarks, SmartPoC achieves confirmation precision of 98.32% and 98.65%, with recall of 84.17% and 85.28%, respectively. On a recent Etherscan verified-source corpus, SmartPoC confirms 64 bugs from 545 audit findings at an average cost of $0.03. Article Search Article: ase26main-p1210-p doi:10.1145/3832783.3834380
	Chen, Mengzhuo	ASE '26: "Piece by Piece: Automating ..." Piece by Piece: Automating Combination Interaction GUI Testing via Planning and Dual Memory Zhe Liu, Oujin Wang, Junjie Wang, Chunyang Chen, Mengzhuo Chen, Boyu Wu, Yuekai Huang, and Qing Wang (Institute of Software at Chinese Academy of Sciences, China; Tsinghua University, China; TU Munich, Germany; University of Chinese Academy of Sciences, Beijing, China) Combination interactions require coordinated operations across multiple GUI widgets within a page to complete a functional task, which are common in modern mobile apps. However, due to widget dependencies, dynamic interface transitions, and context-sensitive execution, existing automated GUI testing approaches based on predefined models or state exploration struggle to reliably complete such interactions. LLM-based GUI testing methods improve semantic understanding but often generate inconsistent actions due to the lack of coordination modeling and interaction context. To address these challenges, this paper proposes COMBDroid, an automated GUI testing approach that enables reliable completion of combination interactions through structured planning and dual memory. COMBDroid first detects combination interaction patterns from GUI structure, then generates page-level interaction plans and grounds them into widget-level executable actions. Inspired by Sudoku solving, COMBDroid maintains a dual-memory mechanism, where context memory preserves execution states within a functionality and experience memory captures reusable interaction patterns. COMBDroid is designed as an integrable module that activates when combination interactions are detected and allows existing testing tools to resume exploration after completion. We evaluate COMBDroid on 100 combination interaction functionalities collected from 100 mobile apps, comparing it with 15 state-of-the-art GUI testing baselines. COMBDroid achieves 103% higher passing rate than the best baseline and improves activity coverage by 65%-100% when integrated with existing testing tools. Furthermore, GUI testing tools integrated with COMBDroid detect 37 new crash bugs in real-world apps, with 26 fixed and the remaining confirmed by developers, demonstrating its effectiveness in improving GUI testing. Article Search Article: ase26main-p3565-p doi:10.1145/3832783.3837553
	Chen, Minghui	ASE '26: "Large Language Model Enabled ..." Large Language Model Enabled Symbolic Execution for Automated Functional Analysis Meixi Liu, Zhenbang Chen, Xudong Wang, Ziran He, Jiachen Gu, Minghui Chen, Lei Wang, and Wei Dong (National University of Defense Technology, China) Symbolic execution shows promise in automated program analysis by systematically exploring the path space of the program. However, due to the inherent limitations of program analysis techniques, symbolic execution cannot understand the program’s functionality, which hinders its application in functional analysis and defect detection. This paper introduces FuSE, a method that enhances symbolic execution with Large Language Models (LLMs) to automatically annotate program paths with functional specifications. A program path is annotated with a natural language description of its functionality, a precondition, and a postcondition. Our method significantly reduces the effort required for functional testing and defect detection. Based on UnitTestBot, FuSE can successfully annotate functional specifications for C, C++, Java, and Python programs, with success rates of 98.2%, 95.52%, 87%, and 95.37%, respectively. In our user study with professional developers and testers, FuSE helps users identify 21.67% more functional defects and improves functional coverage by 15.83%, demonstrating its practical utility. Article Search Artifacts Available Article: ase26main-p2155-p doi:10.1145/3832783.3837524
	Chen, Mingyang	ASE '26: "Structure-Guided Semantic ..." Structure-Guided Semantic Deobfuscation of Android Identifiers Mingyang Chen, Zhentao Xie, Yaqi Gao, Shuang Li, and Wenrui Diao (Shandong University, China) Android developers frequently employ identifier renaming to obfuscate code and hinder reverse engineering. This practice effectively conceals program semantics. However, it severely impedes downstream security analysis tasks, particularly manual inspection of malicious and privacy-sensitive behaviors. Existing deobfuscation techniques rely on code similarity, learned naming priors, or local LLM reasoning. These methods often exhibit severe limitations when applied to proprietary, heavily obfuscated, or cross-file context-dependent code. In this paper, we present DeMask, a novel framework that integrates static program analysis with Large Language Models (LLMs) to recover meaningful identifiers from obfuscated Android apps. Guided by program structure, DeMask executes a bottom-up, context-aware inference process for whole-app semantic reconstruction. It incorporates tailored naming constraints and optimization strategies to mitigate LLM hallucinations and ensure scalability for real-world codebases. We implemented a prototype and evaluated it on diverse datasets of benign and malicious Android apps. The results demonstrate that DeMask significantly outperforms prior work in semantic accuracy and naming consistency. Specifically, it achieves an average effective semantic recovery of over 88.6% across all evaluation settings. Article Search Article: ase26main-p2252-p doi:10.1145/3832783.3837525
	Chen, Pengfei	ASE '26: "OpsLens: Runbook-Free Root ..." OpsLens: Runbook-Free Root Cause Analysis via Multi-agent Collaboration and Tool Management Haiyu Huang, Jiewei Lyu, Gou Tan, Pengfei Chen, Zhihan Jiang, Guangba Yu, Penghui Mi, Fuqiang Wang, Jian Han, Chongkang Tan, and Michael R. Lyu (Sun Yat-sen University, China; Chinese University of Hong Kong, China; Huawei, China; Independent Researcher, China) Root Cause Analysis (RCA) is critical for cloud service reliability, requiring correlation of multi-modal observability data (i.e., traces, logs, and metrics) to identify failure causes. Current LLM-based RCA approaches face two key limitations: over-reliance on system-specific artifacts (e.g., runbooks), limiting transferability; and difficulty ensuring the quality and reuse of LLM-generated diagnostic tools across modalities. To address these issues, we propose OpsLens, an RCA framework that combines modality-specialized multi-agent collaboration with quality-focused tool management , including feedback-driven refinement and a tool graph with scoreboard. On OpenRCA (335 real-world incidents from three production systems), OpsLens achieves a score rate of 0.80, outperforming baselines by 1.79–4.75×. More importantly, OpsLens has been tested on Platform A in Huawei since June 2025, achieving over 80% RCA accuracy across two industrial datasets and reducing diagnosis time from over 1 hour to under 5 minutes. Article Search Artifacts Available Article: ase26ind-p181-p doi:10.1145/3832783.3834501 ASE '26: "AgentChaos: Chaos Engineering ..." AgentChaos: Chaos Engineering for Agent Systems via Programmatic Fault Injection Gou Tan, Zhensu Sun, Jieke Shi, Ting Zhang, Zilong He, Qingfu Wu, Shuai Liang, Weifeng Sun, Junda He, Pengfei Chen, Chuanfu Zhang, Lwin Khin Shar, and David Lo (Sun Yat-sen University, Guangzhou, China; Singapore Management University, Singapore; Monash University, Australia; China Unicom Software Research Institute, Beijing, China) Agent systems rely on LLM APIs for every response, but these APIs can return server errors, truncated responses, or corrupted content that propagates through downstream agents and causes task failure. Evaluating robustness under these faults is crucial for reliable deployment. Existing fault injection methods are offline, require source code modification, or cannot modify specific response fields. A comprehensive evaluation also requires a systematic fault taxonomy because different fault types affect downstream agents differently. We propose AgentChaos, a chaos engineering framework for controlled, runtime, non-intrusive LLM API fault injection. Since all agent systems access LLMs through the same HTTP interface, we inject faults at this shared layer without modifying source code. We define crash, omission, and value faults on content and tool call fields, intercept and modify LLM API responses at runtime, and verify whether each fault is triggered to filter untriggered tasks and avoid underestimating fault impact. Evaluations across agent systems, benchmarks, and backbone LLMs under 65 fault configurations show that all systems degrade under fault injection, with pass@1 dropping by up to 50 percentage points. The ranking is consistent across models, suggesting that robustness depends on system implementation rather than model capability. Existing fault diagnosis methods achieve below 53% accuracy on fault type and below 56% on fault step, leaving room for improvement. We further reveal practical findings for agent system developers. Article Search Artifacts Available Article: ase26main-p355-p doi:10.1145/3832783.3837437 ASE '26: "TELLER: Non-intrusive Cross-Layer ..." TELLER: Non-intrusive Cross-Layer Root-Cause Analysis for LLM Inference Ruilin Xu, Junyi Li, Pengfei Chen, and Zongxuan Xie (Sun Yat-sen University, China) Large language model (LLM) inference has evolved from an offline workload into a continuously operated software service, yet root-cause analysis remains difficult because a single request spans the inference engine, Python/C++ backend, host CUDA APIs, GPU kernels, and distributed communication. Existing profilers expose raw timelines, while log-based diagnosis often misses cross-layer execution semantics and request-level structure. We present TELLER, a non-intrusive trace- and log-aware LLM inference root-cause analysis framework. TELLER first collects NVTX/CUPTI traces and service logs without modifying model binaries, then reconstructs per-request call-chain trees and aligns log lines with the corresponding execution steps. We introduce a dependency-aware causal-context slice that preserves parent-child structure, temporal order, and communication relations, and a Trace Pair Encoding (TPE) tokenizer that compresses such slices into compact structural token sequences with parent, depth, and duration attributes. On top of these representations, TELLER combines numeric candidate localization with a multimodal root-cause model that jointly predicts abnormal steps, localizes suspicious operators, and generates natural-language explanations. Experiments on multi-node GPU inference workloads show a clear compression-accuracy trade-off: a moderate TPE vocabulary reduces per-step trace length by more than 80% while achieving the best overall performance on both horizontal (cross-node communication) and vertical (within-node execution stack) views, whereas more aggressive compression substantially degrades diagnosis quality. Further analyses under low-fault priors, strengthened baselines, modality ablations, explanation-quality checks, and tracing overhead show that TELLER provides a practical triage and evidence-localization substrate for LLM inference RCA. Article Search Artifacts Available Article: ase26main-p423-p doi:10.1145/3832783.3837440 ASE '26: "HERO: Hypothesis-Centered ..." HERO: Hypothesis-Centered Root-Cause Analysis for Microservice Incidents Jiewei Lyu, Junquan Yi, Shu Liang, Pengfei Chen, and Long Pan (Sun Yat-sen University, China; Tencent, China) Root-cause analysis (RCA) in cloud-native microservice systems is challenging because it requires integrating heterogeneous observability signals and deciding what to inspect next under limited diagnosis budgets. Existing large language model (LLM)-based RCA agents either rely heavily on predefined workflows, whose effectiveness is constrained by incomplete Standard Operating Procedure (SOP) coverage, or adopt open-ended diagnosis, which remains brittle when multiple plausible root-cause hypotheses are consistent with the observed evidence. We present Hero, a hypothesis-centered RCA framework that formulates diagnosis as controlled discrimination among competing hypotheses via bounded hypothesis-space instantiation, explicit belief-state tracking, and ambiguity-guided evidence acquisition. We evaluate Hero on OpenRCA and a real-world industrial incident dataset against representative workflow-based and open-ended baselines. On OpenRCA with DeepSeek-V3, Hero achieves an SR of 79.77, outperforming the strongest ReAct-style baseline by 23.20 points while using 1.04 fewer actions on average. On the industrial dataset, it reaches an SR of 85.00 and remains the best-performing method. These results suggest that explicitly controlling competing hypotheses is an effective and practically promising abstraction for microservice RCA, especially in real-world, production-style incidents with incomplete workflow coverage and high diagnostic ambiguity. Article Search Article: ase26main-p1707-p doi:10.1145/3832783.3837509
	Chen, Quan	ASE '26: "InfraAPR: An Agent-Based Repair ..." InfraAPR: An Agent-Based Repair Framework for Cloud Infrastructure-as-Code Programs Quan Chen, Zhao Liu, Chunfang Li, Yifan Zhang, Ning Hu, and Qing Liao (Harbin Institute of Technology, Shenzhen, China; Pengcheng Laboratory, China; Hunan University, China; Nanchang University, China) Infrastructure as Code (IaC) is now a routine part of industrial cloud delivery, and Programming Languages IaC (PL-IaC) frameworks further enable engineers to build infrastructure using familiar programming abstractions. However, repairing buggy PL-IaC programs in practice remains costly and highly challenging. Existing quality assurance efforts for PL-IaC have largely concentrated on defect analysis and static checking, while end-to-end automated repair frameworks for PL-IaC programs remain largely absent. In addition, automated program repair techniques designed for general-purpose software often lack PL-IaC-specific domain knowledge, as well as effective modeling and guidance for topology dependencies, making them ineffective for repairing topology-dependent bugs in PL-IaC settings. This paper presents InfraAPR, an agent-based automated repair framework for PL-IaC programs. To enable end-to-end automated repair, InfraAPR integrates three coordinated modules: (1) an InfraAPR Agent Module for phase-specialized LLM reasoning, (2) a Semantic Mapping Module for reconstructing graph-based PL-IaC semantics, and (3) a Constraint-Guided Repair Module that diagnoses constraint violations and generates repaired programs based on structured diagnostics. We evaluate InfraAPR on an industrial benchmark. Experimental results show that InfraAPR consistently outperforms the baselines, achieving a repair success rate of up to 61.8% and improving the strongest baseline by 15.4% on average. These results demonstrate its substantial practical value and improved reliability for industrial PL-IaC workflows. Article Search Article: ase26ind-p338-p doi:10.1145/3832783.3834526
	Chen, Rongbo	ASE '26: "Planner-Fuzz: Overcoming Diagnostic ..." Planner-Fuzz: Overcoming Diagnostic Saturation in UAV Planners via Boundary-Oriented Fuzzing Rongbo Chen, Chengcheng Zhao, Peng Cheng, Jiming Chen, and Taegyu Kim (Zhejiang University, China; Pennsylvania State University, USA) UAV planners are safety-critical software components whose behavior depends on high-dimensional, continuously tunable parameters. While existing fuzzing approaches focus on discovering failures, configurations deep inside failure regions are often diagnostically uninformative.Once the planner moves far beyond the safety boundary, parameter sensitivity diminishes, and inter-parameter dependencies become obscured.We refer to this phenomenon as diagnostic saturation and observe that configurations near the safe-unsafe transition preserve informative parameter sensitivity and interaction structure, making them more suitable for root-cause analysis. To this end, we propose Planner-Fuzz, a boundary-oriented fuzzing framework. It steers search toward a narrow band around the safety boundary while preventing convergence to a single configuration to enable the exploration of diverse boundary behaviors. Using the collected boundary configuration, Planner-Fuzz performs three-level diagnosis through sensitivity analysis, interaction mining, and counterfactual validation to identify and validate the parameters responsible for failure behavior. We evaluate the approach on three open-source UAV planners under four anomaly types. The results show that Planner-Fuzz discovers more diverse and diagnostically useful boundary configurations than failure-driven baselines, provides stronger signals for identifying influential parameters and interactions, and yields stronger intervention-based recovery evidence. These findings suggest that fuzzing for safety-critical planners should go beyond failure discovery and explicitly support diagnosis. Article Search Article: ase26main-p1399-p doi:10.1145/3832783.3834389
	Chen, Ruijia	ASE '26: "Toward Inclusive Programming ..." Toward Inclusive Programming Support for Novice Programmers with Dyslexia: Insights from a Comparative Study Zihan Fang, Janice Chung, Ruijia Chen, Marcia Barnes, Yuhang Zhao, and Yu Huang (Vanderbilt University, USA; University of Wisconsin-Madison, USA) Programming attracts a diverse range of learners, including individuals with dyslexia, a learning difficulty that affects reading, writing, and spelling despite average intelligence and educational opportunities. Although prior work has examined dyslexia in natural-language and code comprehension, we still know little about how dyslexic learners engage with code relative to natural language, and what this implies for inclusive programming environments. This gap is especially important in the AI era, as novice programmers increasingly rely on AI-powered coding and learning tools that may not address the distinct comprehension and cognitive support needs of learners with dyslexia. To address this gap, we conducted an eye-tracking study with a mixed-methods design involving 24 novice programmers (12 with dyslexia, 12 without) who completed paired code-comprehension and English-comprehension tasks. We found that although the two groups showed similar overall visual scanning patterns, eye-gaze features suggest higher cognitive effort among dyslexic novices during code comprehension. We also found that the performance gap between dyslexic and neurotypical learners was smaller in code comprehension than in English comprehension, suggesting that programming-specific representations may reshape, rather than eliminate, dyslexia-related challenges. In addition, dyslexic novices reported lower confidence, viewed general training methods as less effective, and described difficulties with symbolic elements and structurally complex code. These findings provide an empirical basis for designing AI-assisted programming tools that can detect cognitive overload and adapt explanations, feedback, and task support to better support dyslexic novices. Article Search Article: ase26main-p2412-p doi:10.1145/3832783.3834414
	Chen, Sen	ASE '26: "One Is Not Enough: The Untold ..." One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability Fangyuan Zhang, Lyuye Zhang, Lingling Fan, Chengwei Liu, Yinan Li, Liang Huang, Yang Liu, Zheli Liu, and Sen Chen (Nankai University, China; Nanyang Technological University, Singapore; Qi An Xin Technology Group, China) Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling. Article Search Article: ase26main-p694-p doi:10.1145/3832783.3837455
	Chen, Shaowei	ASE '26: "TDiFf: Detecting Bugs in DataFrame ..." TDiFf: Detecting Bugs in DataFrame Systems via Transferred DBMS Test Cases Jiaxin Hu, Shaowei Chen, and Rongxin Wu (Xiamen University, China; Fujian Agriculture and Forestry University, China) DataFrame systems are core components of modern data analytics platforms and achieve high performance through various optimization techniques. However, these optimizations can introduce subtle defects that are difficult to detect, undermining system reliability. Existing testing approaches primarily rely on manually written unit tests or automated unit test generation tools, which often produce invalid or low-quality test cases and have limited ability to exercise complex API sequences and optimization-induced behaviors. In this paper, we present TDiFf, a novel LLM-based testing framework for DataFrame systems. TDiFf leverages the database-like characteristics of DataFrame systems by translating SQL query statements into Python DataFrame test cases for differential testing. To address limitations of LLMs in mapping SQL constructs to DataFrame APIs and preserving semantic consistency, TDiFf incorporates feature knowledge extracted from SQL and DataFrame API documentation. In addition, it utilizes data flow graphs derived from SQL query plans to guide the generation of syntactically valid and semantically consistent DataFrame API sequences. We evaluate TDiFf on six widely used DataFrame systems: Pandas, Dask, CuDF, Modin, PySpark, and Polars. The results show that more than 99% of the generated DataFrame test cases are valid. Using these test cases, TDiFf uncovers 35 unique and previously unknown bugs confirmed by developers, and outperforms state-of-the-art baseline approaches by 2.5× to 14×. Article Search Article: ase26main-p3190-p doi:10.1145/3832783.3837548
	Chen, Shihong	ASE '26: "Enhancing Trace-Based Root ..." Enhancing Trace-Based Root Cause Analysis for Microservice Systems via Code Change Understanding Min Zhang, Chenxi Zhang, Senyu Xie, Shihong Chen, Lei Wu, and Xin Peng (Fudan University, China; Xidian University, China; McDonald's, China) Microservice architecture has become the dominant design pattern for modern web applications. However, the dynamic structure, complex inter-service invocations, and continuous updates of microservices make root cause analysis (RCA) particularly challenging. Existing RCA methods typically rely on runtime monitoring data such as traces and metrics, and adopt techniques including deep learning, graph analysis, and spectrum analysis. However, most of these methods overlook software changes, even though code and deployment updates are often the underlying causes of production failures. This paper introduces the idea of RCA left-shifting, which shifts part of the diagnostic effort to the development stage by proactively understanding change semantics before failures occur. Based on this insight, we propose DeltaRCA, a trace-based RCA approach that integrates large language model (LLM)-driven change impact analysis with spectrum-based root cause localization. DeltaRCA uses an LLM agent to identify semantically affected operations from code changes. This information is incorporated into a heterogeneous graph to guide the weight propagation process in spectrum-based fault localization. We evaluate DeltaRCA on two microservice benchmarks with 200 injected fault cases. The results show that DeltaRCA outperforms state-of-the-art methods, achieving 63% Top-1 and 79% Top-3 accuracy on average. Furthermore, ablation analysis demonstrates that incorporating change understanding significantly improves localization precision. Article Search Article: ase26main-p199-p doi:10.1145/3832783.3837424
	Chen, Shiru	ASE '26: "CAPMix: Robust KPI Anomaly ..." CAPMix: Robust KPI Anomaly Detection for AIOps in Noisy and Dynamic Environments Xudong Mou, Rui Wang, Tiejun Wang, Zexin Wu, Fangda Guo, Jie Sun, Shiru Chen, Penghao Zhang, Tiezi Zhang, Tianyu Wo, Hao Peng, Chunming Hu, Xudong Liu, and Renyu Yang (Beihang University, China; Chinese Academy of Sciences, China; Inspur, China; Kuaishou, China) Time-series anomaly detection is crucial in AIOps for maintaining large-scale service reliability. In production, streams of Key Performance Indicators (KPI) are high-dimensional, non-stationary, and affected by noise, deployment changes, and latent anomalies, making real failures hard to distinguish from benign variation. Most existing methods assume either normality (learning from “normal” history) or rely on injected anomalies for training. Yet injected patterns often misalign with real failure modes, skewing decision boundaries – aka. Anomaly Shift. We propose CAPMix, a controllable anomaly augmentation framework with prior-guided injection for realistic temporal behaviors. CAPMix combines label revision and dual-space mixup to enhance robustness under contaminated and mixed data. CAPMix consistently outperforms state-of-the-art methods on public AIOps and time-series benchmarks. It has been deployed in a large-scale production system, reducing false alarms and improving monitoring reliability. A real-world dataset is also released to enrich the research on robust KPI anomaly detection. Article Search Article: ase26ind-p110-p doi:10.1145/3832783.3834487
	Chen, Si	ASE '26: "ExeCRE: Execution-Consistency ..." ExeCRE: Execution-Consistency Guided Reliability Estimation for Self-Correcting Code Generation Yiru Dong, Richong Zhang, Fanshuang Kong, and Si Chen (Beihang University, China) Large language models (LLMs) have made notable progress in code generation, but they still struggle on challenging tasks that require sophisticated algorithms or complex implementations. Recent methods increasingly use code execution as feedback, especially in self-correction pipelines that construct verification signals from generated code. However, these pipelines often depend on supervision signals whose reliability is unknown, which can introduce misleading feedback, unnecessary revisions, and incorrect final answers. To address this issue, we propose ExeCRE, an Execution-Consistency guided code Reliability Estimation framework. Instead of judging candidate code by tests or LLM feedback, ExeCRE estimates code reliability by statistically analyzing consistency patterns in execution outputs over a large number of randomly generated inputs. It collects execution outputs over generated inputs, projects them into consistency signals, and applies Dawid–Skene model to infer latent code reliability. We integrate ExeCRE into self-correction for code generation. Experiments show that ExeCRE consistently improves both effectiveness and stability, while substantially reducing misleading correction signals. Under GPT-5.2 on LiveCodeBench, the average number of misleading feedback cases on already correct code drops from 113.2 with a representative self-correction baseline to 14.0 with ExeCRE. As an additional study, we apply the same reliability estimation strategy to code-based mathematical reasoning and observe similar benefits. These results suggest that ExeCRE enables more reliable use of generated code in execution-based pipelines. Article Search Article: ase26main-p496-p doi:10.1145/3832783.3837445
	Chen, Silin	ASE '26: "LLM Agents Can See Code Repositories ..." LLM Agents Can See Code Repositories Dongjian Ma, Silin Chen, Yufei Yang, Yuling Shi, Yanfu Yan, and Xiaodong Gu (Shanghai Jiao Tong University, China; Xi'an Jiaotong University, China; Zhejiang University, China) Coding agents powered by large language models (LLMs) have demonstrated remarkable proficiency in software engineering tasks. Yet modern coding agents rely almost entirely on text, leaving a major gap between how human developers and agents comprehend software repositories. Human developers leverage visual repository cues such as folder hierarchies and dependencies, raising the question of whether multimodal models can similarly improve repository understanding. In this paper, we conduct the first systematic empirical study on multimodal foundation models for repository-level tasks. Our experiments across four modern multimodal models reveal that while a vision-only context representation degrades performance and inflates token costs, integrating visualized context graphs as a supplementary modality can help agents grasp the repository more efficiently. Specifically, providing agents with visual structural context alongside standard text interfaces reduces input token consumption by up to 26% while maintaining or improving issue-resolution accuracy. Furthermore, we demonstrate that visual tools are most effective when utilized during the fault localization stage and when agents autonomously dictate their exploration depth. Our findings highlight a promising hybrid-modality pathway for the design of next-generation coding agents. Article Search Article: ase26main-p734-p doi:10.1145/3832783.3834363
	Chen, Siyu	ASE '26: "Conflict Extraction in Probabilistic ..." Conflict Extraction in Probabilistic Datalog Analyses Siyu Chen, Chungha Sung, Xuyang Li, and Jingbo Wang (Purdue University, USA; Amazon Web Services, USA) Probabilistic extensions of Datalog enable static analyses such as pointer analysis, data race detection, and side-channel analysis to rank alarms by likelihood, but this added expressiveness also introduces a new challenge absent from deterministic analyses: the final output may contain alarms that are individually plausible yet mutually inconsistent, because marginal probabilities do not guarantee joint satisfiability. As a result, developers may spend effort investigating combinations of alarms that can never co-occur in any possible world. We address this problem by formalizing such inconsistencies as minimal unsatisfiable subsets (MUSes) and introducing PPProbe, a conflict extractor specialized for probabilistic Datalog analyses. Rather than improving MUS enumeration in general, PPProbe exploits the structure of Datalog derivation graphs to guide the search toward likely conflicts and prune the search space through bottom-up UNSAT inference. We evaluate PPProbe on 70 benchmarks from power side-channel analysis, data race detection, semantic diffing, and Bayesian-network inference. The results show that PPProbe achieves 2.5–24× higher throughput than state-of-the-art MUS enumerators, and that the conflicts it identifies yield a conservative estimate of false-positive reduction, filtering out an average of 47.7% of mutually inconsistent alarms. Article Search Article: ase26main-p1888-p doi:10.1145/3832783.3834404
	Chen, Tanglin	ASE '26: "Smart Contract Synthesis via ..." Smart Contract Synthesis via Multi-modal Specifications Tanglin Chen, Haoxian Chen, Huilin Xiang, and Yuepeng Wang (ShanghaiTech University, China; Simon Fraser University, Canada) Smart contracts manage substantial digital assets on blockchains. Given their transparency and immutability, ensuring their correctness before deployment is essential. While verification tools offer assistance, the iterative nature of the process presents hurdles, especially for less experienced developers. In this paper, we explore a paradigm shift in smart contract development: writing high-level specifications instead of low-level code. To realize this goal, we propose SmartSpec, a synthesizer that generates smart-contract implementations from functional and safety specifications and validates them with integrated verification. To avoid overly restrictive outcomes, SmartSpec employs maximally permissive synthesis, ensuring contracts preserve all safety requirements while remaining as permissive as possible. Its novel algorithm combines deductive and inductive synthesis techniques, balancing precision and generalization. On 27 contracts, synthesis runs in seconds to minutes; 23 match references without interactive refinement (85%), while the remaining four can be corrected with up to four rounds of interactive feedback through extra examples. Mean gas overhead vs. references on the table is +0.7%. Article Search Artifacts Available Article: ase26main-p244-p doi:10.1145/3832783.3837430
	Chen, Tao	ASE '26: "Less Is More: Tuning Configurable ..." Less Is More: Tuning Configurable Systems with Imperfect Fidelity Yulong Ye, Miqing Li, and Tao Chen (University of Birmingham, UK) Configuration tuning is essential for optimizing the performance of highly configurable systems, e.g., throughput or runtime, under a given environment. Yet, this is a challenging process as there can be many options to tune, and configuration measurement is often highly expensive. In this paper, we demonstrate the phenomenon of “less can be more”: system configuration tuning can be greatly improved with much superior budget utilization by partially tuning under the imperfect-fidelity—an environment that is similar, but cheaper to measure, compared with the concerned perfect-fidelity of environment under which the system should be tuned. We codify a conceptual framework of fidelity for configurable systems, drawing on which allows us to propose MFTune, a tuner that proactively explores in the space of >104 possible imperfect-fidelity settings to approximate a useful one, which strikes for the wideness of tuning. This creates high-quality seeds for the perfect-fidelity, which in turn ensures the tuning depth. Experiment results against 10 state-of-the-art tuners, obtained from running diverse real-world systems for 19 months 24 × 7, show that MFTune performs considerably better on 83.33% cases with up to 19.34% improvement while achieving hours of budget saving in general. Article Search Article: ase26main-p988-p doi:10.1145/3832783.3834376
	Chen, Tianyu	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477
	Chen, Ting	ASE '26: "Beyond Single-Level PGO: Understanding ..." Beyond Single-Level PGO: Understanding and Harnessing Cross-Level Optimization Effects in Industrial Systems Dong Liu, Yifan Cheng, Yunfeng Cui, Ting Chen, Jiachi Chen, Zhihong Xue, Chong Hu, and Shengyu Cheng (ZTE Corporation, China; University of Electronic Science and Technology of China, China; Zhejiang University, China) Profile-guided optimization (PGO) is used to improve software performance in applications and operating system kernels. However, prior work applies PGO to a single layer in isolation, overlooking cross-layer interactions in systems, where kernel and application are optimized independently using different workloads. This practice is common in production environments and makes its impact on end-to-end performance important to understand. It introduces a mismatch between training and deployment, where profiling workloads may not reflect the final co-executed system. Despite its prevalence, the implications of such cross-layer mismatch remain poorly understood. In this paper, we present a large-scale industrial study of multi-level PGO across three representative products. We evaluate the combined effects of independently optimized kernel and application under realistic deployment conditions. Our results show that multi-level PGO can yield performance gains of up to 17.04%, but may lead to severe regressions of up to 81.90%. Through performance counter analysis, we attribute these effects to microarchitectural factors such as cache contention and branch misprediction arising from mismatched profiling assumptions. These findings show that PGO benefits are not necessarily compositional across software layers. Based on these insights, we propose Multi-Level PGO (ML-PGO), a practical guideline for applying PGO safely across system layers. Our work highlights the importance of workload representativeness and cross-layer awareness for achieving reliable performance improvements. Article Search Article: ase26ind-p100-p doi:10.1145/3832783.3834484
	Chen, Tse-Hsun (Peter)	ASE '26: "Probe to Generate: Program ..." Probe to Generate: Program Variant-Guided Test Augmentation for Repository-Level Repair Benchmarks Chenglin Li, Yisen Xu, Zehao Wang, Shin Hwei Tan, and Tse-Hsun (Peter) Chen (Concordia University, Canada) Test-based benchmarks such as SWE-bench have become a standard basis for evaluating automated issue resolution agents, deeming a patch correct if it passes a provided regression test suite. In practice, weak test suites can admit plausible but semantically incorrect patches, inflating reported agent performance. We present PROBE, a test augmentation framework that uses semantically modified program variants as behavioral probes to identify and close gaps in benchmark test suites. Variants of the reference patch that survive the original tests reveal under-constrained behaviors, which then guide targeted regression test generation. Each generated test is retained only if it passes on the reference patch, fails on at least one surviving variant, and remains robust under behavior-preserving transformations. On SWE-bench Verified, 77% of instances admit at least one surviving variant. PROBE generates 1,014 validated tests across 211 instances, increasing patch-region line and branch coverage by 10.8 and 9.5 percentage points. Re-evaluating the top-10 repair agents with the augmented suites reduces resolved rates by 4.2%-9.0%, showing that many previously accepted patches exploit benchmark test gaps rather than fully satisfying the intended repair semantics. These findings demonstrate that benchmark evaluation is not solely a patch-generation problem but also a test-strength problem. Article Search Article: ase26main-p2532-p doi:10.1145/3832783.3837534
	Chen, Wei	ASE '26: "ArkEval: Benchmarking and ..." ArkEval: Benchmarking and Evaluating Automated Code Repair for ArkTS Bang Xie, Senjian Zhang, Zhiyuan Peng, Wei Chen, Xin Yin, Chenhao Ying, and Yuan Luo (Shanghai Jiao Tong University, China; Zhejiang University, China) Automated program repair benchmarks largely cover mature languages such as Python and Java, leaving limited support for ArkTS and OpenHarmony. We present ArkEval, an executable repository-level benchmark for evaluating repair on real ArkTS/OpenHarmony issue-resolution tasks. To the best of our knowledge, it is the first benchmark with this scope. We mined more than 6,000 pull-request and merge-request records available through July 3, 2025, from nine public repositories. Automated profiling and unanimous screening by three ArkTS/OpenHarmony developers produced 502 instances. Their reproduction tests were constructed through a six-round benchmark-wide refinement process, followed by targeted closure for the remaining six instances. We evaluated eight current models with the same localization-guided, RAG-off repair protocol. The best model compiled 54.38% of its patches, whereas the highest behavioral Pass@1 was 19.32%. ArkEval therefore separates build validity from behavioral repair and supplies traceable tests for studying both. Article Search Article: ase26main-p1862-p doi:10.1145/3832783.3837514
	Chen, Wei-Peng	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Chen, Wentao	ASE '26: "A Longitudinal Analysis of ..." A Longitudinal Analysis of Software Development Evolution in a Financial Organization Wentao Chen, Zehong Zhang, Huiqun Yu, Guisheng Fan, Huan Wang, and Kaiwen Zhi (East China University of Science and Technology, China; Orient Securities Company Limited, China) DevOps adoption has become a key mechanism for automating software development, while AI-assisted coding introduces new uncertainties into established workflows. However, long-term evidence on the evolution of software development remains limited, especially in regulated financial organizations. To address this gap, we partner with a leading securities firm and analyze over 800,000 lifecycle records from all software projects between 2021 and 2025. We examine long-term trends, structural change points, and project-level evolution patterns. The results show a shift from development-driven growth to quality-assurance-centric and maintenance-heavy stabilization. We further identify three structural breakpoints mainly associated with DevOps maturation, requirements management, and quality-oriented governance. Project clustering shows that the ecosystem remains stable in earlier periods but becomes more fragmented recently, with a maintenance-intensive project state emerging. To further investigate the evolution of software development in financial organizations, we conduct semi-structured interviews. Practitioner interviews complement these findings by revealing early concerns under AI-assisted development. In general, this study provides longitudinal evidence on the evolution of software development in financial organizations. In addition, it provides lessons learned for AI-assisted software development from a distinctive perspective. Article Search Article: ase26ind-p256-p doi:10.1145/3832783.3834515 ASE '26: "RealAIGC: Towards More Realistic ..." RealAIGC: Towards More Realistic Evaluation of AI-Generated Code Detection in Real-World Code Repository Wentao Chen, Yufei Chen, Huiqun Yu, Guisheng Fan, Kaiwen Zhi, Peite Guo, and Jianyuan Yu (East China University of Science and Technology, China; Shanghai Engineering Research Center of Smart Energy, China) AI-generated code (AIGC) from autonomous coding agents are widely adopted across the software development lifecycle. However, AIGC also introduces critical challenges to open-source community governance, making AIGC detection important. Existing AIGC detection benchmarks are fundamentally misaligned with real-world development processes. To address this gap, we construct RealAIGC, a benchmark for AIGC detection grounded in real-world code repositories. RealAIGC is built from the development histories of GitHub and includes pull request (PR) generated by five coding agents alongside human-written code, covering eight major programming languages. It supports multi-granularity detection at the repository, PR, commit, file, and function levels, with more than four million functions. Based on RealAIGC, we conduct a realistic empirical evaluation of 28 AIGC detection methods across three categories. The results show that supervised approaches perform well only in small, homogeneous, single-language repositories, but degrade significantly in mainstream dynamic languages and in large-scale, multi-developer environments. Perplexity based methods are nearly ineffective in realistic settings. No existing method demonstrates general applicability, and all approaches perform unsatisfactorily at the commit and PR levels. This work provides empirical guidance for advancing AIGC detection techniques. Article Search Article: ase26main-p2317-p doi:10.1145/3832783.3834411
	Chen, Xiang	ASE '26: "CIPIHunter: Detecting Configuration-Induced ..." CIPIHunter: Detecting Configuration-Induced Prediction Instability in Deep Learning Frameworks Yanzhou Mu, Shuo Meng, Mijung Kim, Xiang Chen, Chunrong Fang, Zhenyu Chen, and Juan Zhai (UNIST, Republic of Korea; Nanjing University, China; Nantong University, China; University of Massachusetts at Amherst, USA) Deep learning (DL) frameworks support diverse execution configurations, including precision modes and model optimizations. Even with a fixed model, input, and framework version, changing these configurations can change model predictions, causing Configuration-Induced Prediction Instability (CIPI). CIPI arises when configuration-dependent numerical perturbations propagate and cause potentially harmful model-level behavior. Existing API-level and model-level testing approaches are not well suited to detecting CIPI, as these approaches lack configuration-conditioned exploration and propagation-aware diagnosis. Therefore, we present CIPIHunter, which combines controlled configuration-pair testing, sensitivity-oriented mutation, feedback-guided search, and intermediate tracing to localize suspicious operators or operator groups. On 13 PyTorch models under a 100-round budget, CIPIHunter reports the highest raw CIPI count and 22 deduplicated Type I manifestations, 83.3% more than the strongest baseline, while remaining competitive in overall deduplicated manifestation coverage. In total, we submit 29 PyTorch issue reports. Developers have acknowledged eight, rejected five, and marked four as duplicates; nine remain pending, and three have been closed without an explicit determination. Separately, three reports are labeled “high-priority”. These results demonstrate the practical utility of CIPI testing for framework quality assurance. Article Search Article: ase26main-p163-p doi:10.1145/3832783.3834345
	Chen, Xiangping	ASE '26: "When Comments Mislead: An ..." When Comments Mislead: An Empirical Study of Outdated Comments in LLM-Based Code Completion Zhikun Xia, Yuan Huang, Xiangping Chen, and Zibin Zheng (Sun Yat-sen University, China) Large language models (LLMs) are widely used for code completion, where natural-language comments serve as key contextual signals. While prior work shows that comments and natural-language descriptions can improve generation quality by providing high-level semantic guidance, their reliability in evolving codebases remains unclear. In practice, comments may be outdated or inconsistent with the current implementation, raising the question of whether such context may mislead generation rather than simply degrade it. In this paper, we present an empirical study of outdated comments in LLM-based code completion. We find that outdated comments tend to introduce a systematic misleading effect: instead of merely degrading performance, they can bias generated code toward historical implementations, producing outputs that remain globally plausible while failing in regions where the implementation has changed, as outdated comments often retain partially correct yet inconsistent information. Importantly, this effect is not uniform. Our study shows that the impact of outdated comments varies with factors such as the function signature length and task complexity, reflecting the interaction between structural signals and natural-language guidance. Overall, our findings challenge the common assumption that richer context is uniformly beneficial for code generation. They highlight that natural-language comments can act as strong but unreliable signals, and underscore the need for more robust handling of inconsistent contextual information in LLM-based code generation. Article Search Artifacts Available Article: ase26main-p613-p doi:10.1145/3832783.3834359
	Chen, Xiaohong	ASE '26: "FallibleUser: An Imperfect ..." FallibleUser: An Imperfect User Agent for Realistic Evaluation of Interactive AI Systems Yaotian Yang, Zhi Jin, Dongming Jin, and Xiaohong Chen (Beijing Forestry University, China; Peking University, China; East China Normal University, China) Interactive LLM and agent evaluations often rely on oracle users or ground-truth-aware simulators that provide complete and unambiguous answers once the system asks a relevant question. This idealized assumption makes evaluation scalable and reproducible, but can overestimate robustness when real users omit information, give vague answers, or use unclear references. We present FallibleUser, a pluggable fallible-user simulation toolkit for evaluating interactive AI systems under imperfect user answers. FallibleUser preserves the original oracle-user pipeline, but inserts a configurable answer-rewriting layer before the answer is returned to the evaluated system. The current toolkit supports three representative fallibility operators: slot omission, specificity reduction, and referential ambiguity. It also pairs rewriting with a strict post-answer Q&A-level hit judge, so that a target is credited only when the final interaction actually elicits complete, specific, and unambiguous information. We demonstrate FallibleUser in a requirements-elicitation evaluation setting and show that oracle-user evaluation can substantially overestimate the robustness of the same interviewer agent. FallibleUser is open-sourced at https://doi.org/10.5281/zenodo.20136882, with a demonstration video available at https://youtu.be/T8-I9pb8rAI. Article Search Article: ase26tool-p74-p doi:10.1145/3832783.3834622
	Chen, Xingyan	ASE '26: "MicroAgent: Context-Augmented ..." MicroAgent: Context-Augmented Multi-agent Framework for Automatic Microservice Decomposition Zishan Su, Junjie Huang, Shiwen Shan, Xingyan Chen, Hui Zeng, Yuxin Su, Yanlin Wang, and Michael R. Lyu (Chinese University of Hong Kong, China; Sun Yat-sen University, China) The adoption of Microservice Architecture (MSA) has revolutionized software engineering by enhancing scalability, agility, and maintainability over traditional monolithic applications. As more developers transition their legacy systems to microservice-based architectures, effective microservice decomposition—partitioning monolithic applications into highly cohesive services—becomes vital. However, this decomposition task presents significant challenges. Manual approaches are time-consuming and labor-intensive. Existing automated methods often fail to capture the necessary semantic insights from complex applications, while naive applications of Large Language Models tend to overlook crucial contextual information and design principles, leading to suboptimal results. To address these challenges, we propose MicroAgent, a Context-Augmented Multi-Agent Framework for Microservice Decomposition. Our framework divides the decomposition process into five distinct subtasks and assigns each to a specialized agent. To enhance the effectiveness of each agent, we provide tailored, multi-granularity context that keeps its analysis focused and mitigates information overload. Furthermore, to ensure the decomposition adheres to established design principles, we integrate analytical tools that guide the agents’ decision-making. Experimental evaluations on 10 Java Web applications demonstrate that MicroAgent achieves an average decomposition accuracy of 89.2%, outperforming the state-of-the-art method by 24.6%. We also conduct a case study to highlight the practical benefits of our design. Article Search Artifacts Available Article: ase26main-p3640-p doi:10.1145/3832783.3834441
	Chen, Yan	ASE '26: "Manifesting Implicit Dependencies ..." Manifesting Implicit Dependencies in Requirements Task: An Automated Method Integrating Code Awareness and Change Analysis Hui Ma, Jiajun Yang, Yan Chen, Pingjia Liao, Baoyu Zhao, and Daoping Jiang (Shenzhen Poweroak Newener, China) In modern software development, accurately assessing the impact scope of requirement changes is crucial for software quality, yet this task faces two major challenges. First, highly simplified requirement descriptions (one-sentence requirements) tend to conceal complex business logic and extensive system dependencies. Second, commits often intertwine code changes for multiple requirements, leading to impact assessments that are both incomplete and time-consuming. Traditional manual assessment methods are not only inefficient but also prone to cognitive biases, which often result in the omission of critical impact points. To address these problems, this paper proposes AIST (Analysis of the Impact Scope of the Task), an automated impact scope analysis approach based on Large Language Models (LLMs). AIST leverages the semantic understanding and planning capabilities of LLMs to automatically parse requirement descriptions, retrieve relevant code context from the codebase, and integrate code change information, thereby generating a comprehensive impact scope assessment report. We evaluated AIST on 40 historical requirement changes from three real-world industrial projects. The experimental results show that it achieves a precision of $80.19\%$, a recall of $94.95\%$, and an F1-score of $86.35\%$, thereby significantly improving the completeness of impact scope identification and demonstrating high sensitivity in detecting tangled code changes. In a user survey, the novelty score was 6.32 out of 7.00, and the overall satisfaction score was 6.36 out of 7.00, indicating that users perceive that the tool effectively improves efficiency and reduces the risk of omissions. Article Search Article: ase26ind-p257-p doi:10.1145/3832783.3834516
	Chen, Yanxiang	ASE '26: "Characterizing and Mitigating ..." Characterizing and Mitigating Productivity Loss in Large-Scale Model Training: An Empirical Study Dinghao Xue, Yanxiang Chen, Junhong Liu, Yepeng Zhang, Guangsen Ni, Menghao Zhang, Tianyu Wo, Zheng Zheng, Chunming Hu, Jin Ouyang, and Renyu Yang (Beihang University, China; Kuaishou, China; Unaffiliated, China) Training large-scale foundation models often uses thousands of GPUs for weeks or months. In production clusters, training productivity is reduced not only by explicit failures but also by scheduling delays, repeated recoveries, alive-but-unproductive hangs, and performance degradation during seemingly normal execution. However, existing metrics such as Effective Training Time Ratio (ETTR) mainly account for time lost to failures and restarts, and do not directly capture jobs that remain alive but make slow progress. Prior diagnosis and mitigation efforts typically target specific failure modes, leading to case-by-case fixes and offering limited support for cluster-wide attribution of productivity loss or systematic reliability improvements. In this paper, we present the Effective Training Productivity Ratio (ETPR), a reliability-oriented decomposition of end-to-end training productivity to stabilize the large-scale machine learning (ML) systems. ETPR characterizes productivity loss by accounting for pre-execution loss, unproductive allocated compute time, and reduced execution quality. We conduct an empirical study of thousands of training jobs over three months on Kuaishou's production cluster. Our analysis shows that productivity is mainly degraded by diagnosis and recovery for fail-stop and fail-hang incidents, as well as subtle fail-slow anomalies that delay fault localization and worsen overall efficiency. Based on these findings, we build and deploy an automated stability governance framework that integrates: (i) a multi-stage log-based fail-stop diagnosis pipeline, (ii) temporal stack invariance analysis for fail-hang localization, (iii) an adaptive fail-slow detector with straggler detection, and (iv) hierarchical recovery strategies. Experiments show that this framework accelerates failure diagnosis, accurately localizes anomalous ranks, mitigates silent slowdowns, and improves cluster-wide ETPR in production. Article Search Article: ase26ind-p34-p doi:10.1145/3832783.3834462
	Chen, Yilin	ASE '26: "SafeDep: Detecting State Mutation ..." SafeDep: Detecting State Mutation Unsoundness in Rust via Dependency Slicing and LLM Reasoning Zihao Rao, Yilin Chen, Chengjun Chen, and Hui Xu (Fudan University, China; Ant Group, China) Rust's type system protects safe code, but many low-level abstractions depend on internal unsafe operations whose correctness rests on memory and logical invariants. In struct-based abstractions, a sibling method may legally modify internal fields while invalidating a precondition required by another method's unsafe operation. We call this defect an unsound state mutation. Traditional pattern-based static analyzers support inter-procedural tracking but may lack the capability to model cross-method state interference. Furthermore, they cannot interpret natural-language safety contracts, making these deep defects difficult to detect. LLMs can reason about these contracts, but whole-crate prompting is expensive and often prone to hallucinated paths. To bridge this gap, we present SafeDep, a vulnerability discovery framework that combines compiler-driven static analysis with LLM-based semantic reasoning. SafeDep analyzes Rust MIR to build a field-sensitive read/write dependency graph and slices the graph to retain methods that may affect safety-critical state. An LLM then reconstructs cross-method state transitions from this compact context and generates PoC candidates. A bounded compiler/Miri feedback loop refines the candidates and their exploitability judgments before manual audit. On our evaluation dataset, SafeDep outperforms static and LLM baselines while reducing prompt context. A scan of the top 4,000 crates.io projects found 24 previously unreported soundness vulnerabilities, 18 of which had been confirmed by maintainers or accepted as RustSec advisories at the time of writing. Article Search Artifacts Available Article: ase26main-p1035-p doi:10.1145/3832783.3837481
	Chen, Yiyang	ASE '26: "SmartPoC: Validating Smart ..." SmartPoC: Validating Smart Contract Vulnerability Findings through PoC Generation and Execution Longfei Chen, Ruibin Yan, Taiyu Wong, Yiyang Chen, Jialai Wang, and Chao Zhang (Tsinghua University, China; Peking University, China; National University of Singapore, Singapore) Smart contracts are commonly audited through static analysis to explore vulnerabilities. However, static approaches typically produce heterogeneous findings rather than reproducible, executable proof-of-concept (PoC) test cases, leading to costly and ad hoc manual validation. Large language models (LLMs) offer a promising way to translate audit reports into PoC test cases, but face three major challenges: noisy inputs, lack of execution grounding, and missing runtime oracles. We present SmartPoC, an end-to-end approach for validating reported vulnerabilities in audit reports by generating and executing PoC test cases with automated exploitability verification. SmartPoC first extracts a focused function-level slice from each report to reduce noise, centering on the key functions referenced in a finding and augmenting them with execution-relevant neighbors. To improve executability, we wrap LLM-based PoC synthesis in a generate–repair–execute loop, combining deterministic pre-execution sanitization with feedback-driven post-execution debugging. We further use differential verification as an oracle to confirm the exploitability of generated test cases. On the SmartBugs-Vul and FORGE-Vul benchmarks, SmartPoC achieves confirmation precision of 98.32% and 98.65%, with recall of 84.17% and 85.28%, respectively. On a recent Etherscan verified-source corpus, SmartPoC confirms 64 bugs from 545 audit findings at an average cost of $0.03. Article Search Article: ase26main-p1210-p doi:10.1145/3832783.3834380
	Chen, Youlong	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Chen, Yuanliang	ASE '26: "WiDepFuzz: Finding Wi-Fi Protocol ..." WiDepFuzz: Finding Wi-Fi Protocol Bugs in Mobile Hotspot via Field Dependency Model Yuanliang Chen, Fuchen Ma, Taotao Gu, and Yu Jiang (Tsinghua University, China) Wi-Fi is a widely used wireless protocol, and mobile hotspot functionality has become essential for on-the-go connectivity. Bugs in the hotspot protocol stack can cause crashes, performance degradation, and semantic inconsistencies. Fuzzing is a promising technique for detecting such vulnerabilities. However, existing fuzzers typically test by modeling protocol inputs but ignore some critical dependencies among Wi-Fi fields, leading to inefficient testing. In this work, we present WiDepFuzz, a fuzzing framework designed to detect bugs in Mobile Hotspot implementations by modeling field dependencies in the Wi-Fi protocol. First, WiDepFuzz automatically identifies the semantic dependencies among Wi-Fi fields based on the IEEE 802.11 standard and constructs a Field Dependency Model (FDModel) to characterize various direct and indirect dependencies. Second, leveraging the FDModel, WiDepFuzz utilizes dependency-combination guided fuzzing to constantly generate Wi-Fi test frames that efficiently explore deep paths and trigger hidden bugs. Finally, we propose liveness and dependency detectors that enable real-time monitoring to identify abnormal states and uncover potential bugs in mobile hotspots. We implemented WiDepFuzz and evaluated it in six widely used mobile hotspots, covering major smartphone manufacturers, including Samsung, Xiaomi, OPPO, Honor, Huawei, and Nokia. Compared to SOTA Wi-Fi fuzzers like Peach, OwFuzz, wpaspy, and Greyhound, WiDepFuzz detects 15 more bugs and improves bug detection speed by 37% on average. In total, it uncovered 20 new bugs. Article Search Article: ase26main-p1165-p doi:10.1145/3832783.3837483
	Chen, Yuchen	ASE '26: "Breaking Customized LLMs for ..." Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks Yuchen Chen, Wei Cheng, Yuan Xiao, Weisong Sun, Chunrong Fang, Yang Liu, Zhenyu Chen, and Baowen Xu (Nanjing University, China; Nanjing University of Aeronautics and Astronautics, China; Nanyang Technological University, Singapore) LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness. Article Search Article: ase26main-p2706-p doi:10.1145/3832783.3834424 ASE '26: "How Reasoning Shapes Social ..." How Reasoning Shapes Social Bias in LLM-Generated Code? Weifeng Sun, Jieke Shi, Zhou Yang, Yuchen Chen, Hongyan Li, Meng Yan, and David Lo (Singapore Management University, Singapore; University of Alberta, Canada; Alberta Machine Intelligence Institute, Canada; Nanjing University, China; Chongqing University, China) Large language models (LLMs) are increasingly used for code generation, but recent studies have shown that generated programs can exhibit code bias, i.e., unfair or differential treatment encoded in code logic with respect to sensitive demographic attributes. Although prior work has investigated this problem in a direct generation setting, it remains unclear how bias behaves in reasoning-based code generation, where models produce intermediate reasoning traces before generating the final code. To bridge this gap, we conduct the first systematic empirical study of social bias in reasoning-based code generation. We evaluate 9 models spanning both standard LLMs and large reasoning models (LRMs) on realistic bias-sensitive coding tasks covering three human-centered decision scenarios. Our results reveal four main findings. First, reasoning generally reduces code bias, lowering the average bias rate from 0.64 to 0.40, but the improvement is highly model-dependent. Second, reasoning-based generation does not consistently preserve code quality, with the average quality dropping from 0.72 to 0.59. We further find that biased reasoning strongly predicts biased code, and that simply adjusting generation configurations is insufficient for robust bias mitigation. Motivated by these findings, we propose ProbeDebias, a reasoning-aware debiasing framework that detects biased reasoning traces and rewrites them before final code generation. Extensive experiments demonstrate that ProbeDebias achieves 87.76 Article Search Article: ase26main-p1394-p doi:10.1145/3832783.3834387
	Chen, Yue	ASE '26: "PR2Trigger: From Concurrency-Fix ..." PR2Trigger: From Concurrency-Fix PR Diffs to Executable Triggering Tests for Go Risheng Wei, Yuheng Shen, Yiming Ye, Yuchen Yan, Yihao Peng, Hao Xi, Yue Chen, Hai Wan, and Xibin Zhao (Tsinghua University, China) Public PRs and CVE advisories are valuable sources for Go concurrency-bug research, but rarely provide executable benchmark samples because historical projects are difficult to rebuild and many fixes lack reusable triggering tests. We present PR2Trigger, a semi-automated pipeline that reconstructs PR-localized triggering tests from fix-PR diffs. To address historical build difficulty, PR2Trigger extracts a self-contained package of PR-modified symbols and their in-project dependencies, and executes it in a pinned Docker environment. To address missing triggering tests, PR2Trigger uses a large language model to synthesize support code and a concurrency-driving test entry, while deterministic scripts handle execution, failure detection, and localization matching. On 100 Go race-fix candidate PRs, PR2Trigger improves the gate-passing rate from 2% to 15%, a 7.5× improvement over developer-supplied tests. Article Search Article: ase26nier-p35-p doi:10.1145/3832783.3834543
	Chen, Yufei	ASE '26: "RealAIGC: Towards More Realistic ..." RealAIGC: Towards More Realistic Evaluation of AI-Generated Code Detection in Real-World Code Repository Wentao Chen, Yufei Chen, Huiqun Yu, Guisheng Fan, Kaiwen Zhi, Peite Guo, and Jianyuan Yu (East China University of Science and Technology, China; Shanghai Engineering Research Center of Smart Energy, China) AI-generated code (AIGC) from autonomous coding agents are widely adopted across the software development lifecycle. However, AIGC also introduces critical challenges to open-source community governance, making AIGC detection important. Existing AIGC detection benchmarks are fundamentally misaligned with real-world development processes. To address this gap, we construct RealAIGC, a benchmark for AIGC detection grounded in real-world code repositories. RealAIGC is built from the development histories of GitHub and includes pull request (PR) generated by five coding agents alongside human-written code, covering eight major programming languages. It supports multi-granularity detection at the repository, PR, commit, file, and function levels, with more than four million functions. Based on RealAIGC, we conduct a realistic empirical evaluation of 28 AIGC detection methods across three categories. The results show that supervised approaches perform well only in small, homogeneous, single-language repositories, but degrade significantly in mainstream dynamic languages and in large-scale, multi-developer environments. Perplexity based methods are nearly ineffective in realistic settings. No existing method demonstrates general applicability, and all approaches perform unsatisfactorily at the commit and PR levels. This work provides empirical guidance for advancing AIGC detection techniques. Article Search Article: ase26main-p2317-p doi:10.1145/3832783.3834411
	Chen, Yuhang	ASE '26: "FPSieve: LLM-Powered Cascade ..." FPSieve: LLM-Powered Cascade for Filtering False Positives in OS Migration Testing Jie Dong, Ying Fu, Chao Hu, Yuhang Chen, Qi Xiao, and Heyuan Shi (Central South University, China; Tsinghua University, China; Hunan Congmao Technology, China) Operating system migration requires validating thousands of software packages for behavioral compatibility on the target distribution. Differential testing is the dominant industrial approach. OS level outputs contain many benign differences that are unrelated to package compatibility. These differences produce many false positives. They also bury real compatibility issues under heavy triage load. To address this issue, we first conduct a study of false positive root causes on industrial enterprise Linux migration data. This study yields a five-category taxonomy and a share–cost decision matrix. These findings guide our design. We propose FPSieve, a cost routed filtering pipeline for OS migration validation. FPSieve integrates rule based filtering, semantic similarity filtering, case library retrieval, package level LLM reasoning with confidence based routing, and closed loop container based verification. We evaluate FPSieve on a large scale OS migration differential testing dataset collected from industrial practice. FPSieve reduces the overall manual review queue to 5.9% of its original size while preserving 86.7% recall. It also improves review queue precision from 3.16% to 46.0%. After deduplication, FPSieve surfaced 66 compatibility issues submitted upstream. Of these, 14 received maintainer feedback, and 6 have been fixed. These results show that FPSieve can reduce false positives, reduce manual effort, and improve OS migration validation throughput. Article Search Article: ase26ind-p24-p doi:10.1145/3832783.3834460
	Chen, Yujing	ASE '26: "Demystifying Solana Bots: ..." Demystifying Solana Bots: From GitHub Blueprints to On-Chain Fingerprints Xiaoye Zheng, Yujing Chen, Minghao Wu, David Lo, Difan Xie, Daoyuan Wu, Xiaohu Yang, and Zhiyuan Wan (Zhejiang University, China; Singapore Management University, Singapore; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China; Lingnan University, Hong Kong) Solana is an emerging blockchain platform designed for high throughput and low transaction fees, making it inexpensive to submit transactions at scale and, consequently, increasing exposure to bot spamming and related financial exploitation. Solana bots are typically off-chain software systems that operate in a competitive on-chain execution environment by constructing and submitting transactions, and the bot-related transactions on the decentralized exchanges exceed 250 million dollars in daily trading volume in January 2026. Prior studies on Solana have examined system performance, smart-contract security, and specific on-chain phenomena. However, we still lack a systematic understanding of what Solana bots implement in practice and how these implementations manifest as observable on-chain execution fingerprints. To address this gap, we performed a large-scale empirical study of Solana bots from two complementary views: (i) 586 bot repositories collected from GitHub, and (ii) 200 bot addresses on Solana, with over 44 million on-chain transactions. Our study derives an implementation-grounded taxonomy of Solana bots comprising 15 categories grouped into five domains (e.g., Trading Operations, MEV, and On-chain Analytics), identifies a largely shared five-stage operational pipeline manifested in bot implementations, and uncovers systematic variation in on-chain trading behaviors of Solana bots across diverse trading platforms and assets. Based on our findings, we highlight future research directions, and provide recommendations for building and operating bots on the Solana blockchain. Article Search Article: ase26main-p2100-p doi:10.1145/3832783.3837522
	Chen, Yuxing	ASE '26: "Fuzz4DB: A Practice of LLM-Agent-Guided ..." Fuzz4DB: A Practice of LLM-Agent-Guided Fuzzing for Database Feature-Level Delta Testing Chunling Qin, Yong Hu, Xiao Zhang, Jinchuan Chen, Fangtao Gu, Baoxun Wang, Yuxing Chen, Anqun Pan, and Lixiong Zheng (Renmin University of China, China; Tencent, China) Modern database management systems (DBMSs) evolve rapidly via frequent feature commits, yet validating each code delta within a 24-hour Continuous Integration (CI) budget remains an industrial challenge. Traditional manual regression testing is labor-intensive, while existing automated tools fall short: generation-based fuzzers achieve high throughput but are change-unaware, whereas LLM-based agents understand feature deltas but are orders of magnitude too slow for systematic testing. This paper presents Fuzz4DB, an LLM-agent-guided fuzzer designed for targeted DBMS feature testing. Fuzz4DB decouples LLM-based semantic planning from grammar-based test instantiation, bridging the gap between semantic awareness and generation efficiency. The LLM-powered agent of Fuzz4DB analyzes code deltas and coverage feedback to synthesize test directives—structured specifications at three precision levels, namely grammar scopes, derivation paths, and context–query template pairs. A grammar-based fuzzer then expands each directive into batches of valid SQL test cases. A coverage feedback loop escalates directive precision as coverage growth stalls. Running in the TDSQL production environment for over six months, Fuzz4DB has intercepted 74 zero-day bugs, accounting for ∼40% of all SQL-subsystem bugs. In evaluations across 12 feature commits from 5 mainstream DBMSs, Fuzz4DB achieved 86.9% delta code coverage, outperforming the best automated baseline by 36.9%. Over its full lifecycle on four open-source DBMSs, Fuzz4DB discovered a total of 62 unique bugs (45 newly confirmed by upstream communities), 59 of which were undetectable by state-of-the-art tools within the 24-hour CI window. Furthermore, Fuzz4DB reduces per-commit validation effort from ∼5 person-days to ∼1 person-day, an ∼80% reduction. Article Search Article: ase26ind-p161-p doi:10.1145/3832783.3834498
	Chen, Zhaoxing	ASE '26: "AlarmClaw: Context-Enriched ..." AlarmClaw: Context-Enriched Alarm Management with Category-/Severity-Aware Incident Graphs Siyu Yu, Meizhen Li, Jiacheng Yang, Yifan Wu, Ning Wang, Zhaoxing Chen, Ming Liu, Xinchi Ren, Xincheng Ren, Chan Li, Tong Jia, Xiang Zhang, and Ying Li (Peking University, China; ByteDance, China) Large-scale production systems rely on monitoring rules and anomaly detectors to trigger alarms that notify site reliability engineers (SREs) of potential failures. Before diagnosis and mitigation can begin, alarm management must construct incident state online by deciding whether each arriving alarm is noise, indicates a potential new incident, or should be associated with an existing incident to enrich its evolving state. Existing alarm-management methods remain difficult to deploy because some rely on reusable operational artifacts such as SOPs or historical prototypes to judge alarm relationships, while graph-based methods often apply the same topology-derived propagation patterns across incidents. In production, such artifacts are often missing or service-specific, and valid propagation paths vary with incident type and severity. We present AlarmClaw, a context-enriched alarm-management system built around these two constraints. AlarmClaw uses bounded context clawing to retrieve compact evidence from auditable operational sources and a category- and severity-aware incident graph to constrain a large language model (LLM) decision agent. An evolution mechanism refreshes reusable context and graph evidence from validated outcomes. On a temporally held-out replay from a production corpus of 51,000 alarms and 9,661 incidents, AlarmClaw achieves 86.0% association Precision and 78.5% Recall, improving F1 by 7.4 points over the strongest adapted baseline. During six months of online operation, evolution updates improve F1 by 2.3 points over a matched fixed-knowledge counterfactual. From January to June 2026, AlarmClaw automatically associated more than 4,800 alarms, conservatively saving at least 4,800 engineer-minutes and reducing the per-alarm association operation from approximately 90 s manually to under 10 s. Article Search Article: ase26ind-p313-p doi:10.1145/3832783.3834524
	Chen, Zhenbang	ASE '26: "CTForge: Automatically Generating ..." CTForge: Automatically Generating Test Suites for Software Configuration Yuanliang Zhang, Zhizheng Zheng, Shanshan Li, Zhouyang Jia, Chaopeng Luo, Liqian Chen, Zhenbang Chen, Ji Wang, and Xiangke Liao (National University of Defense Technology, China) Software configuration plays a critical role in modern software systems, yet it also frequently leads to severe failures. Existing approaches, whether static analysis or LLM-based validation, struggle to capture implicit semantic constraints and validate configuration-code interactions. Leveraging existing unit tests is also insufficient due to their lack of configuration-specific focus. Thus, we present CTForge, an LLM-powered framework that automatically generates configuration-specific test suites. Its core innovation is a three-stage configuration-aware optimization pipeline that moves beyond vanilla test generation, specifically using parameter semantics to improve LLM outputs. This optimization pipeline iteratively aligns tests through: (1)enhance configuration-related code coverage to ensure relevance, (2) assertion validation across valid parameter values to eliminate false assertions, and (3) configuration-sensitivity verification to select tests that semantically exercise the intended configuration behavior. Evaluated on five large-scale systems, CTForge detects 63 out of 79 real-world configuration issues and achieves an F1-score of 0.88 in misconfiguration detection. CTForge also uncovers six previously unknown defects. Our work demonstrates that structured configuration-aware refinement is essential for LLM to produce effective test suites. Article Search Article: ase26main-p1197-p doi:10.1145/3832783.3837484 ASE '26: "IncSFS: Incremental Full-Sparse ..." IncSFS: Incremental Full-Sparse Flow-Sensitive Pointer Analysis for C/C++ Kunlin Liu, Zhenbang Chen, Piyi Zu, Yide Du, and Ji Wang (National University of Defense Technology, China) Pointer analysis is the fundamental technique for compiler optimization and program analysis. Flow sensitive pointer analysis provides high precision but hard to scale to large-size projects. Tailored for rapid iteration scenarios where software evolves continuously, we introduce IncSFS, the first incremental full-sparse flow-sensitive pointer analysis algorithm for C/C++ programs. The algorithm contains two main steps. It first transforms the value-flow graph of a program into a constraint graph, on which a strongly-connected component detection is performed to ensure precision. It then propagates increases and decreases in points-to set in an interleaving manner to support both code deletion and insertion within a single analysis pass. IncSFS is guaranteed to terminate and compute the least fixed point when point-to relation during the analysis is object-acyclic. Experimental results on six large-scale real-world projects show that IncSFS is both precise and efficient, achieving average speedups of 9.60 x over full flow-sensitive pointer analysis and of 5.84 x over the traditional reset-recompute incremental approach. Furthermore, IncSFS improves efficiency by 15.8% compared with state-of-the-art incremental pointer analysis algorithms that also propagate changes in points-to sets. Article Search Artifacts Available Article: ase26main-p1456-p doi:10.1145/3832783.3837496 ASE '26: "Large Language Model Enabled ..." Large Language Model Enabled Symbolic Execution for Automated Functional Analysis Meixi Liu, Zhenbang Chen, Xudong Wang, Ziran He, Jiachen Gu, Minghui Chen, Lei Wang, and Wei Dong (National University of Defense Technology, China) Symbolic execution shows promise in automated program analysis by systematically exploring the path space of the program. However, due to the inherent limitations of program analysis techniques, symbolic execution cannot understand the program’s functionality, which hinders its application in functional analysis and defect detection. This paper introduces FuSE, a method that enhances symbolic execution with Large Language Models (LLMs) to automatically annotate program paths with functional specifications. A program path is annotated with a natural language description of its functionality, a precondition, and a postcondition. Our method significantly reduces the effort required for functional testing and defect detection. Based on UnitTestBot, FuSE can successfully annotate functional specifications for C, C++, Java, and Python programs, with success rates of 98.2%, 95.52%, 87%, and 95.37%, respectively. In our user study with professional developers and testers, FuSE helps users identify 21.67% more functional defects and improves functional coverage by 15.83%, demonstrating its practical utility. Article Search Artifacts Available Article: ase26main-p2155-p doi:10.1145/3832783.3837524
	Chen, Zhenyu	ASE '26: "Breaking Customized LLMs for ..." Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks Yuchen Chen, Wei Cheng, Yuan Xiao, Weisong Sun, Chunrong Fang, Yang Liu, Zhenyu Chen, and Baowen Xu (Nanjing University, China; Nanjing University of Aeronautics and Astronautics, China; Nanyang Technological University, Singapore) LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness. Article Search Article: ase26main-p2706-p doi:10.1145/3832783.3834424 ASE '26: "CIPIHunter: Detecting Configuration-Induced ..." CIPIHunter: Detecting Configuration-Induced Prediction Instability in Deep Learning Frameworks Yanzhou Mu, Shuo Meng, Mijung Kim, Xiang Chen, Chunrong Fang, Zhenyu Chen, and Juan Zhai (UNIST, Republic of Korea; Nanjing University, China; Nantong University, China; University of Massachusetts at Amherst, USA) Deep learning (DL) frameworks support diverse execution configurations, including precision modes and model optimizations. Even with a fixed model, input, and framework version, changing these configurations can change model predictions, causing Configuration-Induced Prediction Instability (CIPI). CIPI arises when configuration-dependent numerical perturbations propagate and cause potentially harmful model-level behavior. Existing API-level and model-level testing approaches are not well suited to detecting CIPI, as these approaches lack configuration-conditioned exploration and propagation-aware diagnosis. Therefore, we present CIPIHunter, which combines controlled configuration-pair testing, sensitivity-oriented mutation, feedback-guided search, and intermediate tracing to localize suspicious operators or operator groups. On 13 PyTorch models under a 100-round budget, CIPIHunter reports the highest raw CIPI count and 22 deduplicated Type I manifestations, 83.3% more than the strongest baseline, while remaining competitive in overall deduplicated manifestation coverage. In total, we submit 29 PyTorch issue reports. Developers have acknowledged eight, rejected five, and marked four as duplicates; nine remain pending, and three have been closed without an explicit determination. Separately, three reports are labeled “high-priority”. These results demonstrate the practical utility of CIPI testing for framework quality assurance. Article Search Article: ase26main-p163-p doi:10.1145/3832783.3834345
	Chen, Zhihao	ASE '26: "How Your Credentials Are Leaked ..." How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, and Zhiqiang Li (Griffith University, Australia; Wake Forest University, USA; Nanyang Technological University, Singapore; University of New South Wales, Australia; Zhejiang Sci-Tech University, China; University of Tokyo, Japan; University of Alberta, Canada; Independent Researcher, China) Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research. Article Search Article: ase26main-p928-p doi:10.1145/3832783.3834373
	Chen, Zhimin	ASE '26: "Debugging the Debuggers: Failure-Anchored ..." Debugging the Debuggers: Failure-Anchored Structured Recovery for Software Engineering Agents Chenyu Zhao, Shenglin Zhang, Yihang Lin, Wenwei Gu, Zhimin Chen, Yongqian Sun, Dan Pei, Chetan Bansal, Saravan Rajmohan, and Minghua Ma (Nankai University, China; Tsinghua University, China; Microsoft, USA; Microsoft 365, USA) Software engineering agents are increasingly deployed in evaluable engineering environments, yet post-failure recovery remains costly, manual, and largely ad hoc. Existing systems expose traces for inspection or generate follow-up feedback, but they do not turn heterogeneous runtime evidence into grounded, bounded recovery guidance for a subsequent attempt. We present PROBE, a failure-anchored framework for structured recovery in software engineering agents. PROBE organizes failed-run telemetry into structured evidence, structured diagnosis, and bounded recovery guidance, realized by a Telemetry Layer, a Diagnosis Layer, and a Guidance Gate. The Telemetry Layer preserves fine-grained runtime signals, the Diagnosis Layer fuses cross-signal evidence into a grounded diagnosis, and the Guidance Gate constructs diagnosis-derived recovery guidance only when it is evidence-grounded, actionable, and within the scope of agent-side behavior. We evaluate PROBE across three software engineering settings spanning repository-level software repair, enterprise workflow recovery, and AIOps service mitigation. On 257 initially unresolved cases, PROBE achieves 65.37% Top-1 diagnosis accuracy and a 21.79% recovery rate, outperforming the strongest non-PROBE baseline by 43.58 and 12.45 percentage points, respectively. The results reveal a substantial diagnosis-recovery gap: accurate diagnosis is necessary but not sufficient unless it can be translated into bounded guidance that the subsequent attempt can execute and verify. Beyond controlled evaluation, a Microsoft IcM prototype shows that PROBE can attach as a non-intrusive side channel to existing service-diagnosis agent workflows without changing the agent policy, toolset, or execution budget. These results suggest that telemetry-grounded, failure-anchored recovery is a practical path to improving post-failure recoverability of software engineering agents under realistic engineering constraints. Article Search Article: ase26ind-p114-p doi:10.1145/3832783.3834492
	Chen, Zhixiang	ASE '26: "IcFuzz: Fuzzing Isaac Sim ..." IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation Zhixiang Chen, Zhuangbin Chen, Ruoxi Jia, Zeqin Liao, Wei Li, Jinyang Liu, and Zibin Zheng (Sun Yat-sen University, China; Nanyang Technological University, Singapore; Chinese University of Hong Kong, Hong Kong) Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190%–205% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers. Article Search Article: ase26main-p3261-p doi:10.1145/3832783.3837550
	Chen, Zhongwen	ASE '26: "How Effective Are NPM Malicious ..." How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study Wenbo Guo, Zhongwen Chen, Zhengzi Xu, Chengwei Liu, Ming Kang, Shiwen Song, Chengyue Liu, Yijia Xu, Weisong Sun, and Yang Liu (Nanyang Technological University, Singapore; Sichuan University, China; Imperial Global Singapore, Singapore; Nankai University, China; Singapore Management University, Singapore) The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on disparate datasets with inconsistent settings, making cross-tool comparison unreliable and leaving practitioners without clear guidance. We present the first large-scale empirical study of NPM malicious package detection, evaluating 11 tools with 16 variants on a unified benchmark of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques. Unlike prior work, we inspect each tool’s source code to explain why tools succeed or fail, not merely how often. Our key findings: (1) the precision and recall a tool achieves are structurally determined by how it resolves the ambiguity between code capability and malicious intent, with IntelGuard reaching the best F1 at 95.98% by grounding its judgment in retrieved evidence and GuardDog the best among conventional tools at 93.32%; (2) behavioral coupling amplifies detection signals when behaviors co-occur, raising SAP_DT from 3.2% to 79.3% for the collect-and-exfiltrate chain; (3) 80.3% of malware uses no evasion because the ecosystem lacks mandatory pre-publication scanning; (4) ML degradation is driven by concept convergence rather than concept drift, since malware became simpler and every decision boundary fitted to a corpus ages with it; (5) combination effectiveness equals complementarity minus false-positive introduction, not paradigm diversity. Strategic combinations reach up to 97.21% accuracy and 97.02% F1. We release our benchmark and evaluation framework. Article Search Article: ase26main-p218-p doi:10.1145/3832783.3837427
	Chen, Zhuangbin	ASE '26: "AutoSQL: Extracting SQL Templates ..." AutoSQL: Extracting SQL Templates from Imperative ORM Code in Large-Scale Repositories Junsong Pu, Yichen Li, Zhuangbin Chen, Zhihan Jiang, and Zibin Zheng (Sun Yat-sen University, Zhuhai, China; Chinese University of Hong Kong, Hong Kong) Suboptimal SQL queries can significantly degrade the performance of cloud systems, motivating the extraction and auditing of SQL statements before deployment. However, Go ORM frameworks construct SQL imperatively through scattered method-call sequences, making it difficult to statically recover the resulting SQL templates. We present AutoSQL, a system that reconstructs SQL templates from Go ORM code. AutoSQL constructs a Code Index, a directed graph that captures structural dependencies between functions, types, and global variables as navigable edges. It then traces upstream call chains from ORM invocation sites to identify database-interacting functions as entry points. For each entry point, an LLM agent traverses the Code Index to collect code slices that influence SQL generation, switching to pattern-based search when the graph cannot resolve a retrieval goal. We call this strategy Hybrid Context Retrieval. Once sufficient context is collected, the agent synthesizes SQL templates. Evaluation on a benchmark of 579 test-covered entry points and 1,186 runtime-traced SQL statements from five large-scale Go repositories shows that AutoSQL achieves 68.04% to 72.18% recall, exceeding the static reachability baseline by 11.80% to 15.94% and outperforming existing methods by 8.52% to 48.57%. Article Search Article: ase26main-p169-p doi:10.1145/3832783.3837420 ASE '26: "Panorama: Unveiling Latent ..." Panorama: Unveiling Latent Dependencies for Microservice Autoscaling via Meta-learning Zhuangbin Chen, Hongjiang Feng, Yang Liu, Juzheng Zheng, Xiaoyu He, and Zibin Zheng (Sun Yat-sen University, China) Existing autoscaling approaches primarily leverage direct service calls to model the propagation effects of scaling decisions across inter-service dependencies. However, the intricate and implicit service interactions (i.e., latent dependencies) often go beyond such direct invocations, rendering suboptimal scaling actions and poor adaptability. To address these limitations, we propose Panorama, a novel autoscaling framework that explicitly unveils and exploits indirect service interactions. In particular, we formalize two fundamental categories of latent dependencies, i.e., resource interference dependencies (RIDs), which emerge from shared infrastructure resources, and execution blocking dependencies (EBDs), which stem from temporal constraints in the execution logic of business workflows. Panorama employs a hybrid attention mechanism to model these multifaceted service dependencies alongside temporal dynamics. We also design a meta-learning paradigm to enable rapid adaptation to evolving workload patterns and dependency structures without extensive retraining. Evaluation across four representative microservice benchmarks shows that Panorama consistently outperforms state-of-the-art baselines, achieving up to 68% reduction in resource consumption while improving response time by 42%. This highlights the critical importance of explicitly modeling latent dependencies for effective microservice resource management. Article Search Article: ase26main-p1217-p doi:10.1145/3832783.3837485 ASE '26: "IcFuzz: Fuzzing Isaac Sim ..." IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation Zhixiang Chen, Zhuangbin Chen, Ruoxi Jia, Zeqin Liao, Wei Li, Jinyang Liu, and Zibin Zheng (Sun Yat-sen University, China; Nanyang Technological University, Singapore; Chinese University of Hong Kong, Hong Kong) Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190%–205% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers. Article Search Article: ase26main-p3261-p doi:10.1145/3832783.3837550 ASE '26: "TypeScript Repository Indexing ..." TypeScript Repository Indexing for Code Agent Retrieval Junsong Pu, Yichen Li, and Zhuangbin Chen (Sun Yat-sen University, Zhuhai, China; Chinese University of Hong Kong, Hong Kong; Sun Yat-sen University, China) Graph-based code indexing can improve context retrieval for LLM-based code agents by preserving call chains and dependency relationships that keyword search and similarity retrieval often miss. ABCoder is an open-source framework that parses codebases into a function-level code index called UniAST. Its existing parsers combine lightweight AST parsers for syntactic analysis with language servers for semantic resolution, but because such resolution requires a JSON-RPC call for each symbol lookup, these per-symbol calls become a bottleneck on large TypeScript repositories. We present abcoder-ts-parser, a TypeScript parser built on the TypeScript Compiler API that works directly with the compiler's AST, semantic information, and module resolution logic. We evaluate the parser on three open-source TypeScript projects with up to 1.2 million lines of code and find that it produces reliable indexes significantly more efficiently than the existing architecture. For a live demonstration, watch: https://youtu.be/ryssr7ouvdE Article Search Article: ase26tool-p59-p doi:10.1145/3832783.3834616
	Chen, Zirui	ASE '26: "Assessing the Cross-Version ..." Assessing the Cross-Version Applicability of Java Library Vulnerability Exploits Zirui Chen, Qi Zhan, Jiayuan Zhou, Xing Hu, Xin Xia, and Xiaohu Yang (Zhejiang University, China; Queen's University, Canada; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China) Open-source software supply chain security relies heavily on assessing affected versions of library vulnerabilities. While prior studies have leveraged exploits for verifying vulnerability-affected versions, they point out a key limitation that exploits are version-specific and cannot be directly applied across library versions. Despite being widely acknowledged, this limitation has not been systematically validated at scale, leaving the actual applicability of exploits across versions unexplored. To fill this gap, we conduct the first large-scale empirical study on exploit applicability across library versions. We construct a comprehensive dataset consisting of 259 exploits spanning 128 Java libraries and 28,150 historical versions, covering 61 CWEs that account for 76.3% of vulnerabilities in Maven. Leveraging this dataset, we investigate the root causes of inconsistencies between exploit cross-version execution behaviors and ground truth, while also exploring strategies for exploit migration. Our results (RQ1) show that, even without migration, exploits achieve 83.0% recall and 99.3% precision in identifying affected versions in Java, outperforming most widely used vulnerability databases and assessment tools. Notably, this capability enables us to contribute more than 1,400 confirmed missing affected versions to the CPE dictionary. We investigate the remaining exploit failures (RQ2) and find that they mainly stem from compatibility issues introduced by library evolution and changing environmental constraints. Based on these observations, we manually migrate exploits for 1,885 versions and distill a taxonomy of 10 strategies from these successful adaptation cases (RQ3), thereby increasing the overall recall to 96.1%. Our findings underscore the cross-version potential of exploits and lay a foundation for future research. Article Search Article: ase26main-p1292-p doi:10.1145/3832783.3834383
	Chen, Zongxiong	ASE '26: "Stop When It Matters: Detectability-Guided ..." Stop When It Matters: Detectability-Guided Microbenchmarking for Performance Regression Testing Zongxiong Chen, Derui Zhu, Jinfu Chen, Kundi Yao, Alexander Pretschner, Weiyi Shang, Manfred Hauswirth, and Sonja Schimmler (Fraunhofer FOKUS, Germany; TU Munich, Germany; Wuhan University, China; Ontario Tech University, Canada; fortiss, Germany; University of Waterloo, Canada) Performance microbenchmarks are widely used for detecting performance regressions in continuous integration, yet existing execution policies remain computationally expensive. We present detectability-guided microbenchmarking, a principled framework that reformulates benchmark execution as a Minimum-Detectable-Effect (MDE) problem, achieving substantial speedups with formal statistical guarantees. Our approach introduces a two-threshold specification: a lower threshold, δ0, for negligible slowdowns, and an upper threshold, δ1, for meaningful regressions. We theoretically and empirically show that this specification enables bounded false-positive rates below δ0 and guaranteed statistical power around δ1, while dramatically reducing execution time. To realize this framework, we propose a two-phase procedure: Phase 1 adaptively controls execution via online sample-size re-estimation guided by minimum detectable effect, enabling early stop when sufficient statistical resolution is reached and futile abort when target detectability is unattainable within the execution budget; Phase 2 performs regression analysis under the same specification, yielding decisions with provable error bounds. Experiments on 1702 microbenchmarks from three large-scale open-source projects demonstrate up to 93% reduction in execution time while empirical false-positive rates and power closely match their theoretical targets. Our findings reveal that detectability-guided execution offers a theoretically grounded yet practical path toward efficient microbenchmark-based regression detection. Article Search Artifacts Available Article: ase26main-p833-p doi:10.1145/3832783.3834367
	Cheng, Kai	ASE '26: "ExcavatorFuzz: LLM-Guided ..." ExcavatorFuzz: LLM-Guided Path-Difficulty-Driven Directed Greybox Fuzzing Kaiyu Xie, Siyuan Li, Jiaqian Peng, Yun Yang, Yaowen Zheng, Kai Cheng, Jiayu Zhang, Shizhao Tian, Yubo Li, and Hongsong Zhu (Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China; Shandong University, China) Directed greybox fuzzing (DGF) is effective at steering mutations toward vulnerable code regions, but its efficiency is often limited by two bottlenecks: misprioritized target-reaching paths and hard-to-satisfy blocking predicates. We present ExcavatorFuzz, an LLM-assisted DGF framework that addresses both challenges in a unified workflow. ExcavatorFuzz first performs CLI-aware feasibility filtering to prune configuration-infeasible paths, and then ranks the remaining candidate paths using a lightweight difficulty metric that approximates their relative tractability based on explicit predicate complexity and implicit data-dependency complexity. During fuzzing, ExcavatorFuzz monitors line-level progress to detect blocked paths and invokes the LLM to synthesize or refine seeds for unsatisfied predicates using structured feedback. We evaluate ExcavatorFuzz on 30 real-world C/C++ benchmarks. ExcavatorFuzz triggers 29 out of 30 known vulnerabilities within 24 hours and achieves an average 4.34x speedup in time-to-exposure over seven state-of-the-art fuzzers. It also discovered three previously unknown vulnerabilities in open-source projects, two of which have been assigned CVE IDs. Article Search Article: ase26main-p1484-p doi:10.1145/3832783.3837497
	Cheng, Ke	ASE '26: "WiseSword: An Automated Computation ..." WiseSword: An Automated Computation Graph Partitioning Tool for Industrial DLRM Deployment on Ascend NPUs Ke Cheng, Yuhan Zhang, Bo Pan, Jiawei Zhu, Qidong Zhang, Yuting Yan, Sheng Zhang, Yibo Jin, and Zhengyong Zhang (Nanjing University, China; Huawei Technologies, China) Ascend neural processing units (NPUs) integrate vector cores (VCs) for compute-light operations and cube cores (CCs) for matrix multiplications. In deep learning recommendation models (DLRMs), lightweight operators overload VCs, while leaving CCs underutilized, resulting in severe execution imbalance and degraded inference throughput. We observe that many VC-intensive operators reside in independent feature-processing branches, which can be offloaded to CPUs to enable CPU-NPU pipelined inference. However, adaptively optimizing partition schemes for diverse model architectures and resource specifications remains a significant challenge, especially under request tail latency and CPU utilization constraints in industrial production. To address this challenge, we propose WiseSword, an automated computation graph partitioning tool for high-throughput DLRM deployment. WiseSword employs a progressive subgraph search guided by the light-first principle, which incrementally offloads feature-processing branches based on their batch-size compressibility and computation overhead until the CPU utilization constraint is violated or throughput degrades, thus fully exploiting available CPU resources. Furthermore, it leverages concurrency tuning to satisfy the tail-latency constraint. Experiments on production hardware confirm that WiseSword greatly improves throughput while strictly adhering to both CPU utilization and tail latency constraints. Currently, WiseSword has been deployed in Huawei’s production environment. Article Search Article: ase26ind-p52-p doi:10.1145/3832783.3834464
	Cheng, Leyi	ASE '26: "Verifier-in-the-Loop LLM Solving ..." Verifier-in-the-Loop LLM Solving of Heap Constraints for Concolic Execution Shaoran Xia, Leyi Cheng, Caihua Dong, Dongdong She, Bo Wang, Xin Peng, and Zhen Dong (Fudan University, China; Soochow University, China; Hong Kong University of Science and Technology, China; Beijing Jiaotong University, China) Concolic execution systematically explores program paths by solving symbolic constraints, but in object-oriented software its practical effectiveness is often limited by heap constraints over objects and heap structure, such as nullness, aliasing, runtime types, and field reachability. These constraints form a systematic bottleneck in real-world software because satisfying them requires constructing a concrete heap model rather than merely computing primitive valuations, which existing SMT-based concolic engines and symbolic heap techniques do not handle effectively. We present COHEC, a hybrid concolic architecture that decomposes each target path condition into a primitive component solved by an SMT solver and a heap component handled by a Heap Constraint Solver (HCS). Given extracted heap constraints, HCS uses an LLM to propose candidate heap models and initialization code, while a trusted verifier executes and verifies the generated code, admitting only models whose initialization code constructs states that satisfy all constraints and keeping the LLM outside the trusted computing base. We implement COHEC on top of JDart/JPF and evaluate it on 6,750 APIs from ten Java libraries, together with a stratified sample from commons-lang3 against the LLM-assisted baseline CONCOLLMIC. The results show that COHEC substantially improves path exploration and concrete valuation generation over native JDart, while achieving higher coverage than CONCOLLMIC at lower time and token cost. Overall, the findings indicate that treating heap constraint solving as verified heap model construction is a practical and effective way to extend concolic execution to the object-sensitive behaviors pervasive in modern software. Article Search Artifacts Available Article: ase26main-p2302-p doi:10.1145/3832783.3834410
	Cheng, Peng	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477 ASE '26: "Planner-Fuzz: Overcoming Diagnostic ..." Planner-Fuzz: Overcoming Diagnostic Saturation in UAV Planners via Boundary-Oriented Fuzzing Rongbo Chen, Chengcheng Zhao, Peng Cheng, Jiming Chen, and Taegyu Kim (Zhejiang University, China; Pennsylvania State University, USA) UAV planners are safety-critical software components whose behavior depends on high-dimensional, continuously tunable parameters. While existing fuzzing approaches focus on discovering failures, configurations deep inside failure regions are often diagnostically uninformative.Once the planner moves far beyond the safety boundary, parameter sensitivity diminishes, and inter-parameter dependencies become obscured.We refer to this phenomenon as diagnostic saturation and observe that configurations near the safe-unsafe transition preserve informative parameter sensitivity and interaction structure, making them more suitable for root-cause analysis. To this end, we propose Planner-Fuzz, a boundary-oriented fuzzing framework. It steers search toward a narrow band around the safety boundary while preventing convergence to a single configuration to enable the exploration of diverse boundary behaviors. Using the collected boundary configuration, Planner-Fuzz performs three-level diagnosis through sensitivity analysis, interaction mining, and counterfactual validation to identify and validate the parameters responsible for failure behavior. We evaluate the approach on three open-source UAV planners under four anomaly types. The results show that Planner-Fuzz discovers more diverse and diagnostically useful boundary configurations than failure-driven baselines, provides stronger signals for identifying influential parameters and interactions, and yields stronger intervention-based recovery evidence. These findings suggest that fuzzing for safety-critical planners should go beyond failure discovery and explicitly support diagnosis. Article Search Article: ase26main-p1399-p doi:10.1145/3832783.3834389
	Cheng, Shaoyin	ASE '26: "Beyond Text Matching: Towards ..." Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering Xiuwei Shang, Li Hu, Xiao Jiang, Jieke Shi, Junda He, Zhou Yang, Shaoyin Cheng, Guoqiang Chen, Weiming Zhang, and David Lo (University of Science and Technology of China, China; Singapore Management University, Singapore; University of Alberta, Canada) Human-Oriented Binary Reverse Engineering (HOBRE) aims to transform decompiled pseudocode into a more human-friendly representation, thereby reducing the cognitive burden of reverse analysis and improving efficiency. However, reliably evaluating HOBRE outputs remains a fundamental challenge. On one hand, human evaluation is costly, time-consuming, as well as difficult to scale. On the other hand, existing automated metrics either rely on executable test cases and runtime environments, which are often unavailable for real-world binaries, or depend on high-quality source code references that are typically inaccessible and fail to capture semantically equivalent but lexically diverse outputs. Although the emerging LLM-as-a-Judge paradigm is naturally well-suited to HOBRE evaluation, its effectiveness has not yet been fully studied. This paper presents the first systematic investigation of the LLM-as-a-Judge paradigm for HOBRE, covering three representative tasks: function name recovery, binary code summarization, and decompilation optimization. We introduce BinJudgeBench, the first expert-annotated, reference-free evaluation benchmark based on multi-dimensional human judgment. Our empirical study reveals that LLM-as-a-Judge achieves an average correlation of 63.20% with human judgment, significantly outperforming traditional automated metrics at 35.04%. By analyzing the impact of various judge configurations, including backbone LLMs, prompting strategies, and decoding temperatures, on both correlation and cost, we find that no “one-size-fits-all” configuration exists, as the optimal setup varies across tasks and individual samples. To address this, we propose BinJudge, which employs a lightweight routing mechanism to adaptively select the optimal judge configuration for each specific task and sample. BinJudge improves correlation with human experts by 4.5%–24.7% and reduces API cost to 0.06×–0.84× of that of static best configurations, providing a scalable, cost-effective, and high-fidelity automated evaluation scheme for HOBRE. Article Search Article: ase26main-p130-p doi:10.1145/3832783.3834339 ASE '26: "RegoMender: A Multi-agent ..." RegoMender: A Multi-agent Framework for Automated Rego Policy Repair Ruijie Zhang, Huaxiao Yin, Li Hu, Fanqi Kong, Haozhe Liang, Shaoyin Cheng, Kun Zhang, and Bibo Tu (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Science and Technology of China, China; Peking University, China; University of Chinese Academy of Sciences, China) Policy-as-Code (PaC) has emerged as a foundational paradigm in cloud-native systems. However, repairing Rego policies remains challenging due to their strict syntax, declarative semantics, and specific verification requirements. Existing automated program repair (APR) methods are mainly designed for mainstream languages and struggle to accommodate the unique policy logic and repair workflows of Rego. Thus, Rego policy repair remains a manual process driven by trial and error. To address this, we introduce RegoBench, the first automated Rego policy benchmark comprising 1,159 real-world defects, and propose RegoMender, a feedback-guided multi-agent framework. Collaborating via a shared blackboard and an atomic toolkit, RegoMender dynamically executes patching, rewriting, or rolling back, to resolve complex repair scenarios. Evaluated on RegoBench, RegoMender achieves syntactic and test-based semantic success rates of 82.9% and 77.9%, respectively, outperforming the strongest baseline by 13.4%. Unlike other approaches whose performance drops in complex scenarios, RegoMender maintains effectiveness across single-step and chained repair tasks. Furthermore, it generalizes strongly across HCL and SQL and achieves an 86.4% repair rate on 132 real-world CVE vulnerabilities, proving its robustness and practical utility for security. Article Search Article: ase26main-p1325-p doi:10.1145/3832783.3837490
	Cheng, Shengyu	ASE '26: "Beyond Single-Level PGO: Understanding ..." Beyond Single-Level PGO: Understanding and Harnessing Cross-Level Optimization Effects in Industrial Systems Dong Liu, Yifan Cheng, Yunfeng Cui, Ting Chen, Jiachi Chen, Zhihong Xue, Chong Hu, and Shengyu Cheng (ZTE Corporation, China; University of Electronic Science and Technology of China, China; Zhejiang University, China) Profile-guided optimization (PGO) is used to improve software performance in applications and operating system kernels. However, prior work applies PGO to a single layer in isolation, overlooking cross-layer interactions in systems, where kernel and application are optimized independently using different workloads. This practice is common in production environments and makes its impact on end-to-end performance important to understand. It introduces a mismatch between training and deployment, where profiling workloads may not reflect the final co-executed system. Despite its prevalence, the implications of such cross-layer mismatch remain poorly understood. In this paper, we present a large-scale industrial study of multi-level PGO across three representative products. We evaluate the combined effects of independently optimized kernel and application under realistic deployment conditions. Our results show that multi-level PGO can yield performance gains of up to 17.04%, but may lead to severe regressions of up to 81.90%. Through performance counter analysis, we attribute these effects to microarchitectural factors such as cache contention and branch misprediction arising from mismatched profiling assumptions. These findings show that PGO benefits are not necessarily compositional across software layers. Based on these insights, we propose Multi-Level PGO (ML-PGO), a practical guideline for applying PGO safely across system layers. Our work highlights the importance of workload representativeness and cross-layer awareness for achieving reliable performance improvements. Article Search Article: ase26ind-p100-p doi:10.1145/3832783.3834484
	Cheng, Wei	ASE '26: "Breaking Customized LLMs for ..." Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks Yuchen Chen, Wei Cheng, Yuan Xiao, Weisong Sun, Chunrong Fang, Yang Liu, Zhenyu Chen, and Baowen Xu (Nanjing University, China; Nanjing University of Aeronautics and Astronautics, China; Nanyang Technological University, Singapore) LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness. Article Search Article: ase26main-p2706-p doi:10.1145/3832783.3834424
	Cheng, Xianyun	ASE '26: "Not as Sweet by Another Name: ..." Not as Sweet by Another Name: An Empirical Study of Format Robustness in LLM Document Workflows Xiaoyu Zhang, Xianyun Cheng, Tianlin Li, Yuwei Zheng, Yue Yang, and Yang Liu (Nanyang Technological University, Singapore; National University of Singapore, Singapore; Beihang University, China; Xi'an University of Architecture and Technology, China) LLM-driven software systems are rapidly evolving from plain-text conversations to document-centric end-to-end workflows, where the same semantic content can be delivered in diverse document formats (e.g., CSV) through file upload interfaces. Yet existing testing work focuses on the robustness and reliability of models and systems whose input is a single prompt string, leaving a critical question unanswered: Can these document workflows maintain robust behaviors when the same content arrives in a different document format? To fill the gap, in this paper, we propose a format-aware metamorphic testing framework with three metamorphic relations to comprehensively evaluate the format robustness of end-to-end LLM document workflows. Based on this framework, we conduct a large-scale empirical study spanning four representative LLM workflows, four real-world tasks, and four document formats, comprising a total of 48,000 workflow executions. Our findings reveal that format variation poses a systematic and serious threat. Merely switching formats can cause accuracy to drop by up to 53.63% and trigger decision drifts in over 41% of instances. We further design lightweight mitigation strategies from the users’ perspective that recover up to 44.21% of format-induced decision drift without model retraining. Our study demonstrates that document format is not a neutral wrapper but a critical factor affecting the reliability of LLM software systems, calling for corresponding testing and safeguards in the deployment in real-world high-stakes scenarios. Article Search Article: ase26main-p718-p doi:10.1145/3832783.3837456
	Cheng, Xiao	ASE '26: "RamFuzz: LLM-Guided Greybox ..." RamFuzz: LLM-Guided Greybox Fuzzing for Spatial Memory Corruption via Valid Range Violation Shangzhi Xu, Wei Song, Yuekang Li, Nan Sun, Muhammad Ejaz Ahmed, Willy Susilo, Benjamin Turnbull, Xiao Cheng, and Siqi Ma (University of New South Wales, Australia; CSIRO's Data61, Australia; University of Wollongong, Australia; Macquarie University, Australia) Spatial memory corruptions remain among the most prevalent software vulnerabilities, consistently ranking among the top CWE categories. These vulnerabilities are closely tied to the values processed by the program: when input-derived values fall outside expected ranges, memory operations may be performed beyond their allocated bounds, leading to corruption. Our pilot study on 132 realworld CVEs shows that 72.7% of spatial memory corruptions stem from such valid value violations. Although fuzzing is widely used to expose exploitable memory corruptions, systematically detecting spatial memory corruptions through fuzzing remains challenging, as it requires generating inputs that conform to complex structural formats while violating valid value ranges. Recent work leverages LLMs to generate structured inputs based on format knowledge, yet LLMs exhibit a strong bias toward well-formed outputs, leaving systematic range violations largely unexplored. In this paper, we propose RamFuzz, an approach that exploits rather than mitigates this bias to guide the fuzzing process. RamFuzz prompts LLMs to enumerate valid ranges of target file formats and deliberately assigns invalid values to seeds during fuzzing, systematically triggering spatial memory corruptions. We evaluated RamFuzz on 15 popular real-world projects with more than 1,000 stars on GitHub, RamFuzz discovered 104 previously unknown memory corruptions, of which 39 have been confirmed, and 33 have been fixed by developers. Article Search Article: ase26main-p540-p doi:10.1145/3832783.3837447 ASE '26: "Harnessing Uncertainty in ..." Harnessing Uncertainty in Code Language Models: Lessons from Vulnerability Detection Haodong Li, Xiao Cheng, Xudong Wang, Zhihao Guo, and Haoyu Wang (Huazhong University of Science and Technology, China; Macquarie University, Australia; Zhongguancun Institute of Artificial Intelligence, China; University of Technology Sydney, Australia) Code Language Models (CLMs) are increasingly adopted for vulnerability detection, yet knowing when to trust their predictions remains an open challenge. Uncertainty estimation has improved reliability in traditional discriminative models, but whether these benefits transfer to the generative paradigm of CLMs is unclear. This experience paper presents a systematic empirical study of uncertainty estimation in CLM-based vulnerability detection, evaluating four calibration methods and two uncertainty-driven enhancement frameworks across eight models (2B--16B parameters) under both in-distribution and out-of-distribution settings on 1,050 real-world projects. Our study reveals that: (1) calibration effectiveness is model-scale dependent: temperature scaling and ensembles deliver consistent gains, while Monte Carlo Dropout and Bayesian Low-Rank Adaptation by Backpropagation only benefit medium-scale models (approximately 6B--7B parameters); (2) uncertainty-based correction requires label-conditional modeling to be effective (up to 12% Macro-F1 improvement on out-of-distribution data), as global strategies show negligible effects; (3) curriculum learning fails to improve upon standard fine-tuning, as uncertainty-based difficulty ordering does not align with the learned decision boundary, causing training instability or negligible gains. These findings challenge assumptions about the universal transferability of uncertainty methods and provide practical guidelines for deploying uncertainty-aware vulnerability detection. Article Search Article: ase26main-p786-p doi:10.1145/3832783.3837465
	Cheng, Yifan	ASE '26: "Beyond Single-Level PGO: Understanding ..." Beyond Single-Level PGO: Understanding and Harnessing Cross-Level Optimization Effects in Industrial Systems Dong Liu, Yifan Cheng, Yunfeng Cui, Ting Chen, Jiachi Chen, Zhihong Xue, Chong Hu, and Shengyu Cheng (ZTE Corporation, China; University of Electronic Science and Technology of China, China; Zhejiang University, China) Profile-guided optimization (PGO) is used to improve software performance in applications and operating system kernels. However, prior work applies PGO to a single layer in isolation, overlooking cross-layer interactions in systems, where kernel and application are optimized independently using different workloads. This practice is common in production environments and makes its impact on end-to-end performance important to understand. It introduces a mismatch between training and deployment, where profiling workloads may not reflect the final co-executed system. Despite its prevalence, the implications of such cross-layer mismatch remain poorly understood. In this paper, we present a large-scale industrial study of multi-level PGO across three representative products. We evaluate the combined effects of independently optimized kernel and application under realistic deployment conditions. Our results show that multi-level PGO can yield performance gains of up to 17.04%, but may lead to severe regressions of up to 81.90%. Through performance counter analysis, we attribute these effects to microarchitectural factors such as cache contention and branch misprediction arising from mismatched profiling assumptions. These findings show that PGO benefits are not necessarily compositional across software layers. Based on these insights, we propose Multi-Level PGO (ML-PGO), a practical guideline for applying PGO safely across system layers. Our work highlights the importance of workload representativeness and cross-layer awareness for achieving reliable performance improvements. Article Search Article: ase26ind-p100-p doi:10.1145/3832783.3834484 ASE '26: "UCT: A Versatile Code Translation ..." UCT: A Versatile Code Translation Framework Based on a Unified Intermediate Representation Wangcai Li, Dongyan Wang, Zehong Yu, Yifan Cheng, Ning Ge, Chunming Hu, and Zhuo Su (Beihang University, China; Renmin University of China, China; Tsinghua University, China; University of Electronic Science and Technology of China, China) Model-driven design often requires the same model to support multiple downstream tasks, such as simulation, testing, verification, and deployment. However, existing tools usually build separate translation workflows for different tasks, causing repeated model parsing, redundant semantic reconstruction, and limited reuse across toolchains. In this paper, we present UCT, a versatile code translation framework based on a unified intermediate representation (CIR). UCT translates models into CIR once, preserves executable semantics, structural information, scheduling relations, and model-code mappings, and then generates task-specific code through unified instrumentation and backend translation. We implemented UCT and evaluated it on Simulink benchmark models. The results show that UCT can generate usable customized code for simulation, testing, verification, and deployment. The generated binary artifacts also provide additional benefits, improving model testing coverage by 85.9% on average and accelerating simulation by 19.8× on average over Simulink Rapid Accelerator. The video is presented at https://youtu.be/CCu5iO853p4. The implementation is available at https://github.com/CodeGen123/UCT. Article Search Article: ase26tool-p111-p doi:10.1145/3832783.3834636
	Cheng, Yuxi	ASE '26: "Trace-Driven Automated PoC ..." Trace-Driven Automated PoC Synthesis for On-Chain Attacks Xing Su, Hao Wu, Hanzhong Liang, Yunlin Jiang, Yuxi Cheng, Yating Liu, Fengyuan Xu, and Sheng Zhong (Nanjing University, Nanjing, China) Blockchain systems are increasingly targeted by on-chain attacks that exploit vulnerabilities in smart contracts, resulting in billions of dollars in losses. Understanding and reproducing these attacks is critical for defense, yet currently relies on manually crafting proofs-of-concept (PoCs), which is labor-intensive, expertise-driven, and difficult to scale. In this work, we take the first step toward automating PoC synthesis directly from transaction traces. Our key insight is that a concrete execution trace provides not only behavioral evidence for recovering exploit logic, but also runtime semantics that enable precise code synthesis and verification. We design TracExp, a trace-driven framework that combines a dual decompiler, which fuses symbolic lifting with concrete runtime values to produce semantically enriched pseudocode, and a sketch-based synthesis and refinement mechanism that grounds LLM generation in execution context and ensures semantic correctness. Evaluated on 321 real-world DeFi attacks collected over 20 months, TracExp achieves 94.70% generation, 83.80% compilable, and 57.01% verifiable rates, at an average cost of ∼$0.1 per case. Moreover, we contributed 33 previously unavailable PoCs within 2 days to DeFiHackLabs, and all were accepted and merged, earning $900 in bounties, demonstrating both the practical effectiveness and real-world impact. Article Search Article: ase26main-p24-p doi:10.1145/3832783.3834332
	Cheung, Shing-Chi	ASE '26: "GraphDroid: Asynchronous LLM-Based ..." GraphDroid: Asynchronous LLM-Based Mobile App GUI Testing via History-Aware Exploration and Hybrid Intent Fulfillment Xiaolei Li, Jialun Cao, Zhijian Hou, Yuzhi Zhao, Yepang Liu, and Shing-Chi Cheung (Hong Kong University of Science and Technology, China; Southern University of Science and Technology, China; Guangzhou HKUST Fok Ying Tung Research Institute, China; City University of Hong Kong, China) Automated GUI testing is a widely adopted technique for ensuring mobile application quality by simulating user interactions to exercise functionalities. Despite the research breakthroughs in the past decades, covering complex functionalities that require multi-step action sequences still remains challenging. Traditional tools lack semantic understanding capability and can rarely synthesize such action sequences. Recent LLM-based tools can generate test intents describing target functionalities and leverage the LLM to fulfill the intents, but suffer from three key limitations: 1) loss of historical context for identifying uncovered functionalities, 2) synchronous intent generation that blocks exploration, and 3) per-step LLM-driven fulfillment incurring high cost and latency. To address these limitations, we propose GraphDroid, an intent-driven GUI testing framework that integrates a cluster-based memory mechanism to effectively identify uncovered functionalities from historically visited states for comprehensive application testing. For improving testing efficiency, GraphDroid adopts an asynchronous intent generation paradigm that eliminates the latency bottleneck and a hybrid intent fulfillment strategy that reserves the LLM for fulfilling complex intents while delegating simple intents to a lightweight heuristic algorithm. We evaluate GraphDroid on 41 real-world Android apps against six state-of-the-art baselines. Results show that GraphDroid outperforms all baselines, achieving up to 36.4% higher code coverage while incurring less than one eighth of the cost of the best pure LLM-based baseline. GraphDroid also exposes 19 bugs in the 41 apps and detects 13 of 52 crashes in the Themis bug benchmark, surpassing all the six baselines. Seven of the 19 bugs were previously unknown and we reported them to the developers. So far, four bugs have been confirmed and fixed. Article Search Article: ase26main-p609-p doi:10.1145/3832783.3837449 ASE '26: "FAiLGen: Calibrating LLM for ..." FAiLGen: Calibrating LLM for Failing Test Generation with Monte Carlo Tree Search Tsz-On Li, Xiaochuan Yan, Dehui Yi, Yuhang Jiang, Kexin Li, Congying Xu, Ying Wang, and Shing-Chi Cheung (Hong Kong University of Science and Technology, Hong Kong; Northeastern University, China) Failing test generation is an important yet challenging task in software engineering. It involves searching a vast space to identify fault-triggering test inputs and the oracles that assert these faulty executions. Several approaches have been proposed for generating failing tests. Specifically, given a program-under-test (PUT) and its requirements, these approaches leverage large language models (LLMs) to generate alternative implementations of the PUT that comply with the requirements, followed by differential testing between the PUT and the alternative implementations. Failing tests can be constructed by adopting the inconsistency-revealing inputs as the test inputs and treating the outputs returned by the alternative implementations as expected outputs. As alternative implementations may also contain faults and thus return incorrect outputs, current methods rely on either output consistency across alternative implementations or pre-constructed test cases for validation. However, the former is susceptible to LLM training biases or stochasticity, while the latter can be impractical due to the scarcity or unavailability of pre-constructed test cases in real-world scenarios. To address existing works’ limitations, we employ LLM as an alternative oracle for output validation, and calibrate its reasoning steps to reduce its susceptibility to LLM training biases or stochasticity. One critical challenge is that the calibration process inherently requires correct input-output pairs for the output validation task as ground-truth for reference when validating/calibrating LLMs’ reasoning, yet correct input-outputs (i.e., passing tests) are often scarce or unavailable in real-world scenarios. To address this challenge, our insight is that outputs consistently returned by both the PUT and all alternative implementations have a high probability of being the correct outputs of the PUT, as the PUT and alternative implementations are generated by independent agents (i.e., human developers and LLMs). Based on this insight, we propose FAiLGen, a novel approach that calibrates LLM’s reasoning for failing tests generation via a representative reasoning calibration paradigm, Monte Carlo Tree Search. We evaluate FAiLGen on 100 subjects from CodeForces and 100 subjects from SWE-Bench-Live. Our evaluation results show that FAiLGen achieves a recall of 58.1%, which is 62.4% higher than that of the best baseline (35.8%). Meanwhile, FAiLGen attains a precision of 75.2%, favorably compared to the best baseline (61.1%). Article Search Artifacts Available Article: ase26main-p1022-p doi:10.1145/3832783.3837478
	Cheung, Tsz Tung	ASE '26: "GraphQLer: Enhancing GraphQL ..." GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing Omar Tsai, Jianing Li, Tsz Tung Cheung, Lejing Huang, Hao Zhu, Jianrui Xiao, Iman Sharafaldin, and Mohammad A. Tayebi (Simon Fraser University, Canada; Forward Security, Canada) GraphQL APIs power production systems across financial services, e-commerce, and social platforms, yet their most critical access-control vulnerabilities—Insecure Direct Object Reference (IDOR), Use-After-Free (UAF), and state-dependent injection—routinely escape automated security testing. Industry-standard scanners (ZAP) and the leading research fuzzer (EvoMaster) test operations in isolation and cannot compose the multi-step sequences these flaws require. We present GraphQLer, an open-source automated security testing framework built for production GraphQL APIs. GraphQLer constructs a typed dependency graph from live schema introspection and synthesizes vulnerability chains—ordered operation sequences targeting specific flaw classes. Three strategies cover the critical attack surface: topological SCC-traversal for general reachability, cross-user IDOR replay for broken access control, and CREATE→DELETE→READ synthesis for UAF. On a production financial API (FinServ), GraphQLer identified eight potential vulnerabilities—including denial-of-service vectors that exposed stack traces and sensitive implementation details—without prior documentation or authentication credentials. On a self-hosted Saleor instance pinned to the CVE-2022-39275 commit, GraphQLer reproduced all four broken-access-control mutations cited in the security advisory. On the 11 public APIs of the coverage set, GraphQLer achieves 85.52% mean PositiveCoverage versus 29.29% (EvoMaster) and 21.80% (ZAP); across the 21 evaluated APIs it detects all 5 confirmed IDOR endpoints, UAF behavior on two controlled schemas, and confirms XSS and SQLi on DVGA (an independent third-party oracle)—while all baselines detect zero chain-based vulnerabilities. Article Search Artifacts Available Article: ase26ind-p143-p doi:10.1145/3832783.3834496
	Chimalakonda, Sridhar	ASE '26: "COBug: A Bug Localization ..." COBug: A Bug Localization Pipeline for COBOL: Does It Work? An Exploratory Study Kavyasri Gajula, Phanindra Kodela, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) COBOL still runs core banking, insurance, and government systems, but the developers who understand it are retiring faster than they are replaced, and defects in this code are costly to diagnose. Bug localization could help, yet the technique has matured on Java and Python, while COBOL lacks the standardized bug reports, faulty revisions, and validated report-to-file links required for retrieval-based evaluation. We present COBug, a leakage-controlled benchmark and evaluation pipeline for file-level bug localization in COBOL: 552 deterministic queries across 12 X-COBOL repositories, each carrying one isolated source mutation with mechanically traceable ground truth and a symptom-focused report generated without reading the target source file. Using COBug, we evaluate lexical retrieval, pointwise re-ranking, LambdaMART, and frozen CodeBERT under leave-one-repository-out evaluation. None reliably outperforms the repository-matched random floor. After Holm correction, no method–baseline comparison is statistically significant. Lexical retrieval comes closest at MAP 0.1508 against a floor of 0.1229, though two repositories holding 15 queries contribute over 80% of that margin. We argue that this may partly reflect the benchmark construction itself: a report synthesized in strict isolation from its target may carry limited information about which file is faulty. We therefore present the result as indicating a possible limitation of this template-based construction, rather than as a verdict on COBOL bug localization, and release the pipeline with its manifests and provenance records. Article Search Article: ase26main-p1990-p doi:10.1145/3832783.3837518 ASE '26: "Towards Multilingual AI-Assisted ..." Towards Multilingual AI-Assisted Software Engineering Shivadharshan S, Anirudh Arrepu, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) India produces about 1.5 million Computer Science undergraduates each year, yet software engineering tooling remains predominantly in English. As the industry transitions to AI-assisted development, this English-centric assumption fails a significant portion of the global developer workforce. While AI and Large Language Models (LLMs) provide a multilingual foundation, their unconstrained application often suffers from semantic drift in low-resource Indian languages and may not consistently reinforce the English terminology commonly used in professional software development contexts. To address this gap, we propose Vocabulary Bridge: a terminology contract for bilingual code explanation. Unlike generic translation tools, this protocol aims at explaining code logic in the developer’s native language while explicitly retaining standard technical English terms. As early feasibility evidence, we present BhashaSE, a Visual Studio Code extension implementing this protocol for Telugu, Hindi, Tamil, and Kannada. By formalizing this approach, we aim to guide LLM generation to support the transition from native understanding to professional English proficiency, establishing a new direction for multilingual AI-assisted software engineering. All tool-related artifacts are open-sourced at https://github.com/rishalab/BhashaSE Article Search Article: ase26nier-p100-p doi:10.1145/3832783.3834558 ASE '26: "Software Engineering Meets ..." Software Engineering Meets the EU AI Act: Artifacts, Patterns, and Future Directions Sridhar Chimalakonda and Upendra Karimi (Indian Institute of Technology Tirupati, India) As AI systems become increasingly integrated into consumer, enterprise, and public-sector software, ensuring compliance with emerging AI regulations has become an important challenge. Under the 2026 Digital Omnibus, the EU AI Act’s high-risk obligations are being phased in through 2027–2028. So far, compliance has been treated mainly as a documentation problem: tools check what organizations write about their AI systems. We argue that software engineering offers a complementary path, because an AI system is also a set of artifacts that carry evidence about what the system does. We re-frame AI Act compliance as a software engineering problem and set out an SE-AI Act compliance taxonomy for Articles 8 to 15 organized into three detectability tiers. We derive sub-clause-level detection patterns for Article 12 on record-keeping and implement them in AIActQ, a prototype static analyzer that recovered evidence from three open-source AI repositories: BentoML, DeepFace, and CompreFace. Across 24 repository-sub-clause pairs, AIActQ achieved 75.0% accuracy, with 73.3% macro precision and 66.3% macro recall, showing stronger performance for automatically detectable logging and monitoring obligations and limitations for context-dependent traceability requirements. Ground-truth labels were validated through inter-rater agreement (Cohen’s kappa = 0.799, substantial agreement). We outline directions for SE researchers, industry, standards bodies, and regulators to consider AI regulation as a software engineering concern. Article Search Article: ase26nier-p101-p doi:10.1145/3832783.3834559 ASE '26: "K-COBAgent: A Knowledge-Driven ..." K-COBAgent: A Knowledge-Driven Multi-agent Framework for COBOL Modernization Kavyasri Gajula, Phanindra Kodela, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) Multi-agent pipelines for legacy code translation have been devel- oped and evaluated largely outside COBOL, in settings such as Java to C#, PL/SQL to Java, and legacy web applications. Work targeting COBOL is predominantly single-model or rule-based. Both lines treat each run as self-contained, so prior translations, validation outcomes, failures, and repairs are not carried into the next run. For COBOL systems that are modernized incrementally across months or years, the absence of such reuse can cause repeated translation- generation work on unchanged code. We present K-COBAgent (Knowledge-driven COBOL Agent), which brings a multi-agent pipeline to COBOL modernization and, to our knowledge, is among the first frameworks in either line to persist a knowledge base across independent runs and measure cross-run reuse over repeated passes. Seven pipeline agents operate under a MAPE-K orchestrator, han- dling comprehension, planning, refactoring, translation, test gen- eration, validation, and learning; an on-demand SelfRepairAgent handles failed modules. A dual-layer knowledge base uses SQLite for exact source-hash lookup and ChromaDB for semantic retrieval of failure records and repair information, preserving outcomes across runs. Translation follows a three-layer strategy: KB cache lookup, deterministic rules grounded in COB2PY, and LLM fall- back. Applied to 14 X-COBOL repositories across three passes, the framework persisted 543 translation-output records after Pass 1. The translation-cache hit rate was 0.00% in Pass 1 and 99.82% in Passes 2 and 3 for previously seen source hashes, suggesting that exact-hash reuse may avoid repeated translation-generation work on unchanged modules. Final PASS outcomes varied from 53 to 58 under rerun validation and stochastic repair, while final FAIL out- comes varied from 29 to 24; these variations do not establish a stable quality trend. This is an early study; we report both the promise and the limitations of knowledge-persistent agentic COBOL mod- ernization Article Search Article: ase26nier-p105-p doi:10.1145/3832783.3834560 ASE '26: "RELY-SE: A Dashboard for Measuring ..." RELY-SE: A Dashboard for Measuring Operational Reliability of AI Coding Agents Akilesh P, Shivadharshan S, Sridhar Chimalakonda, Vibhu Saujanya Sharma, and Vikrant Kaulgud (IIT Tirupati, India; Accenture Labs, India) AI coding agents such as Aider, Claude Code Pro, and AutoCodeRover are increasingly deployed in production software development workflows. Existing benchmarks measure correctness: whether an agent resolves a given issue. However, correctness alone does not capture operational reliability: whether the agent breaks the CI pipeline, requires human intervention, or behaves inconsistently across repeated runs. We present RELY-SE, a dashboard that measures five reliability metrics: Human Intervention Ratio (HIR), Commit Failure Ratio (CFR), Task Success Rate (TSR), Agent Goal Achievement Reliability (AGAR) and Decision Stability Metric (DSM) adapted from established safety-critical domains (SRE, autonomous vehicles, aviation, medical AI). The tool ingests execution traces, computes all five metrics, and renders comparative reliability profiles across agents and tasks through interactive views. We demonstrate RELY-SE on three contemporary agents evaluated on 15 SWE-bench Lite tasks (10 Django, 5 Matplotlib) with three trials each (135 total runs). Our key finding: Claude Code Pro achieves a TSR of 71.1% with near-zero CFR, while AutoCodeRover achieves 13.3% TSR with 12.2% CFR. This disparity invisible to correctness-only evaluation but critical for CI stability. RELY-SE is publicly available at https://github.com/rishalab/Rely-SE.git. Demo video: https://youtu.be/RjYReUyznqI. Article Search Article: ase26tool-p279-p doi:10.1145/3832783.3834654
	Chintalapati, Murali	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Cho, Eunho	ASE '26: "Evolution-Aware Regression ..." Evolution-Aware Regression Test Prioritization of ML-Enabled Systems using Gradient-Based Behavior Vectors Eunho Cho, Donghwan Shin, and In-Young Ko (KAIST, Republic of Korea; University of Sheffield, UK) The machine learning(ML) component of an ML-enabled system evolves through retraining, fine-tuning, and optimization, so previously valid test results may no longer hold. A single evolution step can worsen performance on some test cases while improving others, making regression test prioritization inherently directional. We present Gradient-based Behavior Vector-Parameter Delta(GBV-PD), the first approach to operationalize the behavior vector space for evolution-aware regression test prioritization. GBV-PD represents each test case as a gradient-based vector(GBV), a low-dimensional projection of its loss gradient under the original model. It then projects the observed parameter update of the evolved model onto the same PCA basis and uses the resulting alignment to estimate whether each test case's loss is likely to increase or decrease, without running the evolved model on test cases during prioritization. In an empirical study across classification and regression tasks, GBV-PD consistently outperformed non-directional baselines and remained competitive with a full-gradient reference, while offering better time and storage profiles for repeated updates via reusable GBV caching. These results show that behavior-space ideas can be operationalized into a practical and efficient mechanism for repeated-update regression-test prioritization of evolving ML components within ML-enabled systems. Article Search Artifacts Available Article: ase26main-p872-p doi:10.1145/3832783.3834368
	Cho, Haehyun	ASE '26: "RAVEN: Measuring Detection ..." RAVEN: Measuring Detection Instability in Anti-virus Engines under Semantics-Preserving Perturbations Younghoon Ban, Beomjin Jin, Doowon Kim, Hyoungshick Kim, and Haehyun Cho (Soongsil University, Republic of Korea; Ajou University, Republic of Korea; University of Tennessee, Knoxville, USA; Sungkyunkwan University, Republic of Korea) Real-world anti-virus (AV) engines continue to rely heavily on signature-based detection, whereas academic adversarial research has largely focused on ML-based models, leaving an evaluation gap. To better understand signature-based detection behavior, we analyze ClamAV’s open-source signature database as a white-box reference point. Our analysis shows that raw byte-level signatures account for 94.54 Article Search Article: ase26main-p1356-p doi:10.1145/3832783.3837492
	Cho, Jihoon	ASE '26: "EvoLLM: High-Coverage, Readable, ..." EvoLLM: High-Coverage, Readable, and Token-Efficient Unit Test Generation for Industrial Java Codebases Seokhyeon Moon, Myungho Lee, Jihun Kim, Yoon-Chan Jhi, Jihoon Cho, and Hakjoo Oh (Samsung SDS, Republic of Korea; Korea University, Republic of Korea) Adopting automated Java unit-test generation in industrial settings requires high coverage, readability, token efficiency, and modern-Java deployability. No existing technique meets all four: search-based test generators struggle with readability and modern-Java deployability, LLM-centric generators consume tens of millions of tokens, and prior LLM-based test refactoring methods drop baseline coverage by 8–21 percentage points (pp) in our controlled setups. We report on EvoLLM, a hybrid Java unit-test generator we built and deployed to address all four requirements. EvoLLM combines EvoSuiteng—a failure-analysis-driven hardening of EvoSuite that resolves deployability issues and strengthens baseline coverage—with cluster-wise LLM-based refactoring that groups tests by coverage goals and rewrites each cluster in a single LLM call grounded in compact program-under-test context. Across six open-source and three industrial projects, EvoLLM outperforms six state-of-the-art baselines, improving line coverage by 8.2–20.7 pp, branch coverage by 6.2–19.4 pp, and mutation score by 6.8–24.5 pp, while reducing LLM token usage by 47.3%–93.0%. In addition, the test generation stage of EvoLLM demonstrates robust deployability across target projects built with JDKs 8, 11, and 17, while achieving strong effectiveness on a Spring-core release requiring JDK 17. Finally, a 14-participant developer survey further suggests that EvoLLM-generated tests ranked higher in readability than those from prior tools and developer-written tests. Article Search Article: ase26ind-p335-p doi:10.1145/3832783.3834525
	Cho, Youngmin	ASE '26: "MiniPoly: Automatic Extraction ..." MiniPoly: Automatic Extraction of Efficient JavaScript Polyfill from Language Specification Jungwoong Kim, Youngmin Cho, and Jihyeok Park (Korea University, Republic of Korea) A polyfill is a JavaScript implementation of built-in APIs for older execution environments lacking native support. Because developers rely on them to run modern features everywhere, strict conformity to the official language specification (ECMA-262) is crucial. However, manual implementation remains the industry standard; this process is labor-intensive, inherently error-prone, and frequently leads to spec-miscompliance bugs in production. To address this, we present MiniPoly, the first compilation framework to automatically extract correct and optimized polyfills directly from the ECMA-262 specification. To ensure correct generation, MiniPoly employs a static analysis that resolves the specification’s internal control-flow representations (i.e., completion records) and translates them into equivalent JavaScript constructs. Furthermore, it utilizes rewrite rules to apply user-defined optimization patterns, replacing algorithmic bottlenecks in the specification with highly efficient implementations. Evaluation shows that MiniPoly successfully generates polyfills for 89 built-in APIs in ECMAScript 2025 (ES2025) using 17 user-defined rewrite rules. It produces a more spec-compliant polyfill than production-standard libraries like core-js and es-shims with a competitive performance profile. Additionally, we demonstrate that MiniPoly can generate polyfills even for the next draft release of ECMA-262 and early-stage proposals, highlighting its potential to future-proof development. Article Search Artifacts Available Article: ase26main-p3249-p doi:10.1145/3832783.3837549
	Chong, Chun Yong	ASE '26: "When Elo Lies: Hidden Biases ..." When Elo Lies: Hidden Biases in Codeforces-Based Evaluation of Large Language Models in Practice Shenyu Zheng, Ximing Dong, Xiaoshuang Liu, Chun Yong Chong, Gustavo Oliva, Dayi Lin, Boyuan Chen, Shaowei Wang, and Ahmed E. Hassan (Huawei Canada, Canada; Huawei, China; Monash University, Malaysia; Queen's University, Canada; University of Manitoba, Canada) As Large Language Models (LLMs) achieve breakthroughs in complex reasoning, Codeforces-based Elo ratings have emerged as a prominent metric for evaluating competitive programming capabilities in industry. However, these ratings are often reported without critical experimental details, leading to significant discrepancies-illustrated by recent reports where the same model version’s score fluctuated by nearly 500 points (out of 2,029). This paper presents a systematic empirical study on the hidden factors biasing Elo evaluations: (1) the temporal ordering of submissions, (2) contest difficulty selection, and (3) run-to-run stochastic variability of LLMs. Utilizing a controlled benchmark of 37 recent Codeforces contests and 13,691 generated test cases, we demonstrate that Elo scores are highly sensitive to these parameters. Our findings reveal that varying submission orders can shift scores by 394 points, while contest selection can cause differences of up to 1,122 points for the same model. Run-to-run performance exhibits substantial instability, with a maximum difference of 349 points in mean scores observed when evaluating identical contests. We conclude that direct Elo comparisons are unreliable and potentially misleading without strict standardization and transparent reporting of experimental settings. Article Search Article: ase26ind-p20-p doi:10.1145/3832783.3834458 ASE '26: "No Isolated Evolution, No ..." No Isolated Evolution, No Blind Search: Memory-Guided Prompt Co-evolution for Industrial Multi-agent Vulnerability Detection Jie Xu, Zihan Wu, Yun Peng, Chun Yong Chong, Linghan Meng, Kui Liu, and Xiaohua Jia (City University of Hong Kong, Hong Kong; Chinese University of Hong Kong, Hong Kong; Monash University, Malaysia; Huawei Technologies, China) Large Language Model (LLM)-based multi-agent systems have shown promise for automated vulnerability detection, but our industrial deployment reveals two limitations: 1) each agent's prompt is typically optimized in isolation, degrading global end-to-end performance; and 2) evolutionary prompt search lacks memory across iterations, wasting computation costs. To address these limitations, we propose MemCo, a memory-guided prompt co-evolution framework applied to industrial vulnerability detection. First, MemCo takes an end-to-end prompt co-evolution strategy, which evaluates prompts based on the system's final output rather than assessing each agent in isolation. In each evolutionary iteration, only the prompts of agents responsible for the misclassification undergo further evolution, thereby enhancing the system's global accuracy. Second, MemCo adopts a memory-guided search mechanism, which edits prompts based on records of successful and failed modifications. This reduces redundant blind exploration and significantly lowers computation costs. Comprehensive experiments show that MemCo improves Macro-F1 by +8.4 to +18.0 points on public benchmarks and up to 36.9% relative improvement on a proprietary industrial benchmark, while reducing per-generation evolution tokens by 48.5% and inference tokens by 63.8%. MemCo is deployed as a vulnerability detection assistant in our production security pipeline. Article Search Article: ase26ind-p297-p doi:10.1145/3832783.3834522
	Chong, Zichun	ASE '26: "GALA: Graph-Augmented LLM ..." GALA: Graph-Augmented LLM Agents for Root Cause Analysis and Incident Response in Microservices Yifang Tian, Yaming Liu, Zichun Chong, Zihang Huang, Yiran Li, and Hans-Arno Jacobsen (University of Toronto, Canada) Microservice root cause analysis (RCA) requires correlating failures across heterogeneous telemetry within complex service dependency graphs. Existing methods often rely on a single telemetry modality; recent LLM-based approaches can suffer from unconstrained exploration and hallucination; and most systems stop at fault ranking without producing actionable incident response. We present GALA+, a graph-augmented LLM agentic framework centered on graph-guided investigation, which uses service dependencies to bound exploration and refine diagnosis through localized multi-modal evidence. For initial hypothesis generation, GALA+ combines complementary telemetry signals with STRIX, a novel trace- and graph-structure-aware scoring module. GALA+ then produces ranked diagnoses, incident summaries, and stratified action recommendations. We further introduce SURE-Score, a human-guided evaluation framework co-developed with industry SRE experts for assessing RCA-specific output quality beyond conventional text similarity metrics. On two microservice benchmarks, GALA+ consistently achieves the strongest overall results, surpassing the best LLM-based baseline by more than 25 percentage points in AC@1, while also receiving the highest ratings from both SURE-Score and independent human SRE evaluation. Article Search Article: ase26main-p46-p doi:10.1145/3832783.3834335
	Choudhury, Swapnajeet Gon	ASE '26: "Prompt Coach: An Empirical ..." Prompt Coach: An Empirical Evaluation of an Agentic Tutor for Learning Prompt Engineering in Software Development Rohit Mehra, Kapil Singi, Vikrant Kaulgud, Vibhu Saujanya Sharma, Swapnajeet Gon Choudhury, Swati Sharma, Adam P. Burden, and Majd Sakr (Accenture Labs, India; Accenture, India; Accenture, USA) Prompt engineering has emerged as a critical yet undertaught skill for software developers, one that traditional learning approaches are ill-equipped to support given its evolving, interactive, and context-dependent nature. In this paper, we introduce Prompt Coach (PC), an agentic tutor that helps developers learn how to craft high-quality code-generation prompts through Socratic guidance embedded in-flow within their IDE. PC evaluates prompt quality across multiple dimensions and surfaces targeted questions to guide self-correction, grounded in the developer's codebase and the behavior of the target LLM. We present an early empirical study with 15 professional developers combining quantitative prompt quality scoring with qualitative perception measures. Participants showed statistically significant improvements after a single 60-minute session, with the largest gains across dimensions commonly overlooked by developers. They also reported strong trust, high adoption readiness, and unanimous agreement that PC improved their prompt-writing skills. Article Search Article: ase26ind-p91-p doi:10.1145/3832783.3834478
	Chu, Jinzhao	ASE '26: "Zero-Knowledge VMs: Security ..." Zero-Knowledge VMs: Security and Usability in Practice Jinan Jiang, Jinzhao Chu, Pengyu Xue, Xinghao Peng, Haoran Qin, and Xiapu Luo (Hong Kong Polytechnic University, Hong Kong) Zero-knowledge Virtual Machines (zkVMs) are emerging critical infrastructure for blockchain Layer 2 scaling solutions, enabling execution of arbitrary programs while generating succinct proofs of correct computation. Despite hundreds of millions of investment, the rapidly evolving zkVM ecosystem lacks comprehensive empirical analysis of its security and usability challenges. We present the first systematic study of zkVM vulnerability and usability issues, analyzing production zkVMs through three perspectives covering 314 security vulnerabilities (professional audits), 11,854 commits (developer practices), and 1,150 user issues (user experiences). We identify prevalent, severe, and non-traditional vulnerability categories and their root causes, reveal high-value attack surfaces that consistently emerge across zkVMs, and identify major usability issues that users struggle with. Comparing our findings against existing research reveals four gaps representing research and tool development opportunities for the testing and analysis of zkVMs. Article Search Article: ase26main-p1549-p doi:10.1145/3832783.3837500
	Chung, Janice	ASE '26: "Toward Inclusive Programming ..." Toward Inclusive Programming Support for Novice Programmers with Dyslexia: Insights from a Comparative Study Zihan Fang, Janice Chung, Ruijia Chen, Marcia Barnes, Yuhang Zhao, and Yu Huang (Vanderbilt University, USA; University of Wisconsin-Madison, USA) Programming attracts a diverse range of learners, including individuals with dyslexia, a learning difficulty that affects reading, writing, and spelling despite average intelligence and educational opportunities. Although prior work has examined dyslexia in natural-language and code comprehension, we still know little about how dyslexic learners engage with code relative to natural language, and what this implies for inclusive programming environments. This gap is especially important in the AI era, as novice programmers increasingly rely on AI-powered coding and learning tools that may not address the distinct comprehension and cognitive support needs of learners with dyslexia. To address this gap, we conducted an eye-tracking study with a mixed-methods design involving 24 novice programmers (12 with dyslexia, 12 without) who completed paired code-comprehension and English-comprehension tasks. We found that although the two groups showed similar overall visual scanning patterns, eye-gaze features suggest higher cognitive effort among dyslexic novices during code comprehension. We also found that the performance gap between dyslexic and neurotypical learners was smaller in code comprehension than in English comprehension, suggesting that programming-specific representations may reshape, rather than eliminate, dyslexia-related challenges. In addition, dyslexic novices reported lower confidence, viewed general training methods as less effective, and described difficulties with symbolic elements and structurally complex code. These findings provide an empirical basis for designing AI-assisted programming tools that can detect cognitive overload and adapt explanations, feedback, and task support to better support dyslexic novices. Article Search Article: ase26main-p2412-p doi:10.1145/3832783.3834414
	Cito, Jürgen	ASE '26: "Cochise: A Reference Harness ..." Cochise: A Reference Harness for Autonomous Penetration Testing Andreas Happe and Jürgen Cito (TU Wien, Austria) Recent work on LLM-driven autonomous penetration testing reports promising results, but existing systems often bundle architectural, prompting, and tool-integration choices together. This makes it difficult to determine what is gained over a simple agent and harness. We present Cochise, a 630 LOC Python reference implementation for autonomous penetration-testing experiments. Cochise connects to a Linux execution host over SSH and supports attacking controlled target environments reachable from that jump host. The prototype implements a Planner--Executor architecture in which long-term state is maintained by the planner, while a ReAct-style executor issues commands over SSH and self-corrects based on command outputs. The scenario prompt can be adapted to different target environments. We evaluate the harness against a live third-party testbed, Game of Active Directory (GOAD). Cochise is intended not as a state-of-the-art penetration-testing agent, but as a reusable experimental infrastructure for comparing models, agent architectures, and penetration-testing traces. Alongside the prototype, we release replay and analysis tools: (i) cochise-replay for offline visualization of captured runs, (ii) cochise-analyze-logs and cochise-analyze-graphs for cost, token, duration, and compromise analysis, and (iii) a corpus of JSON trajectory logs from GOAD runs, so that researchers can study agent behavior without provisioning the 48-64 GB RAM / 190 GB storage testbed themselves. Tool demo video available at https://youtu.be/2mQimB1ufyI. Article Search Artifacts Available Article: ase26tool-p208-p doi:10.1145/3832783.3834651
	Corallo, Sophie	ASE '26: "The EVerest Dataset for Secure ..." The EVerest Dataset for Secure Software Engineering Sophie Corallo, Debora Grupp, Dominik Fuchß, Jan Keim, Frederik Reiche, Tobias Hey, and Anne Koziolek (KIT, Germany) End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available [4]. A short video is available at https://youtu.be/pnn1uqpomvQ. Article Search Artifacts Available Article: ase26tool-p56-p doi:10.1145/3832783.3834614 ASE '26: "The ARDoCo Tool Landscape: ..." The ARDoCo Tool Landscape: REST API, TraceView, and TraceViz for Architecture Traceability Jan Keim, Dominik Fuchß, Sophie Corallo, Tobias Hey, Julian Winter, and Kevin Feichtinger (KIT, Germany) Context and Problem. Software development produces interrelated artifacts like software architecture documentation (SAD), software architecture models (SAMs), and source code, whose relationships are essential for maintenance and consistency checking. However, automatically recovering links between these artifacts (traceability link recovery (TLR)) remains difficult to deploy in practice. Method and Aim. We present an accessible tool landscape for ARDoCo’s TLR approaches: the ARDoCo REST API exposes four TLR pipelines (SAD-SAM, SAM-Code, SAD-Code, and SAD-SAM-Code) via HTTP endpoints with asynchronous execution and caching; TraceView is a browser-based frontend with a guided wizard and interactive multi-panel exploration of recovered links and inconsistencies; and TraceViz, which is a VS Code extension that overlays trace links directly onto documentation in the IDE. Results and Conclusion. All three components are publicly deployed and usable. A preliminary study for TraceViz’s in-IDE visualization confirmed that it improves developer comprehension during software understanding tasks. The tool landscape makes state-of-the-art TLR accessible to architects, developers, and tool integrators. Video. We provide a screencast of our ARDoCo Tool Landscape and how it is used here: https://youtu.be/IOTEPZQ3tVs Article Search Artifacts Available Article: ase26tool-p73-p doi:10.1145/3832783.3834621
	Cortesi, Agostino	ASE '26: "GoLiSA: An Advanced Static ..." GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts Luca Olivieri, Luca Negrini, Vincenzo Arceri, Pietro Ferrara, Fausto Spoto, and Agostino Cortesi (Ca’ Foscari University of Venice, Italy; University of Parma, Italy; University of Verona, Italy) GoLiSA is a static analysis tool that allows the verification of smart contracts written in Go, the most widely used language for developing smart contracts in Hyperledger Fabric. GoLiSA relies on abstract interpretation to model program semantics and identify potential risks and vulnerabilities in smart contracts. It supports advanced analyses such as information flow tracking and numerical and string value analysis, enabling the approximation of semantic program behaviors. Building on these analyses, GoLiSA implements a suite of checks for detecting non-trivial issues and potential risks in Hyperledger Fabric, including non-determinism, phantom reads, untrusted cross-contract invocations, read-after-write and over-write issues, cross-channel invocation risks, numerical issues, and unhandled errors. GoLiSA is publicly available at https://github.com/lisa-analyzer/go-lisa. A demonstration video showcasing the tool is available at https://youtu.be/WqkYOpWc9oE. Article Search Artifacts Available Article: ase26tool-p147-p doi:10.1145/3832783.3834644
	Costa, Ricardo	ASE '26: "Barista: Synthesizing Typestate ..." Barista: Synthesizing Typestate Specifications with LLM Agents Catarina Gamboa, Paulo Canelas, Ricardo Costa, Márcio Caetano, Jonathan Aldrich, and Alcides Fonseca (Carnegie Mellon University, USA; University of Lisbon, Portugal) Object-oriented classes encode implicit protocols that clients must follow, such as connecting a socket before sending data or opening a stream before reading. Mainstream programming languages like Java cannot validate the correct use of these protocols, but more advanced type systems, such as typestate systems, can detect these violations at compile time. However, these systems require a formalization of these implicit protocols. To overcome this limitation, we propose to extract object protocols from documentation using a combination of LLMs and test generation. We developed Barista, an agentic workflow that transforms class documentation into verifiable LiquidJava specifications through DFA-guided protocol extraction, test synthesis, and verification-driven refinement. We evaluated our approach on 35 Java classes with expert-written ground truth, achieving 87.0% precision and 68.3% recall, with 75% of specifications usable directly or with minor edits. Barista bootstraps these specifications for well-documented libraries, reducing the manual annotation burden and enabling compile-time protocol safety without specialized expertise. Article Search Article: ase26main-p2950-p doi:10.1145/3832783.3834427
	Cruz, Luís	ASE '26: "EnergyTrackr: A Modular Energy ..." EnergyTrackr: A Modular Energy Regressions Detection Tool François Bechet, Jérôme Maquoi, Luís Cruz, Benoît Vanderose, and Xavier Devroey (University of Namur, Belgium; TU Delft, Netherlands) Energy efficiency is increasingly recognized as an important dimension of software quality. As systems evolve rapidly, tracking how energy consumption changes across versions can provide valuable insights for developers and researchers. Although detecting energy regressions (i.e., unintended increases in energy consumption) remains challenging due to measurement variability and complex execution environments, recent advances now make systematic analysis practical. Still, dedicated support for monitoring energy behavior over a project's history is missing. This paper presents EnergyTrackr, a modular, open-source tool for automatically detecting, classifying, and visualizing energy regressions across a commit history. EnergyTrackr traverses a specified set of commits, builds each revision, and measures application-level energy consumption by executing the test suite using the RAPL-based Linux perf utility. It applies established best practices for measurements such as warm-up, randomized execution, repetition, and thermal control. The resulting data are analyzed through a statistical pipeline that filters outliers and classifies energy changes using multiple criteria (e.g., significance, practical impact, ...). EnergyTrackr generates interactive reports that provide a comprehensive view of energy evolution and is designed for easy integration into existing Linux workflows. A preliminary evaluation on large Java projects shows that EnergyTrackr can produce stable measurements at scale and effectively identify energy regressions. Source: https://github.com/snail-unamur/energytrackr. Screencast: https://doi.org/10.5281/zenodo.21507425. Article Search Article: ase26tool-p125-p doi:10.1145/3832783.3834640
	Cui, Baoquan	ASE '26: "From Thread to Pool: Modeling ..." From Thread to Pool: Modeling and Static Detection of Thread Pool Misuses in Java Programs Baoquan Cui, Yucheng Qiu, Rui Han, Hang Gao, and Jian Zhang (Institute of Software at Chinese Academy of Sciences, Beijing, China; Hangzhou Institute for Advanced Study at University of Chinese Academy of Sciences, Hangzhou, China; University of Chinese Academy of Sciences, China) Asynchronous programming is fundamental to modern software performance, and Java ExecutorService-based executors have become a standard abstraction for managing concurrent tasks. While existing research has extensively studied traditional concurrency bugs, management misuses of executors remain under-analyzed. These defects arise not from the business logic of asynchronous tasks, but from how executors are configured, used, and terminated. We present a taxonomy of seven executor-management misuse patterns and formalize them using a resource-management model. Based on this, we develop PoolGuard, a static analysis framework for detecting both executor-generic lifecycle/result-handling defects and ThreadPoolExecutor-specific configuration misuses. Extensive evaluation on a benchmark suite with real-world defects shows that PoolGuard is better than specialized async detectors as well as general-purpose analyzers such as SpotBugs and Infer. Applying PoolGuard to large-scale open-source systems, we identified 50 previously unknown issues, 24 of which have already been fixed or confirmed by developers, demonstrating the practical value of semantic analysis for executor-management defects. Article Search Article: ase26main-p1687-p doi:10.1145/3832783.3837508
	Cui, Hang	ASE '26: "Smart Brain: Semantic Anomaly ..." Smart Brain: Semantic Anomaly Detection for Operational Time Series in Large Scale Service Systems Hang Cui, Zexin Wang, Jingjing Li, Juncheng Hu, Haotian Si, Cenjie Hu, Quan Zhou, Yongchang Hu, Lei Han, Dan Pei, Changhua Pei, and Gaogang Xie (University of Chinese Academy of Sciences, China; Computer Network Information Center at Chinese Academy of Sciences, China; Jilin University, China; Independent Researcher, China; Shenyang Institute of Automation at Chinese Academy of Sciences, China; Huawei Technologies, China; Tsinghua University, China) Time series anomaly detection is a core component of operational automation in large scale service systems. However, most existing methods model anomalies as numerical deviations in the data space, while real software operations require decisions over whether an observed behavior constitutes an actionable abnormal event. This mismatch often leads to brittle thresholds, excessive false alerts, and outputs that are difficult for operators to interpret and act upon. In this paper, we argue that practical anomaly detection should move from point-centric data anomaly detection to semantic anomaly detection. We present Smart Brain, a two stage framework for semantic anomaly detection in operational time series. Stage I extracts structured temporal evidence by recognizing interpretable anomaly patterns. Stage II combines the extracted evidence with metric semantics and operator authored rules to produce semantic anomaly decisions and human-readable explanations. Through evaluation on benchmark datasets and real industrial monitoring scenarios, we show that Smart Brain improves operationally meaningful anomaly identification while providing stronger interpretability and deployment suitability than score centric pipelines. Beyond the framework itself, our study offers practical lessons for building anomaly detection systems in production software environments, highlighting the importance of semantic grounding, structured evidence, and lightweight adaptation to evolving services. Article Search Article: ase26main-p337-p doi:10.1145/3832783.3837436
	Cui, Tianyu	ASE '26: "KRCA: An Efficient Root Cause ..." KRCA: An Efficient Root Cause Analysis System in Hyper-scale Microservice Systems via Agentic AI Jiamin Jiang, Jingfei Feng, Yu Luo, Qingliang Zhang, Yongqian Sun, Wenwei Gu, Shenglin Zhang, Tianyu Cui, Yao Wu, Jielong Huang, Nan Qi, and Dan Pei (Nankai University, China; Kuaishou Technology, China; Tsinghua University, China) Hyper-scale microservice systems have become the standard infrastructure for large-scale Internet companies. These systems consist of numerous loosely coupled microservices that evolve independently through continuous development and deployment. Such complexity makes failures unavoidable, necessitating efficient Root Cause Analysis (RCA) to help Site Reliability Engineers (SREs) quickly localize root cause services and classify failure types. However, existing RCA methods often struggle to adapt to the extreme dynamism and massive scale of these systems. In this paper, we present KRCA, an end-to-end RCA system designed for hyper-scale microservice systems. To manage the vast search space, KRCA employs a multi-stage pipeline that begins with an API-level drilldown to isolate suspicious services. It then instantiates a skeleton-based causal graph from anomalous metrics to serve as a high-recall structural prior, before utilizing a memory-augmented multi-agent framework to verify causality and generate the final failure report. By combining structured causal constraints with multi-agent reasoning, KRCA balances diagnostic accuracy with the efficiency requirements of real-time production use. Experimental results show that KRCA achieves AC@1 scores of 0.88 and 0.79 for root cause service localization and failure type classification, outperforming the strongest baseline by at least 31% in absolute gains. KRCA has been deployed in Kuaishou's production environment for over six months, reducing the average diagnosis time by 77.3%. Article Search Article: ase26ind-p61-p doi:10.1145/3832783.3834468
	Cui, Weihao	ASE '26: "AlphaCu: A Transformation-Driven ..." AlphaCu: A Transformation-Driven Synthesis Framework for LLM-Based GPU Kernel Generation Yangjie Zhou, Xing Ma, Zihan Liu, Qing Wang, Weihao Cui, Wu Sun, Hanjing Wang, Binhang Qi, Jingwen Leng, Yun Lin, Minyi Guo, and Jin Song Dong (National University of Singapore, Singapore; Shanghai Jiao Tong University, China; Shanghai Qi Zhi Institute, China; Nanjing University, China; Harvard University, USA) Large language models show promise for code generation, yet their effectiveness in producing high-performance GPU kernels remains insufficiently understood. Recent agentic workflows improve over direct prompting through specialized generation roles and execution feedback, but our characterization of a representative workflow reveals failures in optimization-strategy selection, hardware-specific instruction realization, and shape-dependent parameter selection. We present AlphaCu, a transformation-driven synthesis framework for LLM-based GPU kernel generation. AlphaCu treats kernel generation as structured synthesis over explicit optimization decisions rather than end-to-end code emission. Specifically, AlphaCu represents these decisions as scoped transformation passes maintained across agent-coordinated synthesis stages, enabling compatibility checking and failure attribution. AlphaCu binds selected hardware-sensitive operations to pre-validated microkernels and uses target-device measurements to revise transformation choices and tune runtime configurations. We evaluate AlphaCu on 104 test cases covering single and fused operators across four GPU architectures: NVIDIA H100, A100, V100, and AMD MI210. Under comparable generation budgets, AlphaCu achieves 100% functional correctness on our benchmark suite and delivers an average speedup of 5.64× over prior LLM workflows, while remaining competitive with vendor libraries and tensor compilers. Article Search Article: ase26main-p287-p doi:10.1145/3832783.3837433
	Cui, Yunfeng	ASE '26: "Beyond Single-Level PGO: Understanding ..." Beyond Single-Level PGO: Understanding and Harnessing Cross-Level Optimization Effects in Industrial Systems Dong Liu, Yifan Cheng, Yunfeng Cui, Ting Chen, Jiachi Chen, Zhihong Xue, Chong Hu, and Shengyu Cheng (ZTE Corporation, China; University of Electronic Science and Technology of China, China; Zhejiang University, China) Profile-guided optimization (PGO) is used to improve software performance in applications and operating system kernels. However, prior work applies PGO to a single layer in isolation, overlooking cross-layer interactions in systems, where kernel and application are optimized independently using different workloads. This practice is common in production environments and makes its impact on end-to-end performance important to understand. It introduces a mismatch between training and deployment, where profiling workloads may not reflect the final co-executed system. Despite its prevalence, the implications of such cross-layer mismatch remain poorly understood. In this paper, we present a large-scale industrial study of multi-level PGO across three representative products. We evaluate the combined effects of independently optimized kernel and application under realistic deployment conditions. Our results show that multi-level PGO can yield performance gains of up to 17.04%, but may lead to severe regressions of up to 81.90%. Through performance counter analysis, we attribute these effects to microarchitectural factors such as cache contention and branch misprediction arising from mismatched profiling assumptions. These findings show that PGO benefits are not necessarily compositional across software layers. Based on these insights, we propose Multi-Level PGO (ML-PGO), a practical guideline for applying PGO safely across system layers. Our work highlights the importance of workload representativeness and cross-layer awareness for achieving reliable performance improvements. Article Search Article: ase26ind-p100-p doi:10.1145/3832783.3834484
	Cui, Yuxin	ASE '26: "PCodeTrans: Translate Decompiled ..." PCodeTrans: Translate Decompiled Pseudocode to Trace-Level Equivalent Source Code Yuxin Cui, Zeyu Gao, Siliang Qin, Yuanda Wang, Jiaming Wang, Xize Luo, Peng Zhou, and Chao Zhang (Tsinghua University, China; Institute of Information Engineering at Chinese Academy of Sciences, China; Peking University, China; Hunan University, China) Decompilation remains foundational for binary analysis, yet conventional tools prioritize human readability over compilation success and test-validated runtime consistency. While recent large language model approaches attempt refining decompiled pseudocode, they often introduce semantic hallucinations. Operating statically without dynamic feedback or attempting whole binary repairs lacking scalability, these existing methods struggle to resolve genuine runtime divergences. We present PCodeTrans, a dynamic feedback driven framework that implements a loop of recompilation, validation, and alignment for the recovery of functional source code. Extracting a minimal yet globally consistent context, PCodeTrans employs an in situ substitutable engine. This mechanism injects isolated compiled functions directly into the original binary, natively preserving authentic execution environments. Utilizing trace-level alignment as a diagnostic objective, PCodeTrans leverages breakpoint matched differential tracing, generating precise runtime causal diagnostics that guide the model through iterative refinement resolving behavioral discrepancies. Evaluated across a comprehensive Linux and Windows Benchmark suite including Coreutils, Binutils, PuTTY, and SQLite3, PCodeTrans achieves substantial translation performance refining raw Hex-Rays outputs. Empirical results confirm PCodeTrans achieves 100% function-level compilation success and 99.5% test-validated consistency on unstripped binaries, resolving up to 85.6% of logic errors. Even for stripped executables, the framework maintains over 97% test-validated consistency, narrowing the gap between raw decompilation and functional source code. Surpassing existing baselines, PCodeTrans paves a practical path toward recovered source that can be recompiled, validated to pass test harnesses, and consumed by source-level security analysis and fuzzing tools. Article Search Article: ase26main-p256-p doi:10.1145/3832783.3837432
	Dai, Rujie	ASE '26: "Making Theft Useless: Adulteration-Based ..." Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems Weijie Wang, Peizhuo Lv, Yan Wang, Weiqing Huang, Rujie Dai, Guokun Xu, Qiujian Lv, Hangcheng Liu, Hao Hu, and Jiaheng Zhang (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Henan Key Laboratory of Information Security, China; National University of Singapore, Singapore) Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants. Article Search Article: ase26main-p131-p doi:10.1145/3832783.3837418
	Dai, Xiaolong	ASE '26: "Beyond Syntactic Differencing: ..." Beyond Syntactic Differencing: Semantic-Aware Scheduling for Cross-Configuration Incremental Builds Xiaolong Dai, Shanshan Li, Jun Lyu, and Xintao Niu (Nanjing University, China) Modern configurable software systems are routinely built and tested across thousands of configuration variants to ensure correctness under diverse settings. Reusing build artifacts across configurations is therefore crucial to reduce redundant effort, yet remains challenging. Existing approaches estimate rebuild cost using syntactic option differences and apply greedy scheduling, which often misestimate true costs and yield suboptimal build orders. We present SIBS, the first semantics-aware scheduling framework for incremental builds across configurations, addressing both inaccurate cost estimation and the limitations of greedy scheduling. The key idea is a semantic distance metric that models the impact of configuration changes on rebuild scope by capturing option-level effects on code generation, accounting for global configuration headers, and propagating changes through dependency graphs. This enables cost-aware global scheduling formulated as an Asymmetric Traveling Salesman Problem (ATSP). Across 21 real-world systems and five independently sampled configuration batches, SIBS reduces observed build time relative to the state-of-the-art build scheduler in 17 systems. On average, it saves 196s (21%), with a median saving of 40s (3%), and achieves a 27.7% geometric-mean reduction in build time across projects. Batch-level reductions range from 25.7% to 29.3%, and the scheduling overhead remains modest (median 3.1s; mean 12.9s). These results demonstrate that semantics-aware cost modeling and global scheduling provide substantial and robust efficiency gains across diverse configurable systems. Article Search Artifacts Available Article: ase26main-p2497-p doi:10.1145/3832783.3837533
	Dalloro, Livio	ASE '26: "Catching Developers in the ..." Catching Developers in the Flow: Low-Latency Agentic Program Repair at Google Scale Celal Ziftci, Spencer Greene, Ray Liu, Livio Dalloro, and Lorenzo Dini (Google, USA) Manual repair of program failures is time-consuming and disruptive for software developers, particularly during the pre-submit phase where test failures occur within continuous integration systems. While Automated Program Repair has seen significant advancement through Large Language Models, existing state-of-the-art techniques primarily focus on post-submit workflows, operating offline without the low-latency requirements necessary to assist developers in real-time within their flow before they switch context. In this paper, we introduce FlowAgent, an AI agent deployed at Google to automatically repair test failures in the pre-submit outer-loop workflow inside continuous integration systems. Integrated into Google’s internal developer tools, Critique and Cider, FlowAgent utilizes a ReAct-style generate-and-validate loop, as well as rigorous pre-execution and post-execution abstention filters to ensure high-quality suggestions under strict latency constraints. Based on our case studies, FlowAgent is highly effective. First, a manual evaluation conducted on 195 real-world test failures demonstrated 67.18% accuracy in suggesting correct fixes. Following its Google-wide deployment, FlowAgent suggested fixes on 295,508 changes, of which developers previewed 65,069 and applied 28,554. Developer feedback from interviews indicate that the agent is useful in suggesting correct fixes, integration of autonomous repair agents into industrial software engineering workflows is received well, while interesting challenges and opportunities still remain. Article Search Article: ase26ind-p231-p doi:10.1145/3832783.3834511
	Dalpiaz, Fabiano	ASE '26: "Can Large Language Models ..." Can Large Language Models Decompose User Stories into Tasks? Exploring the Role of Prompting Strategies and Models Delina Ly, Fatma Başak Aydemir, and Fabiano Dalpiaz (VX Company, Netherlands; Utrecht University, Netherlands) Refining user stories (USs) into tasks is an important step in agile software development, as it translates software requirements into project management artifacts that are assigned to team members. This story-to-task decomposition can be tedious. In this paper, we propose and evaluate DELTA, a Large Language Model (LLM)-based approach that automatically generates tasks from USs and assesses the quality of the resulting decompositions. We conduct a two-phase empirical study to evaluate DELTA. In the first phase, we identify the best-performing DELTA configuration by comparing different prompting strategies, LLM families, and sizes using text similarity metrics on human-created and LLM-generated decompositions. The comparison based on these metrics did not identify a single consistently best-performing configuration. Therefore, in the second phase, we conducted an expert evaluation to determine whether the observed differences in text similarity are reflected in expert judgments and whether DELTA’s criteria-based evaluation module, which uses LLM judges, aligns with expert judgments. Our results show that DELTA’s evaluation module produces rankings that align more closely with expert judgments than text similarity metrics. Moreover, experts generally prefer the top three LLM-generated decompositions, as ranked by LLM judges, over those created by humans, and they express a willingness to adopt DELTA. Article Search Artifacts Available Article: ase26main-p4215-p doi:10.1145/3832783.3837558
	Damevski, Kostadin	ASE '26: "A Low-Cost Human-in-the-Loop ..." A Low-Cost Human-in-the-Loop Investigation of Toxicity on GitHub at Scale Rahat Rizvi Rahman, Mia Mohammad Imran, and Kostadin Damevski (Virginia Commonwealth University, USA; Missouri University of Science and Technology, USA) Toxic interactions in open source discussions can alienate contributors and threaten project sustainability, yet prior empirical studies of GitHub toxicity have been limited in scale, raising questions about their generalizability. Scaling up is difficult because toxicity on GitHub is often implicit and context-dependent, making both fully manual annotation and LLM-based labeling unreliable. We present a human-in-the-loop (HITL) annotation methodology that makes large-scale, domain-calibrated toxicity labeling practical. A single call to a small, local LLM produces both a toxicity prediction and a set of interpretable event category scores. A lightweight Random Forest validator then uses those scores to flag the small subset of conversations most likely to be mislabeled, directing human review only where it is needed. The validator outperforms confidence-based and multi-LLM baselines while adding low annotation cost. We apply this pipeline to over 124,000 GitHub issue and pull request conversations. Using the resulting dataset, we evaluate key findings from prior small-scale research, confirming some and qualifying others, and present new insights into the prevalence, characteristics, and dynamics of toxicity across diverse open source projects. Article Search Article: ase26main-p1633-p doi:10.1145/3832783.3837505
	D'Amici, Aureliano	ASE '26: "AIGen: Automating AI Bill ..." AIGen: Automating AI Bill of Materials Generation through Hybrid MLOps Integration Federica Pepe, Daniele Bifolco, Costantino Martignetti, Aureliano D'Amici, Fabiano Izzo, Damian Andrew Tamburri, and Massimiliano Di Penta (University of Sannio, Italy; Smart Shaped, Italy) The responsible development and deployment of artificial intelligence (AI) systems requires rigorous documentation of their constituent artifacts, e.g., datasets, model weights, training pipelines, and runtime dependencies. Although the Software Package Data Exchange (SPDX) 3.0 standard introduced native support for AI and dataset profiles, practical tooling capable of generating standards-compliant AI Bills of Materials (AIBoMs) in an automated and extensible manner remains scarce. This paper presents AIGen, a modular AIBoM generator that produces machine-readable, interoperable inventories of AI system components that comply with the SPDX 3.0 AI profile. AIGen works on top of the MLflow MLOps framework and combines mining heuristics with Large Language Models to generate AIBoMs. A plugin interface allows practitioners to extend the tool with domain-specific collectors without modifying the core codebase, supporting heterogeneous AI frameworks such as Hugging Face, PyTorch, and TensorFlow. AIGen is designed to facilitate compliance with the European Union AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001, providing a concrete, reusable foundation for transparent, accountable AI supply chain governance. Tool URL: https://github.com/danielebifolco/AIGen Tool Video: https://youtu.be/_nAbXDWfVL4 Article Search Article: ase26tool-p57-p doi:10.1145/3832783.3834615
	Dan, Gyeongmin	ASE '26: "SpecTrum: Specification-Guided ..." SpecTrum: Specification-Guided Differential Fuzzing for Ethereum Consensus Clients Seokhun Jeong, Gyeongmin Dan, Sukyoung Ryu, and Sungjae Hwang (KAIST, Republic of Korea; Sungkyunkwan University, Republic of Korea) Ethereum's consensus safety relies on independent consensus client implementations agreeing on every state transition. When they diverge due to implementation errors, the network can fork, finality can stall, and severe attacks are possible. To prevent such consensus divergences, Ethereum provides a Python reference implementation (consensus-spec), which acts as a specification, and a hand-crafted official test suite (spectests). However, as an executable implementation, Ethereum's specification defines validity implicitly through runtime behavior. As a result, it lacks a systematic way to ensure that all validity conditions are thoroughly evaluated. We present SpecTrum, a framework that addresses this problem in three stages. First, we introduce Consensus-SpecTec, a mechanized specification of the Ethereum consensus algorithm, which makes validity conditions explicit as if-premises. Second, we define premise coverage, a metric that measures which if-premises are evaluated to true and false across spectests. Third, we develop a specification-based test generator that extracts constraints on premises not evaluated to false by spectests and generates inputs to evaluate them. Applying SpecTrum to five major Ethereum consensus clients, we identify 27 cross-client divergence cases, 22 of which cannot be found without the premises inserted in our mechanization. All 27 cases reproduce across fork versions, and extending the mechanized specification to a new fork takes modest effort proportional to the specification difference. Article Search Artifacts Available Article: ase26main-p1970-p doi:10.1145/3832783.3834406
	Dang, Yingnong	ASE '26: "When Does AI Actually Help ..." When Does AI Actually Help in Incident Response? Identifying Good First Messages in Cloud Service Incidents Minghua Ma, Rujia Wang, Chetan Bansal, Saravan Rajmohan, Yingnong Dang, and Hongyu Zhang (Microsoft, USA; Chongqing University, China) Modern cloud services increasingly rely on agentic software operations, where AI agents, rule-based automation (monitoring alerts, health checks, template runbooks), and human engineers coordinate incident response through shared discussion threads. As these systems mature, the on-call engineer faces a growing volume of machine-generated messages and must quickly identify which ones actually help, under minutes-level time pressure where every moment spent reading noise delays mitigation. We study this problem across thousands of production incidents from 5 cloud services over four years (2022 to 2026). We define a good first message (GFM): the first machine-generated message in an incident discussion thread whose specific content demonstrably influences the on-call engineer’s next investigation action. Three findings emerge. First, incident threads grew 7× longer (from a median of 4 to 30 messages) as AI agents were introduced, yet noise (messages lacking substantive technical content) decreased: among the three actor types, AI agents, rule-based automation, and humans, AI produces the lowest noise rate. Second, AI agents and automation are complementary, covering different workflow roles (e.g., diagnosis vs. monitoring) rather than duplicating each other. Third, only about one in five incidents contains a GFM; influence varies dramatically by functional role but far less by actor type: what a message says matters more than who posted it. We further show that GFMs can be surfaced automatically: σ-rank, an LLM ranker whose prompt encodes domain knowledge from the empirical study, places the GFM in the top 3 of ∼20 machine messages 89% of the time, reducing the engineer’s noise-reading burden by 7×. These results provide the first empirical evidence of how deployed AI output is actually consumed during live incidents and offer a practical mechanism to cut through information overload in time-critical incident response. Article Search Article: ase26main-p860-p doi:10.1145/3832783.3837473
	D'Antoni, Loris	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Daoudi, Nadia	ASE '26: "BESSER-NN: Visual Neural Network ..." BESSER-NN: Visual Neural Network Design and Automated Code Generation with the BESSER Low-Code Platform Nadia Daoudi, Armen Sulejmani, and Jordi Cabot (Luxembourg Institute of Science and Technology, Luxembourg; University of Luxembourg, Luxembourg) Neural networks (NNs) are a fundamental component of AI-enhanced software systems, often built following model-driven engineering (MDE) / low-code approaches. Yet, while MDE tools support the modelling of most system components, designing and implementing NNs remains a manual, repetitive, and error-prone task that requires expertise in framework-specific APIs such as PyTorch or TensorFlow. In this paper, we address this gap by extending the BESSER web modelling editor to support NN diagram design and automatic code generation. Our tool relies on a formal NN metamodel, which provides a framework-agnostic representation of neural networks that is automatically converted to runnable PyTorch and TensorFlow code, covering both architecture definition and training and test processes. We validate our tool on a set of representative NN architectures and demonstrate correct code generation across both frameworks. By building on the BESSER platform, our work paves the way for treating NNs as modelled artifacts within a unified MDE workflow. Our tool is open-source, released under the MIT license, and accessible at https://editor.besser-pearl.org/. A video demonstration is available at https://youtu.be/DCb6qwnnlQc Article Search Article: ase26tool-p5-p doi:10.1145/3832783.3834595
	Davis, James C.	ASE '26: "Context-Aware Trust Verification ..." Context-Aware Trust Verification for Identity-Based Software Signing Chinenye Okafor, James C. Davis, and Santiago Torres-Arias (Purdue University, USA) Modern software release infrastructure uses identity-based software signing to associate software artifacts with a known identity. For example, registries such as npm and Docker Hub rely on Sigstore’s identity-based software signing in their artifact provenance workflows. However, existing verification procedures only provide evidence of a signer’s identity, but not the conditions under which signing occurred. As a result, compromised credentials, identity providers, or signing tools can still produce signatures that pass verification. This gap prevents software engineering tools (e.g., package registries, dependency analysis tools, deployment systems, and CI/CD verification stages) from enforcing verifiable context-aware trust policies for software signing. We present DiVerify, a framework for automated verification of software signing conditions. A DiVerify signature binds identity claims from multiple independent scope providers, signing-environment attestation from a TEE-isolated daemon, and the signing key into a single verifiable object. A machine-checkable policy language specifies the identity, authentication, and environment conditions required for accepting a signature. We formally analyze DiVerify and show that it is sound, prototype it across three deployment modes, and demonstrate overhead under 400ms, with storage overhead of less than 1.6% of average PyPI package size. Case study integrations with existing systems confirm DiVerify composes well. Article Search Article: ase26main-p30-p doi:10.1145/3832783.3834333
	Dehghan, Saman	ASE '26: "From Plan to Action: How Well ..." From Plan to Action: How Well Do Agents Follow the Plan? Shuyang Liu, Saman Dehghan, Jatin Ganhotra, Martin Hirzel, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; IBM, USA) Agents are commonly instructed to follow a task-specific plan for guidance.However, it is unknown to what extent agents actually follow instructed plans. Without such an analysis---determining the extent agents comply with a given plan---it is impossible to assess whether a solution was reached through correct strategic reasoning or through other means, e.g., data contamination or overfitting to a benchmark. This paper presents the first extensive, systematic analysis of plan compliance in programming agents, examining 21,120 trajectories from SWE-agent across four LLMs on SWE-bench Verified and SWE-bench Pro under eight plan variations. Without an explicit plan, agents fall back on internalized workflows during training, which are often incomplete, overfit, or inconsistently applied. Providing the standard plan improves issue resolution, and we observe that periodic plan reminders can mitigate plan violations and improve task success. A subpar plan hurts performance even more than no plan at all. Surprisingly, inserting additional task-relevant phases in the early stage can degrade performance, particularly when these phases do not align with the model’s internal problem-solving strategy. These findings call for fine-tuning paradigms that teach models to follow instructed plans, rather than encoding task-specific plans in them, so that they reason and act adaptively, rather than memorizing workflows. Article Search Article: ase26main-p1675-p doi:10.1145/3832783.3834400
	Delaware, Benjamin	ASE '26: "Adaptive Proof Refinement ..." Adaptive Proof Refinement with LLM-Guided Strategy Selection Minghai Lu, Zhe Zhou, Danning Xie, Songlin Jia, Benjamin Delaware, and Tianyi Zhang (Purdue University, USA; Meta, USA) Formal verification via theorem proving enables rigorous proofs of software correctness, but it is difficult to scale due to the significant manual effort and expertise required. While Large Language Models (LLMs) have shown potential in automating proof generation, they frequently produce incorrect proofs on the first attempt that require iterative refinement to fix. However, most existing approaches employ fixed refinement strategies and cannot dynamically choose an effective strategy, which limits their performance. To overcome this limitation, we introduce Adapt, a novel proof refinement framework that leverages an LLM-guided decision-maker to dynamically select a suitable refinement strategy according to the state of the proof assistant and available context of an incorrect proof. We evaluate Adapt on two benchmark suites against five existing methods and find that it significantly outperforms the best baseline on both by proving 11.26% and 18.58% more theorems, respectively. Furthermore, we demonstrate Adapt’s generalizability by evaluating it across six different LLMs. We also conduct ablation studies to measure the contribution of each component and compare the trade-offs of alternative decision-maker designs. Article Search Article: ase26main-p1291-p doi:10.1145/3832783.3834382
	Delgado Jr., Julio	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Delmas, Rémi	ASE '26: "Kani: A Model Checker for ..." Kani: A Model Checker for Rust Rémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech (Amazon Web Services, USA; Amazon Web Services, UK; Queen Mary University, UK; Brown University, USA; Datadog, USA; Massachusetts Institute of Technology, USA) Rust's ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust's Mid-level Intermediate Representation (MIR) into CBMC's bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign. Article Search Artifacts Available Article: ase26ind-p163-p doi:10.1145/3832783.3834499
	Demeyer, Serge	ASE '26: "Mutation Testing of Simulink ..." Mutation Testing of Simulink Cyber-Physical System Models: Challenges and Solutions in Practice Murat Kavak, Onur Kilincceker, Serge Demeyer, Kevin Vandenbroucke, and Halim Abdurrahman Ceylan (University of Antwerp, Belgium; Flanders Make, Belgium; Duco, Belgium; Ege University, Türkiye) Several experience reports illustrate that mutation testing is capable of supporting a "shift-left" testing strategy, especially in industries where late bug discovery incurs very high costs and risks. In the context of cyber-physical systems, a "shift left" implies that engineers need to test the design models used to simulate, prototype, and analyse the feasibility of the system under design. In this paper, we analyse the challenges we encountered and the lessons we learned when incorporating mutation testing in the context of DUCO, a company producing ventilation systems for buildings. The engineers within DUCO have years of experience with model-based engineering centered around Simulink and StateFlow, including unit tests for their models. During a pilot project with our tool prototype MUT4SLX we learned that equivalent mutants, requirement traceability, and mutation testing for StateFlow represent particular challenges not yet reported in the academic literature. Article Search Article: ase26ind-p356-p doi:10.1145/3832783.3834529
	Denaro, Giovanni	ASE '26: "Continuous On-Commit Certification ..." Continuous On-Commit Certification Testing of Railway Control Software: An Experience Report Jacopo Maltagliati, Salvatore De Simone, and Giovanni Denaro (University of Milano-Bicocca, Italy; Rete Ferroviaria Italiana, Italy) The regulatory standards of railway control software impose stringent certification requirements. These constraints, combined with the heterogeneity of the components, the interactive user interfaces, and the proprietary environments that characterize the development processes of this class of software, complicate the adoption of standard practices for continuous integration and continuous testing. This paper discusses our experience in supporting continuous on-commit certification testing of railway control software in an industrial setting. We describe the challenges that we addressed and the design decisions that we adopted accordingly. The result is a solution for continuous integration and continuous certification testing that decouples build, orchestration, and artifact management using isolated execution environments. It features a multi-runner model that enables efficient on-commit execution of hundreds of certification test sequences, supporting full automation of test sequences that require interactions with both the simulated environment and the driver. It aggregates the results from multiple, heterogeneous logging sources, facilitating regression testing, failure analysis, and certification reporting. Overall, our design enables continuous execution of large certification test suites while preserving reproducibility, traceability, and result analysis. Article Search Article: ase26ind-p431-p doi:10.1145/3832783.3834532
	Deng, Gelei	ASE '26: "How Your Credentials Are Leaked ..." How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, and Zhiqiang Li (Griffith University, Australia; Wake Forest University, USA; Nanyang Technological University, Singapore; University of New South Wales, Australia; Zhejiang Sci-Tech University, China; University of Tokyo, Japan; University of Alberta, Canada; Independent Researcher, China) Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research. Article Search Article: ase26main-p928-p doi:10.1145/3832783.3834373 ASE '26: "SAF: An AI-Agent-Ready and ..." SAF: An AI-Agent-Ready and Browser-Accessible Static Analysis Framework for LLVM IR Yuekang Li, Wei Li, Wei Song, Yi Liu, and Gelei Deng (University of New South Wales, Australia; Griffith University, Australia; Nanyang Technological University, Singapore) Static program analysis finds bugs before software ships, and modern checkers for C/C++ depend on whole-program infrastructure: pointer analysis, value-flow tracking, taint analysis, and IFDS-based data flow on top of LLVM. Today’s LLVM-IR frameworks fall short. SVF, Phasar, and Lotus expose their analyses through C++ APIs that require subclassing, recompilation, and pinned LLVM builds; onboarding takes months. CodeQL replaces the C++ API with a domain-specific query language. None is designed for the AI coding agents that increasingly drive software-engineering work. We present the Static Analyzer Factory (SAF), an LLVM-IR analysis framework that combines a Rust kernel exposed to Python through PyO3 zero-copy bindings, a WebAssembly and Pyodide browser playground that runs the same SDK with no install, a declarative YAML language for function specifications that the built-in checkers consume at runtime, and two shipped coding-agent skills installable in Claude Code and Codex. As an illustrative case, SAF’s bundled memory-safety checkers were themselves authored end-to-end through this workflow using Claude Code on the Opus 4.6 model. On the NIST Juliet C/C++ benchmark, these checkers achieve the best F1 on three of four memory-safety CWEs, each measured against whichever of SVF and Lotus ships a corresponding checker. Code: https://github.com/Static-Analyzer-Factory/static-analyzer-factory. Documentation and browser playground: https://static-analyzer-factory.github.io/static-analyzer-factory/. Demo video: https://youtu.be/Cj58VvNCrlw. Article Search Article: ase26tool-p8-p doi:10.1145/3832783.3834597
	Deng, Le	ASE '26: "Doc2Feat-Bench: Evaluating ..." Doc2Feat-Bench: Evaluating Documentation-Driven Feature Addition Zhonghao Jiang, Le Deng, Jialun Cao, Michael Pradel, and Zhongxin Liu (Zhejiang University, China; Hong Kong University of Science and Technology, Hong Kong; CISPA Helmholtz Center for Information Security, Germany) Documentation changes in mature software projects often describe newly introduced or modified behavior. This makes them a natural basis for documentation-driven feature addition, where software engineering agents implement features from public-facing documentation updates. However, existing benchmarks for agentic software development primarily rely on issue reports written for maintainer coordination and often contain implementation-level details. Motivated by this observation, this work introduces Doc2Feat-bench, a benchmark for documentation-driven feature addition. Doc2Feat-bench consists of 634 tasks across 10 mature open-source software projects, involving about 114k code changes in total. Each task pairs a documentation change with the corresponding implementation and developer-written tests, enabling evaluation of whether a software engineering agent can implement the feature described by the documentation diff. The benchmark is constructed through a five-phase pipeline, starting from release notes, and offers broad coverage across libraries, developer tools, and frameworks while preserving real-world development settings. To facilitate lightweight and reliable evaluation under limited resources, we further curate a human-validated subset named Doc2Feat-bench Verified. It contains 114 high-quality instances whose task clarity and evaluation validity are manually verified. We use Doc2Feat-bench to assess a range of state-of-the-art software engineering agents with two widely used scaffolds. Experimental results show that despite significant token consumption, the best task success rate remains as low as 37.72% (OpenHands with Qwen3-Coder-480B). Our analysis reveals that software engineering agents face key challenges in performing cross-file edits, understanding existing code modules, and correctly interpreting documentation semantics. Article Search Article: ase26main-p1306-p doi:10.1145/3832783.3837489
	Deng, Shuiguang	ASE '26: "ARMOR: A Robust Self-Supervised ..." ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality Wenzhuo Qian, Hailiang Zhao, Ziqi Wang, Zhipeng Gao, Jiayi Chen, Zhiwei Ling, and Shuiguang Deng (Zhejiang University, China) Automated incident management is critical for microservice reliability. While recent unified frameworks leverage multimodal data for joint optimization, they unrealistically assume perfect data completeness. In practice, network fluctuations and agent failures frequently cause missing modalities. Existing approaches relying on static placeholders introduce imputation noise that masks anomalies and degrades performance. To address this, we propose ARMOR, a robust self-supervised framework designed for missing modality scenarios. ARMOR features: (i) a modality-specific asymmetric encoder that isolates distribution disparities among metrics, logs, and traces; and (ii) a missing-aware gated fusion mechanism utilizing learnable placeholders and dynamic bias compensation to prevent cross-modal interference from incomplete inputs. By employing self-supervised auto-regression with mask-guided reconstruction, ARMOR jointly optimizes anomaly detection (AD), failure triage (FT), and root cause localization (RCL). AD and RCL require no fault labels, while FT relies solely on failure-type annotations for the downstream classifier. Extensive experiments demonstrate that ARMOR achieves state-of-the-art performance under complete data conditions and maintains robust diagnostic accuracy even with severe modality loss. Article Search Article: ase26main-p102-p doi:10.1145/3832783.3834338
	Deng, Yang	ASE '26: "SustainSR: Interpretable OSS ..." SustainSR: Interpretable OSS Sustainability Prediction via Symbolic Regression Yang Deng, Mustafa Misir, Jinfu Chen, and Jifeng Xuan (Wuhan University, China; Duke Kunshan University, China) Open-source software (OSS) has become a foundational component of modern software ecosystems. Early prediction of OSS sustainability is crucial for identifying potential risks and supporting timely intervention.Existing approaches formulate OSS sustainability prediction task as a binary classification problem using Deep Learning (DL) models.However, their black-box nature obscures the decision process and undermines the credibility of the predictions.To address this limitation, we propose SustainSR, an interpretable symbolic regression–based method for OSS sustainability prediction.SustainSR reformulates prediction task as a function-learning problem and uses Genetic Programming (GP) algorithm to learn explicit sustainability expressions.We further apply Taylor expansion to quantify feature importance and pairwise interactions.The quantified results facilitate early risk identification and actionable intervention guidance.We evaluate SustainSR on Apache and GitHub projects from three dimensions: fitting performance, predictive performance, and interpretability.Results show that SustainSR significantly outperforms most baselines, it improves AUC by 1%-4% and F1avg by 3%-7% over the best-performing baseline.Case studies further demonstrate that SustainSR offers actionable sustainability insights to support risk identification, project selection, and community governance.Overall, SustainSR provides an effective and interpretable solution for OSS sustainability analysis, bridging the gap between predictive performance and interpretability. Article Search Article: ase26main-p823-p doi:10.1145/3832783.3834366
	Deng, Yuetang	ASE '26: "Model-Guided Property-Based ..." Model-Guided Property-Based Testing of WeChat Pay at Billion-User Scale Xiangchen Shen, Yiting Wang, Ting Su, Jingjing Liang, Jingling Sun, Xixian Liang, Haiying Sun, Xinjie Xu, Haochuan Lu, Yuetang Deng, Pengcheng Wang, Geguang Pu, Zhendong Su, and John Hughes (East China Normal University, China; University of Electronic Science and Technology of China, China; Tencent, China; ETH Zurich, Switzerland; Chalmers University of Technology, Sweden) Ensuring the correctness of mobile payment applications is critical, as even subtle faults can lead to severe financial losses. To ensure reliability, the WeChat Pay (a popular payment app with over one billion active users worldwide) team developed a User Acceptance Testing (UAT) system based on model-based testing (MBT). It maintains use cases specifying user operation sequences and expected app behaviors under business rules. UAT converts these use cases into formal models and generates test cases to validate the app. Although UAT achieves 100% state coverage by covering all user operations and business rules, it still suffers from two major limitations: insufficient test coverage and predefined test oracles. In this paper, we introduce a model-guided property-based testing approach to improving the existing UAT system. We have two key observations: (1) UAT test cases can effectively reach all app states; and (2) WeChat Pay exhibits some invariant behaviors, which can be used to synthesize generic properties for bug finding. Building on these observations, our approach performs random exploration from UAT-discovered states, and validates app behaviors against the automatically synthesized properties. We also propose a greedy trace shrinking algorithm to reduce failure-inducing traces. We implemented our approach as UAT++, an advanced testing tool built upon the UAT system. Across 20,000 machine hours, UAT++ found 59 previously unknown bugs, including 48 logic bugs and 11 crash bugs (55 confirmed, 45 fixed). These bugs could not be found by the UAT system and classic property-base testing (PBT). UAT++ improved state transition coverage by 82.6% and 600.0% over the UAT system and classic PBT, respectively. The shrinking algorithm attained an average trace reduction rate of 79.9%. To date, UAT++ has been deployed in the continuous testing pipeline of WeChat Pay across Android, iOS, and HarmonyOS platforms. Article Search Article: ase26ind-p569-p doi:10.1145/3832783.3834537
	Denisov-Blanch, Yegor	ASE '26: "A Few Pages of Markdown: Committed ..." A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, and Sanmi Koyejo (Stanford University, USA; Carnegie Mellon University, USA; Grid Dynamics, USA) Coding agents increase development velocity but also technical debt. Prior work reports only average effects across adopters, hiding wide differences between teams. We introduce RAMP (Repository AI Maturity Profile), a four-level cumulative maturity model grounded in version-controlled artifacts that teams commit to configure AI tools. RAMP runs from behavioral rules and coding standards through named agent definitions to multi-agent orchestration, with observed practice concentrated in the first three levels. Across 441 repositories the levels behave as a cumulative scale, and independent human annotation reproduces RAMP’s repository-level labels on 97 Article Search Article: ase26main-p2970-p doi:10.1145/3832783.3837546
	Deshpande, Prathamesh	ASE '26: "eARCO: Efficient Automated ..." eARCO: Efficient Automated Root Cause Analysis with Prompt Optimization Drishti Goel, Raghav Magazine, Supriyo Ghosh, Akshay Nambi, Prathamesh Deshpande, Xuchao Zhang, Chetan Bansal, and Saravan Rajmohan (University of Illinois at Urbana-Champaign, USA; Microsoft Research, India; Inception, United Arab Emirates; Microsoft, India; Microsoft Research, USA; Microsoft, USA; Microsoft 365, USA) Root cause analysis (RCA) for incidents in large-scale cloud systems is a complex, knowledge-intensive task that often requires significant manual effort from on-call engineers (OCEs). Improving RCA is vital for accelerating the incident resolution process and reducing service downtime and manual efforts. Recent advancements in Large-Language Models (LLMs) have proven to be effective in solving different stages of the incident management lifecycle including RCA. However, existing LLM-based RCA recommendations typically leverage default finetuning or retrieval augmented generation (RAG) methods with static, manually designed prompts, which lead to sub-optimal recommendations. In this work, we leverage 'PromptWizard', a state-of-the-art prompt optimization technique, to automatically identify the best optimized prompt instruction that is combined with semantically similar historical examples for querying underlying LLMs during inference. Moreover, by utilizing more than 180K historical incident data from Microsoft, we developed cost-effective finetuned small language models (SLMs) for RCA recommendation generation and demonstrate the power of prompt optimization on such domain-adapted models. Our extensive experimental results show that prompt optimization can improve the accuracy of RCA recommendations by 21% and 13% on 3K test incidents over RAG-based LLMs and finetuned SLMs, respectively. Lastly, our human evaluation with incident owners have demonstrated the efficacy of prompt optimization on RCA recommendation tasks. These findings underscore the advantages of incorporating prompt optimization into AI for Operations (AIOps) systems, delivering substantial gains without increasing computational overhead. Article Search Article: ase26ind-p86-p doi:10.1145/3832783.3834477
	De Silva, Nadeeshan	ASE '26: "On the Reliability of Code ..." On the Reliability of Code Comprehension Proxies Erfan Arvan, Nadeeshan De Silva, Oscar Chaparro, and Martin Kellogg (New Jersey Institute of Technology, USA; William & Mary, USA) Prior work on code comprehension uses different comprehension proxies—for example, Likert-scale ratings or answers to input-output questions about program snippets, usually collected from students, to approximate whether code is comprehensible to software engineers, but the relative reliability of these proxies is not known. This paper investigates the relative reliability of a collection of proxies common in the extant literature with a pair of human studies. First, we conducted an expert-consensus study with a panel of five professional software engineers to establish a ground-truth comprehensibility ranking of eight code snippets by adapting the Delphi expert-consensus protocol. The Delphi protocol is widely used for expert consensus under conditions of uncertainty in other domains such as medicine and national-security forecasting, but to our knowledge, this is its first application to code comprehension research. Second, we conducted a study with 44 student participants who completed comprehension tasks, allowing us to measure 14 comprehension proxies derived from the literature on the same set of eight code snippets. Finally, we conducted a correlation analysis on the results, concluding that proxies 1) derived from input-output questions and 2) that measure response time rather than accuracy are especially reliable. We also found that proxies derived from questions about program syntax (rather than semantics) are especially unreliable, regardless of measurement strategy, which draws into question the reliability of parts of the existing comprehensibility literature. Article Search Artifacts Available Article: ase26main-p2877-p doi:10.1145/3832783.3834425
	De Simone, Salvatore	ASE '26: "Continuous On-Commit Certification ..." Continuous On-Commit Certification Testing of Railway Control Software: An Experience Report Jacopo Maltagliati, Salvatore De Simone, and Giovanni Denaro (University of Milano-Bicocca, Italy; Rete Ferroviaria Italiana, Italy) The regulatory standards of railway control software impose stringent certification requirements. These constraints, combined with the heterogeneity of the components, the interactive user interfaces, and the proprietary environments that characterize the development processes of this class of software, complicate the adoption of standard practices for continuous integration and continuous testing. This paper discusses our experience in supporting continuous on-commit certification testing of railway control software in an industrial setting. We describe the challenges that we addressed and the design decisions that we adopted accordingly. The result is a solution for continuous integration and continuous certification testing that decouples build, orchestration, and artifact management using isolated execution environments. It features a multi-runner model that enables efficient on-commit execution of hundreds of certification test sequences, supporting full automation of test sequences that require interactions with both the simulated environment and the driver. It aggregates the results from multiple, heterogeneous logging sources, facilitating regression testing, failure analysis, and certification reporting. Overall, our design enables continuous execution of large certification test suites while preserving reproducibility, traceability, and result analysis. Article Search Article: ase26ind-p431-p doi:10.1145/3832783.3834532
	Devroey, Xavier	ASE '26: "EnergyTrackr: A Modular Energy ..." EnergyTrackr: A Modular Energy Regressions Detection Tool François Bechet, Jérôme Maquoi, Luís Cruz, Benoît Vanderose, and Xavier Devroey (University of Namur, Belgium; TU Delft, Netherlands) Energy efficiency is increasingly recognized as an important dimension of software quality. As systems evolve rapidly, tracking how energy consumption changes across versions can provide valuable insights for developers and researchers. Although detecting energy regressions (i.e., unintended increases in energy consumption) remains challenging due to measurement variability and complex execution environments, recent advances now make systematic analysis practical. Still, dedicated support for monitoring energy behavior over a project's history is missing. This paper presents EnergyTrackr, a modular, open-source tool for automatically detecting, classifying, and visualizing energy regressions across a commit history. EnergyTrackr traverses a specified set of commits, builds each revision, and measures application-level energy consumption by executing the test suite using the RAPL-based Linux perf utility. It applies established best practices for measurements such as warm-up, randomized execution, repetition, and thermal control. The resulting data are analyzed through a statistical pipeline that filters outliers and classifies energy changes using multiple criteria (e.g., significance, practical impact, ...). EnergyTrackr generates interactive reports that provide a comprehensive view of energy evolution and is designed for easy integration into existing Linux workflows. A preliminary evaluation on large Java projects shows that EnergyTrackr can produce stable measurements at scale and effectively identify energy regressions. Source: https://github.com/snail-unamur/energytrackr. Screencast: https://doi.org/10.5281/zenodo.21507425. Article Search Article: ase26tool-p125-p doi:10.1145/3832783.3834640 ASE '26: "UltraInstinctVR: A Model-Based ..." UltraInstinctVR: A Model-Based Tool for Automated System Testing of VR Applications Gerry Longfils, Maxime Cauz, Arnaud Blouin, and Xavier Devroey (University of Namur, Belgium; INSA Rennes, France) Virtual Reality (VR) applications are increasingly used in domains such as surgical training and industrial marketing, yet their longterm adoption remains limited by the lack of effective, systematic, and reproducible testing approaches tailored to VR. To address this gap, we present UltraInstinctVR, a novel tool that automates the generation and execution of concrete system-level tests for VR applications, helping developers efficiently validate interactions and behaviors. We evaluated UltraInstinctVR against state-of-the-art automated VR testing tools across 10 open-source VR applications, where it outperformed existing approaches in detecting unique failures and uncovering real-world bugs. In this paper, we further extended this evaluation through an empirical user study with ten VR developers. Results highlight strong dependability and efficiency while identifying opportunities for improvement in other user experience dimensions. Overall, these findings position UltraInstinctVR as a promising step toward more practical, effective, and scalable VR testing. The tool is publicly available at https://github.com/snailunamur/UltraInstinctVR, with a demonstration video available at https://youtu.be/U8DWTmXmeh4. Article Search Article: ase26tool-p141-p doi:10.1145/3832783.3834642
	Dhakal, Maria	ASE '26: "Programming by Chat: A Large-Scale ..." Programming by Chat: A Large-Scale Behavioral Analysis of 11,579 Real-World AI-Assisted IDE Sessions Ningzhi Tang, Chaoran Chen, Zihan Fang, Gelei Xu, Maria Dhakal, Yiyu Shi, Collin McMillan, Yu Huang, and Toby Jia-Jun Li (University of Notre Dame, USA; Vanderbilt University, USA) IDE-integrated AI coding assistants, which operate conversationally within developers' working codebases with access to project context and multi-file editing, are rapidly reshaping software development. However, empirical investigation of this shift remains limited: existing studies largely rely on small-scale, controlled settings or analyze general-purpose chatbots rather than codebase-aware IDE workflows. We present, to the best of our knowledge, the first large-scale study of real-world conversational programming in IDE-native settings, analyzing 74,998 developer messages from 11,579 chat sessions across 1,300 repositories and 899 developers using Cursor and GitHub Copilot. These chats were committed to public repositories as part of routine development, capturing in-the-wild behavior. Our findings reveal three shifts in how programming work is organized: conversational programming operates as progressive specification, with developers iteratively refining outputs rather than specifying complete tasks upfront; developers redistribute cognitive work to AI, delegating diagnosis, comprehension, and validation rather than engaging with code and outputs directly; and developers actively manage the collaboration, externalizing plans into persistent artifacts, and negotiating AI autonomy through context injection and behavioral constraints. These results provide foundational empirical insights into AI-assisted development and offer implications for the design of future programming environments. Article Search Article: ase26main-p1071-p doi:10.1145/3832783.3834377
	Di, Peng	ASE '26: "Free Is More: Empowering Software ..." Free Is More: Empowering Software Agents via Issue-Free Trajectory Learning and Entropy-Aware RLVR Training Xin-Cheng Wen, Binbin Chen, Haoxuan Lan, Hang Yu, Peng Di, and Cuiyun Gao (Harbin Institute of Technology, Shenzhen, China; Ant Group, China; Zhejiang University, China; University of New South Wales, Australia) Large language models (LLMs) have transformed the software engineering landscape. Recently, numerous LLM-based agents have been developed to address real-world software issue fixing tasks. These agents are typically equipped with various coding tools, enabling them to autonomously generate action trajectories for end-to-end problem-solving. Despite their state-of-the-art performance, these agents still face two primary challenges: (1) Lack of sufficiently high-quality issue descriptions: Inconsistencies between issue descriptions and their corresponding solutions introduce noise and ambiguity that can mislead automated agents, restricting their ability to derive effective solutions. Furthermore, high-quality issue-PR pairs are difficult to acquire at scale, and the available datasets remain relatively limited in size. (2) Uncertainty introduced by bash tools prevents stable training and sufficient exploration: Bash tools serve as the primary interface for code execution and file manipulation in SWE agents, making them integral to virtually all agent operations. However, bash tools introduce substantial uncertainty into the agent's decision-making process. In reinforcement learning with verifiable rewards (RLVR), the fixed probability ratio clipping mechanism exhibits limited adaptability to such varying uncertainty states. Specifically, when bash tool invocations trigger high-entropy states, excessively restrictive clipping constraints impede both exploration and stable learning, hindering the training efficiency. To address these challenges, we propose SWE-Fuse, an issue-description-aware training framework that fuses issue-description-guided and issue-free samples for training SWE agents. It consists of two key modules: (1) An issue-free-driven trajectory learning module, which comprises: a multi-step trajectory construction component for generating high-quality multi-turn reasoning-action trajectories, a trajectory data filtering process for ensuring data quality, and issue-free-driven supervised fine-tuning to mitigate potentially misleading issue descriptions while enabling the model to learn step-by-step debugging processes; and (2) An entropy-aware RLVR training module, which adaptively adjusts training dynamics through entropy-driven clipping. It applies relaxed clipping under high entropy to encourage exploration, and stricter clipping under low entropy to ensure training stability. We evaluate SWE-Fuse on the widely studied SWE-bench Verified benchmark shows to demonstrate its effectiveness in solving real-world software problems. Specifically, SWE-Fuse outperforms the best 8B and 32B baselines by 41.9% and 59.3% in solve rate, respectively. Furthermore, integrating SWE-Fuse with test-time scaling (TTS) enables further performance improvements, achieving solve rates of 49.8% and 65.2% under TTS@8 for the 8B and 32B models, respectively. Article Search Article: ase26main-p3466-p doi:10.1145/3832783.3834438
	Di, Yifeng	ASE '26: "When Dependencies Depend: ..." When Dependencies Depend: A Large-Scale Study on Conditional Dependencies and Their Security Implications in C/C++ Yifeng Di, Juewei Zhang, and Tianyi Zhang (Purdue University, USA; Carnegie Mellon University, USA) Third-party libraries (TPLs) are a major source of software supply chain risk. Yet accurately managing them remains difficult in C/C++, where dependency inclusion is often encoded directly in build scripts rather than using standard package managers. A particularly overlooked challenge is conditional dependencies, i.e., TPLs included only under specific build configurations. C/C++ projects commonly express such conditions through fine-grained CMake logic involving platform checks and user-defined configuration variables, making them difficult for existing Software Composition Analysis (SCA) tools to reason about. To investigate this problem, we conduct a large-scale empirical study of 2K real-world C/C++ projects. We develop Condor, a static analysis approach that parses CMake build files to extract conditional dependencies together with their inclusion logic. Our results show that conditional dependencies are pervasive: among projects with at least one detected TPL, 84.33% contain at least one conditional dependency, and on average 53.77% of declared TPLs are conditionally included. We further find that 87.86% of conditional dependencies are governed by user-defined variables, revealing a C/C++-specific landscape of dependency variability that is difficult for existing SCA tools to capture. Finally, our evaluation of four popular SCA tools shows that up to 48.33% of reported vulnerable dependencies are conditionally included and may become false alarms if not included in a given build configuration. These findings highlight a key limitation of current SCA practice and motivate configuration-aware vulnerability analysis for C/C++ projects. Article Search Article: ase26main-p1654-p doi:10.1145/3832783.3834398
	Diao, Wenrui	ASE '26: "Structure-Guided Semantic ..." Structure-Guided Semantic Deobfuscation of Android Identifiers Mingyang Chen, Zhentao Xie, Yaqi Gao, Shuang Li, and Wenrui Diao (Shandong University, China) Android developers frequently employ identifier renaming to obfuscate code and hinder reverse engineering. This practice effectively conceals program semantics. However, it severely impedes downstream security analysis tasks, particularly manual inspection of malicious and privacy-sensitive behaviors. Existing deobfuscation techniques rely on code similarity, learned naming priors, or local LLM reasoning. These methods often exhibit severe limitations when applied to proprietary, heavily obfuscated, or cross-file context-dependent code. In this paper, we present DeMask, a novel framework that integrates static program analysis with Large Language Models (LLMs) to recover meaningful identifiers from obfuscated Android apps. Guided by program structure, DeMask executes a bottom-up, context-aware inference process for whole-app semantic reconstruction. It incorporates tailored naming constraints and optimization strategies to mitigate LLM hallucinations and ensure scalability for real-world codebases. We implemented a prototype and evaluated it on diverse datasets of benign and malicious Android apps. The results demonstrate that DeMask significantly outperforms prior work in semantic accuracy and naming consistency. Specifically, it achieves an average effective semantic recovery of over 88.6% across all evaluation settings. Article Search Article: ase26main-p2252-p doi:10.1145/3832783.3837525
	Dick, Tobias	ASE '26: "FlightRecorder: Tracing Fine-Grained ..." FlightRecorder: Tracing Fine-Grained Development with AI Assistants Tobias Dick, Benedict Bliem, Kallistos Weis, Alisa Welter, and Sven Apel (Saarland University, Germany) AI coding assistants like GitHub Copilot are transforming software development. Yet fundamental questions remain about how code evolves as developers collaborate with AI agents, particularly at fine-grained levels of interaction -- a gap that persists partly because existing telemetry cannot distinguish agent-generated changes from inline completions and human edits, nor precisely track when and where they occur. To address this gap, we present FlightRecorder, a lightweight VSCode extension that collects fine-grained code evolution data without disrupting the workflows of developers. Our extension integrates three data sources: snapshots of agent-mode edits, inline completions, and chat history, all timestamped for precise attribution. Researchers can export these data in structured formats alongside anonymization and basic visualization functionality. By making such fine-grained evolution data accessible, FlightRecorder enables researchers to investigate fundamental questions about AI-assisted development. We provide a replication package, including the code for FlightRecorder and the data used throughout our paper, at https://doi.org/10.5281/zenodo.20134365. We further provide a screencast demo of our tool at https://youtu.be/bZR6aPROVMU. Article Search Artifacts Available Article: ase26tool-p38-p doi:10.1145/3832783.3834607
	Di Grazia, Luca	ASE '26: "All or Nothing: How Library ..." All or Nothing: How Library Type Annotations Affect Client-Side Errors in Python Eric Asare, Luca Di Grazia, and Sarah Nadi (New York University Abu Dhabi, United Arab Emirates; University of St. Gallen, Switzerland) Python’s gradual typing promises that library-side type annotations will propagate safety benefits to downstream clients. Despite over 83% of popular libraries now containing annotations, no empirical evidence exists on whether these efforts actually reduce type errors in client code. We present the first large-scale empirical study of this downstream impact, analyzing the interaction between 13,751 actively maintained client repositories and over 4,178 distinct third-party libraries using the Pyright static type checker. Our results show that (i) 70% of client repositories contain at least one type error stemming from third-party API usage, (ii) the error distribution is heavily skewed, with a small subset of widely used libraries, i.e., numpy, django, pandas, and pytorch, accounting for a disproportionate share of the ecosystem-wide error burden, (iii) measurable benefits of reduced error risks and propagation can only be seen with near-complete annotation coverage (≥ 90%), and (iv) although 60% of library-client pairs are aligned in their typing efforts, only 10% achieve the ideal scenario where highly annotated libraries meet client-side static type checking. Our findings expose a pervasive ecosystem gap: client adoption of static type checking outpaces library annotation efforts, with 19% of cases representing missed opportunities where clients use type checkers but their dependencies lack sufficient annotations. These results call for prioritizing comprehensive annotation of widely used libraries to unlock the full potential of Python’s gradual typing. Article Search Artifacts Available Article: ase26main-p3300-p doi:10.1145/3832783.3834434
	Ding, Guozhen	ASE '26: "RFC2TLA+: Extracting and Verifying ..." RFC2TLA+: Extracting and Verifying Formal Models from RFC Documents using Continuous LLM Feedback Guozhen Ding, Kexin Li, Ilya Grishchenko, and David Lie (University of Toronto, Canada) Extracting natural-language protocol specifications such as Requests for Comments (RFCs) into formally verifiable models is a challenging and labor-intensive process that requires significant expertise. Recent advances in large language models (LLMs) and agents show promise in automating this task. However, existing automated approaches suffer from insufficient structural consistency, hallucinations, and limited scalability. Moreover, the ability to pass such automatically extracted models into formal verification tools such as model checkers has not been demonstrated. We present RFC2TLA+, a three-stage pipeline for automatically extracting RFCs into automatically verifiable models. RFC2TLA+ achieves this by providing fine-grain and continuous feedback to the LLM throughout the extraction process. It decomposes the extraction process into three passes—states, transitions, and invariants—while constraining LLM generation through fine-grained tool calls, lightweight validation, and iterative feedback. This design enables early error detection and correction, mitigating hallucinations and preventing syntactic and semantic inconsistencies. The resulting communicating finite-state machines (CFSMs) are deterministically translated into TLA + and verified using the TLC model checker. We evaluate RFC2TLA+ on a benchmark of 14 RFCs and their accompanying human-crafted FSMs and show that it generates more complete models than the baseline. In addition, our tool extracts invariants, enabling a model checker to detect injected faults. To minimize the effects of LLM memorization, we additionally generate synthetic RFCs and evaluate the tool on them, demonstrating its effectiveness in both model extraction and error detection. Article Search Artifacts Available Article: ase26main-p683-p doi:10.1145/3832783.3837453
	Ding, Zishuo	ASE '26: "ReLog: Execution-Aware Logging ..." ReLog: Execution-Aware Logging with Runtime Feedback for LLM-Oriented Debugging Xin Wang, Yang Feng, Xiaoqian Jiao, Yang Zhang, Zhenhao Li, and Zishuo Ding (Hong Kong University of Science and Technology, Guangzhou, China; Hebei University of Science and Technology, China; York University, Canada) Logging statements are essential for software debugging and maintenance. However, existing approaches to automatic logging generation rely on static analysis and produce statements in a single pass without considering runtime behavior. They are also typically evaluated by similarity to developer-written logs, assuming these logs form an adequate gold standard. This assumption is increasingly limiting in the LLM era, where logs are consumed not only by developers but also by LLMs for downstream tasks. As a result, optimizing logs for human similarity does not necessarily reflect their practical utility. To address these limitations, we introduce ReLog, an iterative logging generation framework guided by runtime feedback. ReLog leverages LLMs to generate, execute, evaluate, and refine logging statements so that runtime logs better support downstream tasks. Instead of comparing against developer-written logs, we evaluate ReLog through downstream debugging tasks, including defect localization and repair. We construct a benchmark based on Defects4J under both direct and indirect debugging settings. Results show that ReLog consistently outperforms all baselines, achieving an F1 score of 0.520 and repairing 97 defects in the direct setting, and the best F1 score of 0.408 in the indirect setting where source code is unavailable. Additional experiments across multiple LLMs demonstrate the generality of the framework, while ablations confirm the importance of iterative refinement and compilation repair. Overall, our work reframes logging as a runtime-guided, task-oriented process and advocates evaluating logs by their downstream utility rather than textual similarity. Article Search Article: ase26main-p769-p doi:10.1145/3832783.3837463 ASE '26: "EffiHolmes: Differential Profiling-Guided ..." EffiHolmes: Differential Profiling-Guided Repository Level Time Inefficiency Fix Localization Haowen Yang, Yun Peng, and Zishuo Ding (Hong Kong University of Science and Technology, Guangzhou, China; Chinese University of Hong Kong, Hong Kong) Large software systems often suffer from time inefficiencies, leading to excessive execution time despite functional correctness. Local- izing the fix locations of such inefficiency issues is notoriously difficult. Applying existing fault localization paradigms to this task presents significant challenges. Unlike functional bugs, time ineffi- ciencies do not cause crashes or test failures. They therefore provide neither binary oracles nor stack-trace localization clues, making traditional fault localization and recent LLM-based methods not ap- plicable. While runtime profiling provides alternative clues, it faces some challenges in repository-level settings. Single-run profiling is non-discriminative, failing to distinguish inefficiency hotspots (i.e., time-consuming functions) from execution noise. Furthermore, existing profilers struggle to extract the execution paths relevant to inefficiency from the vast background execution. Crucially, even with the extracted execution paths, a semantic gap still persists between the observed inefficiency and where to fix. In this paper, we propose EffiHolmes, an LLM-based frame- work for localizing fix locations of repository-level time inefficiency issues. First, it employs differential profiling (default vs. scaled workloads) to pinpoint inefficiency hotspots. Second, to extract the execution paths relevant to inefficiency, it performs execution path extraction, constructing compact execution paths that connect hotspots to the reported inefficient function. Third, to bridge the gap between the hotspots and fix locations, it employs guided LLM reasoning with domain heuristics to locate the inefficiency logic. To facilitate the evaluation, we introduce RepoEffi-Bench, the first benchmark for repository-level inefficiency localization, consisting of 140 high-quality time inefficiency issues collected from popular Python repositories. The results show that EffiHolmes consis- tently outperforms state-of-the-art retrieval-based, agent-based, and profiling-based baselines, with gains of 4.29 pp on GPT-5.1 file- level Acc@3 and 15.00 pp on qwen3-4b function-level Acc@5 over the best baseline. It also remains robust across model capacities. Article Search Article: ase26main-p417-p doi:10.1145/3832783.3834353
	Dini, Lorenzo	ASE '26: "Catching Developers in the ..." Catching Developers in the Flow: Low-Latency Agentic Program Repair at Google Scale Celal Ziftci, Spencer Greene, Ray Liu, Livio Dalloro, and Lorenzo Dini (Google, USA) Manual repair of program failures is time-consuming and disruptive for software developers, particularly during the pre-submit phase where test failures occur within continuous integration systems. While Automated Program Repair has seen significant advancement through Large Language Models, existing state-of-the-art techniques primarily focus on post-submit workflows, operating offline without the low-latency requirements necessary to assist developers in real-time within their flow before they switch context. In this paper, we introduce FlowAgent, an AI agent deployed at Google to automatically repair test failures in the pre-submit outer-loop workflow inside continuous integration systems. Integrated into Google’s internal developer tools, Critique and Cider, FlowAgent utilizes a ReAct-style generate-and-validate loop, as well as rigorous pre-execution and post-execution abstention filters to ensure high-quality suggestions under strict latency constraints. Based on our case studies, FlowAgent is highly effective. First, a manual evaluation conducted on 195 real-world test failures demonstrated 67.18% accuracy in suggesting correct fixes. Following its Google-wide deployment, FlowAgent suggested fixes on 295,508 changes, of which developers previewed 65,069 and applied 28,554. Developer feedback from interviews indicate that the agent is useful in suggesting correct fixes, integration of autonomous repair agents into industrial software engineering workflows is received well, while interesting challenges and opportunities still remain. Article Search Article: ase26ind-p231-p doi:10.1145/3832783.3834511
	Di Penta, Massimiliano	ASE '26: "AIGen: Automating AI Bill ..." AIGen: Automating AI Bill of Materials Generation through Hybrid MLOps Integration Federica Pepe, Daniele Bifolco, Costantino Martignetti, Aureliano D'Amici, Fabiano Izzo, Damian Andrew Tamburri, and Massimiliano Di Penta (University of Sannio, Italy; Smart Shaped, Italy) The responsible development and deployment of artificial intelligence (AI) systems requires rigorous documentation of their constituent artifacts, e.g., datasets, model weights, training pipelines, and runtime dependencies. Although the Software Package Data Exchange (SPDX) 3.0 standard introduced native support for AI and dataset profiles, practical tooling capable of generating standards-compliant AI Bills of Materials (AIBoMs) in an automated and extensible manner remains scarce. This paper presents AIGen, a modular AIBoM generator that produces machine-readable, interoperable inventories of AI system components that comply with the SPDX 3.0 AI profile. AIGen works on top of the MLflow MLOps framework and combines mining heuristics with Large Language Models to generate AIBoMs. A plugin interface allows practitioners to extend the tool with domain-specific collectors without modifying the core codebase, supporting heterogeneous AI frameworks such as Hugging Face, PyTorch, and TensorFlow. AIGen is designed to facilitate compliance with the European Union AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001, providing a concrete, reusable foundation for transparent, accountable AI supply chain governance. Tool URL: https://github.com/danielebifolco/AIGen Tool Video: https://youtu.be/_nAbXDWfVL4 Article Search Article: ase26tool-p57-p doi:10.1145/3832783.3834615 ASE '26: "AIRBORNE: Augmented fIne-grained ..." AIRBORNE: Augmented fIne-grained softwaRe Bill Of mateRials geNerator for stack ovErflow Sabato Nocera, Massimiliano Di Penta, Simone Romano, and Giuseppe Scanniello (University of Salerno, Italy; University of Sannio, Italy) SBOM (Software Bills of Materials) generation tools operate at coarse granularity, capturing only package- or library-level dependencies while overlooking smaller artifacts such as code snippets from Questions & Answers (Q&A) forums such as Stack Overflow (SO). In this tool demo paper, we present AIRBORNE (Augmented fIne-grained softwaRe Bill Of mateRials geNerator for stack ovErflow), a tool that analyzes a software project and generates an augmented fine-grained SBOM enriched with information on self-admitted SO references. AIRBORNE integrates source code analysis, repository mining, and clone detection techniques to align SO provenance with the CycloneDX SBOM standard. We conducted a preliminary assessment of 383 GitHub projects with known self-admitted SO references. The results show that our tool captures fine-grained dependencies whenever developers explicitly acknowledge code snippet reuse through self-admitted references to SO posts. Tool link: https://github.com/MSR4SBOM/airborne Video link: https://youtu.be/HX9wpnrM5tA Article Search Article: ase26tool-p88-p doi:10.1145/3832783.3834631
	Djire, Alberick Euraste	ASE '26: "Evaluating Inference-Time ..." Evaluating Inference-Time Defenses against Package Hallucination in LLM-Generated Code Alberick Euraste Djire, Iyiola E. Olatunji, Melissa Tessa, Earl T. Barr, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg; University College London, UK) LLMs are increasingly used for code generation, yet they frequently hallucinate non-existent software packages, creating exploitable entry points into the software supply chain. We make four contributions to this problem. First, we show that prior evaluation methodologies systematically inflate hallucination rates by misclassifying standard-library modules as hallucinations in some languages. For Python, the overestimation reaches 9.4 percentage points. Second, we evaluate seven inference-time defenses for mitigating package hallucinations, including five guided decoding strategies (Greedy, Contrastive, DoLa, Nudging, and Active Layer-Contrastive Decoding), an iterative self-refinement approach (Self-Refine), and a Retrieval-Augmented Generation (RAG)-based defense. Across eight models spanning five families and four programming languages (Python, JavaScript, Ruby, Rust), RAG reduces the package hallucination rate (PHR) in 18 of 32 model–language configurations. Third, we introduce Package Utility (PU) to assess whether defenses preserve valid and task-relevant recommendations. Among strategies evaluated, Greedy decoding provides the strongest average mitigation–utility trade-off. Fourth, we stress-test all strategies under adversarial prompts seeded with fabricated package names and find that PHR surges by up to 45 percentage points relative to standard prompts, with Ruby consistently the most vulnerable language (80.9–95.2%). Under adversarial conditions, RAG and Self-Refine outperform all decoding-only strategies, indicating that robust defense requires either external grounding or iterative self-verification when prompts are actively hostile. Our results recast package hallucination as both a measurement problem and a decoding-time control problem, and they demonstrate that the choice of defense must be matched to the threat model and recommendation utility. Article Search Article: ase26main-p3592-p doi:10.1145/3832783.3837555 ASE '26: "Do Not Copy/Paste: Soft Barriers ..." Do Not Copy/Paste: Soft Barriers for Copying in AI-Assisted Programming Iyiola E. Olatunji, Alberick Euraste Djire, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg) Copying a function from a chat window into an editor takes less than a second. For many uses of AI coding tools, that speed is the point; in settings such as programming education, code review, and security-sensitive development, it can also be the problem. This paper frames copy-paste as an AI code handoff problem: the moment model-generated text crosses from a conversational context into executable or committed software is a design boundary that current tools leave largely unmanaged. We argue that AI coding assistants should not only be evaluated by the code they generate, but also by how they mediate the transfer of that code into software artifacts. We propose soft barriers as one class of handoff-aware mechanisms. Soft barriers preserve access to AI assistance while making unexamined transfer less frictionless. As an initial technical probe, we instantiate this idea using Unicode output perturbations that preserve visual readability but disrupt naive copy-paste execution. We introduce Copy-Paste Resistance (CPR), the fraction of functionally correct clean solutions that become syntactically invalid after perturbation. Across HumanEval and MBPP with four LLMs and four perturbation families, we find that output-level barriers can achieve high copy-paste resistance, but their effectiveness is highly model- and task-dependent. An exploratory pilot with 18 participants provides early evidence that soft barriers can shift users from direct transfer toward editing and reconstruction. We do not present Unicode perturbations as a deployment-ready solution; rather, we use them as a minimal probe for a broader research agenda on practical, transparent, and policy-aware AI code handoff. Article Search Article: ase26nier-p79-p doi:10.1145/3832783.3834554
	Dong, Caihua	ASE '26: "Verifier-in-the-Loop LLM Solving ..." Verifier-in-the-Loop LLM Solving of Heap Constraints for Concolic Execution Shaoran Xia, Leyi Cheng, Caihua Dong, Dongdong She, Bo Wang, Xin Peng, and Zhen Dong (Fudan University, China; Soochow University, China; Hong Kong University of Science and Technology, China; Beijing Jiaotong University, China) Concolic execution systematically explores program paths by solving symbolic constraints, but in object-oriented software its practical effectiveness is often limited by heap constraints over objects and heap structure, such as nullness, aliasing, runtime types, and field reachability. These constraints form a systematic bottleneck in real-world software because satisfying them requires constructing a concrete heap model rather than merely computing primitive valuations, which existing SMT-based concolic engines and symbolic heap techniques do not handle effectively. We present COHEC, a hybrid concolic architecture that decomposes each target path condition into a primitive component solved by an SMT solver and a heap component handled by a Heap Constraint Solver (HCS). Given extracted heap constraints, HCS uses an LLM to propose candidate heap models and initialization code, while a trusted verifier executes and verifies the generated code, admitting only models whose initialization code constructs states that satisfy all constraints and keeping the LLM outside the trusted computing base. We implement COHEC on top of JDart/JPF and evaluate it on 6,750 APIs from ten Java libraries, together with a stratified sample from commons-lang3 against the LLM-assisted baseline CONCOLLMIC. The results show that COHEC substantially improves path exploration and concrete valuation generation over native JDart, while achieving higher coverage than CONCOLLMIC at lower time and token cost. Overall, the findings indicate that treating heap constraint solving as verified heap model construction is a practical and effective way to extend concolic execution to the object-sensitive behaviors pervasive in modern software. Article Search Artifacts Available Article: ase26main-p2302-p doi:10.1145/3832783.3834410
	Dong, Dezun	ASE '26: "It Takes Two to Tango: Accelerating ..." It Takes Two to Tango: Accelerating Code Generation via Cache-Inspired Hierarchical Speculative Decoding Yinggang Qiu, Shangwen Wang, Yihao Qin, Mingyang Geng, and Dezun Dong (National University of Defense Technology, China; Information Support Force Engineering University, China) While Large Language Models (LLMs) have demonstrated exceptional performance in code generation, their autoregressive decoding paradigm typically results in low inference efficiency. Speculative decoding has emerged as a solution to speed up inference through its draft–verification mechanism, where multiple draft tokens are generated efficiently and then verified in parallel by LLMs. Current speculative decoding approaches for code generation are broadly categorized into two types: model-based approaches that generate drafts using a lightweight draft model, and retrieval-based approaches that reuse code snippets from external corpora. In this work, we first conduct empirical experiments to analyze the strengths and weaknesses of retrieval-based and model-based drafting. We find that retrieval-based approach is efficient but usually low-quality, while model-based one is high-quality but the drafting time increases with inference steps of the draft model. Inspired by the cache mechanism in computer architecture, we propose a novel framework CacheCoder. In our design, retrieval acts as a high-speed Level-1 (L1) cache for rapid draft acquisition, while the draft model functions as a more capable Level-2 (L2) cache to compensate for L1 misses, enabling us to capitalize on the speed of reuse when possible and rely on the precision of generation when necessary. To combine these two hierarchical processes, we propose two customized strategies, i.e., Preliminary Prediction and Draft Expansion, which utilize the draft model to pre-filter retrieved contents and expand them with tokens generated by the draft model to form drafts with higher length. Experimental results show that CacheCoder achieves up to a 2.64× speedup compared to autoregressive decoding, significantly outperforming state-of-the-art approaches. Article Search Article: ase26main-p691-p doi:10.1145/3832783.3837454
	Dong, Jie	ASE '26: "FPSieve: LLM-Powered Cascade ..." FPSieve: LLM-Powered Cascade for Filtering False Positives in OS Migration Testing Jie Dong, Ying Fu, Chao Hu, Yuhang Chen, Qi Xiao, and Heyuan Shi (Central South University, China; Tsinghua University, China; Hunan Congmao Technology, China) Operating system migration requires validating thousands of software packages for behavioral compatibility on the target distribution. Differential testing is the dominant industrial approach. OS level outputs contain many benign differences that are unrelated to package compatibility. These differences produce many false positives. They also bury real compatibility issues under heavy triage load. To address this issue, we first conduct a study of false positive root causes on industrial enterprise Linux migration data. This study yields a five-category taxonomy and a share–cost decision matrix. These findings guide our design. We propose FPSieve, a cost routed filtering pipeline for OS migration validation. FPSieve integrates rule based filtering, semantic similarity filtering, case library retrieval, package level LLM reasoning with confidence based routing, and closed loop container based verification. We evaluate FPSieve on a large scale OS migration differential testing dataset collected from industrial practice. FPSieve reduces the overall manual review queue to 5.9% of its original size while preserving 86.7% recall. It also improves review queue precision from 3.16% to 46.0%. After deduplication, FPSieve surfaced 66 compatibility issues submitted upstream. Of these, 14 received maintainer feedback, and 6 have been fixed. These results show that FPSieve can reduce false positives, reduce manual effort, and improve OS migration validation throughput. Article Search Article: ase26ind-p24-p doi:10.1145/3832783.3834460
	Dong, Jin Song	ASE '26: "AlphaCu: A Transformation-Driven ..." AlphaCu: A Transformation-Driven Synthesis Framework for LLM-Based GPU Kernel Generation Yangjie Zhou, Xing Ma, Zihan Liu, Qing Wang, Weihao Cui, Wu Sun, Hanjing Wang, Binhang Qi, Jingwen Leng, Yun Lin, Minyi Guo, and Jin Song Dong (National University of Singapore, Singapore; Shanghai Jiao Tong University, China; Shanghai Qi Zhi Institute, China; Nanjing University, China; Harvard University, USA) Large language models show promise for code generation, yet their effectiveness in producing high-performance GPU kernels remains insufficiently understood. Recent agentic workflows improve over direct prompting through specialized generation roles and execution feedback, but our characterization of a representative workflow reveals failures in optimization-strategy selection, hardware-specific instruction realization, and shape-dependent parameter selection. We present AlphaCu, a transformation-driven synthesis framework for LLM-based GPU kernel generation. AlphaCu treats kernel generation as structured synthesis over explicit optimization decisions rather than end-to-end code emission. Specifically, AlphaCu represents these decisions as scoped transformation passes maintained across agent-coordinated synthesis stages, enabling compatibility checking and failure attribution. AlphaCu binds selected hardware-sensitive operations to pre-validated microkernels and uses target-device measurements to revise transformation choices and tune runtime configurations. We evaluate AlphaCu on 104 test cases covering single and fused operators across four GPU architectures: NVIDIA H100, A100, V100, and AMD MI210. Under comparable generation budgets, AlphaCu achieves 100% functional correctness on our benchmark suite and delivers an average speedup of 5.64× over prior LLM workflows, while remaining competitive with vendor libraries and tensor compilers. Article Search Article: ase26main-p287-p doi:10.1145/3832783.3837433 ASE '26: "Towards Fully Automated Medical ..." Towards Fully Automated Medical Imaging Code Generation via Validation-Based Context Engineering Zixiao Zhao, Jing Sun, Zhe Hou, Cheng-Hao Cai, Qian Liu, Mengze Li, Zijian Zhang, and Jin Song Dong (University of Auckland, New Zealand; Griffith University, Australia; Monash University, Suzhou, China; Beijing Institute of Technology, China; National University of Singapore, Singapore) Large language models (LLMs) have demonstrated considerable promise in program generation for small-scale and conventional application development; however, they remain limited when applied to complex, domain-specific tasks such as medical image processing. General-purpose models lack explicit domain knowledge and robust validation mechanisms to ensure correctness, often requiring substantial human intervention to produce reliable processing pipelines. To address these limitations, we propose AutoMedImg, a multi-agent framework for fully automated medical image processing code generation. AutoMedImg orchestrates specialised agents across two phases: a Planning Phase that performs dataset analysis and architecture design with semantic and formal verification, and a Coding Phase that generates modules in parallel with static checking, execution testing, and assembly validation. This multi-stage validation mitigates error propagation throughout generation, while comprehensive auto-context engineering combining domain-specific knowledge bases, shared memory, and validation feedback automates context construction without manual prompting. A cross-project adaptive pipeline synthesis mechanism further accumulates validated pipelines and retrieves proven components for new tasks based on project similarity, enhancing generation efficiency through cross-project learning. Extensive evaluation across six diverse and well-established medical imaging datasets with five backbone LLMs demonstrates that AutoMedImg achieves zero human intervention, with Dice scores of up to 0.90 for segmentation tasks and 99% accuracy for classification. Article Search Article: ase26main-p1668-p doi:10.1145/3832783.3834399
	Dong, Junjie	ASE '26: "Li-WaC: A Lightweight WebAssembly ..." Li-WaC: A Lightweight WebAssembly Container for Independently Upgradable IoT Applications in Xiaomi Vela Bin Liao, Canfeng Zheng, Shiwen Shan, Qi Huang, Junjie Dong, Xiang Xiao, Yaoyao Gu, and Yuxin Su (Beijing Xiaomi Mobile Software, China; Sun Yat-sen University, China) In resource-constrained IoT devices, traditional application runtimes often struggle with limited performance and inflexible update mechanisms. WebAssembly (Wasm) has emerged as a promising technology to overcome these bottlenecks. However, existing Wasm implementations are not yet fully optimized for practical IoT environments, particularly in terms of JavaScript performance and modular over-the-air (OTA) updates on production IoT systems. To fill the gap, we propose Li-WaC, a lightweight, high-performance, and efficiently updatable WebAssembly Container framework for IoT operating systems.Specifically, we integrate a Wasm runtime into the event-driven Context Hub Runtime Environment (CHRE) framework. By treating the Wasm runtime as a standalone dispatch entity, Li-WaC runs Wasm modules as standard nanoapps, similar to native C/C++ applications. Performance-intensive tasks that were previously handled in JavaScript can then be offloaded to Wasm. We implemented and deployed Li-WaC within Vela, a production IoT operating system developed and maintained by Xiaomi, a leading global manufacturer of smartphones and IoT devices. On compute-oriented microbenchmarks, the AOT mode of Li-WaC achieves a 13× average speedup over QuickJS, approaching V8 on these microbenchmarks. In a production deployment study, we also observed smaller update packages, shorter installation times, and higher upgrade adoption rates under modular updates, where the upgrade adoption rate is the share of devices in the target cohort that completed an upgrade within a stated observation window. Article Search Article: ase26ind-p186-p doi:10.1145/3832783.3834502
	Dong, Qingao	ASE '26: "DepUpgrade: Automating Dependency ..." DepUpgrade: Automating Dependency Upgrade through State-Path Exploration Xiangxi Ma, Yifan An, Wentong Tian, Xuanqi Wang, Qingao Dong, Xiang Gao, and Hailong Sun (Beihang University, China) Third-party dependencies frequently introduce API breaking changes, and upgrading them causes compilation or runtime failures in client applications. Existing approaches have explored automating dependency upgrades, but struggle with fixing complex issues. This is mainly because traditional methods lack semantic adaptability, while recent prompt-only LLM-based migration approaches often suffer from hallucinations and fail to navigate multi-step, cascading repairs. To solve this problem, in this paper, we propose DepUpgrade, a framework that models dependency upgrade as a state-path exploration problem. A state is a snapshot of the client codebase at a particular point during migration. Transitions between states are validated via compiler feedback and rolled back if regressions occur. Instead of performing a single-pass generation, DepUpgrade systematically explores a search space of intermediate states with the goal of reaching a successful state. DepUpgrade achieves this goal in three steps: API migration knowledge extraction, repair task formulation and state-path exploration. We evaluate DepUpgrade on a benchmark of 123 migration tasks and 18 real-world projects. Experimental results demonstrate that our framework achieves an unprecedented 96.7% full repair rate on the benchmark, outperforming other baselines. On the real-world projects, DepUpgrade fully repairs 15 of the 18 projects and leaves 31 of the 1,085 initial compilation errors unresolved. Article Search Article: ase26main-p442-p doi:10.1145/3832783.3837442
	Dong, Wei	ASE '26: "Best-Effort GR(1) Synthesis: ..." Best-Effort GR(1) Synthesis: Exploiting Environmental Cooperation under Unrealizability Sirui Liu, Yating Zhang, Chi Hu, and Wei Dong (National University of Defense Technology, China; China Academy of Engineering Physics, China) Reactive synthesis automatically derives correct-by-construction controllers from temporal logic specifications. GR(1) synthesis is widely adopted due to its polynomial-time complexity and practical expressiveness. In practice, however, a significant proportion of GR(1) specifications are unrealizable. Conventional synthesis tools report failure in such cases, yet real-world environments are often governed by their own objectives rather than purely adversarial behavior, presenting opportunities for the system to leverage environmental cooperation toward satisfying its justice guarantees. For unrealizable GR(1) specifications, this paper proposes best-effort GR(1) synthesis. The approach requires the system strategy to satisfy two properties: best-effort extensibility, which preserves at every state reached by the play the possibility of satisfying all system justice guarantees, and persistent satisfiability of environment assumptions, which ensures that environmental cooperation does not preclude the environment from satisfying its own justice assumptions. For unrealizable but well-separated specifications, we construct a 3-nested µ-calculus fixpoint formula that characterizes the best-effort system winning region and prove its soundness and completeness. The resulting algorithm performs O(n|Q|) symbolic next-state computations, compared with O(mn|Q|2) for standard GR(1) synthesis. We further analyze the relationship between the best-effort and standard GR(1) winning regions through finite cooperative reachability, yielding a hierarchical classification of dependence on environmental cooperation at the region and initial-state levels for well-separated but unrealizable specifications, thereby quantifying the degree of unrealizability. We implement best-effort checking, controller construction, and classification in the Spectra GR(1) synthesizer and evaluate the approach on a diversified corpus of SYNTECH, AMBA, and GenBuf specifications. Experimental results demonstrate that best-effort realizability is common among well-separated but unrealizable specifications and that all top-level unrealizability categories occur in the combined benchmark corpus. Article Search Artifacts Available Article: ase26main-p372-p doi:10.1145/3832783.3837439 ASE '26: "CiL-Agent: Compiler-in-the-Loop ..." CiL-Agent: Compiler-in-the-Loop LLM Agent for Memory-Safe C Program Repair Yang Shen, Yating Zhang, Jiaqiang Yao, Minghao Liu, and Wei Dong (National University of Defense Technology, China) Automated Program Repair (APR) has advanced rapidly on managed languages such as Java and Python, yet C—the bedrock of systems software—remains far harder to repair safely. The difficulty is specific to C: as an unmanaged language with manual memory management, a patch can compile and pass every functional test while silently introducing a memory-safety defect (a leak, use-after-free, or double free) that managed-language tests would never expose, making such “fixes” potentially worse than no fix. Existing LLM-based repair offers little defense, as it learns from impoverished feedback—no execution at all (APPATCH), binary pass/fail signals (ChatRepair), or loosely-structured, unscored sanitizer text (VRpilot). We present CiL-Agent (Compiler-in-the-Loop Agent), which tightly integrates GCC, the Clang Static Analyzer, and Valgrind into the LLM generation loop, parsing their diagnostics into structured, three-dimensional feedback: compilation reachability, static provability, and dynamic memory safety. A two-phase strategy first samples and composite-scores candidate patches (Best-of-N), then refines the best under precise tool feedback. On 1,000 real-world C vulnerabilities spanning 11 CWE categories, CiL-Agent attains 88.2% Pass@1 with 87.3% memory-safe patches, outperforming five repair baselines (by 8.3–58.4pp, all p<0.001, McNemar’s test) and five modern coding agents by a wide margin. A full 1,000-task ablation shows toolchain integration and iterative refinement are independently essential (−44.3 and −35.2 percentage points), with toolchain integration the single most critical component, and a post-cutoff benchmark confirms the gains are not due to training-data memorization. Article Search Article: ase26main-p1378-p doi:10.1145/3832783.3837493 ASE '26: "Large Language Model Enabled ..." Large Language Model Enabled Symbolic Execution for Automated Functional Analysis Meixi Liu, Zhenbang Chen, Xudong Wang, Ziran He, Jiachen Gu, Minghui Chen, Lei Wang, and Wei Dong (National University of Defense Technology, China) Symbolic execution shows promise in automated program analysis by systematically exploring the path space of the program. However, due to the inherent limitations of program analysis techniques, symbolic execution cannot understand the program’s functionality, which hinders its application in functional analysis and defect detection. This paper introduces FuSE, a method that enhances symbolic execution with Large Language Models (LLMs) to automatically annotate program paths with functional specifications. A program path is annotated with a natural language description of its functionality, a precondition, and a postcondition. Our method significantly reduces the effort required for functional testing and defect detection. Based on UnitTestBot, FuSE can successfully annotate functional specifications for C, C++, Java, and Python programs, with success rates of 98.2%, 95.52%, 87%, and 95.37%, respectively. In our user study with professional developers and testers, FuSE helps users identify 21.67% more functional defects and improves functional coverage by 15.83%, demonstrating its practical utility. Article Search Artifacts Available Article: ase26main-p2155-p doi:10.1145/3832783.3837524
	Dong, Ximing	ASE '26: "When Elo Lies: Hidden Biases ..." When Elo Lies: Hidden Biases in Codeforces-Based Evaluation of Large Language Models in Practice Shenyu Zheng, Ximing Dong, Xiaoshuang Liu, Chun Yong Chong, Gustavo Oliva, Dayi Lin, Boyuan Chen, Shaowei Wang, and Ahmed E. Hassan (Huawei Canada, Canada; Huawei, China; Monash University, Malaysia; Queen's University, Canada; University of Manitoba, Canada) As Large Language Models (LLMs) achieve breakthroughs in complex reasoning, Codeforces-based Elo ratings have emerged as a prominent metric for evaluating competitive programming capabilities in industry. However, these ratings are often reported without critical experimental details, leading to significant discrepancies-illustrated by recent reports where the same model version’s score fluctuated by nearly 500 points (out of 2,029). This paper presents a systematic empirical study on the hidden factors biasing Elo evaluations: (1) the temporal ordering of submissions, (2) contest difficulty selection, and (3) run-to-run stochastic variability of LLMs. Utilizing a controlled benchmark of 37 recent Codeforces contests and 13,691 generated test cases, we demonstrate that Elo scores are highly sensitive to these parameters. Our findings reveal that varying submission orders can shift scores by 394 points, while contest selection can cause differences of up to 1,122 points for the same model. Run-to-run performance exhibits substantial instability, with a maximum difference of 349 points in mean scores observed when evaluating identical contests. We conclude that direct Elo comparisons are unreliable and potentially misleading without strict standardization and transparent reporting of experimental settings. Article Search Article: ase26ind-p20-p doi:10.1145/3832783.3834458
	Dong, Yiru	ASE '26: "ExeCRE: Execution-Consistency ..." ExeCRE: Execution-Consistency Guided Reliability Estimation for Self-Correcting Code Generation Yiru Dong, Richong Zhang, Fanshuang Kong, and Si Chen (Beihang University, China) Large language models (LLMs) have made notable progress in code generation, but they still struggle on challenging tasks that require sophisticated algorithms or complex implementations. Recent methods increasingly use code execution as feedback, especially in self-correction pipelines that construct verification signals from generated code. However, these pipelines often depend on supervision signals whose reliability is unknown, which can introduce misleading feedback, unnecessary revisions, and incorrect final answers. To address this issue, we propose ExeCRE, an Execution-Consistency guided code Reliability Estimation framework. Instead of judging candidate code by tests or LLM feedback, ExeCRE estimates code reliability by statistically analyzing consistency patterns in execution outputs over a large number of randomly generated inputs. It collects execution outputs over generated inputs, projects them into consistency signals, and applies Dawid–Skene model to infer latent code reliability. We integrate ExeCRE into self-correction for code generation. Experiments show that ExeCRE consistently improves both effectiveness and stability, while substantially reducing misleading correction signals. Under GPT-5.2 on LiveCodeBench, the average number of misleading feedback cases on already correct code drops from 113.2 with a representative self-correction baseline to 14.0 with ExeCRE. As an additional study, we apply the same reliability estimation strategy to code-based mathematical reasoning and observe similar benefits. These results suggest that ExeCRE enables more reliable use of generated code in execution-based pipelines. Article Search Article: ase26main-p496-p doi:10.1145/3832783.3837445
	Dong, Yunwei	ASE '26: "From Guessing to Seeing: Enhancing ..." From Guessing to Seeing: Enhancing LLM-Based Program Repair via Trace-Guided Multi-strategy Debate Jiaqing Wu, Tong Wu, Manqing Zhang, Yunwei Dong, and Bo Shen (Northwestern Polytechnical University, China) Automated Program Repair (APR) aims to resolve software bugs without human intervention. However, handling complex logic errors, especially silent failures that produce incorrect outputs without any explicit crash signals, remains a significant challenge. Current LLM-based APR approaches attempt to address this issue through conversational feedback, retrieval-augmented generation, or static analysis tools. However, these methods are fundamentally static, relying only on source code and basic test outputs, and thus struggle to capture complex runtime behaviors and dynamic data dependencies accurately. Inspired by human debugging practice, incorporating runtime evidence into APR provides direct access to program behavior through execution traces, which expose concrete state transitions and data dependencies. However, even with such runtime evidence, a single LLM interpreting it in isolation tends to commit to a specific repair hypothesis, leading to test overfitting and producing patches that satisfy the observed traces and test suite by coincidence rather than correct logic. This observation suggests that runtime evidence should not be treated merely as additional input, but as objective constraints that candidate patches must satisfy. Building on this insight, we propose TraceRepair, a multi-agent framework that leverages runtime facts as shared constraints for patch validation. A probe agent captures execution snapshots of critical variables, forming an objective basis for repair, while a committee of specialized agents cross-verifies candidate patches to expose inconsistencies and iteratively refine them. Evaluated on the Defects4J benchmark, TraceRepair substantially improves repair effectiveness, correctly fixing 392 defects and outperforming existing LLM-based approaches. Extensive experiments further demonstrate improved efficiency and strong generalization on a newly constructed dataset of recent bugs, suggesting that the performance gains arise from dynamic reasoning rather than memorization. Article Search Article: ase26main-p732-p doi:10.1145/3832783.3837458
	Dong, Zhen	ASE '26: "Verifier-in-the-Loop LLM Solving ..." Verifier-in-the-Loop LLM Solving of Heap Constraints for Concolic Execution Shaoran Xia, Leyi Cheng, Caihua Dong, Dongdong She, Bo Wang, Xin Peng, and Zhen Dong (Fudan University, China; Soochow University, China; Hong Kong University of Science and Technology, China; Beijing Jiaotong University, China) Concolic execution systematically explores program paths by solving symbolic constraints, but in object-oriented software its practical effectiveness is often limited by heap constraints over objects and heap structure, such as nullness, aliasing, runtime types, and field reachability. These constraints form a systematic bottleneck in real-world software because satisfying them requires constructing a concrete heap model rather than merely computing primitive valuations, which existing SMT-based concolic engines and symbolic heap techniques do not handle effectively. We present COHEC, a hybrid concolic architecture that decomposes each target path condition into a primitive component solved by an SMT solver and a heap component handled by a Heap Constraint Solver (HCS). Given extracted heap constraints, HCS uses an LLM to propose candidate heap models and initialization code, while a trusted verifier executes and verifies the generated code, admitting only models whose initialization code constructs states that satisfy all constraints and keeping the LLM outside the trusted computing base. We implement COHEC on top of JDart/JPF and evaluate it on 6,750 APIs from ten Java libraries, together with a stratified sample from commons-lang3 against the LLM-assisted baseline CONCOLLMIC. The results show that COHEC substantially improves path exploration and concrete valuation generation over native JDart, while achieving higher coverage than CONCOLLMIC at lower time and token cost. Overall, the findings indicate that treating heap constraint solving as verified heap model construction is a practical and effective way to extend concolic execution to the object-sensitive behaviors pervasive in modern software. Article Search Artifacts Available Article: ase26main-p2302-p doi:10.1145/3832783.3834410
	Dong, Zikan	ASE '26: "An Empirical Study of Security ..." An Empirical Study of Security Risks in the Android Push Notification Ecosystem Shilong Hu, Zikan Dong, Chao Wang, Tianming Liu, and Haoyu Wang (Huazhong University of Science and Technology, China) Push notification services are widely used in mobile apps to deliver time-sensitive content. In the fragmented Android ecosystem, however, no single push service works reliably across all devices and markets, leading developers to integrate multiple push SDKs from device manufacturers and third-party providers. Despite their widespread use, prior studies have focused mainly on Google’s Firebase Cloud Messaging, leaving the security risks of other push services largely unexplored. In this paper, we present a systematic security assessment of the Android push notification ecosystem, covering 11 mainstream push SDKs and 52,748 apps across multiple Android app markets. Our analysis reveals three classes of security risks across the push notification workflow: server secret leakage, notification hijacking, and plaintext exposure of notification payloads. Specifically, we identify 517 apps that leak server secrets, accounting for at least 78.79 billion cumulative installs. These leaks enable attackers to forge notifications with attacker-controlled titles and bodies, redirect users to arbitrary URLs after a click, and, in 9 of the 11 evaluated push services, broadcast such notifications to all users. We further show that four widely used push SDKs are vulnerable to notification hijacking, enabling attackers to reroute victim notifications. In addition, among the 110 communication-oriented apps we evaluated, none protects notification payloads before they enter push service infrastructure, leaving sensitive content exposed in plaintext. These findings show that securing real-world push services requires stronger protections from both app developers and push service providers, highlighting the need for more secure push deployment in industry practice. We responsibly disclosed the issues to push service providers and app developers, and received acknowledgments from affected parties. Article Search Article: ase26ind-p82-p doi:10.1145/3832783.3834475
	Dorn, Johannes	ASE '26: "Assessing Uncertainty in Performance ..." Assessing Uncertainty in Performance Modeling: Conformal Prediction vs. Bayesian Regression Stefan Jahns, Johannes Dorn, Max Weber, Sven Apel, and Norbert Siegmund (Leipzig University, Germany; Saarland University, Germany) Most software systems today are configurable. As a consequence, predicting performance is inherently challenging due to the sheer number of configurations exhibiting individual performance variations. When predicting the performance of unseen configurations, it is imperative to know how reliable such predictions are. Bayesian methods have been shown to be able to quantify the uncertainty in their estimates, but require prior information about performance distributions and, more importantly, are constrained in their learning technique, effectively limiting their practical applicability. Conformal prediction, an entirely novel approach to uncertainty quantification in this area, augments existing learning algorithms via a statistical post-hoc analysis. This allows us to provide uncertainty estimates even for point-estimate algorithms, such as random forests or deep neural networks. The goal of this study is to evaluate how assumptions of conformal predictions regarding sample size and distribution, as well as the heterogeneity of learning algorithms, affect their applicability to software performance prediction. We conduct a comprehensive study comparing four conformal prediction variants against P4, the current standard for uncertainty-aware performance prediction, analyzing accuracy, scalability, and uncertainty quantification. Our results show that conformal prediction consistently outperforms the state of the art across six out of eight real world scenarios, producing correct confidence intervals that are 46–75 % narrower, and thus more certain. Notably, conformal prediction can be used to enrich existing techniques, with post-hoc uncertainty quantification in a plug and play fashion. Article Search Article: ase26main-p207-p doi:10.1145/3832783.3837425
	Du, Sheng	ASE '26: "DBRepro: Automated Database ..." DBRepro: Automated Database Synthesis via a Hybrid Constraint-Solving Approach for Reproducing Slow Queries Zhaoyang Zhang, Shuang Liu, Dengfeng Xu, Wei Lu, Jianquan Leng, Sheng Du, and Xiaoyong Du (Renmin University of China, China; China Electronics Technology Kingbase (Beijing) Technologies, China) Slow queries frequently cause severe performance bottlenecks in Database Management Systems (DBMSs). Due to the severe risk of exacerbating online resource contention, diagnosing their root causes online is usually infeasible; offline diagnosis has thus become the de facto approach. However, strict data privacy regulations prohibit accessing original user data. Therefore, synthesizing a proxy database, one that induces the query optimizer to generate identical physical execution plans as in production, from non-intrusive metadata, is critical for reproducing and diagnosing slow queries offline. Achieving high-fidelity reproduction demands satisfying both global statistical distributions and exact local cardinality constraints. Existing works fundamentally fail to achieve both simultaneously: data-driven approaches cannot enforce strict local cardinalities, whereas workload-aware approaches severely distort the overall data distribution, misleading the optimizer into divergent execution plans. To bridge this gap, we introduce DBRepro, an automated end-to-end database synthesis framework that synergistically integrates data-driven and workload-aware methodologies. DBRepro formulates database generation as a constrained distribution synthesis problem. It initializes a global data distribution from lightweight column statistics, extracts execution constraints from the target queries, and progressively adjusts the distribution to satisfy these constraints, ensuring the global distribution is maximally preserved while exact local cardinalities are strictly enforced. Extensive evaluations on the TPC-H and SSB benchmarks demonstrate that DBRepro outperforms state-of-the-art baselines across comprehensive fidelity metrics. Compared to the data-driven baseline, it reduces cardinality error by up to 20.3% while maintaining identical plan consistency. Against a workload-aware baseline, it reproduces 15% more consistent execution plans and lowers the latency proportion error by 21.5%. Furthermore, we validate its industrial practicality on a nearly 1 TB real-world dataset from a specific industrial sector, managed by KingbaseES, successfully reproducing the execution performance of complex slow queries with high fidelity. Article Search Article: ase26ind-p50-p doi:10.1145/3832783.3834463
	Du, Xiaoyong	ASE '26: "DBRepro: Automated Database ..." DBRepro: Automated Database Synthesis via a Hybrid Constraint-Solving Approach for Reproducing Slow Queries Zhaoyang Zhang, Shuang Liu, Dengfeng Xu, Wei Lu, Jianquan Leng, Sheng Du, and Xiaoyong Du (Renmin University of China, China; China Electronics Technology Kingbase (Beijing) Technologies, China) Slow queries frequently cause severe performance bottlenecks in Database Management Systems (DBMSs). Due to the severe risk of exacerbating online resource contention, diagnosing their root causes online is usually infeasible; offline diagnosis has thus become the de facto approach. However, strict data privacy regulations prohibit accessing original user data. Therefore, synthesizing a proxy database, one that induces the query optimizer to generate identical physical execution plans as in production, from non-intrusive metadata, is critical for reproducing and diagnosing slow queries offline. Achieving high-fidelity reproduction demands satisfying both global statistical distributions and exact local cardinality constraints. Existing works fundamentally fail to achieve both simultaneously: data-driven approaches cannot enforce strict local cardinalities, whereas workload-aware approaches severely distort the overall data distribution, misleading the optimizer into divergent execution plans. To bridge this gap, we introduce DBRepro, an automated end-to-end database synthesis framework that synergistically integrates data-driven and workload-aware methodologies. DBRepro formulates database generation as a constrained distribution synthesis problem. It initializes a global data distribution from lightweight column statistics, extracts execution constraints from the target queries, and progressively adjusts the distribution to satisfy these constraints, ensuring the global distribution is maximally preserved while exact local cardinalities are strictly enforced. Extensive evaluations on the TPC-H and SSB benchmarks demonstrate that DBRepro outperforms state-of-the-art baselines across comprehensive fidelity metrics. Compared to the data-driven baseline, it reduces cardinality error by up to 20.3% while maintaining identical plan consistency. Against a workload-aware baseline, it reproduces 15% more consistent execution plans and lowers the latency proportion error by 21.5%. Furthermore, we validate its industrial practicality on a nearly 1 TB real-world dataset from a specific industrial sector, managed by KingbaseES, successfully reproducing the execution performance of complex slow queries with high fidelity. Article Search Article: ase26ind-p50-p doi:10.1145/3832783.3834463
	Du, Yide	ASE '26: "IncSFS: Incremental Full-Sparse ..." IncSFS: Incremental Full-Sparse Flow-Sensitive Pointer Analysis for C/C++ Kunlin Liu, Zhenbang Chen, Piyi Zu, Yide Du, and Ji Wang (National University of Defense Technology, China) Pointer analysis is the fundamental technique for compiler optimization and program analysis. Flow sensitive pointer analysis provides high precision but hard to scale to large-size projects. Tailored for rapid iteration scenarios where software evolves continuously, we introduce IncSFS, the first incremental full-sparse flow-sensitive pointer analysis algorithm for C/C++ programs. The algorithm contains two main steps. It first transforms the value-flow graph of a program into a constraint graph, on which a strongly-connected component detection is performed to ensure precision. It then propagates increases and decreases in points-to set in an interleaving manner to support both code deletion and insertion within a single analysis pass. IncSFS is guaranteed to terminate and compute the least fixed point when point-to relation during the analysis is object-acyclic. Experimental results on six large-scale real-world projects show that IncSFS is both precise and efficient, achieving average speedups of 9.60 x over full flow-sensitive pointer analysis and of 5.84 x over the traditional reset-recompute incremental approach. Furthermore, IncSFS improves efficiency by 15.8% compared with state-of-the-art incremental pointer analysis algorithms that also propagate changes in points-to sets. Article Search Artifacts Available Article: ase26main-p1456-p doi:10.1145/3832783.3837496
	Du, Yuxuan	ASE '26: "KQFuzz: Knowledge-Guided Fuzzing ..." KQFuzz: Knowledge-Guided Fuzzing for Quantum Libraries via Large Language Models Fuyuan Xia, Qixin Zhang, Chenhao Ying, Haojin Zhu, Shuai Wang, Yuan Luo, Pingchuan Ma, and Yuxuan Du (Shanghai Jiao Tong University, China; Nanyang Technological University, Singapore; Hong Kong University of Science and Technology, Hong Kong; Zhejiang University of Technology, China) As quantum computing continually improves, ensuring the reliability and correctness of quantum libraries has become increasingly critical. To this end, many LLM-based fuzzing approaches towards quantum libraries have been proposed to uncover potential bugs. However, these methods still suffer from limitations such as insufficient flexibility and low efficiency, which hinder the progress of the quantum computing field. To address these challenges, we propose KQFuzz, a novel knowledge-guided fuzzer for quantum libraries. It leverages comprehensive codebase knowledge to ground LLM-based test generation, synergizing this with fitness-guided evaluation and two-level mutations to explore complex execution paths and trigger potential bugs. Firstly, KQFuzz introduces a novel prompting scheme tailored to quantum programs, which strategically incorporates knowledge of the codebase to efficiently generate high-quality quantum seed programs. Moreover, we develop evaluation and mutation strategies to handle the generated seed programs, facilitating efficient fuzzing execution while further enriching the diversity of the resulting test cases. We implement KQFuzz and conduct fuzzing on three popular quantum libraries, including Qiskit, PennyLane, and Cirq. Experimental results demonstrate that our approach significantly outperforms other state-of-the-art methods, with coverage improved by up to 18.44%. During the development of KQFuzz, we discovered 13 bugs, all of which have been confirmed and 12 have already been fixed by the developers. Article Search Article: ase26main-p1509-p doi:10.1145/3832783.3834392
	Duan, Chiming	ASE '26: "Bifrost: Empowering Pretrained ..." Bifrost: Empowering Pretrained Language Model with Fallibility Representation for Log-Based Fault Diagnosis Minghua He, Tong Jia, Lingzhe Zhang, Chiming Duan, Xinlong Zhao, Leyi Pan, Cheng Wang, Kangjin Wang, Yinghao Yu, Liping Zhang, Yifan Wu, and Ying Li (Peking University, China; Tsinghua University, China; Alibaba Group, China) Log-based fault diagnosis is crucial for runtime debugging and maintenance. Existing fault diagnosis methods use language models pre-trained on natural language (PLMs) for log representation. However, system faults are reflected in the multi-level structure of system logs. PLMs pre-trained on natural language struggle to comprehensively capture multi-level fault information, failing to meet the requirements of fault diagnosis. We refer to this information as fallibility representations. To address this problem, we propose a novel log representation learning method, Bifrost. It draws inspiration from the log analysis experience of Site Reliability Engineers and meticulously designs strategies based on self-supervised contrastive learning to learn the fallibility representations of logs. Across three public systems and one industrial ML-as-a-Service system, the log representations produced by Bifrost outperform existing PLMs by average margins of 9.83% in F1 for anomaly detection, 18.28% in HR@k for root cause localization, and 20.88% in Macro-F1 for fault identification. Article Search Article: ase26main-p3295-p doi:10.1145/3832783.3834433
	Duan, Yuechen	ASE '26: "SplitCA: An Effective Tool ..." SplitCA: An Effective Tool for Generating 4-wise Covering Arrays for Large-Scale Highly Configurable Systems Shuangyu Lyu, Ruizhi Shi, Yuechen Duan, Chunming Hu, and Chuan Luo (Beihang University, China) Highly configurable software systems are difficult to test exhaustively because their configuration spaces grow exponentially with the number of options. Combinatorial interaction testing (CIT) addresses this problem by generating t-wise covering arrays (CAs), and prior studies show that 4-wise CIT can detect important faults missed by lower-strength testing. However, existing constrained covering array generation (CCAG) tools still struggle to generate 4-wise CAs for large-scale systems with more than one thousand options. To address this limitation, we propose , an effective tool for large-scale 4-wise CA generation. We evaluate on 118 public real-world large-scale highly configurable software instances, each with more than one thousand options. Under reasonable time and memory limits, existing 4-wise CCAG tools fail to generate a 4-wise CA for any of these instances. In contrast, successfully generates 4-wise CAs for 117 instances, substantially improving the scalability of 4-wise CCAG. Video: https://youtu.be/9uM1Vl2ph-o Repository: https://github.com/chuan-luo-group/SplitCA or https://doi.org/10.5281/zenodo.21360896 Article Search Artifacts Available Article: ase26tool-p76-p doi:10.1145/3832783.3834623
	Duan, Zhiyu	ASE '26: "Optimization-Free Repair of ..." Optimization-Free Repair of Code LLMs: A Closed-Form Fisher-Guided Bayesian Approach Zhiyu Duan, Chong Bian, Yizhuo Zhang, and Shunkun Yang (Beihang University, China; China Mobile, China) Large language models (LLMs) are increasingly used in software engineering, yet their code generations remain vulnerable to subtle functional errors, making reliable post-hoc repair essential. Existing repair methods typically apply localized parameter updates without explicitly accounting for the heterogeneous importance of pre-trained knowledge, which can entangle targeted correction with unintended changes to general coding ability. We propose Fisher-Informed Semantic Repair (FISR), a principled framework that treats code LLM repair as a Bayesian posterior update constrained by pre-trained prior knowledge. It estimates parameter-wise semantic importance through the Fisher Information Matrix, using local curvature information to identify high-confidence directions that should be preserved during repair. It then introduces Fisher-weighted structural constraints to guide corrective updates away from knowledge-critical parameters and toward more adaptable regions of the parameter space. To make this process scalable, we combine structured curvature approximation with low-rank precision decomposition, enabling efficient closed-form updates within a safe repair subspace rather than relying on iterative retraining. Extensive experiments on three backbone code models and six software engineering benchmarks show that FISR achieves the best overall trade-off among repair accuracy, stability, and efficiency. It reaches up to 95.8% Exact Match, improving Exact Match by up to 3.1% and Pass@1 by up to 3.4% over strong prior repair methods. It also demonstrates stronger held-out stability while substantially reducing repair cost, requiring only 40%-67% of the end-to-end repair time and 14%-20% of the update-time cost of competitive editing-based baselines. These results demonstrate that the proposed method enables accurate, safe, and efficient semantic repair for code LLMs. Article Search Article: ase26main-p3860-p doi:10.1145/3832783.3834442
	Dutta, Saikat	ASE '26: "Automated Assertion Generation ..." Automated Assertion Generation and Regression Testing for Machine Learning Notebooks Yingao (Elaine) Yao, Vedant Nimje, Varun Viswanath, and Saikat Dutta (Cornell University, USA; Veermata Jijabai Technological Institute, India; Dwarkadas J Sanghvi College of Engineering, India) Jupyter Notebooks have become the de-facto choice for data scientists and machine learning (ML) engineers for prototyping and experimenting with ML pipelines. Notebooks provide a rich interactive interface with support for code, data, and visualization in one place. However, notebooks provide limited support for testing. As a result, during continuous development, many silent (non-crashing) regressions often go unnoticed and make notebooks unreliable and results hard to reproduce. To enable more systematic testing of ML notebooks, we introduce NBTestGen – the first automated assertion generation approach for ML notebooks. NBTestGen generates regression-based assertions that check properties related to data processing, model building, and model evaluation steps in a typical ML notebook. To support systematic integration of such assertions in notebooks, we introduce the first regression testing framework (called NBTest) that can be used as a Jupyter plugin and allows developers to write cell-scoped assertions in notebooks. Three key features of such assertions are that they are 1) cell-scoped: they are linked to specific notebook cells and execute only after those cells are executed, 2) non-intrusive: they do not block notebook execution (in a Jupyter session), so that development can continue when they fail, and 3) they integrate with pytest and CI pipelines, allowing developers to easily do regression testing of their notebooks. We evaluate NBTestGen on a corpus of 585 notebooks from the popular Kaggle platform. NBTestGen generates a total of 21542 assertions (36.82 on average per notebook). The generated assertions kill 72.21% of ML-specific mutations, while maintaining a high passrate of 100.00%. We also show that NBTestGen can detect 69.68% of historical regressions in 531 older versions of Kaggle notebooks. A popular ML library, SHAP, integrated NBTest into their CI. Further, we perform a user study with 17 ML developers that shows that such users find NBTest highly intuitive and useful. Article Search Artifacts Available Article: ase26main-p1451-p doi:10.1145/3832783.3834390
	Dwyer, Matthew B.	ASE '26: "Documentation vs. Code Patterns: ..." Documentation vs. Code Patterns: What Drives LLM-Based Exception Oracle Generation? Soneya Binta Hossain, Matthew B. Dwyer, and Tasfia Tasnim (University of Texas at Dallas, USA; University of Virginia, USA) LLM-based test oracle generation (TOG) methods report high accuracy on exception-oracle generation, but it remains unclear what evidence drives these predictions. In particular, do models use explicit exceptional-behavior documentation such as Javadoc @throws clauses, or do they rely on recurring patterns in tests, code, and documentation? We investigate this question through a large-scale intervention-based study of three TOG systems spanning classifier-based and generative architectures and model sizes from roughly 110M to 7B parameters, evaluated on three real-world benchmarks comprising two generated-test datasets and a new benchmark of developer-written tests. We first remove Javadoc @throws clauses and find that accuracy changes only marginally, with the largest drop below one percentage point. This indicates that structured exception documentation is not the primary driver of exception-oracle prediction. We then apply attribution-guided substitution ablations to identify the signals that predictions depend on. The results show that high accuracy can be driven by shortcut signals: some models are highly sensitive to a small number of structural tokens, while others distribute reliance across many lexical cues. These findings challenge the assumption that strong exception-oracle accuracy reflects robust use of exception semantics. Future TOG systems should therefore be evaluated not only by whether they predict the correct oracle type, but also by whether their predictions are grounded in meaningful exception-triggering evidence. Article Search Article: ase26main-p773-p doi:10.1145/3832783.3837464
	Ebrahimi, Shahriar	ASE '26: "VeriSBOM: Secure and Verifiable ..." VeriSBOM: Secure and Verifiable SBOM Sharing via Zero-Knowledge Proofs Gianpietro Castiglione, Shahriar Ebrahimi, and Narges Khakpour (Newcastle University, UK) SBOMs often contain sensitive information that organizations are unwilling to disclose in full. To avoid disruption of privacy and confidentiality in delivering plaintext SBOMs, we present VeriSBOM, a trustless SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs, i.e., third-parties can validate if software contains authentic dependencies distributed by official package managers and that the same dependencies are compliant with policy constraints. The verification process requires no trust in the SBOM publisher beyond the soundness of the underlying primitives, and third parties can independently check proofs against the public cryptographic commitments. We design and implement VeriSBOM, analyze its security, evaluate its performance on real-world package registries and SBOMs, and evaluate its usability. Article Search Artifacts Available Article: ase26main-p3290-p doi:10.1145/3832783.3834432
	Ehsani, Ramtin	ASE '26: "How Do LLMs Read Bug Reports? ..." How Do LLMs Read Bug Reports? An Empirical Study of Attention in LLMs for Automated Program Repair Ramtin Ehsani, Irene Manotas, Saurabh Pujar, Luca Buratti, and Preetha Chatterjee (Drexel University, USA; IBM Research, USA) Large Language Model (LLM)-based Automated Program Repair systems are advancing rapidly, yet their performance remains inconsistent. Even when provided with the same contextual information, an LLM may generate a correct patch for one bug but fail on another closely related bug. Why this happens remains poorly understood, and it is unclear how LLMs prioritize the diverse information in bug reports and whether model attention affects repair success. In this paper, we present the first empirical study of attention patterns in LLM-based program repair, providing interpretable insights into how models process bug reports and where their attention is concentrated during repair. We analyze 319 real-world Python and Java bugs from SWE-bench Verified and Multi-SWE-bench to study (RQ1) how model attention is distributed across bug report sections, (RQ2) how attention patterns within each section differ between successful and unsuccessful repairs, and (RQ3) how these patterns compare to information developers consider important for bug fixing. We find that successful repairs are characterized by diffused attention across multiple diagnostic components such as bug descriptions, stacktraces, and test cases, while failures often exhibit over-localized attention toward metadata such as version information. We further observe that stronger alignment between model attention and developer-identified key sections and phrases is associated with higher repair success. Our results provide the first empirical evidence that attention misallocation is a key factor in LLM-based APR failures, and offer actionable insights for designing more interpretable and reliable future APR systems. Article Search Artifacts Available Article: ase26main-p306-p doi:10.1145/3832783.3837434
	Eisenbarth, Thomas	ASE '26: "A Comprehensive Evaluation ..." A Comprehensive Evaluation of Code Language Models for Security Patch Detection Nils Loose, Joseph Bienhüls, Kristoffer Hempel, Felix Mächtle, and Thomas Eisenbarth (University of Lübeck, Germany) Automated detection of vulnerability-fixing commits (VFCs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and many fixes never receive advisories. Code language models are increasingly adopted for identifying , yet whether they can recognize a security fix from the code change itself remains unclear, as reported performance is shaped by commit messages, project-level data leakage, and uncertain data quality. We present a rigorous re-evaluation that jointly controls these factors through a unified framework consolidating 20 fragmented datasets spanning more than 180000 commits. Training 270 models from 125M to 80B parameters, we isolate the code signal under group-stratified code-only evaluation and assess the impact of model capacity and additional code context, ranging from intra-procedural enrichment to inter-procedural repository context. Model capacity yields clear but insufficient gains, and the evaluated context signals provide no reliable improvement under strict false positive budgets. At a false positive rate of 0.5 Article Search Article: ase26main-p2677-p doi:10.1145/3832783.3837538
	Etemadi, Khashayar	ASE '26: "CppPerf: An Automated Pipeline ..." CppPerf: An Automated Pipeline and Dataset for Performance-Improving C++ Commits Tommy Ho, Khashayar Etemadi, and Zhendong Su (ETH Zurich, Switzerland) Recent progress in automated repair of performance bugs demands realistic, executable benchmarks. However, existing C++ performance benchmarks are largely built from competitive programming submissions, and recent real-world benchmarks predominantly target Python and .NET. To fill this gap, we present CppPerf-Mine, a configurable pipeline that mines execution-time-improving patches from open-source C++ repositories on GitHub by combining structural commit filtering, an LLM-based commit classifier, and a containerized build & test stage that produces fully reproducible Docker images for each patch. Using CppPerf-Mine, we build CppPerf-DB, a benchmark comprising 347 manually verified patches from 42 mature C++ repositories, 39% of which are multi-file, enabling the evaluation of repository-level repair tools. In our preliminary study, OpenHands correctly fixes only 13.5% of the patches in CppPerf-DB, confirming that real-world C++ performance repair remains an open challenge. CppPerf-Mine and CppPerf-DB are open-source and publicly available at: https://doi.org/10.5281/zenodo.20097425. In addition, a demonstration video is available at: https://www.youtube.com/watch?v=nixlupIgSdM. Article Search Article: ase26tool-p37-p doi:10.1145/3832783.3834606
	Eyraud, Côme	ASE '26: "Baseliner: A Plugin-Oriented, ..." Baseliner: A Plugin-Oriented, Hardware-Agnostic GPU Benchmarking Library Côme Eyraud and Maxime Lamothe (Polytechnique Montréal, Canada) GPU benchmarking underpins performance claims across high-performance computing (HPC), yet the software infrastructure producing these measurements is rarely treated as a first-class research artifact. Existing tools fragment into benchmark suites where measurement logic is coupled to kernels, vendor profilers designed for diagnostic tracing rather than statistical benchmarking, and ecosystem-specific libraries that lack cross-hardware portability. We present Baseliner, a hardware-agnostic GPU benchmarking framework whose plugin-oriented architecture decouples workload definition from measurement orchestration. A formalized Workload Interface and a backend abstraction layer let workloads, timing backends, stopping criteria, and statistics engines be swapped independently of the core engine. An adapter mechanism further enables a single Workload definition to be executed by Baseliner, NVBench, or PrimBench, eliminating redundant implementations across toolchains. We validate the framework through blas-baseliner, a cross-vendor BLAS suite spanning cuBLAS and rocBLAS. Empirical evaluation on NVIDIA V100 and AMD MI210 hardware shows Baseliner reaches measurement parity with vendor libraries within the precision floor of GPU event timing while remaining competitive in wall-clock time. Video: https://youtu.be/LdKUEqewmQw Article Search Article: ase26tool-p156-p doi:10.1145/3832783.3834645
	Fabry, Johan	ASE '26: "If You Build It, Will They ..." If You Build It, Will They Come? Lessons from 20 Years of Industrial Use of a Code Transformation DSL Johan Fabry and Vadim Zaytsev (Raincode Labs, Belgium; University of Twente, Netherlands) Legacy modernisation at industrial scale requires automated source-to-source transformation rather than manual refactoring. This paper reports an experience study of RcScript, a proprietary code-transformation DSL used in production at Raincode and Raincode Labs for more than 20 years, and of the long-lived transformation platform built with it to modernise PACBASE-generated COBOL. The platform has been applied to more than 500 million lines of legacy source code. We highlight one engineering question within that industrial ASE solution: which optional language features of the implementation DSL are actually adopted in practice, which are avoided, and why. The study combines static analysis of two production configurations with an interview with the lead maintainer. The observed feature use varies, yet the results show a consistent pattern: features that improve local readability are used, whereas features that hide errors, are hard to read, or depend on weak editor support are avoided or used only sparingly. From that, we distil practical lessons for the design and evolution of industrial DSLs and long-lived automated transformation platforms. Article Search Article: ase26ind-p279-p doi:10.1145/3832783.3834520
	Fahim, Md Asif Iqbal	ASE '26: "ReqEvolve: User-Oriented Software ..." ReqEvolve: User-Oriented Software Self-Evolution through Automatic Requirement Interpretation Md Asif Iqbal Fahim and Alessio Ferrari (University College Dublin, Ireland; National Research Council, Italy) The paradigm of software self-evolution enables systems to autonomously extend and reconfigure their own capabilities during execution in response to technical specifications. Yet requests for new functionality often originate from end users and are rarely expressed in technical terms. As a result, developers must translate user needs into technical specifications before the system can evolve, delaying early validation of the requested functionality by preventing users from immediately observing the resulting behaviour. To address this gap, we present ReqEvolve, a runtime code generation system that enables user-driven self-evolution by accepting high-level user requests. The system integrates automatic requirements engineering (RE) and test-driven development (TDD) to transform these requests into executable functionality through clarification, specification decomposition, test generation, and runtime integration. We evaluate ReqEvolve on 72 software evolution cases across 18 projects against two baselines: SpecFix, an RE-focused code generation approach, and an ablation variant of our system. ReqEvolve achieves 89.2% Pass@1, outperforming SpecFix by 18.8% (p < 0.01, r = 0.79, large effect) and the ablation baseline by 32.6% (p < 0.001, r = 0.88, large effect). These results provide initial evidence that user-driven self-evolution is a viable paradigm for autonomously extending software capabilities from user requests, thereby accelerating requirements validation prior to developer verification. Article Search Article: ase26main-p2528-p doi:10.1145/3832783.3834416
	Fan, Fengyuan	ASE '26: "Maintaining Control States ..." Maintaining Control States for Initialization-Aware GRPO in Industrial LLM Workflows Chen Liu, Zhenzhao Yuan, Fengyuan Fan, Limei Che, Qiao Qian, Qingyuan Liang, Zeyu Sun, and Lu Zhang (Peking University, China; Tencent, China; Institute of Software at Chinese Academy of Sciences, China) Large language models (LLMs) are increasingly used as components in industrial software workflows, where they are expected to support reliable automation. However, newly introduced workflows often provide only limited data and sparse task-level feedback, making post-deployment adaptation difficult. GRPO-based post-training provides a practical adaptation way in this setting, but its effectiveness depends on the state from which adaptation begins. When the initial behavior of an LLM workflow is poorly aligned with the target workflow, early samples may provide weak reward signals, wasting adaptation budget and delaying workflow onboarding. We propose CoSTAR, an industrial post-deployment adaptation framework that maintains the starting state for downstream GRPO through a lightweight workflow-level control component. CoSTAR performs GRPO-style optimization on this control component while keeping the task model fixed, and alternates this maintenance with downstream GRPO, so that the control state can continue adapting across stages rather than remain a one-shot initialization. Experiments on a company-internal industrial workflow automation task show that CoSTAR substantially improves task-specific post-training, achieving 94.00% exact match and raising performance on complex cases to 80.56%. Overall, our results show that maintaining the starting state of downstream GRPO improves adaptation under limited workflow feedback and provides a more effective path for industrial LLM workflow maintenance. Article Search Article: ase26ind-p22-p doi:10.1145/3832783.3834459
	Fan, Gang	ASE '26: "Source-Free Detection and ..." Source-Free Detection and Impact Analysis of Compiler Optimization Problems in Mobile Applications Han Hu, Xiaoheng Xie, Bo Sun, Jian Gu, Gang Fan, and Li Li (Independent Researcher, Hong Kong; Independent Researcher, China; Monash University, Australia; Beihang University, China) Mobile apps frequently suffer from frame drops, overheating, and excessive power consumption. While developers optimize algorithms and debug code, a critical bottleneck often goes unnoticed: native libraries compiled with low optimization levels (O0/O1 instead of O2/O3). Because these libraries execute without functional errors, the resulting performance degradation remains hidden in production apps. We present OptDetect, a source-free framework that detects compiler optimization problems directly from app binaries. OptDetect handles mixed optimization levels through binary disassembly, chunk-level classification, and weighted score aggregation, achieving 93.0% accuracy on controlled datasets and 81.9% on real-world datasets. Applying OptDetect to 21,972 native libraries from 830 top-ranked Google Play apps, we find that 30.5% of libraries use low optimization levels, affecting 91.7% of apps. Through case studies on 12 production apps, fixing detected issues reduces CPU instructions by 10-63% (median: 20.5%) for commercial apps and 15-58% (median: 32%) for open-source apps. Performance complaints decrease in 5 of 6 commercial apps, and ratings increase in 5 of 6. Further investigation reveals that widely-used third-party libraries are themselves distributed at low optimization levels, with 49.7% of 1,073 libraries in a major repository exhibiting this problem. These findings show that compiler optimization problems are common, source-free detectable, and practically consequential in mobile app ecosystems. Article Search Article: ase26main-p135-p doi:10.1145/3832783.3834340
	Fan, Guisheng	ASE '26: "A Longitudinal Analysis of ..." A Longitudinal Analysis of Software Development Evolution in a Financial Organization Wentao Chen, Zehong Zhang, Huiqun Yu, Guisheng Fan, Huan Wang, and Kaiwen Zhi (East China University of Science and Technology, China; Orient Securities Company Limited, China) DevOps adoption has become a key mechanism for automating software development, while AI-assisted coding introduces new uncertainties into established workflows. However, long-term evidence on the evolution of software development remains limited, especially in regulated financial organizations. To address this gap, we partner with a leading securities firm and analyze over 800,000 lifecycle records from all software projects between 2021 and 2025. We examine long-term trends, structural change points, and project-level evolution patterns. The results show a shift from development-driven growth to quality-assurance-centric and maintenance-heavy stabilization. We further identify three structural breakpoints mainly associated with DevOps maturation, requirements management, and quality-oriented governance. Project clustering shows that the ecosystem remains stable in earlier periods but becomes more fragmented recently, with a maintenance-intensive project state emerging. To further investigate the evolution of software development in financial organizations, we conduct semi-structured interviews. Practitioner interviews complement these findings by revealing early concerns under AI-assisted development. In general, this study provides longitudinal evidence on the evolution of software development in financial organizations. In addition, it provides lessons learned for AI-assisted software development from a distinctive perspective. Article Search Article: ase26ind-p256-p doi:10.1145/3832783.3834515 ASE '26: "RealAIGC: Towards More Realistic ..." RealAIGC: Towards More Realistic Evaluation of AI-Generated Code Detection in Real-World Code Repository Wentao Chen, Yufei Chen, Huiqun Yu, Guisheng Fan, Kaiwen Zhi, Peite Guo, and Jianyuan Yu (East China University of Science and Technology, China; Shanghai Engineering Research Center of Smart Energy, China) AI-generated code (AIGC) from autonomous coding agents are widely adopted across the software development lifecycle. However, AIGC also introduces critical challenges to open-source community governance, making AIGC detection important. Existing AIGC detection benchmarks are fundamentally misaligned with real-world development processes. To address this gap, we construct RealAIGC, a benchmark for AIGC detection grounded in real-world code repositories. RealAIGC is built from the development histories of GitHub and includes pull request (PR) generated by five coding agents alongside human-written code, covering eight major programming languages. It supports multi-granularity detection at the repository, PR, commit, file, and function levels, with more than four million functions. Based on RealAIGC, we conduct a realistic empirical evaluation of 28 AIGC detection methods across three categories. The results show that supervised approaches perform well only in small, homogeneous, single-language repositories, but degrade significantly in mainstream dynamic languages and in large-scale, multi-developer environments. Perplexity based methods are nearly ineffective in realistic settings. No existing method demonstrates general applicability, and all approaches perform unsatisfactorily at the commit and PR levels. This work provides empirical guidance for advancing AIGC detection techniques. Article Search Article: ase26main-p2317-p doi:10.1145/3832783.3834411
	Fan, Lingling	ASE '26: "One Is Not Enough: The Untold ..." One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability Fangyuan Zhang, Lyuye Zhang, Lingling Fan, Chengwei Liu, Yinan Li, Liang Huang, Yang Liu, Zheli Liu, and Sen Chen (Nankai University, China; Nanyang Technological University, Singapore; Qi An Xin Technology Group, China) Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling. Article Search Article: ase26main-p694-p doi:10.1145/3832783.3837455
	Fan, Xiaoxiong	ASE '26: "A Selective Undo/Redo Algorithm ..." A Selective Undo/Redo Algorithm for Dependency-Constrained Operation Histories Based on Change Propagation Xiaoxiong Fan, Hou Tam, Hanxi Zhu, and Song-Hai Zhang (Tsinghua University, China) Selective undo and redo let users disable or re-enable a specific historical operation while attempting to preserve unrelated later work. This is particularly valuable in interaction-heavy and collaborative editing environments, where mistakes may be discovered only after substantial later work has accumulated and where discarded edits are costly to reconstruct manually. Achieving this is significantly harder when operations are dependency-constrained: whether they remain valid after a toggle may depend on complex semantic conditions, and naively replaying long history suffixes after every toggle is too expensive for interactive use. To this end, we present a dependency-sensitive change-propagation algorithm that preserves a replay-style correctness target without full replay after every toggle. Our approach decomposes editor state into fine-grained slots with reducer-backed semantics, evaluates operation legality against prefix state, and propagates the effect of a toggle only through the affected neighborhood of later operations and state changes. We implement the mechanism in the scene editor of an in-house game IDE built on a heavily modified version of the Godot Engine. Across differential testing against two exact replay baselines and a validity-aware fuzzing campaign comprising 45 runs and 450,000 recorded actions, our change-propagation pipeline matched the reference semantics on all evaluated workloads. It substantially reduced toggle latency and semantic work relative to both baselines, including a reduction of about 194× in prerequisite evaluations. These results show that replay-style selective undo/redo can be made practical for operations with hard dependency constraints. Article Search Article: ase26main-p1098-p doi:10.1145/3832783.3837482
	Fan, Yujia	ASE '26: "WebCQ: Cooperative Multi-agent ..." WebCQ: Cooperative Multi-agent Deep Reinforcement Learning for Scalable Web GUI Testing Yujia Fan, Sinan Wang, Zebang Fei, Yao Qin, Huaxuan Li, and Yepang Liu (Southern University of Science and Technology, China) Multi-agent reinforcement learning (MARL)-based techniques have shown promise for GUI testing. However, as the complexity of modern GUI software increases, existing MARL-based approaches (e.g., MARG and Fastbot) struggle to scale due to the inherent limitations of their underlying tabular reinforcement learning algorithms. This limits their applicability to large-scale commercial GUI software, especially web applications with vast state spaces and many interactive elements. To fill this gap, we propose WebCQ, a novel MARL-based approach for scalable web GUI testing. WebCQ incorporates QTRAN for multi-agent coordination and a lightweight synchronization mechanism, allowing it to work under asynchronous web testing scenarios. It extracts semantic and exploration features for each UI event to form an action vector. This vector is concatenated with the current state vector and fed into the policy network, enabling DQN-based decision making within a dynamic action space. We evaluated WebCQ on eight large-scale commercial websites. Under the same time budget and agent count, WebCQ explored 33.3% more states and executed 42.2% more unique actions than MARG, while triggering more failures on six of the eight websites under test. It also demonstrated strong scalability, maintaining higher action throughput during 20-hour experiments, and achieving greater performance improvements as the number of agents increased. These results show that WebCQ overcomes key limitations of existing MARL-based approaches, providing a scalable and effective solution to enhance modern web GUI testing. Article Search Article: ase26main-p944-p doi:10.1145/3832783.3834374
	Fang, Chunrong	ASE '26: "Breaking Customized LLMs for ..." Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks Yuchen Chen, Wei Cheng, Yuan Xiao, Weisong Sun, Chunrong Fang, Yang Liu, Zhenyu Chen, and Baowen Xu (Nanjing University, China; Nanjing University of Aeronautics and Astronautics, China; Nanyang Technological University, Singapore) LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness. Article Search Article: ase26main-p2706-p doi:10.1145/3832783.3834424 ASE '26: "CIPIHunter: Detecting Configuration-Induced ..." CIPIHunter: Detecting Configuration-Induced Prediction Instability in Deep Learning Frameworks Yanzhou Mu, Shuo Meng, Mijung Kim, Xiang Chen, Chunrong Fang, Zhenyu Chen, and Juan Zhai (UNIST, Republic of Korea; Nanjing University, China; Nantong University, China; University of Massachusetts at Amherst, USA) Deep learning (DL) frameworks support diverse execution configurations, including precision modes and model optimizations. Even with a fixed model, input, and framework version, changing these configurations can change model predictions, causing Configuration-Induced Prediction Instability (CIPI). CIPI arises when configuration-dependent numerical perturbations propagate and cause potentially harmful model-level behavior. Existing API-level and model-level testing approaches are not well suited to detecting CIPI, as these approaches lack configuration-conditioned exploration and propagation-aware diagnosis. Therefore, we present CIPIHunter, which combines controlled configuration-pair testing, sensitivity-oriented mutation, feedback-guided search, and intermediate tracing to localize suspicious operators or operator groups. On 13 PyTorch models under a 100-round budget, CIPIHunter reports the highest raw CIPI count and 22 deduplicated Type I manifestations, 83.3% more than the strongest baseline, while remaining competitive in overall deduplicated manifestation coverage. In total, we submit 29 PyTorch issue reports. Developers have acknowledged eight, rejected five, and marked four as duplicates; nine remain pending, and three have been closed without an explicit determination. Separately, three reports are labeled “high-priority”. These results demonstrate the practical utility of CIPI testing for framework quality assurance. Article Search Article: ase26main-p163-p doi:10.1145/3832783.3834345 ASE '26: "MultiFixer: A Coordinator-Proposer ..." MultiFixer: A Coordinator-Proposer Based Multi-agent Framework for Fixing Multi-hunk Bugs Haichuan Hu, Chunrong Fang, Ye Shang, Jiawei Liu, Weifeng Sun, Guoqing Xie, Chenxing Zhong, and Quanjun Zhang (Nanjing University of Science and Technology, China; Nanjing University, China; Singapore Management University, Singapore) Automated Program Repair (APR) has benefited greatly from Large Language Models (LLMs), but existing LLM-based APR methods still struggle with multi-hunk bugs that require coordinated changes across multiple locations. These bugs demand repository-level context understanding, repair-order scheduling, and effective hunk-level patch generation and selection. To address these challenges, we propose MultiFixer, a novel Coordinator-Proposer based multi-agent framework for multi-hunk repair. MultiFixer performs tool-augmented bug analysis, constructs fine-grained repair context, iteratively generates patches through a Coordinator-Proposer architecture, and applies two-stage patch refinement for syntactic and semantic correctness. We evaluate MultiFixer on 835 bugs from Defects4J and three vulnerability benchmarks. On Defects4J, MultiFixer fixes 326 bugs, including 62 multi-method and 27 multi-file bugs, and outperforms prior APR baselines in the reported comparisons with the same base model. Moreover, MultiFixer also fixes 46 multi-hunk bugs among 95 unique fixes. When combined with Claude-3.5-Sonnet, MultiFixer repairs 420 bugs, establishing a new state of the art on Defects4J. On VUL4J, MultiFixer repairs 24 real-world vulnerabilities, including 5 multi-hunk cases. On the multi-hunk subsets of SEC-bench and PatchEval, MultiFixer fixes 11 and 19 vulnerabilities, respectively, outperforming all compared baselines under GPT-3.5. These results demonstrate the effectiveness of MultiFixer for multi-hunk repair. Article Search Article: ase26main-p2372-p doi:10.1145/3832783.3837527
	Fang, Jian	ASE '26: "Mining Tactics for Automated ..." Mining Tactics for Automated Theorem Proving Jian Fang, Yixun Yao, and Yingfei Xiong (Peking University, China) Automated theorem proving is essential for the formal verification of safety-critical systems. As the corpus of formal proofs grows, a natural paradigm is to learn from existing proofs. However, current learning-based approaches predominantly train Large Language Models (LLMs) as end-to-end provers, which yields resource-intensive, opaque systems. Conversely, while traditional symbolic provers are computationally efficient, how to automatically improve these solvers from data remains an open challenge. This paper bridges this gap by proposing LLM2Ltac, a novel approach that leverages the reasoning power of LLMs not as end-to-end provers, but as intelligent synthesizers to mine purely symbolic tactics from data. Given a corpus of formal proofs, LLM2Ltac asks an LLM to identify latent proof strategies and formalize them into reusable tactics. These tactics are verified for validity and generalizability, and finally integrated into symbolic provers to enhance their automated proving capabilities without the runtime cost of LLMs. We implement LLM2Ltac on Rocq 8.20.0 and mine tactics from 11,725 theorems in the standard library. We evaluate our approach on 6,199 theorems from four large real-world verification projects, namely, CompCert, Coq-Art, Ext-Lib, and VFA. Results show that the mined tactics improve CoqHammer to prove 23.87% more theorems, and when integrating the improved CoqHammer with Claude Code, the overall proved theorems increases by 9.90%, indicating the effectiveness of LLM2Ltac. Article Search Article: ase26main-p2413-p doi:10.1145/3832783.3837528
	Fang, Zihan	ASE '26: "Toward Inclusive Programming ..." Toward Inclusive Programming Support for Novice Programmers with Dyslexia: Insights from a Comparative Study Zihan Fang, Janice Chung, Ruijia Chen, Marcia Barnes, Yuhang Zhao, and Yu Huang (Vanderbilt University, USA; University of Wisconsin-Madison, USA) Programming attracts a diverse range of learners, including individuals with dyslexia, a learning difficulty that affects reading, writing, and spelling despite average intelligence and educational opportunities. Although prior work has examined dyslexia in natural-language and code comprehension, we still know little about how dyslexic learners engage with code relative to natural language, and what this implies for inclusive programming environments. This gap is especially important in the AI era, as novice programmers increasingly rely on AI-powered coding and learning tools that may not address the distinct comprehension and cognitive support needs of learners with dyslexia. To address this gap, we conducted an eye-tracking study with a mixed-methods design involving 24 novice programmers (12 with dyslexia, 12 without) who completed paired code-comprehension and English-comprehension tasks. We found that although the two groups showed similar overall visual scanning patterns, eye-gaze features suggest higher cognitive effort among dyslexic novices during code comprehension. We also found that the performance gap between dyslexic and neurotypical learners was smaller in code comprehension than in English comprehension, suggesting that programming-specific representations may reshape, rather than eliminate, dyslexia-related challenges. In addition, dyslexic novices reported lower confidence, viewed general training methods as less effective, and described difficulties with symbolic elements and structurally complex code. These findings provide an empirical basis for designing AI-assisted programming tools that can detect cognitive overload and adapt explanations, feedback, and task support to better support dyslexic novices. Article Search Article: ase26main-p2412-p doi:10.1145/3832783.3834414 ASE '26: "Programming by Chat: A Large-Scale ..." Programming by Chat: A Large-Scale Behavioral Analysis of 11,579 Real-World AI-Assisted IDE Sessions Ningzhi Tang, Chaoran Chen, Zihan Fang, Gelei Xu, Maria Dhakal, Yiyu Shi, Collin McMillan, Yu Huang, and Toby Jia-Jun Li (University of Notre Dame, USA; Vanderbilt University, USA) IDE-integrated AI coding assistants, which operate conversationally within developers' working codebases with access to project context and multi-file editing, are rapidly reshaping software development. However, empirical investigation of this shift remains limited: existing studies largely rely on small-scale, controlled settings or analyze general-purpose chatbots rather than codebase-aware IDE workflows. We present, to the best of our knowledge, the first large-scale study of real-world conversational programming in IDE-native settings, analyzing 74,998 developer messages from 11,579 chat sessions across 1,300 repositories and 899 developers using Cursor and GitHub Copilot. These chats were committed to public repositories as part of routine development, capturing in-the-wild behavior. Our findings reveal three shifts in how programming work is organized: conversational programming operates as progressive specification, with developers iteratively refining outputs rather than specifying complete tasks upfront; developers redistribute cognitive work to AI, delegating diagnosis, comprehension, and validation rather than engaging with code and outputs directly; and developers actively manage the collaboration, externalizing plans into persistent artifacts, and negotiating AI autonomy through context injection and behavioral constraints. These results provide foundational empirical insights into AI-assisted development and offer implications for the design of future programming environments. Article Search Article: ase26main-p1071-p doi:10.1145/3832783.3834377
	Fei, Zebang	ASE '26: "WebCQ: Cooperative Multi-agent ..." WebCQ: Cooperative Multi-agent Deep Reinforcement Learning for Scalable Web GUI Testing Yujia Fan, Sinan Wang, Zebang Fei, Yao Qin, Huaxuan Li, and Yepang Liu (Southern University of Science and Technology, China) Multi-agent reinforcement learning (MARL)-based techniques have shown promise for GUI testing. However, as the complexity of modern GUI software increases, existing MARL-based approaches (e.g., MARG and Fastbot) struggle to scale due to the inherent limitations of their underlying tabular reinforcement learning algorithms. This limits their applicability to large-scale commercial GUI software, especially web applications with vast state spaces and many interactive elements. To fill this gap, we propose WebCQ, a novel MARL-based approach for scalable web GUI testing. WebCQ incorporates QTRAN for multi-agent coordination and a lightweight synchronization mechanism, allowing it to work under asynchronous web testing scenarios. It extracts semantic and exploration features for each UI event to form an action vector. This vector is concatenated with the current state vector and fed into the policy network, enabling DQN-based decision making within a dynamic action space. We evaluated WebCQ on eight large-scale commercial websites. Under the same time budget and agent count, WebCQ explored 33.3% more states and executed 42.2% more unique actions than MARG, while triggering more failures on six of the eight websites under test. It also demonstrated strong scalability, maintaining higher action throughput during 20-hour experiments, and achieving greater performance improvements as the number of agents increased. These results show that WebCQ overcomes key limitations of existing MARL-based approaches, providing a scalable and effective solution to enhance modern web GUI testing. Article Search Article: ase26main-p944-p doi:10.1145/3832783.3834374
	Fei, Zhiwei	ASE '26: "SkillMOO: Multi-objective ..." SkillMOO: Multi-objective Optimization of Agent Skills for Software Engineering Jingzhi Gong, Ruizhen Gu, Zhiwei Fei, Yazhuo Cao, Lukas Twist, Alina Geiger, Shuo Han, Dominik Sobania, Federica Sarro, and Jie M. Zhang (King's College London, UK; Queen's University Belfast, UK; Nanjing University, China; Johannes Gutenberg University Mainz, Germany; University College London, UK; University of Duisburg-Essen, Germany) Agent skills are increasingly used to configure coding agents for software engineering (SE) tasks, yet current practice treats them as static, hand-crafted assets, or evolved on pass rate alone. This is insufficient: a skill can improve task success while substantially raising token cost, or introducing misleading guidance. We argue that SE agent skill bundles can be treated as multi-objective search objects and present SkillMOO, a framework that evolves skill bundles through LLM-proposed edits and NSGA-II Pareto selection on pass rate and inference cost. Evaluated across all 16 SkillsBench SE tasks, SkillMOO achieves the top pass rate rank on 11 of 12 non-zero-pass tasks while achieving cost reductions of up to 31.7% over static bundles, with pass rate gains up to 42 percentage points. Analysis of 38 skill edits shows that pruning and substitution dominate successful operations, offering actionable principles for skill bundle design. Thereby, the current practice of deploying skills without cost-aware validation leaves better skill configurations unexplored, motivating a new class of multi-objective search-based skill engineering. Article Search Article: ase26nier-p65-p doi:10.1145/3832783.3834550
	Feichtinger, Kevin	ASE '26: "The ARDoCo Tool Landscape: ..." The ARDoCo Tool Landscape: REST API, TraceView, and TraceViz for Architecture Traceability Jan Keim, Dominik Fuchß, Sophie Corallo, Tobias Hey, Julian Winter, and Kevin Feichtinger (KIT, Germany) Context and Problem. Software development produces interrelated artifacts like software architecture documentation (SAD), software architecture models (SAMs), and source code, whose relationships are essential for maintenance and consistency checking. However, automatically recovering links between these artifacts (traceability link recovery (TLR)) remains difficult to deploy in practice. Method and Aim. We present an accessible tool landscape for ARDoCo’s TLR approaches: the ARDoCo REST API exposes four TLR pipelines (SAD-SAM, SAM-Code, SAD-Code, and SAD-SAM-Code) via HTTP endpoints with asynchronous execution and caching; TraceView is a browser-based frontend with a guided wizard and interactive multi-panel exploration of recovered links and inconsistencies; and TraceViz, which is a VS Code extension that overlays trace links directly onto documentation in the IDE. Results and Conclusion. All three components are publicly deployed and usable. A preliminary study for TraceViz’s in-IDE visualization confirmed that it improves developer comprehension during software understanding tasks. The tool landscape makes state-of-the-art TLR accessible to architects, developers, and tool integrators. Video. We provide a screencast of our ARDoCo Tool Landscape and how it is used here: https://youtu.be/IOTEPZQ3tVs Article Search Artifacts Available Article: ase26tool-p73-p doi:10.1145/3832783.3834621
	Fein, Benedikt	ASE '26: "ScratchLog+: Live Analytics ..." ScratchLog+: Live Analytics of Learners’ Exercise Progress Benedikt Fein and Gordon Fraser (University of Passau, Germany) While the block-based programming language Scratch is a popular introductory programming environment, gathering information about student progress is challenging since the environment does not expose any kind of analytics. The ScratchLog tool already alleviates this somewhat, but focusses mainly on classroom management and general analytics suited for open-ended tasks. To also provide insights about student progress in goal-oriented exercises, we propose the ScratchLog+ extension in this paper. Our tool combines Whisker test suites to collect information about the functional correctness of students’ programs, and code embedding models to estimate structural and semantic progress towards an example solution. To make these new analytics of ScratchLog+ accessible to teachers, they are directly integrated into the ScratchLog user interface as interpretable visualisations of the typically abstract code embedding vectors. We provide a screencast demonstrating the tool at https://youtu.be/lQSCDqvbpQY. Article Search Artifacts Available Article: ase26tool-p62-p doi:10.1145/3832783.3834618
	Fekete, Alan	ASE '26: "Maximal Format-Free Data Repair ..." Maximal Format-Free Data Repair Zijian Luo, Xi Wu, Hong Jin Kang, Alan Fekete, and Rahul Gopinath (University of Sydney, Australia) ERROR in abstract. Article Search Artifacts Available Article: ase26main-p428-p doi:10.1145/3832783.3834354
	Feng, Guohao	ASE '26: "PL4SA: Optimized Partial Library ..." PL4SA: Optimized Partial Library Selection for Efficient Static Analysis Guohao Feng, Yifei Lu, and Minxue Pan (Nanjing University, China) With the rapid advancements in modern software engineering practices, software applications have become increasingly dependent on external libraries, making the choice between whole-program and application-only analysis more critical: the former often leads to timeouts due to high computational overhead, while the latter risks missing library-induced bugs. Recent research has explored a compromise path, i.e., partial inclusion of libraries to balance analysis efficiency and recall. However, achieving a more precise relevance analysis that enables a more balanced and accurate library selection while minimizing the associated overhead remains a significant challenge. This paper proposes PL4SA, a novel partial library selection approach that establishes precise relevance between client analyses and library methods using fine-grained whole-program points-to information. The key point of PL4SA lies in integrating points-to analysis with the partial library selection process in a progressively expanding manner. During this process, pointers are ranked according to their relevance to the client analysis; in each iteration, the most relevant pointer as well as its corresponding library is selected, while pointers dependent on the selected pointer are further expanded to reveal their points-to information. To support this analysis, extended pointers, a pointer-based abstraction that summarizes additional information flows into/out of method invocations and array accesses, serve as anchors for the progressive expansion of points-to information. Furthermore, PL4SA organizes this analysis in three steps, leveraging summarization techniques to enable the reuse of time-critical intra-procedural points-to analysis results within libraries across different projects, due to the inherent stability of library code. Collectively, these design choices contribute to PL4SA’s high efficiency. Our experimental results demonstrate that by including only 12% and 17% library methods, PL4SA achieves 24.6x, 9.0x speedup, and 99.0% recall, and both 100% precision for variable-type analysis and null-pointer analysis compared to whole-program analysis, significantly outperforming existing baselines. Article Search Article: ase26main-p3256-p doi:10.1145/3832783.3834431
	Feng, Haoyu	ASE '26: "GPU-Accelerated Belief Propagation ..." GPU-Accelerated Belief Propagation for Program Analysis Haoyu Feng and Xin Zhang (Peking University, China) Belief Propagation (BP) is a widely used approximate inference algorithm in probabilistic graphical models (PGMs), but it is computationally expensive when applied to large-scale program analysis. Existing GPU-based approaches are unable to support flexible update strategies and have yet to integrate logical constraints with GPU acceleration, leading to challenges in both generality and efficiency. We present FastLBP, a GPU-accelerated BP framework for program analysis. We propose a unified representation for specifying flexible update strategies required in program analysis, along with a dependency analysis algorithm to enable parallel execution. Furthermore, we implement BP with local structures on GPUs by assigning individual threads to message computations and utilizing a memory-efficient representation. Experiments on SmartFL and Bingo show that FastLBP achieves average speedups of 17.42× and 2.82× over CPU-based approaches on SmartFL and Bingo, respectively, and 6.14× over the GPU-based approach on SmartFL, while preserving accuracy. Moreover, FastLBP supports update strategies that existing GPU-based approaches cannot support, demonstrating its improved generality for real-world program analysis. Article Search Artifacts Available Article: ase26main-p4025-p doi:10.1145/3832783.3834444
	Feng, Hongjiang	ASE '26: "Panorama: Unveiling Latent ..." Panorama: Unveiling Latent Dependencies for Microservice Autoscaling via Meta-learning Zhuangbin Chen, Hongjiang Feng, Yang Liu, Juzheng Zheng, Xiaoyu He, and Zibin Zheng (Sun Yat-sen University, China) Existing autoscaling approaches primarily leverage direct service calls to model the propagation effects of scaling decisions across inter-service dependencies. However, the intricate and implicit service interactions (i.e., latent dependencies) often go beyond such direct invocations, rendering suboptimal scaling actions and poor adaptability. To address these limitations, we propose Panorama, a novel autoscaling framework that explicitly unveils and exploits indirect service interactions. In particular, we formalize two fundamental categories of latent dependencies, i.e., resource interference dependencies (RIDs), which emerge from shared infrastructure resources, and execution blocking dependencies (EBDs), which stem from temporal constraints in the execution logic of business workflows. Panorama employs a hybrid attention mechanism to model these multifaceted service dependencies alongside temporal dynamics. We also design a meta-learning paradigm to enable rapid adaptation to evolving workload patterns and dependency structures without extensive retraining. Evaluation across four representative microservice benchmarks shows that Panorama consistently outperforms state-of-the-art baselines, achieving up to 68% reduction in resource consumption while improving response time by 42%. This highlights the critical importance of explicitly modeling latent dependencies for effective microservice resource management. Article Search Article: ase26main-p1217-p doi:10.1145/3832783.3837485
	Feng, Jia	ASE '26: "Towards Reliable C-to-Rust ..." Towards Reliable C-to-Rust Translation with Rule-Guided Reasoning and Reinforcement Learning Feng Luo, Jiachen Liu, Cuiyun Gao, Jia Feng, and Kui Liu (Harbin Institute of Technology, Shenzhen, China; Huawei Technologies, China) The migration of legacy C programs to Rust has become an important direction for improving software memory safety while alleviating the high cost of manual rewriting. Leveraging large language models (LLMs) for automated C-to-Rust translation has emerged as a promising direction. However, existing LLM-based approaches remain limited. On the one hand, LLMs exhibit limited capability in identifying Rust-specific rules, and inadequate handling of Rust syntax often results in incorrect translations. On the other hand, existing LLMs often struggle to accurately capture the semantics of complex code, resulting in incorrect translations. To address these challenges, we propose a Translation fRAmework Via rule-guided reasoning and rEinforcement Learning, namely TRAVEL, consisting of two modules. The first module employs Monte Carlo Tree Search (MCTS)-based reasoning path construction guided by Rust-specific rules, steering the search toward translation steps that respect the syntactic rules that LLMs frequently violate. The second module introduces reinforcement learning with execution feedback and reasoning-quality signals to improve semantic preservation. We evaluate TRAVEL on three datasets: xCodeEval (a public benchmark), OS-Bench (functions collected from the Linux kernel), and HW-Bench (an industrial dataset from Huawei). On xCodeEval, TRAVEL outperforms all baselines across three backbone LLMs. In particular, compared to the strongest prompting baseline IRENE, TRAVEL improves computational accuracy (CA) by 26.22% and compilation success rate (CSR) by 18.77%. On HW-Bench and OS-Bench, TRAVEL further improves CSR by 18.28% and 16.51%, respectively, while reducing unsafe rate (UR) by 13.06% and 13.08%, respectively. Article Search Article: ase26ind-p459-p doi:10.1145/3832783.3834534
	Feng, Jingfei	ASE '26: "KRCA: An Efficient Root Cause ..." KRCA: An Efficient Root Cause Analysis System in Hyper-scale Microservice Systems via Agentic AI Jiamin Jiang, Jingfei Feng, Yu Luo, Qingliang Zhang, Yongqian Sun, Wenwei Gu, Shenglin Zhang, Tianyu Cui, Yao Wu, Jielong Huang, Nan Qi, and Dan Pei (Nankai University, China; Kuaishou Technology, China; Tsinghua University, China) Hyper-scale microservice systems have become the standard infrastructure for large-scale Internet companies. These systems consist of numerous loosely coupled microservices that evolve independently through continuous development and deployment. Such complexity makes failures unavoidable, necessitating efficient Root Cause Analysis (RCA) to help Site Reliability Engineers (SREs) quickly localize root cause services and classify failure types. However, existing RCA methods often struggle to adapt to the extreme dynamism and massive scale of these systems. In this paper, we present KRCA, an end-to-end RCA system designed for hyper-scale microservice systems. To manage the vast search space, KRCA employs a multi-stage pipeline that begins with an API-level drilldown to isolate suspicious services. It then instantiates a skeleton-based causal graph from anomalous metrics to serve as a high-recall structural prior, before utilizing a memory-augmented multi-agent framework to verify causality and generate the final failure report. By combining structured causal constraints with multi-agent reasoning, KRCA balances diagnostic accuracy with the efficiency requirements of real-time production use. Experimental results show that KRCA achieves AC@1 scores of 0.88 and 0.79 for root cause service localization and failure type classification, outperforming the strongest baseline by at least 31% in absolute gains. KRCA has been deployed in Kuaishou's production environment for over six months, reducing the average diagnosis time by 77.3%. Article Search Article: ase26ind-p61-p doi:10.1145/3832783.3834468 ASE '26: "OpsAgent: An Evolving Multi-agent ..." OpsAgent: An Evolving Multi-agent System for Incident Management in Microservices Yu Luo, Jiamin Jiang, Jingfei Feng, Lei Tao, Qingliang Zhang, Xidao Wen, Yongqian Sun, Shenglin Zhang, Tong Liu, Wenjie Zhang, and Dan Pei (Nankai University, China; Alibaba Cloud, China; Lenovo, China; Tsinghua University, China) Incident management (IM) is central to the reliability of large-scale microservice systems. Yet manual IM, where on-call engineers examine metrics, logs, and traces is labor-intensive and error-prone in the face of massive and heterogeneous observability data. Existing automated IM approaches often struggle to generalize across systems, provide limited interpretability, and incur high deployment costs, which hinders adoption in practice. In this paper, we present OpsAgent, a lightweight, self-evolving multi-agent system for IM that employs a training-free data processor to convert heterogeneous observability data into structured textual descriptions, along with a multi-agent collaboration framework that makes diagnostic inference transparent and auditable. To support continual capability growth, OpsAgent also introduces a dual self-evolution mechanism that integrates internal model updates with external experience accumulation, thereby closing the deployment loop. Comprehensive experiments on the OPENRCA benchmark demonstrate state-of-the-art performance and show that OpsAgent is generalizable, interpretable, cost-efficient, and self-evolving, making it a practically deployable and sustainable solution for long-term operation in real-world microservice systems. Notably, its deployment in Lenovo’s production environment further validates its effectiveness in real-world industrial settings. Article Search Article: ase26ind-p92-p doi:10.1145/3832783.3834479
	Feng, Sidong	ASE '26: "Mobile Bug Reproduction via ..." Mobile Bug Reproduction via Global State Reprioritization and LLM-Guided Trajectory Exploration Dingbang Wang, Sidong Feng, William G. J. Halfond, and Tingting Yu (University of Connecticut, USA; Monash University, Australia; University of Southern California, USA) Mobile bug reproduction is essential to effective debugging in software engineering. Recent methods leveraging Large Language Models (LLMs) have shown significant performance gains over traditional techniques in automating this task. However, existing LLM-based methods remain constrained by two major limitations. First, they lack robustness to unreliable or inconsistent LLM outputs due to overreliance on a single LLM-suggested action without principled planning. Second, substantial token overhead arises from frequent LLM queries and the limited utilization of each query’s output capacity. To address these limitations, we propose ReproPilot, a lightweight framework that combines global planning with LLM-based semantic reasoning to reproduce mobile bugs. Specifically, the LLM provides diverse, reusable long-horizon guidance beyond step-wise action suggestions. This guidance is integrated with heuristic signals by a global planning mechanism to reason about reproduction progress and globally determine where to explore (i.e., which reproduction states) and what trajectories to explore, rather than merely executing actions on the current UI page at each iteration. As a result, ReproPilot improves the consistency and cost-efficiency of bug reproduction while maintaining competitive effectiveness. Evaluation on 74 real-world Android crash reports shows that our approach delivers the best reliability–cost trade-off among the evaluated methods, attaining the highest consistency (80.14%) with competitive effectiveness (86.49%), reducing reproduction time by 2.32%–14.07%, and lowering LLM token consumption by 65.39%–83.96% compared with state-of-the-art LLM-based baselines. Article Search Article: ase26main-p1450-p doi:10.1145/3832783.3837495
	Feng, Xiaotao	ASE '26: "Evidence-Grounded Logic Vulnerability ..." Evidence-Grounded Logic Vulnerability Detection for Smart Contracts via Runtime Context Reasoning Guang Gong, Yucong Jiang, Rong Jian, Xiaotao Feng, Zhihan Wei, Qi Li, and Ke Xu (Tsinghua University, China; 360 Vulnerability Research Institute, China) Smart contracts are foundational to DeFi, yet detecting business-logic vulnerabilities, i.e., execution is syntactically correct but violates a contract’s intended behavior, remains difficult. Most recent LLM-based approaches still follow a largely static, source-code–centric auditing paradigm. In practice, however, smart contracts are inherently stateful: many logic flaws emerge only under specific contract states and across particular state transitions. As a result, code-only auditing can produce false positives and miss true vulnerabilities. To address this gap, we present RcAudit, a system for detecting smart-contract logic vulnerabilities via runtime-context–enhanced LLM reasoning. RcAudit constructs a Contract Logic Knowledge Base that captures contract behavior from multiple perspectives to support LLM analysis. It then applies a state- and intent-aware fuzzing strategy to generate logic-critical runtime contexts, and performs LLM reasoning over selected contexts that exhibit potential intent–behavior inconsistencies to pinpoint vulnerabilities. We evaluate RcAudit on three real-world datasets. RcAudit identifies 74 of 132 known logic vulnerabilities with high precision (96.9%), achieving 117.6% higher detection than the strongest baseline. Importantly, RcAudit further uncovers 22 zero-day vulnerabilities in real-world projects. Article Search Artifacts Available Article: ase26main-p839-p doi:10.1145/3832783.3837471
	Feng, Yang	ASE '26: "ReLog: Execution-Aware Logging ..." ReLog: Execution-Aware Logging with Runtime Feedback for LLM-Oriented Debugging Xin Wang, Yang Feng, Xiaoqian Jiao, Yang Zhang, Zhenhao Li, and Zishuo Ding (Hong Kong University of Science and Technology, Guangzhou, China; Hebei University of Science and Technology, China; York University, Canada) Logging statements are essential for software debugging and maintenance. However, existing approaches to automatic logging generation rely on static analysis and produce statements in a single pass without considering runtime behavior. They are also typically evaluated by similarity to developer-written logs, assuming these logs form an adequate gold standard. This assumption is increasingly limiting in the LLM era, where logs are consumed not only by developers but also by LLMs for downstream tasks. As a result, optimizing logs for human similarity does not necessarily reflect their practical utility. To address these limitations, we introduce ReLog, an iterative logging generation framework guided by runtime feedback. ReLog leverages LLMs to generate, execute, evaluate, and refine logging statements so that runtime logs better support downstream tasks. Instead of comparing against developer-written logs, we evaluate ReLog through downstream debugging tasks, including defect localization and repair. We construct a benchmark based on Defects4J under both direct and indirect debugging settings. Results show that ReLog consistently outperforms all baselines, achieving an F1 score of 0.520 and repairing 97 defects in the direct setting, and the best F1 score of 0.408 in the indirect setting where source code is unavailable. Additional experiments across multiple LLMs demonstrate the generality of the framework, while ablations confirm the importance of iterative refinement and compilation repair. Overall, our work reframes logging as a runtime-guided, task-oriented process and advocates evaluating logs by their downstream utility rather than textual similarity. Article Search Article: ase26main-p769-p doi:10.1145/3832783.3837463 ASE '26: "RustGTC: Constraint-Guided ..." RustGTC: Constraint-Guided Test Generation for Rust APIs via Comment Analysis and Code Context Yichi Zhang, Jinhao Huang, and Yang Feng (Peking University, China; Institute of Software at Chinese Academy of Sciences, China; Nanjing University, China) Manually crafting test cases for Rust APIs is labor-intensive and error-prone, especially because of Rust’s advanced features and complex trait system. Recent advances in large language models (LLMs) have shown promise in automated test generation; however, existing approaches often underuse documented input requirements embedded in API comments. We present RustGTC, a framework that uses API comments to guide Rust API test generation. RustGTC extracts documented parameter constraints from comments, constructs tests around boundary cases, and repairs generated tests to improve compilability. We evaluate RustGTC on 12 Rust crates, achieving high coverage and uncovering 41 defects. Additionally, we submitted 132 test cases; 123 were accepted, 9 were rejected. These results show that RustGTC uses documented constraints to guide Rust API test generation and reveal comment-code inconsistencies around boundary cases. Article Search Article: ase26main-p2466-p doi:10.1145/3832783.3837531
	Feng, Yebo	ASE '26: "Breaking the Isolation: Coordinated ..." Breaking the Isolation: Coordinated Multi-agent Fuzzing for Smart Contracts with Multi-dimensional Objective Learning Ruichao Liang, Ruochen Cao, Jing Chen, Kun He, Yebo Feng, Yue Xue, and Cong Wu (Wuhan University, China; Nanyang Technological University, Singapore; MetaTrust Labs, Singapore) Smart contracts manage critical assets in decentralized systems but are prone to vulnerabilities. While fuzzing has proven effective in software testing, existing contract fuzzers often rely on ad-hoc optimization strategies with limited objective guidance, typically driven by coverage or simple heuristics. This narrow focus leads to high false negative rates, as important perspectives of smart contracts, like semantic, state, and economic effects, are overlooked during transaction sequence generation. Moreover, coordinating these dimensions into fuzzing is challenging because their divergent objectives and complex interactions make ad-hoc adaptations to fitness functions or mutation strategies largely ineffective. To fill the gaps, we propose SynerFuzz, a multi-agent deep reinforcement learning-based fuzzer. We formulate fuzzing as a Decentralized Partially Observable Markov Decision Process, where each agent is assigned a distinct testing objective extracted from the target contract. Through coordinated learning, DRL agents integrate multi-dimensional signals to construct high-quality sequences, enabling SynerFuzz to uncover both subtle semantic flaws and economically profitable behaviors. Compared to 9 SOTA tools, SynerFuzz detects up to 4.2× more vulnerabilities while reducing time and transaction overhead by 70.6% and 86.8%. In real-world scenarios, SynerFuzz reproduces 33 historical DeFi exploits with over $40 million losses and discovers 17 0-day vulnerabilities in 4 projects managing over $179.8 million, earning $3,800 bug bounties. Article Search Article: ase26main-p791-p doi:10.1145/3832783.3837466
	Feng, Yueyang	ASE '26: "Certified Program Synthesis ..." Certified Program Synthesis with a Multi-modal Verifier Yueyang Feng, Dipesh Kafle, Vladimir Gladshtein, Vitaly Kurin, George Pîrlea, Qiyuan Zhao, Peter Müller, and Ilya Sergey (National University of Singapore, Singapore; Neapolis University Pafos, Cyprus; ETH Zurich, Switzerland) Certified program synthesis (a.k.a. vericoding) is the process of automatically generating a program, its formal specification, and a machine-checkable proof of program/specification alignment from a natural-language task description. Two key challenges make vericoding difficult. First, specifications synthesised from natural language descriptions are often either too weak to be meaningful or too strong to be implementable, yet existing approaches lack systematic means to detect such defects. Second, the program verifiers used to validate results are fragmented: each tool supports a particular reasoning mode—auto-active (e.g., Dafny, Verus) or interactive (e.g., Rocq, Lean)—with its own trade-off between automation and expressivity. This forces each synthesis methodology to target a single paradigm, limiting the tasks it can handle. We overcome both challenges by structuring the synthesis workflow in stages around a multi-modal verifier—a single tool that combines dynamic validation, automated proofs, and interactive proof scripting within one foundational framework. We realise this idea in LeetProof, a new agentic pipeline built on Velvet, a multi-modal program verifier built in the Lean theorem prover. Multi-modality enables LeetProof to validate generated specifications via randomised property-based testing before any code is synthesised, decompose the synthesis task into sub-problems guided by verification conditions, and delegate residual proof obligations to frontier AI provers specialised for Lean. We evaluate LeetProof on an extensive benchmark suite derived from prior work on certified synthesis. Our specification validation uncovers defects in existing reference benchmarks, and LeetProof's staged pipeline achieves a significantly higher rate of fully certified solutions than a single-mode baseline at the same fixed budget—consistently across two different frontier LLM backends. Article Search Artifacts Available Article: ase26main-p4427-p doi:10.1145/3832783.3837559
	Feng, Zhexuan	ASE '26: "LaMAR: Latent Multi-agent ..." LaMAR: Latent Multi-agent Collaboration via KV-Cache Communication for Automated Program Repair Rui Jiao, Yue Zhang, Zhexuan Feng, and Jinku Li (Xidian University, China; Shandong University, China) Multi-agent systems for automated program repair communicate through text tokens, requiring each agent to decode its internal state into discrete symbols and the next agent to re-encode them. This conversion loses information and incurs token overhead that grows quadratically with the agent count. We develop Latent Agent Communication (LAC), a theoretically grounded framework that formalizes how agents can share KV-cache representations directly in continuous space, and prove it provides a communication channel with strictly higher information capacity while reducing token complexity from O(N^2) to O(N). We instantiate LAC as LaMAR, a dual-chain repair system: Bug Analysis Chain diagnoses the bug through four collaborating latent agents; Repair Chain refines the patch through multi-agent latent collaboration with cross-chain context transfer, and supports optional multi-round iteration for complex defects. Evaluated across three benchmarks spanning Java, Python, and C++ with three model families, LaMAR with Qwen3-8B achieves 24.5% repair success rate on Defects4J and 62.1%--87.5% on DebugBench and QuixBugs, outperforming all baselines in the large majority of settings. Ablation experiments identify the bug analysis chain and latent communication as the most critical components. Article Search Article: ase26main-p198-p doi:10.1145/3832783.3837423
	Ferrara, Antonio	ASE '26: "Doc2Test: An Industrial Multi-agent ..." Doc2Test: An Industrial Multi-agent Framework for Document-Driven End-to-End Selenium Test Generation Andrea Lops, Antonio Ferrara, Fedelucio Narducci, Azzurra Ragone, and Michelantonio Trizio (Polytechnic University of Bari, Italy; Wideverse, Italy; University of Bari, Italy) End-to-end (E2E) testing is a persistent industrial bottleneck: Selenium, a widely used open-source framework for automating web browsers via scripted interactions that emulate user behaviour, relies on brittle scripts, while off-the-shelf Large Language Models (LLMs) hallucinate selectors and saturate the context window when asked to synthesise complete user journeys over production DOMs. We present Doc2Test, a Multi-Agent System (MAS) deployed inside Wideverse (a software engineering and digital transformation ICT company) that translates unstructured requirement documents into executable Selenium suites through three specialised phases: requirements analysis, dynamic DOM/visual context perception, and adaptive code generation with a self-healing loop. Across 90 independent runs on a production Angular cruise-booking platform (~145k LoC, under NDA), four open-sourced internal Wideverse applications, and one independently-developed external application (RealWorld), Doc2Test achieves a 94.4% generation success rate (95% CI: [87.5%, 98.2%]), detects 98.9% of 180 injected UI regressions, and reduces token usage by 86% against a zero-shot single-prompt baseline. Over three months of nightly Jenkins operation, it reduced maintenance effort by ~2.6 person-days / sprint and the flaky-test rate from 11.4% to 4.6%. We further report cost breakdowns and deployment lessons from integrating Doc2Test into our industrial partner's CI/CD pipeline. Article Search Article: ase26ind-p201-p doi:10.1145/3832783.3834507
	Ferrara, Pietro	ASE '26: "GoLiSA: An Advanced Static ..." GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts Luca Olivieri, Luca Negrini, Vincenzo Arceri, Pietro Ferrara, Fausto Spoto, and Agostino Cortesi (Ca’ Foscari University of Venice, Italy; University of Parma, Italy; University of Verona, Italy) GoLiSA is a static analysis tool that allows the verification of smart contracts written in Go, the most widely used language for developing smart contracts in Hyperledger Fabric. GoLiSA relies on abstract interpretation to model program semantics and identify potential risks and vulnerabilities in smart contracts. It supports advanced analyses such as information flow tracking and numerical and string value analysis, enabling the approximation of semantic program behaviors. Building on these analyses, GoLiSA implements a suite of checks for detecting non-trivial issues and potential risks in Hyperledger Fabric, including non-determinism, phantom reads, untrusted cross-contract invocations, read-after-write and over-write issues, cross-channel invocation risks, numerical issues, and unhandled errors. GoLiSA is publicly available at https://github.com/lisa-analyzer/go-lisa. A demonstration video showcasing the tool is available at https://youtu.be/WqkYOpWc9oE. Article Search Artifacts Available Article: ase26tool-p147-p doi:10.1145/3832783.3834644
	Ferrari, Alessio	ASE '26: "ReqEvolve: User-Oriented Software ..." ReqEvolve: User-Oriented Software Self-Evolution through Automatic Requirement Interpretation Md Asif Iqbal Fahim and Alessio Ferrari (University College Dublin, Ireland; National Research Council, Italy) The paradigm of software self-evolution enables systems to autonomously extend and reconfigure their own capabilities during execution in response to technical specifications. Yet requests for new functionality often originate from end users and are rarely expressed in technical terms. As a result, developers must translate user needs into technical specifications before the system can evolve, delaying early validation of the requested functionality by preventing users from immediately observing the resulting behaviour. To address this gap, we present ReqEvolve, a runtime code generation system that enables user-driven self-evolution by accepting high-level user requests. The system integrates automatic requirements engineering (RE) and test-driven development (TDD) to transform these requests into executable functionality through clarification, specification decomposition, test generation, and runtime integration. We evaluate ReqEvolve on 72 software evolution cases across 18 projects against two baselines: SpecFix, an RE-focused code generation approach, and an ablation variant of our system. ReqEvolve achieves 89.2% Pass@1, outperforming SpecFix by 18.8% (p < 0.01, r = 0.79, large effect) and the ablation baseline by 32.6% (p < 0.001, r = 0.88, large effect). These results provide initial evidence that user-driven self-evolution is a viable paradigm for autonomously extending software capabilities from user requests, thereby accelerating requirements validation prior to developer verification. Article Search Article: ase26main-p2528-p doi:10.1145/3832783.3834416
	Fessler, Marc	ASE '26: "DAL: Decoupled Aspect-Based ..." DAL: Decoupled Aspect-Based Layering of I/O Processing for Automotive Software Muhammet Uslu, Atif Imran Penkar, Robert Rasche, Olaf Spinczy, Marc Fessler, and Michael Unterreiner (Cariad, Germany; Volkswagen Group, Germany; TU Dortmund, Germany; Tensor embedded, Germany; Osnabrück University, Germany; Porsche, Germany) Large automotive organizations develop application software for multiple target platforms while aiming to preserve and reuse core functional logic as critical intellectual property, in line with the vision of Software-Defined Vehicles (SDVs). In current industrial practice, business logic is frequently developed using Model-Driven Development (MDD) and becomes tightly coupled with input/output (I/O) handling and defensive programming concerns, such as signal mapping, range checking, and diagnostics. This coupling violates fundamental software engineering principles, including Separation of Concerns and Don’t Repeat Yourself, and limits reuse, maintainability and scalability across platforms. Based on an empirical analysis of an industrial vehicle dynamics platform (VDP), we observe substantial duplication of modeling artifacts and generated code caused by recurring I/O concerns, with up to 30% code duplication within individual components and similar patterns recurring across dozens of components. To address this challenge, we propose DAL, an aspect-oriented framework that modularizes recurring I/O concerns and cleanly decouples them from core application logic in MDD-based automotive software. To the best of our knowledge, this is the first industrial application of aspect-oriented programming (AOP) to systematically address I/O entanglement in this class of automotive software. We evaluate DAL on the same microcontroller used in a production chassis Electronic Control Unit (ECU), comparing it with both a naïve approach and a baseline implementation. The production-grade proof of concept shows that DAL remains performance-competitive, reduces stack usage by 18% relative to the naïve approach, and incurs only a modest increase in static code size compared to the baseline implementation under the evaluated compiler and linker configurations. These results demonstrate that DAL effectively modularizes automotive application software, promotes separation of concerns and software reuse and does so while preserving the real-time and resource constraints required for production automotive systems. Article Search Article: ase26ind-p250-p doi:10.1145/3832783.3834514
	Filieri, Antonio	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488 ASE '26: "IAM Policy Autopilot: Static ..." IAM Policy Autopilot: Static Analysis for Policy Generation from Application Code Antonio Filieri, Luke Kennedy, Kevin Luo, Matt Luttrell, Adrián Palacios, Akash Panda, Neha Rungta, Matthias Schlaipfer, Karan Jit Singh, Anvesh Tanuku, Nick Winans, Diana Yin, and Weiben Zhang (Amazon Web Services, USA; Amazon Web Services, Germany) Every application deployed on Amazon Web Services (AWS) requires Identity and Access Management (IAM) policies that specify which API actions the application is authorized to perform. AWS offers managed policies as a convenience to simplify policy authoring. However, these policies are designed to cover common scenarios which can lead to unnecessarily broad permissions beyond what a specific use case requires. AI coding assistants offer an alternative, but can be unreliable: they hallucinate invalid policy content, and lag behind newly launched services and APIs. Moreover, some organizations distrust nondeterministic processes for security-critical artifacts such as access policies. We present IAM Policy Autopilot (IPA), a deterministic static-analysis tool that generates IAM policies by examining API usage in Python, Java, Go, and TypeScript/JavaScript code. The tool occupies a middle ground between hand-crafted least-privilege policies, which require deep IAM expertise, and potentially overpermissive managed policy selection. It implements a three-phase pipeline that parses source files to identify AWS SDK calls via AST pattern matching; maps SDK operations to the required permissions by consulting authoritative, up-to-date service metadata; and synthesizes policy documents with provenance, tracing each permission to its origin in the source code. We evaluate IPA in two settings: (1) on 10 synthetic benchmark applications across four languages, comparing generated policies against minimal baseline policies, AI-generated policies, and an optimal selection of managed policies. IPA-generated policies prove sufficient to run 9 of the 10 applications; and (2) on a production-style multi-service chatbot application in Python, where IPA-generated policies prove sufficient for executing 11 of 12 handlers. Our findings show that policies generated by our tool are sufficient to run applications on a level similar to, or outperforming, AI-generated policies, while being generated deterministically. On average, the policies permit about an order of magnitude fewer permissions than the optimal selection of managed policies and about 60% fewer permissions than an expert developer-authored set of policies, indicating that IAM Policy Autopilot provides a good starting point when writing application policies. Article Search Article: ase26ind-p234-p doi:10.1145/3832783.3834512
	Fischer, Bernd	ASE '26: "Learning the Lexical Structure ..." Learning the Lexical Structure of Black-Box Systems by Parsing Systematic String Edit Mutations Moeketsi Raselimo, Lars Grunske, and Bernd Fischer (Humboldt University of Berlin, Germany; Stellenbosch University, South Africa) We describe and evaluate an approach to learn the lexical structure of black-box systems from a set of positive training examples. Our core idea is to use the system as oracle for repeated membership queries which we construct by systematically mutating the training examples using different string edit operations. We then learn the elements of the lexical structure by generalizing from the oracle responses to the mutated training examples. We have applied this approach to several systems with target languages of varying complexity, such as TinyC, JSON, AMPL, Modula-2, Oberon, Zig, or C. We show that the learned tokens are similar, and in many cases identical, to those of the oracle lexers. Their inspection can indicate where the systems under test deviate from the lexical structure of their respective target languages; the learned tokens can thus serve as precise test oracles for lexers. We show that the segmentations induced by lexing the validation sets with the learned and oracle lexers, respectively, are identical in many cases and that the non-identical parts affect on average between zero and about 15 percent of the characters. We finally demonstrate that using the learned tokens substantially improves the quality of the context-free grammar that the state-of-the-art grammar learner Kedavra learns for cJSON, increasing the average F1-score of the grammars learned in five runs from 0.93 to 1.00. Article Search Article: ase26main-p1479-p doi:10.1145/3832783.3834391
	Fonseca, Alcides	ASE '26: "Barista: Synthesizing Typestate ..." Barista: Synthesizing Typestate Specifications with LLM Agents Catarina Gamboa, Paulo Canelas, Ricardo Costa, Márcio Caetano, Jonathan Aldrich, and Alcides Fonseca (Carnegie Mellon University, USA; University of Lisbon, Portugal) Object-oriented classes encode implicit protocols that clients must follow, such as connecting a socket before sending data or opening a stream before reading. Mainstream programming languages like Java cannot validate the correct use of these protocols, but more advanced type systems, such as typestate systems, can detect these violations at compile time. However, these systems require a formalization of these implicit protocols. To overcome this limitation, we propose to extract object protocols from documentation using a combination of LLMs and test generation. We developed Barista, an agentic workflow that transforms class documentation into verifiable LiquidJava specifications through DFA-guided protocol extraction, test synthesis, and verification-driven refinement. We evaluated our approach on 35 Java classes with expert-written ground truth, achieving 87.0% precision and 68.3% recall, with 75% of specifications usable directly or with minor edits. Barista bootstraps these specifications for well-documented libraries, reducing the manual annotation burden and enabling compile-time protocol safety without specialized expertise. Article Search Article: ase26main-p2950-p doi:10.1145/3832783.3834427
	Formica, Federico	ASE '26: "Test Suite Generation for ..." Test Suite Generation for Simulink Models: An Experience with Reactis Andrea Bombarda, Nunzio Marco Bisceglia, Marco Saini, Federico Formica, Angelo Gargantini, and Claudio Menghi (University of Bergamo, Italy; Gran Sasso Science Institute, Italy; McMaster University, Canada) Testing Simulink models is a widely recognized, relevant, and challenging problem for automated software engineering. It is relevant to industry practitioners since Simulink is a development and simulation language widely used by the Cyber-Physical System (CPS) industry. It is challenging since CPS are usually complex, entail many components, and failures are not easily identifiable without automated support. This paper reports our experience in applying Reactis, an industrial tool for testing Simulink models, to the ten Cyber-Physical Challenges Simulink models from Lockheed Martin. We considered 48 requirements from these challenge models. We assess the effectiveness of Reactis in identifying failure-revealing test cases and its efficiency. We compare our results and those from an academic testing tool (HC), and two model checking tools (QVtrace and CoCoSim). Our results show that Reactis could return a failure-revealing test case for a requirement that was considered correct. They also show that the efficiency of Reactis is comparable to that of existing tools. Article Search Article: ase26ind-p98-p doi:10.1145/3832783.3834483
	Foster, Michael	ASE '26: "FlakeFighters: A Pytest Plugin ..." FlakeFighters: A Pytest Plugin to Detect Flaky Test Failures Michael Foster, Owain Parry, Michael Hilton, Gregory M. Kapfhammer, and Phil McMinn (University of Sheffield, UK; University of Edinburgh, UK; Carnegie Mellon University, USA; Allegheny College, USA) Flaky tests — tests which non-deterministically pass and fail against the same version of code — pose a well-established painful issue for developers due to the unpredictability of failures. The current state of practice to detect and work around flaky tests is to simply rerun them. However, this can erode confidence in failing test outcomes and represents a significant waste of time and compute resources. A better solution is to detect flaky tests based on static data (collectable without running any tests) and/or execution data (collected by running the test suite) to determine if a test failure has occurred due to flaky behaviour or a genuine bug. Several such techniques have appeared in recent literature, but these exist in isolation as prototype research tools, and typically only support Java codebases. This paper presents FlakeFighters, an extensible pytest extension that implements a "Swiss army knife" of flaky test classification tools to help developers classify the underlying cause of failing tests as genuine bugs or flakiness in Python codebases. We ran pytest with the FlakeFighters extension on 23 failing workflows from the home-assistant/core repository and found that it was able to identify all of the failing flaky tests. A video demonstration of FlakeFighters can be found at https://youtu.be/3J4odtgzQX0. Article Search Artifacts Available Article: ase26tool-p127-p doi:10.1145/3832783.3834641
	Fraser, Gordon	ASE '26: "ScratchLog+: Live Analytics ..." ScratchLog+: Live Analytics of Learners’ Exercise Progress Benedikt Fein and Gordon Fraser (University of Passau, Germany) While the block-based programming language Scratch is a popular introductory programming environment, gathering information about student progress is challenging since the environment does not expose any kind of analytics. The ScratchLog tool already alleviates this somewhat, but focusses mainly on classroom management and general analytics suited for open-ended tasks. To also provide insights about student progress in goal-oriented exercises, we propose the ScratchLog+ extension in this paper. Our tool combines Whisker test suites to collect information about the functional correctness of students’ programs, and code embedding models to estimate structural and semantic progress towards an example solution. To make these new analytics of ScratchLog+ accessible to teachers, they are directly integrated into the ScratchLog user interface as interpretable visualisations of the typically abstract code embedding vectors. We provide a screencast demonstrating the tool at https://youtu.be/lQSCDqvbpQY. Article Search Artifacts Available Article: ase26tool-p62-p doi:10.1145/3832783.3834618
	Frattini, Julian	ASE '26: "Same Scrutiny, More Time: ..." Same Scrutiny, More Time: Eye Tracking Insights into Reviewing LLM-Labelled Code Ranim Khojah, Francisco Gomes de Oliveira Neto, Mazen Mohamad, Julian Frattini, and Philipp Leitner (Chalmers University of Technology, Sweden; University of Gothenburg, Sweden; RISE Research Institutes of Sweden, Sweden) Modern software development increasingly involves the use of large language models (LLMs) to generate code. Despite their rapid advancement, LLMs remain prone to errors and hallucinations, emphasizing the importance of careful code inspection. However, in practice, developers' trust in LLM-generated code and their willingness to review it thoroughly may not align with these recommendations, which is a gap that remains largely unexplored. In this study, we conduct a Wizard-of-Oz experiment to examine how software engineers behave when code is explicitly labelled as LLM-generated during a code review task. We collect both behavioral data and participant feedback through eye-tracking and exit interviews. Combining Bayesian data analysis with qualitative analysis, we found that while the thoroughness of code review did not change for participants, they spent more time fixating on LLM-labelled code, indicating that the label itself influences attention. Practitioners also adapted their review strategy for LLM-labelled code by assessing the code based on specific criteria (e.g., logical correctness), or using the prompt to guide their review. These findings inform LLM-based tool design on labelling while incorporating the prompt as a software artifact. Our study reveals a gap between reviewers' intentions and actual reviewing behaviour, highlighting the need for software companies to revisit their AI policies (particularly regarding LLM-assisted development) to better support developers in reviewing LLM-generated code. Article Search Artifacts Available Article: ase26main-p2693-p doi:10.1145/3832783.3834423
	Friedl, Ken E.	ASE '26: "Search-Based Testing of Vision ..." Search-Based Testing of Vision Language Models for In-Car Scene Understanding Lev Sorokin, Chen Yang, Ken E. Friedl, and Andrea Stocco (TU Munich, Germany; BMW Group, Germany; fortiss, Germany) The automotive industry is increasingly exploring vision-language models (VLMs) for in-car scene understanding (ISU), extracting semantic information from camera-recorded scenes to detect safety-critical events such as driver distraction. However, VLMs may generate incomplete, erroneous, or misleading scene descriptions, highlighting the need for systematic testing. Collecting real in-vehicle data is costly, difficult to scale, and often infeasible, particularly in early design stages. In this paper, we present ISU-Test, an automated testing approach that combines rendering-based scene generation with search-based testing to evaluate ISU systems. By framing testing as an optimization problem and systematically modifying scene parameters, our method generates diverse in-car scenarios and explores a wide range of configurations. We evaluate ISU-Test on both an industrial prototype and open-source VLMs across two case studies: question answering and captioning, comparing against randomized scenario generation. Results show that ISU-Test significantly outperforms the baseline, achieving up to 10× higher failure rates and up to 3.6× higher coverage. Article Search Article: ase26ind-p198-p doi:10.1145/3832783.3834506
	Frömmgen, Alexander	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	F. Silva, Álvaro	ASE '26: "ProofPulse: Interactive Proof ..." ProofPulse: Interactive Proof Coverage Analysis for Dafny Álvaro F. Silva, Ruben Martins, and Alexandra Mendes (INESC TEC, Portugal; Universidade do Porto, Portugal; Carnegie Mellon University, USA) Deductive verification ensures that an implementation satisfies its specification, but successful verification does not guarantee the quality of the specification. As such, weak specifications and redundant invariants may create overconfidence in "verified" code. We present ProofPulse, a tool for Dafny that diagnoses specification quality using a three-valued proof coverage model. By analyzing proof dependencies, ProofPulse distinguishes between elements that contribute to specification intent, those used only for auxiliary checks, and those irrelevant to any proof obligation. Evaluated against an oracle of 252 programs from the dafny-synthesis benchmark, ProofPulse provides a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification and reduces false positives across all evaluated categories. These results show that proof coverage is a practical complement to verification. Although it cannot fully capture semantic intent, it can reveal weak proof coupling in programs that otherwise appear fully verified. Just as a pulse check distinguishes vitality from the mere absence of symptoms, ProofPulse exposes weaknesses in proofs that technically verify successfully but still suffer from inadequate or redundant code and specifications. Demo: https://www.youtube.com/watch?v=8pO3NAodjoQ Code: https://github.com/VeriFixer/ProofPulse Prebuilt Docker image: https://doi.org/10.5281/zenodo.21174686 Article Search Artifacts Available Article: ase26tool-p18-p doi:10.1145/3832783.3834600 ASE '26: "DSpec2Test: Specification-Driven ..." DSpec2Test: Specification-Driven Test Generation in Dafny Sofia Vieira Pinto, Álvaro F. Silva, João Pascoal Faria, and Alexandra Mendes (INESC TEC, Portugal; Universidade do Porto, Portugal) Verification-aware languages, such as Dafny, integrate logical constructs into code and enable automatic verification of program correctness. However, tests remain helpful in scenarios that verification alone does not address (e.g., to support test-driven development). Existing Dafny test generation tools are implementation-based, limiting their applicability in this context. We present DSpec2Test, a specification-driven test generation tool for Dafny that automatically derives tests from formal specifications, without considering implementation details. Our tool extends Dafny's generate-tests command with a new black-box mode based on Disjunctive Normal Form (DNF) equivalence class partitioning and optional Boundary Value Analysis (BVA). DSpec2Test relies on the Z3 SMT solver to synthesize inputs and expected outputs that meet the specification-derived constraints. We evaluate DSpec2Test on programs from DafnyBench mutated using MutDafny and compare it against Dafny's existing implementation-driven Block mode. DSpec2Test achieves a 93.9% mutation kill rate on a dataset of 131 mutants, outperforming Block's 82.4%, and uniquely killing 17 mutants. These results suggest that specification-driven testing is an effective and complementary approach for testing Dafny programs. Demo: https://youtu.be/mK1EeJfinRQ Code: https://github.com/VeriFixer/DSpec2Test Prebuilt docker image: https://doi.org/10.5281/zenodo.21191158 Article Search Artifacts Available Article: ase26tool-p85-p doi:10.1145/3832783.3834629
	Fu, Hongfei	ASE '26: "Fully Automating Template ..." Fully Automating Template Polyhedral Analysis by Leveraging LLMs Renjie Huang, Liqian Chen, Hongfei Fu, Banghu Yin, Dengping Wei, and Ji Wang (National University of Defense Technology, China; Shanghai University of Finance and Economics, China) Abstract interpretation provides a generic framework to design static analysis, and has been widely applied in analysis of real-world programs. The scalability and precision of these analyses depend largely on the chosen abstract domain. The template polyhedra domain is well-known for offering a compelling trade-off between scalability and precision. However, designing effective templates currently requires intensive manual effort and domain expertise. In this paper, we propose a bottom-up approach based on Large Language Models (LLMs) to automatically generate linear templates for the template polyhedral analysis. By leveraging the advanced code comprehension capabilities of LLMs, our approach automatically generates highly relevant templates. Based on this approach, we have implemented IKOSplus, a program analyzer supporting fully automated context-sensitive and interprocedural template polyhedral analysis, on top of IKOS. We evaluated IKOSplus on a variety of small-scale benchmark programs and complex real-world programs. Experimental results demonstrate that IKOSplus effectively balances analytical precision and scalability in the template polyhedral analysis. Article Search Artifacts Available Article: ase26main-p849-p doi:10.1145/3832783.3837472
	Fu, Michael	ASE '26: "InsightQL: A Unified Code ..." InsightQL: A Unified Code Database for Fuzz Blocker Analysis Wentao Gao, Renata Borovica-Gajic, Sang Kil Cha, Michael Fu, Tian Qiu, and Van-Thuan Pham (University of Melbourne, Australia; KAIST, Republic of Korea) Fuzzing is a highly effective automated testing method for uncovering software vulnerabilities. Despite advances in fuzzing techniques, many fuzzers still struggle with coverage plateaus caused by fuzz blockers, which limit their ability to discover deeper vulnerabilities. We introduce InsightQL, the first human-assisted tool for fuzz blocker analysis. InsightQL is powered by a unified database, an intuitive parameterised query interface, and a VS Code plugin. It enables developers to reason about the root causes of fuzz blockers, often with a simple right-click in the plugin. The framework is extensible and it could support C/C++ projects in OSS-Fuzz. It can also be easily extended with custom queries. A screencast of the tool is available at https://youtu.be/mFxYhmikXs8. Article Search Article: ase26tool-p98-p doi:10.1145/3832783.3834633
	Fu, Ruowei	ASE '26: "LLM-Assisted Joint Ticket ..." LLM-Assisted Joint Ticket and Log Analysis for Incident Triage in Intelligent and Connected Vehicles Ruowei Fu, Shenglin Zhang, Wenwei Gu, Weiguo Li, Yongqian Sun, and Dan Pei (Nankai University, China; Huawei, China; Tsinghua University, China) With the rapid development of intelligent and connected vehicles (ICVs), in-vehicle systems have grown increasingly complex, leading to frequent anomalies in real-world usage. To maintain a high-quality user experience, efficient incident triage is essential for timely issue resolution. However, with the growing volume and complexity of incidents, traditional manual triage processes are becoming increasingly insufficient. Recent advances in large language models (LLMs) have demonstrated strong capabilities in reasoning and natural language understanding, offering new opportunities for automation. We propose InsightTriage, an end-to-end automated incident triage system designed and deployed for real-world industrial scenarios, which leverages LLMs to jointly analyze user queries and vehicle logs to generate accurate and explainable triage results. To address the lack of domain-specific knowledge, InsightTriage first constructs a component-level structured knowledge base in an offline phase by leveraging LLMs to automatically extract knowledge from historical vehicle logs. In the online phase, to mitigate the context length limitations of LLMs in log analysis, InsightTriage introduces a log retriever pretrained with contrastive learning, which efficiently identifies query-relevant log entries. Comprehensive experiments conducted on a dataset collected from the production environment of a top-tier global supplier for ICVs, demonstrate that InsightTriage achieves superior performance, reaching a weighted F1-Score of 0.801 (an improvement of 0.137 over the best baseline), while also providing explainable triage reports. Article Search Article: ase26ind-p283-p doi:10.1145/3832783.3834521
	Fu, Ying	ASE '26: "FPSieve: LLM-Powered Cascade ..." FPSieve: LLM-Powered Cascade for Filtering False Positives in OS Migration Testing Jie Dong, Ying Fu, Chao Hu, Yuhang Chen, Qi Xiao, and Heyuan Shi (Central South University, China; Tsinghua University, China; Hunan Congmao Technology, China) Operating system migration requires validating thousands of software packages for behavioral compatibility on the target distribution. Differential testing is the dominant industrial approach. OS level outputs contain many benign differences that are unrelated to package compatibility. These differences produce many false positives. They also bury real compatibility issues under heavy triage load. To address this issue, we first conduct a study of false positive root causes on industrial enterprise Linux migration data. This study yields a five-category taxonomy and a share–cost decision matrix. These findings guide our design. We propose FPSieve, a cost routed filtering pipeline for OS migration validation. FPSieve integrates rule based filtering, semantic similarity filtering, case library retrieval, package level LLM reasoning with confidence based routing, and closed loop container based verification. We evaluate FPSieve on a large scale OS migration differential testing dataset collected from industrial practice. FPSieve reduces the overall manual review queue to 5.9% of its original size while preserving 86.7% recall. It also improves review queue precision from 3.16% to 46.0%. After deduplication, FPSieve surfaced 66 compatibility issues submitted upstream. Of these, 14 received maintainer feedback, and 6 have been fixed. These results show that FPSieve can reduce false positives, reduce manual effort, and improve OS migration validation throughput. Article Search Article: ase26ind-p24-p doi:10.1145/3832783.3834460
	Fu, Yingjie	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477
	Fu, Yulong	ASE '26: "Benchmarking Automated Security ..." Benchmarking Automated Security Patch Backporting: How Far Are We? Jincheng Yang, Yulong Fu, Chengwei Liu, Lyuye Zhang, Fangyuan Zhang, Bingyang Ren, Yang Liu, and Hui Li (Xidian University, China; Nankai University, China; Nanyang Technological University, Singapore) Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools have reported high success rates, often exceeding 80% on their respective datasets. However, these evaluations are typically confined to homogeneous environments, such as within the same repository or specific project versions. Consequently, it remains unclear how well these tools generalize beyond their originally targeted scenarios. We present Porting Benchmark, a curated dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework. Using this benchmark, we evaluate five state-of-the-art tools spanning traditional program analysis, LLM-based prompting, and LLM agents under aligned evaluation settings. Our results show that aligned evaluation changes the apparent performance landscape: PortGPT and TSBPort remain comparatively strong on the Replication Dataset, while FixMorph and Mystique degrade substantially under the common protocol. Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design. On a 45-case dynamically validated subset with verified test cases and constructed POCs, we further observe that reference-based benchmark scores do not fully capture real-world remediation: exact match sharply under-credits harder target adaptations, while executable validation reveals residual integration failures in the target that static reference agreement misses. Executable-feedback refinement provides limited but measurable recovery on the hardest executable cases. Article Search Article: ase26main-p2788-p doi:10.1145/3832783.3837542
	Fuchß, Dominik	ASE '26: "The EVerest Dataset for Secure ..." The EVerest Dataset for Secure Software Engineering Sophie Corallo, Debora Grupp, Dominik Fuchß, Jan Keim, Frederik Reiche, Tobias Hey, and Anne Koziolek (KIT, Germany) End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available [4]. A short video is available at https://youtu.be/pnn1uqpomvQ. Article Search Artifacts Available Article: ase26tool-p56-p doi:10.1145/3832783.3834614 ASE '26: "The ARDoCo Tool Landscape: ..." The ARDoCo Tool Landscape: REST API, TraceView, and TraceViz for Architecture Traceability Jan Keim, Dominik Fuchß, Sophie Corallo, Tobias Hey, Julian Winter, and Kevin Feichtinger (KIT, Germany) Context and Problem. Software development produces interrelated artifacts like software architecture documentation (SAD), software architecture models (SAMs), and source code, whose relationships are essential for maintenance and consistency checking. However, automatically recovering links between these artifacts (traceability link recovery (TLR)) remains difficult to deploy in practice. Method and Aim. We present an accessible tool landscape for ARDoCo’s TLR approaches: the ARDoCo REST API exposes four TLR pipelines (SAD-SAM, SAM-Code, SAD-Code, and SAD-SAM-Code) via HTTP endpoints with asynchronous execution and caching; TraceView is a browser-based frontend with a guided wizard and interactive multi-panel exploration of recovered links and inconsistencies; and TraceViz, which is a VS Code extension that overlays trace links directly onto documentation in the IDE. Results and Conclusion. All three components are publicly deployed and usable. A preliminary study for TraceViz’s in-IDE visualization confirmed that it improves developer comprehension during software understanding tasks. The tool landscape makes state-of-the-art TLR accessible to architects, developers, and tool integrators. Video. We provide a screencast of our ARDoCo Tool Landscape and how it is used here: https://youtu.be/IOTEPZQ3tVs Article Search Artifacts Available Article: ase26tool-p73-p doi:10.1145/3832783.3834621
	Fuksa, Mario	ASE '26: "Evaluating the Maintainability ..." Evaluating the Maintainability of ViewModel Tests using Multi-modal DSLs: An Industrial Mixed-Methods Study Mario Fuksa, Sandro Speth, and Steffen Becker (University of Stuttgart, Germany; TU Munich, Germany) As in many modern software engineering domains, the quality of an application's Graphical User Interface (GUI) is fundamentally verified by automated testing. One established approach to mitigate testing challenges is to leverage architectural patterns, such as Model-View-ViewModel (MVVM), to decouple presentation logic and test it in isolation. However, developing these ViewModel tests in general-purpose languages (GPLs) often forces engineers to write excessive boilerplate code for test setup and complex assertion chains. While multi-modal domain-specific languages (DSLs) show promise in mitigating these GPL-related issues, empirical evidence of their impact on test maintainability in practice is lacking. To address this gap, we present an industrial mixed-methods study evaluating how abstracting GUI tests to the ViewModel level via multi-modal DSLs impacts maintenance overhead in practice, using the ViMoTest method as our representative realization. After establishing industrial applicability via a pre-study comprising action research and a case study, we conducted a task-based evaluation with industry experts, triangulated with semi-structured interviews and a questionnaire. Quantitative results indicate that the ViMoTest method shows a strong tendency to reduce test specification effort and size compared to a C++ engineering baseline. Furthermore, qualitative expert feedback indicates that visual assertions and robust refactoring capabilities reduce cognitive load during structural test evolution. Overall, this study provides empirical evidence that multi-modal DSLs positively impact the maintainability of ViewModel tests. Article Search Article: ase26main-p892-p doi:10.1145/3832783.3834370
	Fukui, Taku	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Fukuta, Shigeki	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Gacek, Andrew	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Gajula, Kavyasri	ASE '26: "COBug: A Bug Localization ..." COBug: A Bug Localization Pipeline for COBOL: Does It Work? An Exploratory Study Kavyasri Gajula, Phanindra Kodela, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) COBOL still runs core banking, insurance, and government systems, but the developers who understand it are retiring faster than they are replaced, and defects in this code are costly to diagnose. Bug localization could help, yet the technique has matured on Java and Python, while COBOL lacks the standardized bug reports, faulty revisions, and validated report-to-file links required for retrieval-based evaluation. We present COBug, a leakage-controlled benchmark and evaluation pipeline for file-level bug localization in COBOL: 552 deterministic queries across 12 X-COBOL repositories, each carrying one isolated source mutation with mechanically traceable ground truth and a symptom-focused report generated without reading the target source file. Using COBug, we evaluate lexical retrieval, pointwise re-ranking, LambdaMART, and frozen CodeBERT under leave-one-repository-out evaluation. None reliably outperforms the repository-matched random floor. After Holm correction, no method–baseline comparison is statistically significant. Lexical retrieval comes closest at MAP 0.1508 against a floor of 0.1229, though two repositories holding 15 queries contribute over 80% of that margin. We argue that this may partly reflect the benchmark construction itself: a report synthesized in strict isolation from its target may carry limited information about which file is faulty. We therefore present the result as indicating a possible limitation of this template-based construction, rather than as a verdict on COBOL bug localization, and release the pipeline with its manifests and provenance records. Article Search Article: ase26main-p1990-p doi:10.1145/3832783.3837518 ASE '26: "K-COBAgent: A Knowledge-Driven ..." K-COBAgent: A Knowledge-Driven Multi-agent Framework for COBOL Modernization Kavyasri Gajula, Phanindra Kodela, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) Multi-agent pipelines for legacy code translation have been devel- oped and evaluated largely outside COBOL, in settings such as Java to C#, PL/SQL to Java, and legacy web applications. Work targeting COBOL is predominantly single-model or rule-based. Both lines treat each run as self-contained, so prior translations, validation outcomes, failures, and repairs are not carried into the next run. For COBOL systems that are modernized incrementally across months or years, the absence of such reuse can cause repeated translation- generation work on unchanged code. We present K-COBAgent (Knowledge-driven COBOL Agent), which brings a multi-agent pipeline to COBOL modernization and, to our knowledge, is among the first frameworks in either line to persist a knowledge base across independent runs and measure cross-run reuse over repeated passes. Seven pipeline agents operate under a MAPE-K orchestrator, han- dling comprehension, planning, refactoring, translation, test gen- eration, validation, and learning; an on-demand SelfRepairAgent handles failed modules. A dual-layer knowledge base uses SQLite for exact source-hash lookup and ChromaDB for semantic retrieval of failure records and repair information, preserving outcomes across runs. Translation follows a three-layer strategy: KB cache lookup, deterministic rules grounded in COB2PY, and LLM fall- back. Applied to 14 X-COBOL repositories across three passes, the framework persisted 543 translation-output records after Pass 1. The translation-cache hit rate was 0.00% in Pass 1 and 99.82% in Passes 2 and 3 for previously seen source hashes, suggesting that exact-hash reuse may avoid repeated translation-generation work on unchanged modules. Final PASS outcomes varied from 53 to 58 under rerun validation and stochastic repair, while final FAIL out- comes varied from 29 to 24; these variations do not establish a stable quality trend. This is an early study; we report both the promise and the limitations of knowledge-persistent agentic COBOL mod- ernization Article Search Article: ase26nier-p105-p doi:10.1145/3832783.3834560
	Gambi, Alessio	ASE '26: "E-CoDrive: A Co-Simulation ..." E-CoDrive: A Co-Simulation Framework for Testing Energy-Critical Driving Scenarios Manfredi Napolitano, Alessandra Somma, Alessio Gambi, Andrea Stocco, and Nicola Mazzocca (University of Naples Federico II, Italy; Austrian Institute of Technology, Austria; Italian Institute of AI for Industry, Italy; TU Munich, Germany; fortiss, Germany) Autonomous driving research has largely focused on safety while giving limited attention to non-functional aspects such as energy consumption and sustainability. As Autonomous Electric Vehicles (AEVs) become increasingly common in urban traffic, understanding how complex traffic dynamics influence their energy consumption is paramount to test whether AEVs can complete trips before battery depletion. To support energy-aware scenario-based testing of AEVs, we present E-CoDrive, a framework for reproducible closed-loop driving co-simulations that integrates an energy consumption model, a micro-traffic simulator, and a high-fidelity driving simulator to test AEV software stacks in urban scenarios. This tool paper describes the architecture of E-CoDrive and demonstrates its applicability by testing an Autoware-based AEV stack. Our evaluation shows that varying traffic conditions produce substantial differences in vehicle energy consumption. The artifact is publicly available at https://doi.org/10.6084/m9.figshare.32244783, and a screencast showing the tool is available at https://youtu.be/yX9fWHqCvgc. Article Search Article: ase26tool-p162-p doi:10.1145/3832783.3834648
	Gamboa, Catarina	ASE '26: "Barista: Synthesizing Typestate ..." Barista: Synthesizing Typestate Specifications with LLM Agents Catarina Gamboa, Paulo Canelas, Ricardo Costa, Márcio Caetano, Jonathan Aldrich, and Alcides Fonseca (Carnegie Mellon University, USA; University of Lisbon, Portugal) Object-oriented classes encode implicit protocols that clients must follow, such as connecting a socket before sending data or opening a stream before reading. Mainstream programming languages like Java cannot validate the correct use of these protocols, but more advanced type systems, such as typestate systems, can detect these violations at compile time. However, these systems require a formalization of these implicit protocols. To overcome this limitation, we propose to extract object protocols from documentation using a combination of LLMs and test generation. We developed Barista, an agentic workflow that transforms class documentation into verifiable LiquidJava specifications through DFA-guided protocol extraction, test synthesis, and verification-driven refinement. We evaluated our approach on 35 Java classes with expert-written ground truth, achieving 87.0% precision and 68.3% recall, with 75% of specifications usable directly or with minor edits. Barista bootstraps these specifications for well-documented libraries, reducing the manual annotation burden and enabling compile-time protocol safety without specialized expertise. Article Search Article: ase26main-p2950-p doi:10.1145/3832783.3834427
	Ganhotra, Jatin	ASE '26: "From Plan to Action: How Well ..." From Plan to Action: How Well Do Agents Follow the Plan? Shuyang Liu, Saman Dehghan, Jatin Ganhotra, Martin Hirzel, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; IBM, USA) Agents are commonly instructed to follow a task-specific plan for guidance.However, it is unknown to what extent agents actually follow instructed plans. Without such an analysis---determining the extent agents comply with a given plan---it is impossible to assess whether a solution was reached through correct strategic reasoning or through other means, e.g., data contamination or overfitting to a benchmark. This paper presents the first extensive, systematic analysis of plan compliance in programming agents, examining 21,120 trajectories from SWE-agent across four LLMs on SWE-bench Verified and SWE-bench Pro under eight plan variations. Without an explicit plan, agents fall back on internalized workflows during training, which are often incomplete, overfit, or inconsistently applied. Providing the standard plan improves issue resolution, and we observe that periodic plan reminders can mitigate plan violations and improve task success. A subpar plan hurts performance even more than no plan at all. Surprisingly, inserting additional task-relevant phases in the early stage can degrade performance, particularly when these phases do not align with the model’s internal problem-solving strategy. These findings call for fine-tuning paradigms that teach models to follow instructed plans, rather than encoding task-specific plans in them, so that they reason and act adaptively, rather than memorizing workflows. Article Search Article: ase26main-p1675-p doi:10.1145/3832783.3834400
	Gao, Cuiyun	ASE '26: "Towards Reliable C-to-Rust ..." Towards Reliable C-to-Rust Translation with Rule-Guided Reasoning and Reinforcement Learning Feng Luo, Jiachen Liu, Cuiyun Gao, Jia Feng, and Kui Liu (Harbin Institute of Technology, Shenzhen, China; Huawei Technologies, China) The migration of legacy C programs to Rust has become an important direction for improving software memory safety while alleviating the high cost of manual rewriting. Leveraging large language models (LLMs) for automated C-to-Rust translation has emerged as a promising direction. However, existing LLM-based approaches remain limited. On the one hand, LLMs exhibit limited capability in identifying Rust-specific rules, and inadequate handling of Rust syntax often results in incorrect translations. On the other hand, existing LLMs often struggle to accurately capture the semantics of complex code, resulting in incorrect translations. To address these challenges, we propose a Translation fRAmework Via rule-guided reasoning and rEinforcement Learning, namely TRAVEL, consisting of two modules. The first module employs Monte Carlo Tree Search (MCTS)-based reasoning path construction guided by Rust-specific rules, steering the search toward translation steps that respect the syntactic rules that LLMs frequently violate. The second module introduces reinforcement learning with execution feedback and reasoning-quality signals to improve semantic preservation. We evaluate TRAVEL on three datasets: xCodeEval (a public benchmark), OS-Bench (functions collected from the Linux kernel), and HW-Bench (an industrial dataset from Huawei). On xCodeEval, TRAVEL outperforms all baselines across three backbone LLMs. In particular, compared to the strongest prompting baseline IRENE, TRAVEL improves computational accuracy (CA) by 26.22% and compilation success rate (CSR) by 18.77%. On HW-Bench and OS-Bench, TRAVEL further improves CSR by 18.28% and 16.51%, respectively, while reducing unsafe rate (UR) by 13.06% and 13.08%, respectively. Article Search Article: ase26ind-p459-p doi:10.1145/3832783.3834534 ASE '26: "Free Is More: Empowering Software ..." Free Is More: Empowering Software Agents via Issue-Free Trajectory Learning and Entropy-Aware RLVR Training Xin-Cheng Wen, Binbin Chen, Haoxuan Lan, Hang Yu, Peng Di, and Cuiyun Gao (Harbin Institute of Technology, Shenzhen, China; Ant Group, China; Zhejiang University, China; University of New South Wales, Australia) Large language models (LLMs) have transformed the software engineering landscape. Recently, numerous LLM-based agents have been developed to address real-world software issue fixing tasks. These agents are typically equipped with various coding tools, enabling them to autonomously generate action trajectories for end-to-end problem-solving. Despite their state-of-the-art performance, these agents still face two primary challenges: (1) Lack of sufficiently high-quality issue descriptions: Inconsistencies between issue descriptions and their corresponding solutions introduce noise and ambiguity that can mislead automated agents, restricting their ability to derive effective solutions. Furthermore, high-quality issue-PR pairs are difficult to acquire at scale, and the available datasets remain relatively limited in size. (2) Uncertainty introduced by bash tools prevents stable training and sufficient exploration: Bash tools serve as the primary interface for code execution and file manipulation in SWE agents, making them integral to virtually all agent operations. However, bash tools introduce substantial uncertainty into the agent's decision-making process. In reinforcement learning with verifiable rewards (RLVR), the fixed probability ratio clipping mechanism exhibits limited adaptability to such varying uncertainty states. Specifically, when bash tool invocations trigger high-entropy states, excessively restrictive clipping constraints impede both exploration and stable learning, hindering the training efficiency. To address these challenges, we propose SWE-Fuse, an issue-description-aware training framework that fuses issue-description-guided and issue-free samples for training SWE agents. It consists of two key modules: (1) An issue-free-driven trajectory learning module, which comprises: a multi-step trajectory construction component for generating high-quality multi-turn reasoning-action trajectories, a trajectory data filtering process for ensuring data quality, and issue-free-driven supervised fine-tuning to mitigate potentially misleading issue descriptions while enabling the model to learn step-by-step debugging processes; and (2) An entropy-aware RLVR training module, which adaptively adjusts training dynamics through entropy-driven clipping. It applies relaxed clipping under high entropy to encourage exploration, and stricter clipping under low entropy to ensure training stability. We evaluate SWE-Fuse on the widely studied SWE-bench Verified benchmark shows to demonstrate its effectiveness in solving real-world software problems. Specifically, SWE-Fuse outperforms the best 8B and 32B baselines by 41.9% and 59.3% in solve rate, respectively. Furthermore, integrating SWE-Fuse with test-time scaling (TTS) enables further performance improvements, achieving solve rates of 49.8% and 65.2% under TTS@8 for the 8B and 32B models, respectively. Article Search Article: ase26main-p3466-p doi:10.1145/3832783.3834438 ASE '26: "Perception, Reasoning, and ..." Perception, Reasoning, and Action: A ReAct-Based Vulnerability Detection Framework with Repository-Level Reasoning Xin-Cheng Wen, Hanyue Luo, Cuiyun Gao, Hao Zhu, Yang Xiao, and Ge Li (Harbin Institute of Technology, Shenzhen, China; Peking University, China; Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) The exponential growth in software vulnerabilities has created an urgent demand for automated vulnerability detection solutions. Recent research has emphasized the importance of repository-level context for vulnerability detection and has leveraged large language models (LLMs) to address this challenge. Although these methods show state-of-the-art performance, they face the following challenges: (1) Insufficient perception of repository-level contextual information. Current approaches primarily rely on the given input itself or predefined knowledge bases. They cannot adequately account for inter-file dependencies, such as import relationships and class hierarchies, that may be critical to understanding specific vulnerabilities. (2) Relying on manually designed actions in the LLM reasoning process. Specifically, existing methods do not effectively integrate reasoning (i.e., predicting vulnerability existence by LLMs) with action (i.e., dynamically retrieving additional or reduced context by tool). This limitation can lead to factual hallucinations throughout the detection process, leading to limited performance. To address these challenges, we propose to model the repository-level vulnerability detection task from a Reasoning and Action (i.e., ReAct) paradigm and incorporate human workflows into multi agent-based LLMs, termed ReAct-Vul, which consists of two key modules: (1) a repository-scale knowledge slicing, which comprises an intra-procedural slicing process, an inter-procedural slicing process, and a ReAct-based perception component for extracting the vulnerability-related context and knowledge at the repository level. (2) a synergistic reasoning-action-driven detection module, which interleaves a dual-perspective vulnerability analysis (Action phase) and detection-reflection loop (Reasoning phase). This synergistic approach enables the framework to explicitly consider both vulnerability presence and absence, generate reasoning explanations and refine subsequent targeted actions for vulnerability detection. We evaluate ReAct-Vul on the real-world C/C++ dataset PrimeVul and SVEN to demonstrate its effectiveness in vulnerability detection. Specifically, ReAct-Vul outperforms the best baseline by 18.4% on SVEN and 8.7% on PrimeVul in terms of accuracy. Furthermore, we demonstrate that the proposed ReAct paradigm enhances the reasoning capabilities of different models, achieving a 15.9% improvement in the accuracy of SVEN. Article Search Article: ase26main-p3189-p doi:10.1145/3832783.3837547
	Gao, Hang	ASE '26: "From Thread to Pool: Modeling ..." From Thread to Pool: Modeling and Static Detection of Thread Pool Misuses in Java Programs Baoquan Cui, Yucheng Qiu, Rui Han, Hang Gao, and Jian Zhang (Institute of Software at Chinese Academy of Sciences, Beijing, China; Hangzhou Institute for Advanced Study at University of Chinese Academy of Sciences, Hangzhou, China; University of Chinese Academy of Sciences, China) Asynchronous programming is fundamental to modern software performance, and Java ExecutorService-based executors have become a standard abstraction for managing concurrent tasks. While existing research has extensively studied traditional concurrency bugs, management misuses of executors remain under-analyzed. These defects arise not from the business logic of asynchronous tasks, but from how executors are configured, used, and terminated. We present a taxonomy of seven executor-management misuse patterns and formalize them using a resource-management model. Based on this, we develop PoolGuard, a static analysis framework for detecting both executor-generic lifecycle/result-handling defects and ThreadPoolExecutor-specific configuration misuses. Extensive evaluation on a benchmark suite with real-world defects shows that PoolGuard is better than specialized async detectors as well as general-purpose analyzers such as SpotBugs and Infer. Applying PoolGuard to large-scale open-source systems, we identified 50 previously unknown issues, 24 of which have already been fixed or confirmed by developers, demonstrating the practical value of semantic analysis for executor-management defects. Article Search Article: ase26main-p1687-p doi:10.1145/3832783.3837508
	Gao, Shuzheng	ASE '26: "BDiff: Block-Aware and Accurate ..." BDiff: Block-Aware and Accurate Text-Based Code Differencing Yao Lu, Wanwei Liu, Tanghaoran Zhang, Kang Yang, Yang Zhang, Wenyu Xu, Longfei Sun, Xinjun Mao, Shuzheng Gao, and Michael R. Lyu (National University of Defense Technology, China; Chinese University of Hong Kong, China) Code differencing is a fundamental technique in software engineering. Traditional line-level differencing tools (e.g., Git Myers algorithm) cannot accurately identify block-level edit actions (EAs) such as block move and copy, which are common in real development. They split multi-line block edits into fragmented line-wise changes, raising developers’ cognitive overhead during code review. This paper presents BDiff, a text-based differencing algorithm capable of identifying two types of block-level EAs and five types of line-level EAs. Building on traditional differencing algorithms, we first construct a candidate set containing all possible line and block mappings. Leveraging the Kuhn-Munkres algorithm, we then compute the optimal mapping set and derive a minimal edit script (ES) that closely aligns with the original developer intent. To evaluate BDiff, we selected five state-of-the-art tools, including large language models (LLMs), as baselines, and adopted a combined qualitative and quantitative approach to assess their performance in terms of ES size, result quality, and running time. Experimental results show that BDiff produces higher-quality differencing results than baseline tools while maintaining competitive runtime performance. Our experiments also show the unreliability of LLMs in code differencing tasks and their infeasibility in terms of runtime efficiency. Based on the proposed algorithm, we have implemented an open-sourced visual differencing tool. Article Search Artifacts Available Article: ase26main-p251-p doi:10.1145/3832783.3837431 ASE '26: "Multi-level Code Optimization ..." Multi-level Code Optimization via Mixture of Prompts Yun Peng, Jun Wan, Jiakun Liu, Shuzheng Gao, David Lo, and Xiaoxue Ren (Fudan University, China; Zhejiang University, China; Harbin Institute of Technology, China; Chinese University of Hong Kong, Hong Kong; Singapore Management University, Singapore; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China) Runtime efficiency is a critical factor that impacts both software quality and user satisfaction. There are many approaches proposed for code optimization to improve runtime efficiency. Traditional code optimization methods operate on intermediate representations (IRs) during compilation for static languages. They are effective but struggle to handle dynamic languages that do not require compilation. Recently, large language models (LLMs) have been leveraged to directly optimize source code in dynamic languages. However, these methods fail to identify suitable optimization targets and usually conduct incomprehensive single-level optimization. To address these challenges, we propose Optimo, a multi-level LLM-based code optimization approach built on a novel Mixture-of-Prompts (MoP) architecture. In the MoP architecture, Optimo identifies time-critical code structures as performance bottlenecks via differential profiling. These structures are then routed to some optimization strategies, akin to expert models in MoE, each tailored to optimize specific code patterns. Unlike traditional approaches that focus only on statement-level optimizations, Optimo operates at four levels of abstraction, ranging from coarse-grained algorithmic improvements to fine-grained optimizations in API usage. We evaluate Optimo on two code efficiency benchmarks, COFFE and Effibench. Our results demonstrate that Optimo achieves an up to 57.48% opt%, i.e., the percentage of optimized programs that are correct and at least 10% faster than the original programs, and an up to 3.97x speedup when optimizing human-written code, and it consistently outperforms the best baseline by up to 96.51% in terms of opt%. Furthermore, Optimo achieves an up to 42.42% opt% and an up to 13.51x speedup when optimizing LLM-generated code. Article Search Article: ase26main-p874-p doi:10.1145/3832783.3834369
	Gao, Tianchang	ASE '26: "Finding Typing-Related Bugs ..." Finding Typing-Related Bugs in JVM Implementations Yanzhou Lu, Junjie Chen, Yingquan Zhao, Tianchang Gao, and Zan Wang (Tianjin University, China) As an object-oriented language, Java relies heavily on its type system. Existing testing efforts mainly target type-related implementations in the Java compiler, while the substantially different type-related implementations in the Java Virtual Machine (JVM) remain insufficiently tested. Although many techniques have been proposed for direct JVM testing, they mostly focus on specific components such as the JIT compiler or garbage collector, leaving type-related implementations underexplored. In this paper, we present Caster, the first technique for testing JVM type-related implementations by directly generating bytecode test programs guided by type specifications in the Java Language Specification (JLS). Specifically, Caster designs a set of feature primitives to encapsulate the operations needed for type-related testing, and leverages a Large Language Model (LLM) to identify type-related test scenarios from the JLS and guide primitive composition. Based on these scenarios, Caster organizes the selected primitive combinations into a multi-unit test-program generator, whose Cartesian-product expansion produces a large number of concrete test programs. To support large-scale execution, Caster dynamically loads these generated programs from memory and invokes them via reflection across different JVM implementations, collects their result lists, and compares them to identify inconsistencies and detect potential JVM bugs. Extensive experiments on four Long-Term Support OpenJDK versions of three popular JVM implementations (i.e., HotSpot, OpenJ9, and Dragonwell) demonstrate that Caster outperforms the state-of-the-art techniques in detecting more JVM inconsistencies. Moreover, Caster has uncovered a total of 21 previously unknown defects in the latest JVM releases, among which 18 have been confirmed or fixed by developers. Article Search Article: ase26main-p1588-p doi:10.1145/3832783.3834396
	Gao, Wentao	ASE '26: "InsightQL: A Unified Code ..." InsightQL: A Unified Code Database for Fuzz Blocker Analysis Wentao Gao, Renata Borovica-Gajic, Sang Kil Cha, Michael Fu, Tian Qiu, and Van-Thuan Pham (University of Melbourne, Australia; KAIST, Republic of Korea) Fuzzing is a highly effective automated testing method for uncovering software vulnerabilities. Despite advances in fuzzing techniques, many fuzzers still struggle with coverage plateaus caused by fuzz blockers, which limit their ability to discover deeper vulnerabilities. We introduce InsightQL, the first human-assisted tool for fuzz blocker analysis. InsightQL is powered by a unified database, an intuitive parameterised query interface, and a VS Code plugin. It enables developers to reason about the root causes of fuzz blockers, often with a simple right-click in the plugin. The framework is extensible and it could support C/C++ projects in OSS-Fuzz. It can also be easily extended with custom queries. A screencast of the tool is available at https://youtu.be/mFxYhmikXs8. Article Search Article: ase26tool-p98-p doi:10.1145/3832783.3834633
	Gao, Xiang	ASE '26: "DepUpgrade: Automating Dependency ..." DepUpgrade: Automating Dependency Upgrade through State-Path Exploration Xiangxi Ma, Yifan An, Wentong Tian, Xuanqi Wang, Qingao Dong, Xiang Gao, and Hailong Sun (Beihang University, China) Third-party dependencies frequently introduce API breaking changes, and upgrading them causes compilation or runtime failures in client applications. Existing approaches have explored automating dependency upgrades, but struggle with fixing complex issues. This is mainly because traditional methods lack semantic adaptability, while recent prompt-only LLM-based migration approaches often suffer from hallucinations and fail to navigate multi-step, cascading repairs. To solve this problem, in this paper, we propose DepUpgrade, a framework that models dependency upgrade as a state-path exploration problem. A state is a snapshot of the client codebase at a particular point during migration. Transitions between states are validated via compiler feedback and rolled back if regressions occur. Instead of performing a single-pass generation, DepUpgrade systematically explores a search space of intermediate states with the goal of reaching a successful state. DepUpgrade achieves this goal in three steps: API migration knowledge extraction, repair task formulation and state-path exploration. We evaluate DepUpgrade on a benchmark of 123 migration tasks and 18 real-world projects. Experimental results demonstrate that our framework achieves an unprecedented 96.7% full repair rate on the benchmark, outperforming other baselines. On the real-world projects, DepUpgrade fully repairs 15 of the 18 projects and leaves 31 of the 1,085 initial compilation errors unresolved. Article Search Article: ase26main-p442-p doi:10.1145/3832783.3837442
	Gao, Xinyu	ASE '26: "TrackTest: Trajectory Generation ..." TrackTest: Trajectory Generation and Prioritization for Testing Multiple Object Tracking System Xinyu Gao, Haoxin Chen, Shuoxiao Zhang, Enyi Tang, Hengrui Xu, Haoxiang Tian, Minghui Wei, and An Guo (Nanjing University, China; Nanyang Technological University, Singapore; Hong Kong Polytechnic University, China) Multiple Object Tracking (MOT) is a fundamental component of the perception stack in Autonomous Driving Systems (ADS), providing essential state estimation for downstream decision-making. Despite the adoption of multi-sensor fusion to enhance reliability, MOT systems remain susceptible to tracking failures, which can lead to catastrophic safety incidents. Current perception testing and evaluation predominantly rely on manually annotated real-world datasets, which are behaviorally imbalanced, prohibitively expensive to scale, and insufficient to cover diverse dynamic interactions. To bridge this gap, we propose TrackTest, an automated testing framework designed to systematically expose tracking failures in MOT systems. TrackTest transforms real-world seed scenarios into challenging test cases by synthesizing physically feasible and behaviorally diverse trajectories. We formulate six representative driving patterns as constraint-based optimization problems for behavior-controllable trajectory generation. To reduce computational overhead, we introduce a trajectory prioritization strategy that identifies high-risk scenarios most likely to trigger tracking failures. We evaluate TrackTest on six state-of-the-art MOT systems. Experimental results show that TrackTest effectively generate behavior-diverse trajectories and uncover diverse tracking failures. Article Search Article: ase26main-p2727-p doi:10.1145/3832783.3837540
	Gao, Yaqi	ASE '26: "Structure-Guided Semantic ..." Structure-Guided Semantic Deobfuscation of Android Identifiers Mingyang Chen, Zhentao Xie, Yaqi Gao, Shuang Li, and Wenrui Diao (Shandong University, China) Android developers frequently employ identifier renaming to obfuscate code and hinder reverse engineering. This practice effectively conceals program semantics. However, it severely impedes downstream security analysis tasks, particularly manual inspection of malicious and privacy-sensitive behaviors. Existing deobfuscation techniques rely on code similarity, learned naming priors, or local LLM reasoning. These methods often exhibit severe limitations when applied to proprietary, heavily obfuscated, or cross-file context-dependent code. In this paper, we present DeMask, a novel framework that integrates static program analysis with Large Language Models (LLMs) to recover meaningful identifiers from obfuscated Android apps. Guided by program structure, DeMask executes a bottom-up, context-aware inference process for whole-app semantic reconstruction. It incorporates tailored naming constraints and optimization strategies to mitigate LLM hallucinations and ensure scalability for real-world codebases. We implemented a prototype and evaluated it on diverse datasets of benign and malicious Android apps. The results demonstrate that DeMask significantly outperforms prior work in semantic accuracy and naming consistency. Specifically, it achieves an average effective semantic recovery of over 88.6% across all evaluation settings. Article Search Article: ase26main-p2252-p doi:10.1145/3832783.3837525
	Gao, Zeyu	ASE '26: "PCodeTrans: Translate Decompiled ..." PCodeTrans: Translate Decompiled Pseudocode to Trace-Level Equivalent Source Code Yuxin Cui, Zeyu Gao, Siliang Qin, Yuanda Wang, Jiaming Wang, Xize Luo, Peng Zhou, and Chao Zhang (Tsinghua University, China; Institute of Information Engineering at Chinese Academy of Sciences, China; Peking University, China; Hunan University, China) Decompilation remains foundational for binary analysis, yet conventional tools prioritize human readability over compilation success and test-validated runtime consistency. While recent large language model approaches attempt refining decompiled pseudocode, they often introduce semantic hallucinations. Operating statically without dynamic feedback or attempting whole binary repairs lacking scalability, these existing methods struggle to resolve genuine runtime divergences. We present PCodeTrans, a dynamic feedback driven framework that implements a loop of recompilation, validation, and alignment for the recovery of functional source code. Extracting a minimal yet globally consistent context, PCodeTrans employs an in situ substitutable engine. This mechanism injects isolated compiled functions directly into the original binary, natively preserving authentic execution environments. Utilizing trace-level alignment as a diagnostic objective, PCodeTrans leverages breakpoint matched differential tracing, generating precise runtime causal diagnostics that guide the model through iterative refinement resolving behavioral discrepancies. Evaluated across a comprehensive Linux and Windows Benchmark suite including Coreutils, Binutils, PuTTY, and SQLite3, PCodeTrans achieves substantial translation performance refining raw Hex-Rays outputs. Empirical results confirm PCodeTrans achieves 100% function-level compilation success and 99.5% test-validated consistency on unstripped binaries, resolving up to 85.6% of logic errors. Even for stripped executables, the framework maintains over 97% test-validated consistency, narrowing the gap between raw decompilation and functional source code. Surpassing existing baselines, PCodeTrans paves a practical path toward recovered source that can be recompiled, validated to pass test harnesses, and consumed by source-level security analysis and fuzzing tools. Article Search Article: ase26main-p256-p doi:10.1145/3832783.3837432 ASE '26: "Are Reasoning Traces Faithful ..." Are Reasoning Traces Faithful in LLM-Based Code Vulnerability Detection? Jialai Wang, Juncheng Lu, Songtao Yang, Bingyi He, Zeyu Gao, Chao Zhang, and Shuai Wang (National University of Singapore, Singapore; Tsinghua University, China; Zhongguancun Laboratory, China; Huazhong University of Science and Technology, China; Hong Kong University of Science and Technology, Hong Kong) Reasoning traces generated by large language models (LLMs) provide interpretability by exposing the factors that purportedly support their predictions. Such interpretability is important because model decisions may rely on spurious factors, and it can help practitioners identify such reliance and respond appropriately. However, the usefulness of reasoning traces hinges on their faithfulness, namely whether they reflect the factors that the model actually relies on when producing its prediction. Unfaithful traces may instead serve as plausible narratives that do not correspond to the true decision process. Despite its importance, reasoning-trace faithfulness has not been systematically studied in LLM-based vulnerability detection. We present VulFaith, the first framework for evaluating reasoning-trace faithfulness in this domain. We formalize two complementary criteria: completeness, which requires that all decision-relevant factors sustaining an insecure prediction are exposed, and per-factor faithfulness, which requires that each cited factor is genuinely relied upon by the model. To operationalize these criteria, we design an automated repair-based evaluation scheme that removes cited insecurity factors through code repairs and re-queries the model to test whether the prediction remains sustained. We implement VulFaith and conduct experiments on both repository-level and function-level vulnerability datasets, evaluating ten state-of-the-art open-source models and four commercial LLMs. Our results show that unfaithfulness is widespread, with completeness unfaithfulness reaching up to 66.14% and per-factor unfaithfulness up to 94.00%. We further validate that the unfaithfulness cases identified by VulFaith can support data augmentation for supervised fine-tuning, reducing completeness unfaithfulness by up to 47.89% and per-factor unfaithfulness by up to 59.18%. Article Search Article: ase26main-p776-p doi:10.1145/3832783.3834364
	Gao, Zhipeng	ASE '26: "ARMOR: A Robust Self-Supervised ..." ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality Wenzhuo Qian, Hailiang Zhao, Ziqi Wang, Zhipeng Gao, Jiayi Chen, Zhiwei Ling, and Shuiguang Deng (Zhejiang University, China) Automated incident management is critical for microservice reliability. While recent unified frameworks leverage multimodal data for joint optimization, they unrealistically assume perfect data completeness. In practice, network fluctuations and agent failures frequently cause missing modalities. Existing approaches relying on static placeholders introduce imputation noise that masks anomalies and degrades performance. To address this, we propose ARMOR, a robust self-supervised framework designed for missing modality scenarios. ARMOR features: (i) a modality-specific asymmetric encoder that isolates distribution disparities among metrics, logs, and traces; and (ii) a missing-aware gated fusion mechanism utilizing learnable placeholders and dynamic bias compensation to prevent cross-modal interference from incomplete inputs. By employing self-supervised auto-regression with mask-guided reconstruction, ARMOR jointly optimizes anomaly detection (AD), failure triage (FT), and root cause localization (RCL). AD and RCL require no fault labels, while FT relies solely on failure-type annotations for the downstream classifier. Extensive experiments demonstrate that ARMOR achieves state-of-the-art performance under complete data conditions and maintains robust diagnostic accuracy even with severe modality loss. Article Search Article: ase26main-p102-p doi:10.1145/3832783.3834338 ASE '26: "SmellCC: A Tool for Automated ..." SmellCC: A Tool for Automated Code Smells Remediation Xiaoting Zhang, Yujie Zhang, Zhipeng Gao, Xing Hu, and Xin Xia (Zhejiang University, China; Shanghai Institute for Advanced Study of Zhejiang University, China) Code smells significantly threaten software maintainability by accumulating technical debt, yet developers often lack the resources to manually address these flaws under tight release schedules. While static analysis tools like SonarQube provide precise detection, they function largely as passive alert systems, leaving the burden of refactoring on developers. To bridge this gap, we present a novel cleaning tool, namely SmellCC, a Visual Studio Code extension that augments SonarQube with an LLM-based pipeline to automatically detect and refactor Python code smells. By employing Chain-of-Thought (CoT) and few-shot learning, SmellCC provides in-place, one-click remediation for the top-10 most frequent smells, effectively preventing the accumulation of technical debt during development. Our quantitative evaluation demonstrates that our is promising in helping developers effectively eliminate code smells (96.8% cleaning rate) with high accuracy (i.e., 91.3%), ensuring that the refactored code remains syntactically correct and behavior-preserving, thereby significantly improving long-term software maintainability. The full paper underlying this tool has been published in ACM Transactions on Software Engineering and Methodology [], where SmellCC was introduced and evaluated as an offline pipeline for large-scale code corpus cleaning. Extending this prior work, the present paper focuses on an IDE-native implementation of SmellCC that translates SonarQube for IDE diagnostics into interactive, in-place refactoring actions within Visual Studio Code. Article Search Article: ase26tool-p47-p doi:10.1145/3832783.3834611
	García Núñez, Ignacio	ASE '26: "From Backlog Items to Security ..." From Backlog Items to Security Guidance: Towards Continuous Security Compliance Ignacio García Núñez, Florian Angermeir, and Fabiola Moyón Constante (Technical University of Munich, Germany; fortiss, Germany; Blekinge Institute of Technology, Sweden; Siemens Technology, Germany) Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief, free-form descriptions and often lack timely guidance on applicable requirements. We present an NLP-based backlog enrichment system that detects security-relevant backlog items and links them to relevant security requirements. The approach combines a security-relevance classifier with a retrieval-augmented generation (RAG) pipeline over security requirements documents. The approach was developed and evaluated in the context of a large enterprise in highly regulated domains. We present three contributions. First, we release a dataset of 288 backlog items labeled for security relevance by nine security practitioners, with substantial agreement (Fleiss’ κ=0.787). Second, a recall-oriented classifier achieving F2=0.774 in-distribution and mean zero-shot G-measure ≈ 0.65 across five established benchmarks, matching or outperforming most published classical-ML and open-source GPT baselines. Third, we preliminarily evaluated a four-stage security requirements document-grounded RAG pipeline with two practitioners on industrial backlogs using company-internal security policies and CIS Benchmarks. Of the retrieved 24 clauses, 12 were rated at least 4/5 for relevance. Our findings provide first indicators that NLP-based product backlog enrichment can support engineers in identifying security requirements early in the development process. With this work we aim to facilitate continuous security compliance through proactive introduction of security requirements in continuous software engineering. Article Search Artifacts Available Article: ase26ind-p344-p doi:10.1145/3832783.3834527
	Garg, Spandan	ASE '26: "Debug2Fix: Can Interactive ..." Debug2Fix: Can Interactive Debugging Help Coding Agents Fix More Bugs? Spandan Garg and Yufan Huang (Microsoft Corporation, USA) While significant progress has been made in automating various aspects of software development through coding agents, there is still significant room for improvement in their bug fixing capabilities. Debugging and investigation of runtime behavior remains largely a manual, developer-driven process. Popular coding agents typically rely on either static analysis of the code or iterative test-fix cycles, which is akin to trial and error debugging. We believe that there is a wealth of rich runtime information that developers routinely access while debugging code, which agents are currently deprived of due to design limitations. Despite how prevalent debuggers are in modern IDEs and command-line tools, they have surprisingly not made their way into coding agents. In this work, we introduce Debug2Fix, a novel framework that incorporates interactive debugging as a core component of a software engineering agent via a subagent architecture. We incorporate debuggers for Java and Python into our agent framework and evaluate against GitBug-Java and SWE-Bench-Live and achieve >20% improvement in performance compared to the baseline for certain models. Furthermore, using our framework, we're able to make weaker models like GPT-5 and Claude Haiku 4.5 match or exceed the performances of stronger models like Claude Sonnet 4.5, showing that better tool design is often just as important as switching to a more expensive model. Finally, we conduct systematic ablations demonstrating the importance of both the subagent architecture and debugger integration. Article Search Article: ase26ind-p65-p doi:10.1145/3832783.3834471
	Gargantini, Angelo	ASE '26: "Test Suite Generation for ..." Test Suite Generation for Simulink Models: An Experience with Reactis Andrea Bombarda, Nunzio Marco Bisceglia, Marco Saini, Federico Formica, Angelo Gargantini, and Claudio Menghi (University of Bergamo, Italy; Gran Sasso Science Institute, Italy; McMaster University, Canada) Testing Simulink models is a widely recognized, relevant, and challenging problem for automated software engineering. It is relevant to industry practitioners since Simulink is a development and simulation language widely used by the Cyber-Physical System (CPS) industry. It is challenging since CPS are usually complex, entail many components, and failures are not easily identifiable without automated support. This paper reports our experience in applying Reactis, an industrial tool for testing Simulink models, to the ten Cyber-Physical Challenges Simulink models from Lockheed Martin. We considered 48 requirements from these challenge models. We assess the effectiveness of Reactis in identifying failure-revealing test cases and its efficiency. We compare our results and those from an academic testing tool (HC), and two model checking tools (QVtrace and CoCoSim). Our results show that Reactis could return a failure-revealing test case for a requirement that was considered correct. They also show that the efficiency of Reactis is comparable to that of existing tools. Article Search Article: ase26ind-p98-p doi:10.1145/3832783.3834483
	Gazzillo, Paul	ASE '26: "Translation Tag Team: Formal ..." Translation Tag Team: Formal Rules and LLMs Translate More Macros Together Than Apart Brent Pappas, Joseph Zalusky, Zachary Burkett, and Paul Gazzillo (University of Central Florida, USA) Modern critical software infrastructure is largely written in C. Since C lacks memory safety, researchers are investigating automatic translation of C to safer languages like Rust. But real-world C software consists of more than just C code, often using named code fragments called macros which are not part of the C language proper. State-of-the-art techniques avoid translating macros by preprocessing C code first before translating it. But this approach produces translations that are dissimilar to the original C code, because preprocessing inlines all macro definitions. To preserve macro usage in translated code, we study the language features that macros and C share and distill them into the first formally- specified translator, MerC. To evaluate MerC, we introduce the first macro translation benchmark, MacroBench, with test cases based on macros randomly sampled from real-world C programs. We find that MerC supports 50% of MacroBench’s macro test cases. We also use MacroBench to evaluate how effective large language models (LLMs) are at performing the previously-unstudied task of macro translation. LLMs translate 22% to 77% more of MacroBench than MerC, but with 8% and 28% of these translations being incorrect translations requiring additional validation by developers. In contrast, MerC only produces correct translations. Our key insight is that running MerC first then using LLMs on the remainder reaps greater benefits than using either technique alone. This tag team approach has an average failure rate 32% lower than that of LLMs, while also translating an average of 51% more test cases than MerC. Article Search Artifacts Available Article: ase26main-p5-p doi:10.1145/3832783.3837412
	Ge, Hua	ASE '26: "Exact-IaC: Execution-Driven ..." Exact-IaC: Execution-Driven Exact Knowledge Injection for Reliable IaC Synthesis Hua Ge and Minxue Pan (Nanjing University, China) The deployment and maintenance of software systems rely heavily on Infrastructure-as-Code (IaC) to translate high-level infrastructure intent into deployable configurations. While Large Language Models (LLMs) show potential in automating IaC synthesis, relying on closed-source cloud APIs poses severe data privacy risks. Conversely, deploying Small Language Models (SLMs) locally often encounters performance bottlenecks due to schema hallucinations and attention dilution in long-context scenarios. Furthermore, existing retrieval-augmented generation (RAG), multi-turn repair, and semantic topology parsing approaches struggle to resolve complex declarative resource dependencies. In this paper, we propose Exact-IaC, an execution-driven framework designed to enhance SLMs for reliable IaC synthesis. It employs a divide-and-conquer strategy: it transitions from initial semantic intent approximation to an iterative repair loop that utilizes compiler feedback for deterministic schema injection. This approach effectively offloads the SLM’s parametric memorization burden. Extensive experiments on the IaC-Eval benchmark demonstrate the effectiveness and generalizability of Exact-IaC across diverse open-weight SLMs, yielding 55.0% to 69.8% relative gains. Specifically, for our primary 30B backbone (Qwen3-Coder), the framework elevates the Pass@1 rate from 31.00% (the performance ceiling of evaluated baselines) to 49.34%, achieving a 59.2% relative improvement. Notably, this locally deployed SLM, augmented by Exact-IaC, outperforms a top-tier proprietary model (GPT-5.2-Codex) operating under its strongest baseline setting (48.47%). Furthermore, our trajectory-level error analysis reveals the L6 Paradox: even at extreme infrastructure complexity, SLMs fail predominantly due to micro-parameter hallucinations rather than macroscopic topological reasoning deficits. Ultimately, Exact-IaC establishes a zero-data-leakage orchestration pipeline, proving empirically that deterministic context precision can effectively substitute raw parameter scale for secure enterprise cloud provisioning. Article Search Artifacts Available Article: ase26main-p2695-p doi:10.1145/3832783.3837539
	Ge, Ning	ASE '26: "UCT: A Versatile Code Translation ..." UCT: A Versatile Code Translation Framework Based on a Unified Intermediate Representation Wangcai Li, Dongyan Wang, Zehong Yu, Yifan Cheng, Ning Ge, Chunming Hu, and Zhuo Su (Beihang University, China; Renmin University of China, China; Tsinghua University, China; University of Electronic Science and Technology of China, China) Model-driven design often requires the same model to support multiple downstream tasks, such as simulation, testing, verification, and deployment. However, existing tools usually build separate translation workflows for different tasks, causing repeated model parsing, redundant semantic reconstruction, and limited reuse across toolchains. In this paper, we present UCT, a versatile code translation framework based on a unified intermediate representation (CIR). UCT translates models into CIR once, preserves executable semantics, structural information, scheduling relations, and model-code mappings, and then generates task-specific code through unified instrumentation and backend translation. We implemented UCT and evaluated it on Simulink benchmark models. The results show that UCT can generate usable customized code for simulation, testing, verification, and deployment. The generated binary artifacts also provide additional benefits, improving model testing coverage by 85.9% on average and accelerating simulation by 19.8× on average over Simulink Rapid Accelerator. The video is presented at https://youtu.be/CCu5iO853p4. The implementation is available at https://github.com/CodeGen123/UCT. Article Search Article: ase26tool-p111-p doi:10.1145/3832783.3834636
	Geiger, Alina	ASE '26: "SkillMOO: Multi-objective ..." SkillMOO: Multi-objective Optimization of Agent Skills for Software Engineering Jingzhi Gong, Ruizhen Gu, Zhiwei Fei, Yazhuo Cao, Lukas Twist, Alina Geiger, Shuo Han, Dominik Sobania, Federica Sarro, and Jie M. Zhang (King's College London, UK; Queen's University Belfast, UK; Nanjing University, China; Johannes Gutenberg University Mainz, Germany; University College London, UK; University of Duisburg-Essen, Germany) Agent skills are increasingly used to configure coding agents for software engineering (SE) tasks, yet current practice treats them as static, hand-crafted assets, or evolved on pass rate alone. This is insufficient: a skill can improve task success while substantially raising token cost, or introducing misleading guidance. We argue that SE agent skill bundles can be treated as multi-objective search objects and present SkillMOO, a framework that evolves skill bundles through LLM-proposed edits and NSGA-II Pareto selection on pass rate and inference cost. Evaluated across all 16 SkillsBench SE tasks, SkillMOO achieves the top pass rate rank on 11 of 12 non-zero-pass tasks while achieving cost reductions of up to 31.7% over static bundles, with pass rate gains up to 42 percentage points. Analysis of 38 skill edits shows that pruning and substitution dominate successful operations, offering actionable principles for skill bundle design. Thereby, the current practice of deploying skills without cost-aware validation leaves better skill configurations unexplored, motivating a new class of multi-objective search-based skill engineering. Article Search Article: ase26nier-p65-p doi:10.1145/3832783.3834550
	Geng, Mingyang	ASE '26: "It Takes Two to Tango: Accelerating ..." It Takes Two to Tango: Accelerating Code Generation via Cache-Inspired Hierarchical Speculative Decoding Yinggang Qiu, Shangwen Wang, Yihao Qin, Mingyang Geng, and Dezun Dong (National University of Defense Technology, China; Information Support Force Engineering University, China) While Large Language Models (LLMs) have demonstrated exceptional performance in code generation, their autoregressive decoding paradigm typically results in low inference efficiency. Speculative decoding has emerged as a solution to speed up inference through its draft–verification mechanism, where multiple draft tokens are generated efficiently and then verified in parallel by LLMs. Current speculative decoding approaches for code generation are broadly categorized into two types: model-based approaches that generate drafts using a lightweight draft model, and retrieval-based approaches that reuse code snippets from external corpora. In this work, we first conduct empirical experiments to analyze the strengths and weaknesses of retrieval-based and model-based drafting. We find that retrieval-based approach is efficient but usually low-quality, while model-based one is high-quality but the drafting time increases with inference steps of the draft model. Inspired by the cache mechanism in computer architecture, we propose a novel framework CacheCoder. In our design, retrieval acts as a high-speed Level-1 (L1) cache for rapid draft acquisition, while the draft model functions as a more capable Level-2 (L2) cache to compensate for L1 misses, enabling us to capitalize on the speed of reuse when possible and rely on the precision of generation when necessary. To combine these two hierarchical processes, we propose two customized strategies, i.e., Preliminary Prediction and Draft Expansion, which utilize the draft model to pre-filter retrieved contents and expand them with tokens generated by the draft model to form drafts with higher length. Experimental results show that CacheCoder achieves up to a 2.64× speedup compared to autoregressive decoding, significantly outperforming state-of-the-art approaches. Article Search Article: ase26main-p691-p doi:10.1145/3832783.3837454
	Gerasimou, Simos	ASE '26: "Leveraging System-Level Observations ..." Leveraging System-Level Observations to Inform Bayesian Learning of Model Parameters for Quantitative Verification Simos Gerasimou and Xingyu Zhao (Cyprus University of Technology, Cyprus; Wuhan University, China) Combining Bayesian learning and quantitative verification is a powerful toolset for analysing key quantitative properties of software systems, like reliability and response time. However, the accuracy and robustness of verification results strongly depend on the prior knowledge (PK) underlying Bayesian inference. This knowledge reflects original beliefs about the probability of events and typically depends on domain expertise. Using inaccurate or uninformative PK can negatively affect quantitative analysis, yielding incorrect verification results. Our EPIK approach tackles this important challenge by eliciting and embedding PK in quantitative verification equipped with Bayesian estimators. Unlike existing approaches that require PK on formal model transition parameters, EPIK leverages system-level properties that are directly observable and are linked to real-world semantics. EPIK formulates a twofold optimisation problem to derive the distributions of unknown transition parameters and then embeds these distributions to verify new or difficult-to-measure (elusive) properties. The detailed experimental evaluation using multiple variants of real-world case studies and diverse EPIK instantiations shows its effectiveness, flexibility and generality. Article Search Article: ase26main-p2427-p doi:10.1145/3832783.3837529
	Gergely, Anita	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Gerstl, Oliver	ASE '26: "Inferring the Shape of Data ..." Inferring the Shape of Data Frames in R Programs using Abstract Interpretation Oliver Gerstl, Florian Sihler, and Matthias Tichy (Ulm University, Germany) Data frames are a fundamental data structure in many data analysis tasks and are widely used in programming languages like R. Due to their omnipresence in data analysis, there are many functions that operate on their shape and content, for example, to clean and transform study data. However, languages like R do not offer static guarantees on data frames making it difficult to reason about their shape at a specific point in the program. In this paper, we present a novel static analysis to infer the shape of data frames in R programs using abstract interpretation by tracking the ensured and potential column names, as well as the potential number of columns and rows. For this, we use a reduced product domain and define abstract semantics for the most commonly used data frame operations, such as mutating, filtering, and subsetting. We evaluate the correctness and accuracy of our analysis on a selection of 78 executable real-world R scripts achieving empirical evidence for soundness by never under-approximating the data frame shape. Additionally, we demonstrate the ability of our analysis to infer the shape of data frames on a large dataset of 33,314 real-world R scripts by inferring concrete shape constraints for 42.1 % and exact shapes for 0.9 % of the data frame operations, improving to 58.7 % and 4.2 % if all datasets read in these scripts are available to our analysis. Using the inferred data frame shapes, we identified 40 real-world R scripts containing potential invalid data frame accesses. This shows the potential of our analysis to significantly support researchers in using data frames in data analysis. Article Search Article: ase26main-p4457-p doi:10.1145/3832783.3834445
	Ghosh, Supriyo	ASE '26: "eARCO: Efficient Automated ..." eARCO: Efficient Automated Root Cause Analysis with Prompt Optimization Drishti Goel, Raghav Magazine, Supriyo Ghosh, Akshay Nambi, Prathamesh Deshpande, Xuchao Zhang, Chetan Bansal, and Saravan Rajmohan (University of Illinois at Urbana-Champaign, USA; Microsoft Research, India; Inception, United Arab Emirates; Microsoft, India; Microsoft Research, USA; Microsoft, USA; Microsoft 365, USA) Root cause analysis (RCA) for incidents in large-scale cloud systems is a complex, knowledge-intensive task that often requires significant manual effort from on-call engineers (OCEs). Improving RCA is vital for accelerating the incident resolution process and reducing service downtime and manual efforts. Recent advancements in Large-Language Models (LLMs) have proven to be effective in solving different stages of the incident management lifecycle including RCA. However, existing LLM-based RCA recommendations typically leverage default finetuning or retrieval augmented generation (RAG) methods with static, manually designed prompts, which lead to sub-optimal recommendations. In this work, we leverage 'PromptWizard', a state-of-the-art prompt optimization technique, to automatically identify the best optimized prompt instruction that is combined with semantically similar historical examples for querying underlying LLMs during inference. Moreover, by utilizing more than 180K historical incident data from Microsoft, we developed cost-effective finetuned small language models (SLMs) for RCA recommendation generation and demonstrate the power of prompt optimization on such domain-adapted models. Our extensive experimental results show that prompt optimization can improve the accuracy of RCA recommendations by 21% and 13% on 3K test incidents over RAG-based LLMs and finetuned SLMs, respectively. Lastly, our human evaluation with incident owners have demonstrated the efficacy of prompt optimization on RCA recommendation tasks. These findings underscore the advantages of incorporating prompt optimization into AI for Operations (AIOps) systems, delivering substantial gains without increasing computational overhead. Article Search Article: ase26ind-p86-p doi:10.1145/3832783.3834477
	Gladshtein, Vladimir	ASE '26: "Certified Program Synthesis ..." Certified Program Synthesis with a Multi-modal Verifier Yueyang Feng, Dipesh Kafle, Vladimir Gladshtein, Vitaly Kurin, George Pîrlea, Qiyuan Zhao, Peter Müller, and Ilya Sergey (National University of Singapore, Singapore; Neapolis University Pafos, Cyprus; ETH Zurich, Switzerland) Certified program synthesis (a.k.a. vericoding) is the process of automatically generating a program, its formal specification, and a machine-checkable proof of program/specification alignment from a natural-language task description. Two key challenges make vericoding difficult. First, specifications synthesised from natural language descriptions are often either too weak to be meaningful or too strong to be implementable, yet existing approaches lack systematic means to detect such defects. Second, the program verifiers used to validate results are fragmented: each tool supports a particular reasoning mode—auto-active (e.g., Dafny, Verus) or interactive (e.g., Rocq, Lean)—with its own trade-off between automation and expressivity. This forces each synthesis methodology to target a single paradigm, limiting the tasks it can handle. We overcome both challenges by structuring the synthesis workflow in stages around a multi-modal verifier—a single tool that combines dynamic validation, automated proofs, and interactive proof scripting within one foundational framework. We realise this idea in LeetProof, a new agentic pipeline built on Velvet, a multi-modal program verifier built in the Lean theorem prover. Multi-modality enables LeetProof to validate generated specifications via randomised property-based testing before any code is synthesised, decompose the synthesis task into sub-problems guided by verification conditions, and delegate residual proof obligations to frontier AI provers specialised for Lean. We evaluate LeetProof on an extensive benchmark suite derived from prior work on certified synthesis. Our specification validation uncovers defects in existing reference benchmarks, and LeetProof's staged pipeline achieves a significantly higher rate of fully certified solutions than a single-mode baseline at the same fixed budget—consistently across two different frontier LLM backends. Article Search Artifacts Available Article: ase26main-p4427-p doi:10.1145/3832783.3837559
	Goel, Drishti	ASE '26: "eARCO: Efficient Automated ..." eARCO: Efficient Automated Root Cause Analysis with Prompt Optimization Drishti Goel, Raghav Magazine, Supriyo Ghosh, Akshay Nambi, Prathamesh Deshpande, Xuchao Zhang, Chetan Bansal, and Saravan Rajmohan (University of Illinois at Urbana-Champaign, USA; Microsoft Research, India; Inception, United Arab Emirates; Microsoft, India; Microsoft Research, USA; Microsoft, USA; Microsoft 365, USA) Root cause analysis (RCA) for incidents in large-scale cloud systems is a complex, knowledge-intensive task that often requires significant manual effort from on-call engineers (OCEs). Improving RCA is vital for accelerating the incident resolution process and reducing service downtime and manual efforts. Recent advancements in Large-Language Models (LLMs) have proven to be effective in solving different stages of the incident management lifecycle including RCA. However, existing LLM-based RCA recommendations typically leverage default finetuning or retrieval augmented generation (RAG) methods with static, manually designed prompts, which lead to sub-optimal recommendations. In this work, we leverage 'PromptWizard', a state-of-the-art prompt optimization technique, to automatically identify the best optimized prompt instruction that is combined with semantically similar historical examples for querying underlying LLMs during inference. Moreover, by utilizing more than 180K historical incident data from Microsoft, we developed cost-effective finetuned small language models (SLMs) for RCA recommendation generation and demonstrate the power of prompt optimization on such domain-adapted models. Our extensive experimental results show that prompt optimization can improve the accuracy of RCA recommendations by 21% and 13% on 3K test incidents over RAG-based LLMs and finetuned SLMs, respectively. Lastly, our human evaluation with incident owners have demonstrated the efficacy of prompt optimization on RCA recommendation tasks. These findings underscore the advantages of incorporating prompt optimization into AI for Operations (AIOps) systems, delivering substantial gains without increasing computational overhead. Article Search Article: ase26ind-p86-p doi:10.1145/3832783.3834477
	Goknil, Arda	ASE '26: "To Think or Not to Think: ..." To Think or Not to Think: Evaluating LLM Reasoning and Agents in Vulnerability Detection Hua Beng Tan, Ratnadira Widyasari, Merve Astekin, Arda Goknil, Hasan Sözer, Yan Naing Tun, Erik Johannes Husom, Lwin Khin Shar, and Lingxiao Jiang (Singapore Management University, Singapore; SINTEF, Norway; Ozyegin University, Türkiye) Large language models (LLMs) are increasingly studied for software vulnerability detection, but the benefits of recent reasoning-enabled (“thinking”) modes remain unclear. At the same time, agentic LLM designs aim to enhance analysis through structured collaboration, while practical software security workflows require explanations that facilitate inspection, validation, and remediation. Because prior studies often examine these dimensions separately or under heterogeneous settings, their individual effects on vulnerability detection remain difficult to disentangle. This paper addresses the gap through a phased, factor-separated empirical study on the PrimeVul Pair benchmark. In the first phase, we compare instruct and thinking variants of four open models under zero- and few-shot prompting without agents. In the second phase, we evaluate single-, dual-, and multi-agent (SA, DA, and MA) designs alongside call-matched single-agent baselines, alert-burden metrics, and cost analysis. In the third, we assess explanations through blinded human and calibrated LLM evaluation across correct and incorrect predictions, controlling for response length and model family. Thinking improves non-agent (NA) F1 in 7 of 8 settings, mainly through recall, while DA achieves the highest F1/recall but flags 88.2% of functions as vulnerable. MA performs better on pairwise discrimination, although call-matched self-revision achieves the best Pair-wise Correct Prediction (P-C) overall. Thinking also uses 2.7–4.4× more energy, and its F1 benefit declines with greater orchestration. Explanation gains are model-specific, partly length-mediated, and do not distinguish correct from incorrect predictions. Article Search Article: ase26main-p2084-p doi:10.1145/3832783.3837521
	Gomes de Oliveira Neto, Francisco	ASE '26: "Same Scrutiny, More Time: ..." Same Scrutiny, More Time: Eye Tracking Insights into Reviewing LLM-Labelled Code Ranim Khojah, Francisco Gomes de Oliveira Neto, Mazen Mohamad, Julian Frattini, and Philipp Leitner (Chalmers University of Technology, Sweden; University of Gothenburg, Sweden; RISE Research Institutes of Sweden, Sweden) Modern software development increasingly involves the use of large language models (LLMs) to generate code. Despite their rapid advancement, LLMs remain prone to errors and hallucinations, emphasizing the importance of careful code inspection. However, in practice, developers' trust in LLM-generated code and their willingness to review it thoroughly may not align with these recommendations, which is a gap that remains largely unexplored. In this study, we conduct a Wizard-of-Oz experiment to examine how software engineers behave when code is explicitly labelled as LLM-generated during a code review task. We collect both behavioral data and participant feedback through eye-tracking and exit interviews. Combining Bayesian data analysis with qualitative analysis, we found that while the thoroughness of code review did not change for participants, they spent more time fixating on LLM-labelled code, indicating that the label itself influences attention. Practitioners also adapted their review strategy for LLM-labelled code by assessing the code based on specific criteria (e.g., logical correctness), or using the prompt to guide their review. These findings inform LLM-based tool design on labelling while incorporating the prompt as a software artifact. Our study reveals a gap between reviewers' intentions and actual reviewing behaviour, highlighting the need for software companies to revisit their AI policies (particularly regarding LLM-assisted development) to better support developers in reviewing LLM-generated code. Article Search Artifacts Available Article: ase26main-p2693-p doi:10.1145/3832783.3834423
	Gong, Guang	ASE '26: "Evidence-Grounded Logic Vulnerability ..." Evidence-Grounded Logic Vulnerability Detection for Smart Contracts via Runtime Context Reasoning Guang Gong, Yucong Jiang, Rong Jian, Xiaotao Feng, Zhihan Wei, Qi Li, and Ke Xu (Tsinghua University, China; 360 Vulnerability Research Institute, China) Smart contracts are foundational to DeFi, yet detecting business-logic vulnerabilities, i.e., execution is syntactically correct but violates a contract’s intended behavior, remains difficult. Most recent LLM-based approaches still follow a largely static, source-code–centric auditing paradigm. In practice, however, smart contracts are inherently stateful: many logic flaws emerge only under specific contract states and across particular state transitions. As a result, code-only auditing can produce false positives and miss true vulnerabilities. To address this gap, we present RcAudit, a system for detecting smart-contract logic vulnerabilities via runtime-context–enhanced LLM reasoning. RcAudit constructs a Contract Logic Knowledge Base that captures contract behavior from multiple perspectives to support LLM analysis. It then applies a state- and intent-aware fuzzing strategy to generate logic-critical runtime contexts, and performs LLM reasoning over selected contexts that exhibit potential intent–behavior inconsistencies to pinpoint vulnerabilities. We evaluate RcAudit on three real-world datasets. RcAudit identifies 74 of 132 known logic vulnerabilities with high precision (96.9%), achieving 117.6% higher detection than the strongest baseline. Importantly, RcAudit further uncovers 22 zero-day vulnerabilities in real-world projects. Article Search Artifacts Available Article: ase26main-p839-p doi:10.1145/3832783.3837471
	Gong, Jingzhi	ASE '26: "SkillMOO: Multi-objective ..." SkillMOO: Multi-objective Optimization of Agent Skills for Software Engineering Jingzhi Gong, Ruizhen Gu, Zhiwei Fei, Yazhuo Cao, Lukas Twist, Alina Geiger, Shuo Han, Dominik Sobania, Federica Sarro, and Jie M. Zhang (King's College London, UK; Queen's University Belfast, UK; Nanjing University, China; Johannes Gutenberg University Mainz, Germany; University College London, UK; University of Duisburg-Essen, Germany) Agent skills are increasingly used to configure coding agents for software engineering (SE) tasks, yet current practice treats them as static, hand-crafted assets, or evolved on pass rate alone. This is insufficient: a skill can improve task success while substantially raising token cost, or introducing misleading guidance. We argue that SE agent skill bundles can be treated as multi-objective search objects and present SkillMOO, a framework that evolves skill bundles through LLM-proposed edits and NSGA-II Pareto selection on pass rate and inference cost. Evaluated across all 16 SkillsBench SE tasks, SkillMOO achieves the top pass rate rank on 11 of 12 non-zero-pass tasks while achieving cost reductions of up to 31.7% over static bundles, with pass rate gains up to 42 percentage points. Analysis of 38 skill edits shows that pruning and substitution dominate successful operations, offering actionable principles for skill bundle design. Thereby, the current practice of deploying skills without cost-aware validation leaves better skill configurations unexplored, motivating a new class of multi-objective search-based skill engineering. Article Search Article: ase26nier-p65-p doi:10.1145/3832783.3834550
	Gong, Yeyun	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477
	Gopinath, Rahul	ASE '26: "Maximal Format-Free Data Repair ..." Maximal Format-Free Data Repair Zijian Luo, Xi Wu, Hong Jin Kang, Alan Fekete, and Rahul Gopinath (University of Sydney, Australia) ERROR in abstract. Article Search Artifacts Available Article: ase26main-p428-p doi:10.1145/3832783.3834354
	Gorla, Alessandra	ASE '26: "TORI: A Tool for Oracle Quality ..." TORI: A Tool for Oracle Quality Assessment Facundo Molina, Nazareno Aguirre, and Alessandra Gorla (Complutense University of Madrid, Spain; University of Rio Cuarto, Argentina; CONICET, Argentina; Guangdong Technion-Israel Institute of Technology, China; IMDEA Software Institute, Spain) Oracle quality is a critical factor in software testing, directly influencing the fault-detection capability and overall effectiveness of test suites. Despite its importance, assessing oracle quality remains challenging: existing techniques predominantly rely on dynamic analysis, which incurs substantial computational overhead and limits adoption in large-scale or time-constrained development settings. In this tool demo paper, we present Tori, a lightweight static analysis tool designed to help testers evaluate oracle quality efficiently. Tori operates by analyzing assertion-based oracles within test cases and generating a quality report based on the state field coverage metric, a measure of how comprehensively the assertions exercise the internal state fields of the software under test. A demonstration video showcasing the use of Tori is available at https://youtu.be/neb3B-Dyacw. Article Search Article: ase26tool-p238-p doi:10.1145/3832783.3834653
	Goyal, Anand	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Greene, Spencer	ASE '26: "Catching Developers in the ..." Catching Developers in the Flow: Low-Latency Agentic Program Repair at Google Scale Celal Ziftci, Spencer Greene, Ray Liu, Livio Dalloro, and Lorenzo Dini (Google, USA) Manual repair of program failures is time-consuming and disruptive for software developers, particularly during the pre-submit phase where test failures occur within continuous integration systems. While Automated Program Repair has seen significant advancement through Large Language Models, existing state-of-the-art techniques primarily focus on post-submit workflows, operating offline without the low-latency requirements necessary to assist developers in real-time within their flow before they switch context. In this paper, we introduce FlowAgent, an AI agent deployed at Google to automatically repair test failures in the pre-submit outer-loop workflow inside continuous integration systems. Integrated into Google’s internal developer tools, Critique and Cider, FlowAgent utilizes a ReAct-style generate-and-validate loop, as well as rigorous pre-execution and post-execution abstention filters to ensure high-quality suggestions under strict latency constraints. Based on our case studies, FlowAgent is highly effective. First, a manual evaluation conducted on 195 real-world test failures demonstrated 67.18% accuracy in suggesting correct fixes. Following its Google-wide deployment, FlowAgent suggested fixes on 295,508 changes, of which developers previewed 65,069 and applied 28,554. Developer feedback from interviews indicate that the agent is useful in suggesting correct fixes, integration of autonomous repair agents into industrial software engineering workflows is received well, while interesting challenges and opportunities still remain. Article Search Article: ase26ind-p231-p doi:10.1145/3832783.3834511
	Grishchenko, Ilya	ASE '26: "RFC2TLA+: Extracting and Verifying ..." RFC2TLA+: Extracting and Verifying Formal Models from RFC Documents using Continuous LLM Feedback Guozhen Ding, Kexin Li, Ilya Grishchenko, and David Lie (University of Toronto, Canada) Extracting natural-language protocol specifications such as Requests for Comments (RFCs) into formally verifiable models is a challenging and labor-intensive process that requires significant expertise. Recent advances in large language models (LLMs) and agents show promise in automating this task. However, existing automated approaches suffer from insufficient structural consistency, hallucinations, and limited scalability. Moreover, the ability to pass such automatically extracted models into formal verification tools such as model checkers has not been demonstrated. We present RFC2TLA+, a three-stage pipeline for automatically extracting RFCs into automatically verifiable models. RFC2TLA+ achieves this by providing fine-grain and continuous feedback to the LLM throughout the extraction process. It decomposes the extraction process into three passes—states, transitions, and invariants—while constraining LLM generation through fine-grained tool calls, lightweight validation, and iterative feedback. This design enables early error detection and correction, mitigating hallucinations and preventing syntactic and semantic inconsistencies. The resulting communicating finite-state machines (CFSMs) are deterministically translated into TLA + and verified using the TLC model checker. We evaluate RFC2TLA+ on a benchmark of 14 RFCs and their accompanying human-crafted FSMs and show that it generates more complete models than the baseline. In addition, our tool extracts invariants, enabling a model checker to detect injected faults. To minimize the effects of LLM memorization, we additionally generate synthetic RFCs and evaluate the tool on them, demonstrating its effectiveness in both model extraction and error detection. Article Search Artifacts Available Article: ase26main-p683-p doi:10.1145/3832783.3837453
	Grunske, Lars	ASE '26: "Learning the Lexical Structure ..." Learning the Lexical Structure of Black-Box Systems by Parsing Systematic String Edit Mutations Moeketsi Raselimo, Lars Grunske, and Bernd Fischer (Humboldt University of Berlin, Germany; Stellenbosch University, South Africa) We describe and evaluate an approach to learn the lexical structure of black-box systems from a set of positive training examples. Our core idea is to use the system as oracle for repeated membership queries which we construct by systematically mutating the training examples using different string edit operations. We then learn the elements of the lexical structure by generalizing from the oracle responses to the mutated training examples. We have applied this approach to several systems with target languages of varying complexity, such as TinyC, JSON, AMPL, Modula-2, Oberon, Zig, or C. We show that the learned tokens are similar, and in many cases identical, to those of the oracle lexers. Their inspection can indicate where the systems under test deviate from the lexical structure of their respective target languages; the learned tokens can thus serve as precise test oracles for lexers. We show that the segmentations induced by lexing the validation sets with the learned and oracle lexers, respectively, are identical in many cases and that the non-identical parts affect on average between zero and about 15 percent of the characters. We finally demonstrate that using the learned tokens substantially improves the quality of the context-free grammar that the state-of-the-art grammar learner Kedavra learns for cJSON, increasing the average F1-score of the grammars learned in five runs from 0.93 to 1.00. Article Search Article: ase26main-p1479-p doi:10.1145/3832783.3834391 ASE '26: "Is Three the Magic Number? ..." Is Three the Magic Number? An Empirical Evaluation of LLM-Based Repair Loops Tobias Kiecker, Eik Reichmann, Hosung Kang, Gabin An, and Lars Grunske (Humboldt-Universität zu Berlin, Germany; Korea University, Republic of Korea) Iterative repair loops have become a core design pattern in LLM-based software engineering systems. These workflows repeatedly generate, validate, and repair artifacts using feedback such as compiler errors or test failures. Despite their widespread use, the impact of repair-loop iteration limits remains poorly understood, as most prior work adopts fixed, often arbitrary, repair budgets. We study repair-loop effectiveness across multiple software engineering tasks, including code generation, test generation, and code translation. Across several representative workflows, datasets, and contemporary low-cost LLMs, we observe a consistent pattern of diminishing returns: the first three to four repair iterations account for most achievable gains, while later iterations contribute only marginal improvements. Across the evaluated models, repair behavior is influenced more strongly by workflow orchestration and feedback design than by the underlying model itself. These results suggest that repair budgets should be treated as an explicit experimental variable, as they directly affect evaluation outcomes, computational cost, runtime, and reproducibility in LLM-based software engineering research. Article Search Article: ase26nier-p58-p doi:10.1145/3832783.3834547
	Grupp, Debora	ASE '26: "The EVerest Dataset for Secure ..." The EVerest Dataset for Secure Software Engineering Sophie Corallo, Debora Grupp, Dominik Fuchß, Jan Keim, Frederik Reiche, Tobias Hey, and Anne Koziolek (KIT, Germany) End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available [4]. A short video is available at https://youtu.be/pnn1uqpomvQ. Article Search Artifacts Available Article: ase26tool-p56-p doi:10.1145/3832783.3834614
	Gu, Bin	ASE '26: "AutoFLC: An LLM-Based Flowchart ..." AutoFLC: An LLM-Based Flowchart Generation Tool for Legacy Code Repository Yixing Luo, Longxing Yang, Xiaofeng Li, Bin Gu, and Zhi Jin (Beijing Institute of Control Engineering, China; Peking University, China) Code comprehension remains a major bottleneck in maintaining large-scale legacy code repositories, particularly due to their complex intra-procedural control flows and lack of up-to-date documentation. While textual summaries generated by large language models (LLMs) provide semantic insights, they fail to intuitively represent non-linear control logic. Visual flowcharts are therefore highly desirable, yet existing automated approaches either produce cluttered diagrams or generate syntactically invalid scripts that cannot be rendered. To address these challenges, we present AutoFLC, a general-purpose tool to transform repository-scale legacy codebases into comprehensive visual flowcharts. AutoFLC combines static analysis for precise function extraction with a renderer-in-the-loop self-correction mechanism. This tool iteratively refines the generated PlantUML script to guarantee syntactic validity, thereby ensuring the successful rendering of the final visual flowchart. Evaluations on three real-world aerospace systems demonstrate that AutoFLC achieves a flowchart generation success rate exceeding 99%. A user study with 10 industrial practitioners further confirms that the generated flowcharts significantly reduce cognitive load and effectively support logic comprehension. The tool is publicly available at https://github.com/dfjdkjkdf/AutoFLC/tree/main under the MIT License, with a demonstration video accessible at https://youtu.be/AeEi9Nbw7xI. Article Search Article: ase26tool-p107-p doi:10.1145/3832783.3834635
	Gu, Fangtao	ASE '26: "Fuzz4DB: A Practice of LLM-Agent-Guided ..." Fuzz4DB: A Practice of LLM-Agent-Guided Fuzzing for Database Feature-Level Delta Testing Chunling Qin, Yong Hu, Xiao Zhang, Jinchuan Chen, Fangtao Gu, Baoxun Wang, Yuxing Chen, Anqun Pan, and Lixiong Zheng (Renmin University of China, China; Tencent, China) Modern database management systems (DBMSs) evolve rapidly via frequent feature commits, yet validating each code delta within a 24-hour Continuous Integration (CI) budget remains an industrial challenge. Traditional manual regression testing is labor-intensive, while existing automated tools fall short: generation-based fuzzers achieve high throughput but are change-unaware, whereas LLM-based agents understand feature deltas but are orders of magnitude too slow for systematic testing. This paper presents Fuzz4DB, an LLM-agent-guided fuzzer designed for targeted DBMS feature testing. Fuzz4DB decouples LLM-based semantic planning from grammar-based test instantiation, bridging the gap between semantic awareness and generation efficiency. The LLM-powered agent of Fuzz4DB analyzes code deltas and coverage feedback to synthesize test directives—structured specifications at three precision levels, namely grammar scopes, derivation paths, and context–query template pairs. A grammar-based fuzzer then expands each directive into batches of valid SQL test cases. A coverage feedback loop escalates directive precision as coverage growth stalls. Running in the TDSQL production environment for over six months, Fuzz4DB has intercepted 74 zero-day bugs, accounting for ∼40% of all SQL-subsystem bugs. In evaluations across 12 feature commits from 5 mainstream DBMSs, Fuzz4DB achieved 86.9% delta code coverage, outperforming the best automated baseline by 36.9%. Over its full lifecycle on four open-source DBMSs, Fuzz4DB discovered a total of 62 unique bugs (45 newly confirmed by upstream communities), 59 of which were undetectable by state-of-the-art tools within the 24-hour CI window. Furthermore, Fuzz4DB reduces per-commit validation effort from ∼5 person-days to ∼1 person-day, an ∼80% reduction. Article Search Article: ase26ind-p161-p doi:10.1145/3832783.3834498
	Gu, Jiachen	ASE '26: "Large Language Model Enabled ..." Large Language Model Enabled Symbolic Execution for Automated Functional Analysis Meixi Liu, Zhenbang Chen, Xudong Wang, Ziran He, Jiachen Gu, Minghui Chen, Lei Wang, and Wei Dong (National University of Defense Technology, China) Symbolic execution shows promise in automated program analysis by systematically exploring the path space of the program. However, due to the inherent limitations of program analysis techniques, symbolic execution cannot understand the program’s functionality, which hinders its application in functional analysis and defect detection. This paper introduces FuSE, a method that enhances symbolic execution with Large Language Models (LLMs) to automatically annotate program paths with functional specifications. A program path is annotated with a natural language description of its functionality, a precondition, and a postcondition. Our method significantly reduces the effort required for functional testing and defect detection. Based on UnitTestBot, FuSE can successfully annotate functional specifications for C, C++, Java, and Python programs, with success rates of 98.2%, 95.52%, 87%, and 95.37%, respectively. In our user study with professional developers and testers, FuSE helps users identify 21.67% more functional defects and improves functional coverage by 15.83%, demonstrating its practical utility. Article Search Artifacts Available Article: ase26main-p2155-p doi:10.1145/3832783.3837524
	Gu, Jian	ASE '26: "Source-Free Detection and ..." Source-Free Detection and Impact Analysis of Compiler Optimization Problems in Mobile Applications Han Hu, Xiaoheng Xie, Bo Sun, Jian Gu, Gang Fan, and Li Li (Independent Researcher, Hong Kong; Independent Researcher, China; Monash University, Australia; Beihang University, China) Mobile apps frequently suffer from frame drops, overheating, and excessive power consumption. While developers optimize algorithms and debug code, a critical bottleneck often goes unnoticed: native libraries compiled with low optimization levels (O0/O1 instead of O2/O3). Because these libraries execute without functional errors, the resulting performance degradation remains hidden in production apps. We present OptDetect, a source-free framework that detects compiler optimization problems directly from app binaries. OptDetect handles mixed optimization levels through binary disassembly, chunk-level classification, and weighted score aggregation, achieving 93.0% accuracy on controlled datasets and 81.9% on real-world datasets. Applying OptDetect to 21,972 native libraries from 830 top-ranked Google Play apps, we find that 30.5% of libraries use low optimization levels, affecting 91.7% of apps. Through case studies on 12 production apps, fixing detected issues reduces CPU instructions by 10-63% (median: 20.5%) for commercial apps and 15-58% (median: 32%) for open-source apps. Performance complaints decrease in 5 of 6 commercial apps, and ratings increase in 5 of 6. Further investigation reveals that widely-used third-party libraries are themselves distributed at low optimization levels, with 49.7% of 1,073 libraries in a major repository exhibiting this problem. These findings show that compiler optimization problems are common, source-free detectable, and practically consequential in mobile app ecosystems. Article Search Article: ase26main-p135-p doi:10.1145/3832783.3834340
	Gu, Jiazhen	ASE '26: "SimServing: Native-Execution ..." SimServing: Native-Execution Simulation for Evolution-Resilient LLM Serving Configuration Tuning Yujie Huang, Jiazhen Gu, Zhihan Jiang, and Michael R. Lyu (Chinese University of Hong Kong, Hong Kong) Large Language Model (LLM) services expose a large configuration space that critically affects performance, yet tuning these configurations on hardware (e.g., NVIDIA GPUs) is prohibitively expensive. Simulation offers a scalable alternative, but state-of-the-art simulators suffer from a fundamental software engineering pitfall: they re-implement the serving framework's complex control logic (e.g., request scheduling and memory management), creating a semantic copy that inevitably diverges from the rapidly evolving upstream software. Our empirical study across eight consecutive vLLM versions confirms this fidelity drift, with prediction errors widening as the framework evolves. We observe that the serving management software dominates performance fidelity yet accounts for less than 10% of total execution time, with GPU computation consuming over 90%. This asymmetry motivates SimServing, a hybrid simulation framework that executes the native, unmodified serving software while replacing GPU computation with a pluggable latency estimator. This design preserves the serving management software's control flow by executing it rather than modeling it, thereby automatically inheriting upstream updates and substantially reducing the maintenance burden associated with re-implementation. Integrating SimServing with Particle Swarm Optimization for configuration tuning, our evaluation shows that it reduces throughput prediction error from 13.8% to 4.9%, achieves up to 21.18× simulation speedup, and discovers configurations that improve throughput by up to 10.2% over existing baselines. Article Search Article: ase26main-p625-p doi:10.1145/3832783.3834362
	Gu, Ruizhen	ASE '26: "SkillMOO: Multi-objective ..." SkillMOO: Multi-objective Optimization of Agent Skills for Software Engineering Jingzhi Gong, Ruizhen Gu, Zhiwei Fei, Yazhuo Cao, Lukas Twist, Alina Geiger, Shuo Han, Dominik Sobania, Federica Sarro, and Jie M. Zhang (King's College London, UK; Queen's University Belfast, UK; Nanjing University, China; Johannes Gutenberg University Mainz, Germany; University College London, UK; University of Duisburg-Essen, Germany) Agent skills are increasingly used to configure coding agents for software engineering (SE) tasks, yet current practice treats them as static, hand-crafted assets, or evolved on pass rate alone. This is insufficient: a skill can improve task success while substantially raising token cost, or introducing misleading guidance. We argue that SE agent skill bundles can be treated as multi-objective search objects and present SkillMOO, a framework that evolves skill bundles through LLM-proposed edits and NSGA-II Pareto selection on pass rate and inference cost. Evaluated across all 16 SkillsBench SE tasks, SkillMOO achieves the top pass rate rank on 11 of 12 non-zero-pass tasks while achieving cost reductions of up to 31.7% over static bundles, with pass rate gains up to 42 percentage points. Analysis of 38 skill edits shows that pruning and substitution dominate successful operations, offering actionable principles for skill bundle design. Thereby, the current practice of deploying skills without cost-aware validation leaves better skill configurations unexplored, motivating a new class of multi-objective search-based skill engineering. Article Search Article: ase26nier-p65-p doi:10.1145/3832783.3834550
	Gu, Taotao	ASE '26: "WiDepFuzz: Finding Wi-Fi Protocol ..." WiDepFuzz: Finding Wi-Fi Protocol Bugs in Mobile Hotspot via Field Dependency Model Yuanliang Chen, Fuchen Ma, Taotao Gu, and Yu Jiang (Tsinghua University, China) Wi-Fi is a widely used wireless protocol, and mobile hotspot functionality has become essential for on-the-go connectivity. Bugs in the hotspot protocol stack can cause crashes, performance degradation, and semantic inconsistencies. Fuzzing is a promising technique for detecting such vulnerabilities. However, existing fuzzers typically test by modeling protocol inputs but ignore some critical dependencies among Wi-Fi fields, leading to inefficient testing. In this work, we present WiDepFuzz, a fuzzing framework designed to detect bugs in Mobile Hotspot implementations by modeling field dependencies in the Wi-Fi protocol. First, WiDepFuzz automatically identifies the semantic dependencies among Wi-Fi fields based on the IEEE 802.11 standard and constructs a Field Dependency Model (FDModel) to characterize various direct and indirect dependencies. Second, leveraging the FDModel, WiDepFuzz utilizes dependency-combination guided fuzzing to constantly generate Wi-Fi test frames that efficiently explore deep paths and trigger hidden bugs. Finally, we propose liveness and dependency detectors that enable real-time monitoring to identify abnormal states and uncover potential bugs in mobile hotspots. We implemented WiDepFuzz and evaluated it in six widely used mobile hotspots, covering major smartphone manufacturers, including Samsung, Xiaomi, OPPO, Honor, Huawei, and Nokia. Compared to SOTA Wi-Fi fuzzers like Peach, OwFuzz, wpaspy, and Greyhound, WiDepFuzz detects 15 more bugs and improves bug detection speed by 37% on average. In total, it uncovered 20 new bugs. Article Search Article: ase26main-p1165-p doi:10.1145/3832783.3837483
	Gu, Wenwei	ASE '26: "KRCA: An Efficient Root Cause ..." KRCA: An Efficient Root Cause Analysis System in Hyper-scale Microservice Systems via Agentic AI Jiamin Jiang, Jingfei Feng, Yu Luo, Qingliang Zhang, Yongqian Sun, Wenwei Gu, Shenglin Zhang, Tianyu Cui, Yao Wu, Jielong Huang, Nan Qi, and Dan Pei (Nankai University, China; Kuaishou Technology, China; Tsinghua University, China) Hyper-scale microservice systems have become the standard infrastructure for large-scale Internet companies. These systems consist of numerous loosely coupled microservices that evolve independently through continuous development and deployment. Such complexity makes failures unavoidable, necessitating efficient Root Cause Analysis (RCA) to help Site Reliability Engineers (SREs) quickly localize root cause services and classify failure types. However, existing RCA methods often struggle to adapt to the extreme dynamism and massive scale of these systems. In this paper, we present KRCA, an end-to-end RCA system designed for hyper-scale microservice systems. To manage the vast search space, KRCA employs a multi-stage pipeline that begins with an API-level drilldown to isolate suspicious services. It then instantiates a skeleton-based causal graph from anomalous metrics to serve as a high-recall structural prior, before utilizing a memory-augmented multi-agent framework to verify causality and generate the final failure report. By combining structured causal constraints with multi-agent reasoning, KRCA balances diagnostic accuracy with the efficiency requirements of real-time production use. Experimental results show that KRCA achieves AC@1 scores of 0.88 and 0.79 for root cause service localization and failure type classification, outperforming the strongest baseline by at least 31% in absolute gains. KRCA has been deployed in Kuaishou's production environment for over six months, reducing the average diagnosis time by 77.3%. Article Search Article: ase26ind-p61-p doi:10.1145/3832783.3834468 ASE '26: "Debugging the Debuggers: Failure-Anchored ..." Debugging the Debuggers: Failure-Anchored Structured Recovery for Software Engineering Agents Chenyu Zhao, Shenglin Zhang, Yihang Lin, Wenwei Gu, Zhimin Chen, Yongqian Sun, Dan Pei, Chetan Bansal, Saravan Rajmohan, and Minghua Ma (Nankai University, China; Tsinghua University, China; Microsoft, USA; Microsoft 365, USA) Software engineering agents are increasingly deployed in evaluable engineering environments, yet post-failure recovery remains costly, manual, and largely ad hoc. Existing systems expose traces for inspection or generate follow-up feedback, but they do not turn heterogeneous runtime evidence into grounded, bounded recovery guidance for a subsequent attempt. We present PROBE, a failure-anchored framework for structured recovery in software engineering agents. PROBE organizes failed-run telemetry into structured evidence, structured diagnosis, and bounded recovery guidance, realized by a Telemetry Layer, a Diagnosis Layer, and a Guidance Gate. The Telemetry Layer preserves fine-grained runtime signals, the Diagnosis Layer fuses cross-signal evidence into a grounded diagnosis, and the Guidance Gate constructs diagnosis-derived recovery guidance only when it is evidence-grounded, actionable, and within the scope of agent-side behavior. We evaluate PROBE across three software engineering settings spanning repository-level software repair, enterprise workflow recovery, and AIOps service mitigation. On 257 initially unresolved cases, PROBE achieves 65.37% Top-1 diagnosis accuracy and a 21.79% recovery rate, outperforming the strongest non-PROBE baseline by 43.58 and 12.45 percentage points, respectively. The results reveal a substantial diagnosis-recovery gap: accurate diagnosis is necessary but not sufficient unless it can be translated into bounded guidance that the subsequent attempt can execute and verify. Beyond controlled evaluation, a Microsoft IcM prototype shows that PROBE can attach as a non-intrusive side channel to existing service-diagnosis agent workflows without changing the agent policy, toolset, or execution budget. These results suggest that telemetry-grounded, failure-anchored recovery is a practical path to improving post-failure recoverability of software engineering agents under realistic engineering constraints. Article Search Article: ase26ind-p114-p doi:10.1145/3832783.3834492 ASE '26: "MERA: A Multi-expert LLM Framework ..." MERA: A Multi-expert LLM Framework for Severity Assessment of User Tickets in Mobile OS Beta Testing Yongqian Sun, Yimin Zuo, Qingliang Zhang, Bowen Hao, Wenwei Gu, Jiaqi Luan, Sixu Zhou, Shenglin Zhang, and Dan Pei (Nankai University, China; Tsinghua University, China) Large-scale mobile OS beta testing generates massive ticket vol- umes, creating a triage bottleneck in which assigning severity dic- tates engineering priority. Automating this is difficult: unlike server logs with rich telemetry, beta tickets rely on vague, symptom-driven user descriptions, which confound standard AIOps tools. Tradi- tional classifiers based on deep learning or pre-trained language models (PLMs) further struggle to adapt to the rapid concept drift triggered by frequent feature updates, and their black-box nature fails to provide the reasoning transparency that engineers require for trust. We observe that experienced triage engineers resolve these challenges by triangulating across user intent, system context, and historical precedent—a discipline that no single monolithic model captures. We present MERA (Multi-expert Evidence Reasoning and Arbitration), the first production-deployed multi-expert LLM framework for severity assessment in telemetry-void mobile OS beta testing. MERA operationalizes this discipline by decoupling severity assessment into three expert perspectives and fusing their evidence into an auditable decision. To meet strict online latency budgets, MERA distills the reasoning capability of a large teacher model into three lightweight experts, and a dynamic fusion layer weighs their evidence to produce a severity decision with human- reviewable rationales. In the mobile OS beta-testing pipeline of a leading global information and communications technology (ICT) provider, MERA serves as the default severity grader for all incom- ing beta tickets, with engineers performing spot-checks. Over five months it processed more than 370,000 tickets at 85% accuracy, sub- stantially outperforming baselines under concept drift and reducing manual triage effort by 60%. Article Search Article: ase26ind-p263-p doi:10.1145/3832783.3834518 ASE '26: "LLM-Assisted Joint Ticket ..." LLM-Assisted Joint Ticket and Log Analysis for Incident Triage in Intelligent and Connected Vehicles Ruowei Fu, Shenglin Zhang, Wenwei Gu, Weiguo Li, Yongqian Sun, and Dan Pei (Nankai University, China; Huawei, China; Tsinghua University, China) With the rapid development of intelligent and connected vehicles (ICVs), in-vehicle systems have grown increasingly complex, leading to frequent anomalies in real-world usage. To maintain a high-quality user experience, efficient incident triage is essential for timely issue resolution. However, with the growing volume and complexity of incidents, traditional manual triage processes are becoming increasingly insufficient. Recent advances in large language models (LLMs) have demonstrated strong capabilities in reasoning and natural language understanding, offering new opportunities for automation. We propose InsightTriage, an end-to-end automated incident triage system designed and deployed for real-world industrial scenarios, which leverages LLMs to jointly analyze user queries and vehicle logs to generate accurate and explainable triage results. To address the lack of domain-specific knowledge, InsightTriage first constructs a component-level structured knowledge base in an offline phase by leveraging LLMs to automatically extract knowledge from historical vehicle logs. In the online phase, to mitigate the context length limitations of LLMs in log analysis, InsightTriage introduces a log retriever pretrained with contrastive learning, which efficiently identifies query-relevant log entries. Comprehensive experiments conducted on a dataset collected from the production environment of a top-tier global supplier for ICVs, demonstrate that InsightTriage achieves superior performance, reaching a weighted F1-Score of 0.801 (an improvement of 0.137 over the best baseline), while also providing explainable triage reports. Article Search Article: ase26ind-p283-p doi:10.1145/3832783.3834521
	Gu, Xiaodong	ASE '26: "LLM Agents Can See Code Repositories ..." LLM Agents Can See Code Repositories Dongjian Ma, Silin Chen, Yufei Yang, Yuling Shi, Yanfu Yan, and Xiaodong Gu (Shanghai Jiao Tong University, China; Xi'an Jiaotong University, China; Zhejiang University, China) Coding agents powered by large language models (LLMs) have demonstrated remarkable proficiency in software engineering tasks. Yet modern coding agents rely almost entirely on text, leaving a major gap between how human developers and agents comprehend software repositories. Human developers leverage visual repository cues such as folder hierarchies and dependencies, raising the question of whether multimodal models can similarly improve repository understanding. In this paper, we conduct the first systematic empirical study on multimodal foundation models for repository-level tasks. Our experiments across four modern multimodal models reveal that while a vision-only context representation degrades performance and inflates token costs, integrating visualized context graphs as a supplementary modality can help agents grasp the repository more efficiently. Specifically, providing agents with visual structural context alongside standard text interfaces reduces input token consumption by up to 26% while maintaining or improving issue-resolution accuracy. Furthermore, we demonstrate that visual tools are most effective when utilized during the fault localization stage and when agents autonomously dictate their exploration depth. Our findings highlight a promising hybrid-modality pathway for the design of next-generation coding agents. Article Search Article: ase26main-p734-p doi:10.1145/3832783.3834363
	Gu, Yaoyao	ASE '26: "Li-WaC: A Lightweight WebAssembly ..." Li-WaC: A Lightweight WebAssembly Container for Independently Upgradable IoT Applications in Xiaomi Vela Bin Liao, Canfeng Zheng, Shiwen Shan, Qi Huang, Junjie Dong, Xiang Xiao, Yaoyao Gu, and Yuxin Su (Beijing Xiaomi Mobile Software, China; Sun Yat-sen University, China) In resource-constrained IoT devices, traditional application runtimes often struggle with limited performance and inflexible update mechanisms. WebAssembly (Wasm) has emerged as a promising technology to overcome these bottlenecks. However, existing Wasm implementations are not yet fully optimized for practical IoT environments, particularly in terms of JavaScript performance and modular over-the-air (OTA) updates on production IoT systems. To fill the gap, we propose Li-WaC, a lightweight, high-performance, and efficiently updatable WebAssembly Container framework for IoT operating systems.Specifically, we integrate a Wasm runtime into the event-driven Context Hub Runtime Environment (CHRE) framework. By treating the Wasm runtime as a standalone dispatch entity, Li-WaC runs Wasm modules as standard nanoapps, similar to native C/C++ applications. Performance-intensive tasks that were previously handled in JavaScript can then be offloaded to Wasm. We implemented and deployed Li-WaC within Vela, a production IoT operating system developed and maintained by Xiaomi, a leading global manufacturer of smartphones and IoT devices. On compute-oriented microbenchmarks, the AOT mode of Li-WaC achieves a 13× average speedup over QuickJS, approaching V8 on these microbenchmarks. In a production deployment study, we also observed smaller update packages, shorter installation times, and higher upgrade adoption rates under modular updates, where the upgrade adoption rate is the share of devices in the target cohort that completed an upgrade within a stated observation window. Article Search Article: ase26ind-p186-p doi:10.1145/3832783.3834502
	Guan, Jingjing	ASE '26: "SpecFSM: Extracting and Repairing ..." SpecFSM: Extracting and Repairing Finite State Machines from Protocol Specification Documents Xiangdong Li, DaWei Huang, Jingjing Guan, and Hui Li (Beijing University of Posts and Telecommunications, Beijing, China) Finite state machines (FSMs) are a fundamental abstraction for modeling dynamic system behavior and are widely used in protocol analysis. However, automatically extracting FSMs from natural-language specifications remains challenging. Protocol documents are often lengthy and structurally complex, with state-transition descriptions scattered across the text. As a result, large language models (LLMs) operating under incomplete context are prone to generating spurious transitions and logically flawed FSMs. In this paper, we propose SpecFSM, a framework for the automatic extraction and repair of protocol FSMs from natural-language specifications. SpecFSM combines state completion, evidence tracing, and formal verification into a unified pipeline that infers missing states, constrains incorrect transitions, and repairs logical defects in the extracted models. Experiments on multiple protocol documents show that SpecFSM improves the average number of correctly extracted state transitions by 54.7% over existing methods, while producing FSMs with stronger logical validity and better interpretability. Article Search Artifacts Available Article: ase26main-p13-p doi:10.1145/3832783.3834331
	Gudaparthi, Hemanth	ASE '26: "A Scalable Rule-Based Deep ..." A Scalable Rule-Based Deep Reinforcement Learning Framework for the Next Release Problem Hemanth Gudaparthi, Nan Niu, Prem Swaroopaanda Ramalingam, and Laxman Chowdary Kakara (Governors State University, USA; University of North Florida, USA) Next-release planning and feature selection remain critical challenges in the software deployment cycle, especially with the rapid introduction of updates and AI-driven functionalities. Selecting a subset of high-impact features that balances customer satisfaction with stakeholder business goals requires scalable models capable of producing near real-time predictions from requirements descriptions. However, uncertainty about which features truly align with customer needs makes this task difficult. This paper proposes a scalable feature prioritization framework that leverages rules derived from feature perplexity, probabilistic relevance, and customer-oriented criteria. We introduce a dual deep-reinforcement learning (DDRL) architecture that recommends high-value requirements through a hierarchical strategy. The first level applies graph reinforcement learning (GRL) guided by rule-based reasoning to structure tasks and reduce search space, while the second level uses deep reinforcement learning (DRL) to refine predictions. Experimental results on Zoom, Webex, and Teams datasets show that the approach maintains linear complexity (O(m)) compared to the cubic complexity (O(m^3)) of traditional graph-based methods, where m is the number of edges. The model achieves up to 85.56 Article Search Artifacts Available Article: ase26main-p350-p doi:10.1145/3832783.3834348
	Guo, An	ASE '26: "TrackTest: Trajectory Generation ..." TrackTest: Trajectory Generation and Prioritization for Testing Multiple Object Tracking System Xinyu Gao, Haoxin Chen, Shuoxiao Zhang, Enyi Tang, Hengrui Xu, Haoxiang Tian, Minghui Wei, and An Guo (Nanjing University, China; Nanyang Technological University, Singapore; Hong Kong Polytechnic University, China) Multiple Object Tracking (MOT) is a fundamental component of the perception stack in Autonomous Driving Systems (ADS), providing essential state estimation for downstream decision-making. Despite the adoption of multi-sensor fusion to enhance reliability, MOT systems remain susceptible to tracking failures, which can lead to catastrophic safety incidents. Current perception testing and evaluation predominantly rely on manually annotated real-world datasets, which are behaviorally imbalanced, prohibitively expensive to scale, and insufficient to cover diverse dynamic interactions. To bridge this gap, we propose TrackTest, an automated testing framework designed to systematically expose tracking failures in MOT systems. TrackTest transforms real-world seed scenarios into challenging test cases by synthesizing physically feasible and behaviorally diverse trajectories. We formulate six representative driving patterns as constraint-based optimization problems for behavior-controllable trajectory generation. To reduce computational overhead, we introduce a trajectory prioritization strategy that identifies high-risk scenarios most likely to trigger tracking failures. We evaluate TrackTest on six state-of-the-art MOT systems. Experimental results show that TrackTest effectively generate behavior-diverse trajectories and uncover diverse tracking failures. Article Search Article: ase26main-p2727-p doi:10.1145/3832783.3837540
	Guo, Fangda	ASE '26: "CAPMix: Robust KPI Anomaly ..." CAPMix: Robust KPI Anomaly Detection for AIOps in Noisy and Dynamic Environments Xudong Mou, Rui Wang, Tiejun Wang, Zexin Wu, Fangda Guo, Jie Sun, Shiru Chen, Penghao Zhang, Tiezi Zhang, Tianyu Wo, Hao Peng, Chunming Hu, Xudong Liu, and Renyu Yang (Beihang University, China; Chinese Academy of Sciences, China; Inspur, China; Kuaishou, China) Time-series anomaly detection is crucial in AIOps for maintaining large-scale service reliability. In production, streams of Key Performance Indicators (KPI) are high-dimensional, non-stationary, and affected by noise, deployment changes, and latent anomalies, making real failures hard to distinguish from benign variation. Most existing methods assume either normality (learning from “normal” history) or rely on injected anomalies for training. Yet injected patterns often misalign with real failure modes, skewing decision boundaries – aka. Anomaly Shift. We propose CAPMix, a controllable anomaly augmentation framework with prior-guided injection for realistic temporal behaviors. CAPMix combines label revision and dual-space mixup to enhance robustness under contaminated and mixed data. CAPMix consistently outperforms state-of-the-art methods on public AIOps and time-series benchmarks. It has been deployed in a large-scale production system, reducing false alarms and improving monitoring reliability. A real-world dataset is also released to enrich the research on robust KPI anomaly detection. Article Search Article: ase26ind-p110-p doi:10.1145/3832783.3834487
	Guo, Minyi	ASE '26: "AlphaCu: A Transformation-Driven ..." AlphaCu: A Transformation-Driven Synthesis Framework for LLM-Based GPU Kernel Generation Yangjie Zhou, Xing Ma, Zihan Liu, Qing Wang, Weihao Cui, Wu Sun, Hanjing Wang, Binhang Qi, Jingwen Leng, Yun Lin, Minyi Guo, and Jin Song Dong (National University of Singapore, Singapore; Shanghai Jiao Tong University, China; Shanghai Qi Zhi Institute, China; Nanjing University, China; Harvard University, USA) Large language models show promise for code generation, yet their effectiveness in producing high-performance GPU kernels remains insufficiently understood. Recent agentic workflows improve over direct prompting through specialized generation roles and execution feedback, but our characterization of a representative workflow reveals failures in optimization-strategy selection, hardware-specific instruction realization, and shape-dependent parameter selection. We present AlphaCu, a transformation-driven synthesis framework for LLM-based GPU kernel generation. AlphaCu treats kernel generation as structured synthesis over explicit optimization decisions rather than end-to-end code emission. Specifically, AlphaCu represents these decisions as scoped transformation passes maintained across agent-coordinated synthesis stages, enabling compatibility checking and failure attribution. AlphaCu binds selected hardware-sensitive operations to pre-validated microkernels and uses target-device measurements to revise transformation choices and tune runtime configurations. We evaluate AlphaCu on 104 test cases covering single and fused operators across four GPU architectures: NVIDIA H100, A100, V100, and AMD MI210. Under comparable generation budgets, AlphaCu achieves 100% functional correctness on our benchmark suite and delivers an average speedup of 5.64× over prior LLM workflows, while remaining competitive with vendor libraries and tensor compilers. Article Search Article: ase26main-p287-p doi:10.1145/3832783.3837433
	Guo, Peite	ASE '26: "RealAIGC: Towards More Realistic ..." RealAIGC: Towards More Realistic Evaluation of AI-Generated Code Detection in Real-World Code Repository Wentao Chen, Yufei Chen, Huiqun Yu, Guisheng Fan, Kaiwen Zhi, Peite Guo, and Jianyuan Yu (East China University of Science and Technology, China; Shanghai Engineering Research Center of Smart Energy, China) AI-generated code (AIGC) from autonomous coding agents are widely adopted across the software development lifecycle. However, AIGC also introduces critical challenges to open-source community governance, making AIGC detection important. Existing AIGC detection benchmarks are fundamentally misaligned with real-world development processes. To address this gap, we construct RealAIGC, a benchmark for AIGC detection grounded in real-world code repositories. RealAIGC is built from the development histories of GitHub and includes pull request (PR) generated by five coding agents alongside human-written code, covering eight major programming languages. It supports multi-granularity detection at the repository, PR, commit, file, and function levels, with more than four million functions. Based on RealAIGC, we conduct a realistic empirical evaluation of 28 AIGC detection methods across three categories. The results show that supervised approaches perform well only in small, homogeneous, single-language repositories, but degrade significantly in mainstream dynamic languages and in large-scale, multi-developer environments. Perplexity based methods are nearly ineffective in realistic settings. No existing method demonstrates general applicability, and all approaches perform unsatisfactorily at the commit and PR levels. This work provides empirical guidance for advancing AIGC detection techniques. Article Search Article: ase26main-p2317-p doi:10.1145/3832783.3834411
	Guo, Shudi	ASE '26: "When Ambiguity Meets Atypicality: ..." When Ambiguity Meets Atypicality: Dual-Perspective Test Input Prioritization for DNNs Haoran Li, Shihai Wang, Bin Liu, Jialuo Chen, Wenjing Zhu, Yu Liu, Tengfei Shi, and Shudi Guo (Beihang University, China; Zhejiang University, China) While Deep Neural Networks (DNNs) have achieved remarkable progress in cutting-edge domains, their inherent brittleness has become a growing concern. To ensure the reliability and safety of DNN-enabled software, DNN testing has emerged as an indispensable practice. Within this context, test input prioritization is essential for early fault detection and reducing labeling costs. However, it remains challenging to accurately identify failure-inducing inputs. Although decision ambiguity and distributional atypicality are two widely adopted perspectives for characterizing inter-class competition and intra-class typicality respectively, relying on either perspective in isolation inevitably introduces blind spots. In this paper, we propose DuFP (Dual perspective Feature space Prioritization), a KNN density-based test input prioritization approach for DNNs that jointly incorporates both inter-class and intra-class perspectives. The prioritization framework of DuFP is built upon class-conditional density estimation. Based on the estimation results, prediction correctness is characterized by an ambiguity score and an atypicality score, with the former reflecting decision ambiguity and the latter quantifying distributional atypicality. A hybrid uncertainty score is then constructed by integrating both scores to guide the final prioritization. We evaluate DuFP on prioritization and selection tasks across image and text datasets under clean, corrupted, and adversarial scenarios. Experimental results demonstrate that DuFP effectively and efficiently prioritizes fault-inducing inputs and outperforms state-of-the-art approaches. Article Search Artifacts Available Article: ase26main-p367-p doi:10.1145/3832783.3834351
	Guo, Wenbo	ASE '26: "How Effective Are NPM Malicious ..." How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study Wenbo Guo, Zhongwen Chen, Zhengzi Xu, Chengwei Liu, Ming Kang, Shiwen Song, Chengyue Liu, Yijia Xu, Weisong Sun, and Yang Liu (Nanyang Technological University, Singapore; Sichuan University, China; Imperial Global Singapore, Singapore; Nankai University, China; Singapore Management University, Singapore) The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on disparate datasets with inconsistent settings, making cross-tool comparison unreliable and leaving practitioners without clear guidance. We present the first large-scale empirical study of NPM malicious package detection, evaluating 11 tools with 16 variants on a unified benchmark of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques. Unlike prior work, we inspect each tool’s source code to explain why tools succeed or fail, not merely how often. Our key findings: (1) the precision and recall a tool achieves are structurally determined by how it resolves the ambiguity between code capability and malicious intent, with IntelGuard reaching the best F1 at 95.98% by grounding its judgment in retrieved evidence and GuardDog the best among conventional tools at 93.32%; (2) behavioral coupling amplifies detection signals when behaviors co-occur, raising SAP_DT from 3.2% to 79.3% for the collect-and-exfiltrate chain; (3) 80.3% of malware uses no evasion because the ecosystem lacks mandatory pre-publication scanning; (4) ML degradation is driven by concept convergence rather than concept drift, since malware became simpler and every decision boundary fitted to a corpus ages with it; (5) combination effectiveness equals complementarity minus false-positive introduction, not paradigm diversity. Strategic combinations reach up to 97.21% accuracy and 97.02% F1. We release our benchmark and evaluation framework. Article Search Article: ase26main-p218-p doi:10.1145/3832783.3837427 ASE '26: "Latent Reuse in Agent Skills: ..." Latent Reuse in Agent Skills: Multi-modal Clone Detection at Ecosystem Scale Jiaying Zhu, Lyuye Zhang, Wenbo Guo, and Yang Liu (Nanyang Technological University, Singapore) An agent skill is a reusable package for extending an LLM agent, typically a SKILL.md file that combines YAML metadata, natural-language instructions, and executable code. Public repositories now host over two million skills, yet existing tools analyze each artifact in isolation, and registries do not track reuse created through copying, renaming, or adaptation. Detecting these links is difficult because reuse may appear in one channel while the others change; conventional single-channel clone detectors can therefore miss such adaptations. We present SkillReuse, a multi-modal clone detector that combines global lexical matching with channel-specific representations for YAML, prose, and code, then uses logistic regression to produce clone scores and interpretable clone-type labels. We also introduce SkillReuse-Bench, an annotated benchmark of 300 skill pairs spanning exact copies, renamed copies, adaptations, and semantic equivalents. On SkillReuse-Bench, SkillReuse reaches an F1 of 0.939 with 0.952 precision, improving over TF-IDF and delivering 4.2× higher recall on Type-4 semantic clones than MinHash. Applied to all 137,470 skills that pass the content filter, SkillReuse identifies 1.06 million clone pairs involving 66.8% of the analyzed skills; 95.3% of these pairs cross author boundaries. Among skills in the analyzed name-based clone families, 67% are superseded by a higher-quality variant. Tracing 938 security-relevant skills through the clone graph surfaces 16,587 clone links spanning 6,376 related skills that per-skill scanners alone would miss. Article Search Article: ase26main-p820-p doi:10.1145/3832783.3837468
	Guo, Xiaoyu	ASE '26: "QDoctor: Probe-Based Testing ..." QDoctor: Probe-Based Testing for Quantum Programs Qichen Wang, Shangzhou Xia, Xiaoyu Guo, and Jianjun Zhao (Kyushu University, Japan) Testing quantum programs in a black-box setting is difficult because bug-relevant behavioral differences may be missed at two levels: the chosen inputs may fail to trigger faulty behavior, and even when faults are triggered, the chosen measurements may fail to make the resulting differences observable. Existing methods have mainly strengthened either input generation or measurement design in isolation, leaving their coupling insufficiently addressed. In this paper, we present QDoctor, a probe-based black-box testing framework that wraps the program under test with a variety of property-based probes, thereby effectively extracting program information and exploring its behavior. A probe integrates two components: test-case generation and the specification of the measurement basis. To reduce false positive rate, QDoctor also supports semantic-aware partial equivalence testing through constrained probe-oracle design. Experimental results on benchmark suites show that QDoctor achieves the best balanced performance among representative black-box baselines, reaching 99.89% recall, 98.23% precision, 99.06% F1, and 0.9988 AUC. Ablation shows that jointly strengthening inputs and measurements raises recall from 85.280% to 99.728% with zero false positives, while semantic probes drive the false-positive rate to zero on SWAP-induced equivalent mutants. Article Search Article: ase26main-p1302-p doi:10.1145/3832783.3837488
	Guo, Yangfan	ASE '26: "AgentSysFilter: A Multi-agent ..." AgentSysFilter: A Multi-agent Analysis Approach for Scenario-Aware Syscall Limitation Dongyang Zhan, Xingchen Yan, Zhaofeng Yu, Yangfan Guo, Kai Tan, and Langtong Zhang (Harbin Institute of Technology, China; Macau University of Science and Technology, China) Modern OS kernels expose hundreds of syscalls to applications, yet individual programs typically require only a small subset. This over-privileging violates the principle of least privilege and expands the kernel attack surface. Existing methods for limiting system calls face several challenges: dynamic tracing suffers from incompleteness, while static analysis, though it ensures completeness, introduces excessive redundant system calls due to a lack of dynamic information and a failure to account for differences in application service scenarios. In this paper, we propose AgentSysFilter, a scenario-aware multi-agent static analysis framework leveraging LLM-driven agents to analyze the service scenarios of the target application and generate scenario-specific syscall limitation strategies. Experimental results indicate that AgentSysFilter reduces allowed syscalls and mitigates more CVEs compared to existing approaches while maintaining functional compatibility. The video and code of AgentSysFilter are available at https://youtu.be/BKWFZL5FR8g and https://github.com/gresces/AgentSysFilter. Article Search Artifacts Available Article: ase26tool-p106-p doi:10.1145/3832783.3834634
	Guo, Yao	ASE '26: "Towards Reliable Alarm Flood ..." Towards Reliable Alarm Flood Reduction in Data Center via Grammar-Guided Verifiable LLM Reasoning Jiacheng Liu, Guocong Lin, Jichao Yan, Huiwen Zheng, Hongli Ma, Changhao Zhou, Zhiyi Yu, Yuanchun Li, Yunxin Liu, Ding Li, Tao Xie, and Yao Guo (Peking University, China; Tsinghua University, China; GDS Holdings, China) Alarm floods pose a critical challenge in system operations, where a single fault can trigger cascaded alarms across interconnected components, overwhelming human operators and obscuring actionable signals. Alarm flood reduction aims to reduce redundant alarms under a safety-oriented objective, because any incorrect reduction may falsely exclude real failures. Existing approaches face a fundamental trade-off: rule-based systems ensure reliability but lack scalability, while solutions based on a large language model (LLM) offer strong generalization but suffer from non-determinism and unverifiable reasoning, limiting their use in safety-critical settings. In this paper, we study the alarm flood reduction problem in data center operations and introduce a solution based on structured reasoning and conservative verification. Our key insight is that expert-level alarm analysis relies on explicit reasoning chains that connect upstream causes to downstream alarms. We design Constrained Reasoning Chain Grammar (CRCG), a lightweight yet expressive grammar that formalizes such reasoning processes as compositional inference chains with logical and numerical constraints. Our method follows two tightly connected steps. First, we use LLM-assisted annotation, checker-guided compilation, and supervised fine-tuning (SFT) to organize expert knowledge in CRCG and train a model to generate explicit reasoning chains. Second, we conservatively reduce alarms only when the reasoning chain can be verified based on CRCG. We evaluate the method on real-world data center HVAC alarms. Results have shown that our method achieves high accuracy while driving false reductions to zero on the evaluated setting, outperforming both rule-based and LLM-only baselines and reducing operational workload substantially. Article Search Artifacts Available Article: ase26ind-p96-p doi:10.1145/3832783.3834481
	Guo, Yingqian	ASE '26: "Towards Verifiable Fairness ..." Towards Verifiable Fairness Testing: Auditable Coverage over Data-Supported Input Domains Yingqian Guo, Wentian Zhao, and Tian Song (Beijing Institute of Technology, China) Black-box models are increasingly deployed in high-stakes domains such as education, personnel hiring, and credit assessment, making systematic and auditable fairness testing particularly important. In such settings, black-box fairness testing is typically modeled as a search problem aiming to discover biases in the target model as much as possible. However, existing methods offer limited support for verifiable evaluation on a clearly stated, data-supported test domain: which reasonable regions have been tested, which have not, and whether exploration is balanced across the test domain remain unclear. This paper redefines black-box fairness testing as an auditable process on a data-supported, reasonable input domain. We first construct a reasonable region from the reference data and divide it into a finite set of local coverage units. Then, we introduce a coverage scheduler that distributes testing work among the units and explicitly records tested and untested regions, thus achieving reproducible and verifiable sufficient testing. To improve discriminative discovery capabilities without compromising the coverage foundation, we further design a structure-aware intra-unit search mechanism that combines a structure-aware discriminative field (SDF) and directional influence refinement (DIR). Experiments on multiple real-world tabular datasets show that our method enables auditable unit-level coverage accounting and achieves more balanced coverage, higher sample naturalness, and higher discrimination discovery effectiveness than representative black-box fairness testing baselines. Moreover, the discovered instances are effective for mitigating individual fairness violations through retraining. Article Search Artifacts Available Article: ase26main-p3140-p doi:10.1145/3832783.3834430
	Guo, Zhihao	ASE '26: "Harnessing Uncertainty in ..." Harnessing Uncertainty in Code Language Models: Lessons from Vulnerability Detection Haodong Li, Xiao Cheng, Xudong Wang, Zhihao Guo, and Haoyu Wang (Huazhong University of Science and Technology, China; Macquarie University, Australia; Zhongguancun Institute of Artificial Intelligence, China; University of Technology Sydney, Australia) Code Language Models (CLMs) are increasingly adopted for vulnerability detection, yet knowing when to trust their predictions remains an open challenge. Uncertainty estimation has improved reliability in traditional discriminative models, but whether these benefits transfer to the generative paradigm of CLMs is unclear. This experience paper presents a systematic empirical study of uncertainty estimation in CLM-based vulnerability detection, evaluating four calibration methods and two uncertainty-driven enhancement frameworks across eight models (2B--16B parameters) under both in-distribution and out-of-distribution settings on 1,050 real-world projects. Our study reveals that: (1) calibration effectiveness is model-scale dependent: temperature scaling and ensembles deliver consistent gains, while Monte Carlo Dropout and Bayesian Low-Rank Adaptation by Backpropagation only benefit medium-scale models (approximately 6B--7B parameters); (2) uncertainty-based correction requires label-conditional modeling to be effective (up to 12% Macro-F1 improvement on out-of-distribution data), as global strategies show negligible effects; (3) curriculum learning fails to improve upon standard fine-tuning, as uncertainty-based difficulty ordering does not align with the learned decision boundary, causing training instability or negligible gains. These findings challenge assumptions about the universal transferability of uncertainty methods and provide practical guidelines for deploying uncertainty-aware vulnerability detection. Article Search Article: ase26main-p786-p doi:10.1145/3832783.3837465
	Haiduc, Sonia	ASE '26: "VidTutorAssistant: Automating ..." VidTutorAssistant: Automating Responses to Programming Tutorial Questions Ahmad Tayeb, Sonia Haiduc, and Mohammad D. Alahmadi (King Abdulaziz University, Saudi Arabia; Florida State University, USA; University of Jeddah, Saudi Arabia) Programming tutorial videos on YouTube are an important information resource for software developers and students, and their comment sections have evolved into active spaces where viewers ask follow-up questions. The volume of these questions, however, often exceeds what content creators can address, leaving learners without the clarifications they need. We present VidTutorAssistant, a web platform that automates responses to viewer questions on programming video tutorials. VidTutorAssistant implements a retrieval-augmented generation pipeline that extracts a video’s transcript, then segments it and embeds it. It then classifies each viewer comment as being a question or non-question, retrieves the most relevant transcript segments to each identified question via cosine similarity, and then generates an answer to the question using an LLM (GPT-4), while grounding the response using the retrieved transcript segments as context. We validate VidTutorAssistant through a study on a subset of 440 user comments selected from a larger dataset of 105,553 comments extracted from 7,522 Python and Java tutorials. VidTutorAssistant is evaluated on various criteria: a) its ability to identify the programming language in a video, achieving a 0.99 accuracy; b) its ability to classify comments into questions and non-questions, reaching a 0.96 accuracy; and c) its ability to produce correct and complete answers to questions, producing 98% correct and 99.5% complete responses, compared with 89% and 90% for the original creators’ answers. Article Search Article: ase26tool-p17-p doi:10.1145/3832783.3834599
	Halfond, William G. J.	ASE '26: "Mobile Bug Reproduction via ..." Mobile Bug Reproduction via Global State Reprioritization and LLM-Guided Trajectory Exploration Dingbang Wang, Sidong Feng, William G. J. Halfond, and Tingting Yu (University of Connecticut, USA; Monash University, Australia; University of Southern California, USA) Mobile bug reproduction is essential to effective debugging in software engineering. Recent methods leveraging Large Language Models (LLMs) have shown significant performance gains over traditional techniques in automating this task. However, existing LLM-based methods remain constrained by two major limitations. First, they lack robustness to unreliable or inconsistent LLM outputs due to overreliance on a single LLM-suggested action without principled planning. Second, substantial token overhead arises from frequent LLM queries and the limited utilization of each query’s output capacity. To address these limitations, we propose ReproPilot, a lightweight framework that combines global planning with LLM-based semantic reasoning to reproduce mobile bugs. Specifically, the LLM provides diverse, reusable long-horizon guidance beyond step-wise action suggestions. This guidance is integrated with heuristic signals by a global planning mechanism to reason about reproduction progress and globally determine where to explore (i.e., which reproduction states) and what trajectories to explore, rather than merely executing actions on the current UI page at each iteration. As a result, ReproPilot improves the consistency and cost-efficiency of bug reproduction while maintaining competitive effectiveness. Evaluation on 74 real-world Android crash reports shows that our approach delivers the best reliability–cost trade-off among the evaluated methods, attaining the highest consistency (80.14%) with competitive effectiveness (86.49%), reducing reproduction time by 2.32%–14.07%, and lowering LLM token consumption by 65.39%–83.96% compared with state-of-the-art LLM-based baselines. Article Search Article: ase26main-p1450-p doi:10.1145/3832783.3837495
	Hamadou, Borhaneddine	ASE '26: "PWCC: Probability-Weighted ..." PWCC: Probability-Weighted Combinatorial Coverage for Risk-Informed Scenario Testing of Autonomous Systems Borhaneddine Hamadou, Chokri Mraidha, and Nikolaos Matragkas (Université Paris-Saclay, France; CEA List, France) Scenario-based testing of autonomous systems faces a fundamental unsolved problem: knowing when to stop. Existing coverage metrics measure either structural diversity or combinatorial breadth, but neither tells you how much of the system’s expected real-world operation remains untested. A test suite can score well on every existing metric while systematically missing the conditions the system will actually encounter. We introduce Probability-Weighted Combinatorial Coverage (PWCC), a metric that simultaneously measures coverage of the Op- erational Design Domain (ODD) and test adequacy. PWCC learns a probabilistic model of expected operating conditions from oper- ational profiling data, uses it to assign probability mass to 𝑡-way combinations of scenario features, and declares testing adequate when the uncovered mass falls below a risk-calibrated threshold. This gives practitioners something no existing metric provides: a principled, quantitative answer to “have we tested enough?” Evaluated on four autonomous driving datasets against seven baselines, PWCC demonstrates three properties. First, it is the strongest predictor of fault detection where the operational dis- tribution carries signal, reaching Spearman 𝑟𝑠 = +0.981 on Deep- Collision — 0.167 above the best combinatorial baseline at a lower interaction order. Second, it suppresses false sufficiency: on Deep- Scenario, PWCC achieves FSR = UFC = 0 across all splits versus CC’s mean UFC ≥ 95.8%, false sufficiency eliminated entirely, and, judged at its own stopping point, surfaces 99.6% of failure-triggering com- binations where combinatorial saturation stops after 6.4% of the campaign; on failure-rich datasets UFC drops by up to 4.9×. Third, it is stable: the score varies by at most 0.006 across a ten-fold increase in Monte Carlo sample size and grows monotonically with suite size. These results show that operational probability weighting is the decisive factor in avoiding dangerous false sufficiency verdicts; and that PWCC transforms coverage from a descriptive statistic into a risk-informed stopping decision. Article Search Artifacts Available Article: ase26main-p443-p doi:10.1145/3832783.3837443
	Han, HyungSeok	ASE '26: "CtxFuzz: Context-Aware Directed ..." CtxFuzz: Context-Aware Directed Fuzzing via Runtime Fuzzer-Agent Cooperation Jiho Kim, Dongkwan Kim, HyungSeok Han, Youngjoon Kim, Soyeon Park, Sangwoo Ji, Joshua Wang, Dae R. Jeong, and Taesoo Kim (Georgia Institute of Technology, USA; Microsoft, USA; Independent Researcher, USA; Samsung Electronics, Republic of Korea; Seoul National University, Republic of Korea) Automated tools produce vulnerability reports at unprecedented scale, but turning a report into a confirmed proof-of-vulnerability remains challenging. Directed grey-box fuzzers are widely used for validation but lack the ability to consume the rich context these reports carry, reducing each target to a bare location. In contrast, LLM-based approaches can consume this context but are often unable to identify the true triggering mechanism or to synthesize a working proof-of-vulnerability. We present CtxFuzz, a context-aware directed fuzzer that enables an LLM agent and a coverage-guided fuzzer to iteratively exchange and refine bug-triggering context throughout the campaign. The fuzzer contributes execution context, such as what inputs were tried and how the program behaved, grounding the agent’s reasoning in concrete evidence. The agent contributes semantic context, including hypotheses about the triggering conditions, explanations of failed attempts, and targeted mutations to overcome them, guiding the fuzzer toward relevant regions of the input space. Failed attempts are not discarded but decomposed into mutation scripts that translate each identified blocker into a fuzzer-executable strategy. This iterative exchange enables CtxFuzz to trigger vulnerabilities that neither directed fuzzers nor LLM agents reach independently. On 62 vulnerabilities across 16 open-source projects from the AIxCC Final competition (39 C, 23 Java), CtxFuzz exposes 61 of 62 targets, including 29 that no state-of-the-art directed fuzzer reaches, and exposes two zero-day vulnerabilities through a real-world vulnerability report validation pipeline. Article Search Article: ase26main-p797-p doi:10.1145/3832783.3834365
	Han, Jian	ASE '26: "OpsLens: Runbook-Free Root ..." OpsLens: Runbook-Free Root Cause Analysis via Multi-agent Collaboration and Tool Management Haiyu Huang, Jiewei Lyu, Gou Tan, Pengfei Chen, Zhihan Jiang, Guangba Yu, Penghui Mi, Fuqiang Wang, Jian Han, Chongkang Tan, and Michael R. Lyu (Sun Yat-sen University, China; Chinese University of Hong Kong, China; Huawei, China; Independent Researcher, China) Root Cause Analysis (RCA) is critical for cloud service reliability, requiring correlation of multi-modal observability data (i.e., traces, logs, and metrics) to identify failure causes. Current LLM-based RCA approaches face two key limitations: over-reliance on system-specific artifacts (e.g., runbooks), limiting transferability; and difficulty ensuring the quality and reuse of LLM-generated diagnostic tools across modalities. To address these issues, we propose OpsLens, an RCA framework that combines modality-specialized multi-agent collaboration with quality-focused tool management , including feedback-driven refinement and a tool graph with scoreboard. On OpenRCA (335 real-world incidents from three production systems), OpsLens achieves a score rate of 0.80, outperforming baselines by 1.79–4.75×. More importantly, OpsLens has been tested on Platform A in Huawei since June 2025, achieving over 80% RCA accuracy across two industrial datasets and reducing diagnosis time from over 1 hour to under 5 minutes. Article Search Artifacts Available Article: ase26ind-p181-p doi:10.1145/3832783.3834501
	Han, Lei	ASE '26: "Smart Brain: Semantic Anomaly ..." Smart Brain: Semantic Anomaly Detection for Operational Time Series in Large Scale Service Systems Hang Cui, Zexin Wang, Jingjing Li, Juncheng Hu, Haotian Si, Cenjie Hu, Quan Zhou, Yongchang Hu, Lei Han, Dan Pei, Changhua Pei, and Gaogang Xie (University of Chinese Academy of Sciences, China; Computer Network Information Center at Chinese Academy of Sciences, China; Jilin University, China; Independent Researcher, China; Shenyang Institute of Automation at Chinese Academy of Sciences, China; Huawei Technologies, China; Tsinghua University, China) Time series anomaly detection is a core component of operational automation in large scale service systems. However, most existing methods model anomalies as numerical deviations in the data space, while real software operations require decisions over whether an observed behavior constitutes an actionable abnormal event. This mismatch often leads to brittle thresholds, excessive false alerts, and outputs that are difficult for operators to interpret and act upon. In this paper, we argue that practical anomaly detection should move from point-centric data anomaly detection to semantic anomaly detection. We present Smart Brain, a two stage framework for semantic anomaly detection in operational time series. Stage I extracts structured temporal evidence by recognizing interpretable anomaly patterns. Stage II combines the extracted evidence with metric semantics and operator authored rules to produce semantic anomaly decisions and human-readable explanations. Through evaluation on benchmark datasets and real industrial monitoring scenarios, we show that Smart Brain improves operationally meaningful anomaly identification while providing stronger interpretability and deployment suitability than score centric pipelines. Beyond the framework itself, our study offers practical lessons for building anomaly detection systems in production software environments, highlighting the importance of semantic grounding, structured evidence, and lightweight adaptation to evolving services. Article Search Article: ase26main-p337-p doi:10.1145/3832783.3837436
	Han, Linlin	ASE '26: "Expanding Guard Reach: Online ..." Expanding Guard Reach: Online Learning-Driven Incremental Kernel Panic Diagnosis Yicheng Sui, Xiaotian Wang, Hailin Zhang, Shenglin Zhang, Binhong Jiang, Heng Zheng, Yongqian Sun, Yuzhi Zhang, Yang Zhang, Xin Wu, Liangyan Peng, Linlin Han, Feng Wang, Xiaozhou Liu, and Yu Zhang (Nankai University, China; ByteDance, China) Kernel panic faults (KPFaults) disrupt large-scale infrastructures. While logs are the primary diagnostic resource, they exhibit continuous semantic drift driven by the evolution of diverse online services and hardware heterogeneity. Existing methods fail to adapt to this drift. However, employing online learning to address this drift encounters two operational bottlenecks: the sparsity of KPFault-indicating logs and the heavy burden of manual intervention. To address this, we propose PanicGuard, an incremental diagnosis framework driven by online learning. PanicGuard integrates Fault-Indicating Representation Extraction (FIRE) to autonomously filter noise from sparse logs and Emergent Drift Guard Engine (EDGE) to verify evolving patterns within known fault categories and escalate genuinely novel types for expert registration using LLM-assisted reasoning. Evaluations on two real-world datasets comprising 6,789 and 6,779 KPFault cases demonstrate that PanicGuard achieves high accuracy (0.996 and 0.993) and Macro-F1 score (0.977 and 0.990) with only 29 and 33 human interventions, respectively. Compared to the strongest baseline, PanicGuard reduces human effort by 69% and 95%, respectively, while maintaining high precision. It has been operating in production for over three months, proving its effectiveness in achieving superior diagnostic performance compared to legacy methods, while significantly reducing manual intervention. The source code is publicly available at https://doi.org/10.5281/zenodo.19826984. Article Search Artifacts Available Article: ase26ind-p78-p doi:10.1145/3832783.3834474
	Han, Rui	ASE '26: "From Thread to Pool: Modeling ..." From Thread to Pool: Modeling and Static Detection of Thread Pool Misuses in Java Programs Baoquan Cui, Yucheng Qiu, Rui Han, Hang Gao, and Jian Zhang (Institute of Software at Chinese Academy of Sciences, Beijing, China; Hangzhou Institute for Advanced Study at University of Chinese Academy of Sciences, Hangzhou, China; University of Chinese Academy of Sciences, China) Asynchronous programming is fundamental to modern software performance, and Java ExecutorService-based executors have become a standard abstraction for managing concurrent tasks. While existing research has extensively studied traditional concurrency bugs, management misuses of executors remain under-analyzed. These defects arise not from the business logic of asynchronous tasks, but from how executors are configured, used, and terminated. We present a taxonomy of seven executor-management misuse patterns and formalize them using a resource-management model. Based on this, we develop PoolGuard, a static analysis framework for detecting both executor-generic lifecycle/result-handling defects and ThreadPoolExecutor-specific configuration misuses. Extensive evaluation on a benchmark suite with real-world defects shows that PoolGuard is better than specialized async detectors as well as general-purpose analyzers such as SpotBugs and Infer. Applying PoolGuard to large-scale open-source systems, we identified 50 previously unknown issues, 24 of which have already been fixed or confirmed by developers, demonstrating the practical value of semantic analysis for executor-management defects. Article Search Article: ase26main-p1687-p doi:10.1145/3832783.3837508
	Han, Sanghoon	ASE '26: "Safe Multi-site Binary Instrumentation ..." Safe Multi-site Binary Instrumentation of Running x86-64 Programs Jihun Baek, Sanghoon Han, and Hyungon Moon (UNIST, Republic of Korea) Applying binary instrumentation to a running x86-64 process is difficult because variable-length instructions and weak alignment guarantees prevent safe in-place code modification under concurrent execution. Existing run-time approaches either trap concurrent threads on every overwrite or require global synchronization, limiting scalability. This paper presents DIBE, a run-time binary editing framework that safely instruments running x86-64 programs without trapping in the common case. An admin process resolves all instrumentation decisions, including multi-site patching tactics and trampoline placement, and exports them as metadata. A lightweight runtime inside the target process replays these edits, safely activating E9Patch's multi-site rewriting tactics on the live process by applying their dependent overwrites in an order that keeps every intermediate program state correct under concurrent execution, a guarantee that single-site punning and offline rewriting do not provide. It applies 77-90% of overwrites using hardware atomic primitives invisible to concurrent threads, with a trap-based fallback only for the remaining cross-boundary cases. We evaluate DIBE on 28 SPEC CPU2006 benchmarks and a multi-process Nginx server, and demonstrate it at browser scale on a running Chrome renderer and as a live memory-safety checker. DIBE matches static E9Patch on both instrumentation coverage (near-complete) and execution time overhead (within 0.5% at the geometric mean), keeps per-instruction overwrite latency sub-microsecond, and records zero trap hits across all Nginx configurations under sustained load. Article Search Article: ase26main-p1407-p doi:10.1145/3832783.3837494
	Han, Shuo	ASE '26: "SkillMOO: Multi-objective ..." SkillMOO: Multi-objective Optimization of Agent Skills for Software Engineering Jingzhi Gong, Ruizhen Gu, Zhiwei Fei, Yazhuo Cao, Lukas Twist, Alina Geiger, Shuo Han, Dominik Sobania, Federica Sarro, and Jie M. Zhang (King's College London, UK; Queen's University Belfast, UK; Nanjing University, China; Johannes Gutenberg University Mainz, Germany; University College London, UK; University of Duisburg-Essen, Germany) Agent skills are increasingly used to configure coding agents for software engineering (SE) tasks, yet current practice treats them as static, hand-crafted assets, or evolved on pass rate alone. This is insufficient: a skill can improve task success while substantially raising token cost, or introducing misleading guidance. We argue that SE agent skill bundles can be treated as multi-objective search objects and present SkillMOO, a framework that evolves skill bundles through LLM-proposed edits and NSGA-II Pareto selection on pass rate and inference cost. Evaluated across all 16 SkillsBench SE tasks, SkillMOO achieves the top pass rate rank on 11 of 12 non-zero-pass tasks while achieving cost reductions of up to 31.7% over static bundles, with pass rate gains up to 42 percentage points. Analysis of 38 skill edits shows that pruning and substitution dominate successful operations, offering actionable principles for skill bundle design. Thereby, the current practice of deploying skills without cost-aware validation leaves better skill configurations unexplored, motivating a new class of multi-objective search-based skill engineering. Article Search Article: ase26nier-p65-p doi:10.1145/3832783.3834550
	Hao, Bowen	ASE '26: "MERA: A Multi-expert LLM Framework ..." MERA: A Multi-expert LLM Framework for Severity Assessment of User Tickets in Mobile OS Beta Testing Yongqian Sun, Yimin Zuo, Qingliang Zhang, Bowen Hao, Wenwei Gu, Jiaqi Luan, Sixu Zhou, Shenglin Zhang, and Dan Pei (Nankai University, China; Tsinghua University, China) Large-scale mobile OS beta testing generates massive ticket vol- umes, creating a triage bottleneck in which assigning severity dic- tates engineering priority. Automating this is difficult: unlike server logs with rich telemetry, beta tickets rely on vague, symptom-driven user descriptions, which confound standard AIOps tools. Tradi- tional classifiers based on deep learning or pre-trained language models (PLMs) further struggle to adapt to the rapid concept drift triggered by frequent feature updates, and their black-box nature fails to provide the reasoning transparency that engineers require for trust. We observe that experienced triage engineers resolve these challenges by triangulating across user intent, system context, and historical precedent—a discipline that no single monolithic model captures. We present MERA (Multi-expert Evidence Reasoning and Arbitration), the first production-deployed multi-expert LLM framework for severity assessment in telemetry-void mobile OS beta testing. MERA operationalizes this discipline by decoupling severity assessment into three expert perspectives and fusing their evidence into an auditable decision. To meet strict online latency budgets, MERA distills the reasoning capability of a large teacher model into three lightweight experts, and a dynamic fusion layer weighs their evidence to produce a severity decision with human- reviewable rationales. In the mobile OS beta-testing pipeline of a leading global information and communications technology (ICT) provider, MERA serves as the default severity grader for all incom- ing beta tickets, with engineers performing spot-checks. Over five months it processed more than 370,000 tickets at 85% accuracy, sub- stantially outperforming baselines under concept drift and reducing manual triage effort by 60%. Article Search Article: ase26ind-p263-p doi:10.1145/3832783.3834518
	Hao, Ming	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Hao, Qinfen	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Happe, Andreas	ASE '26: "Cochise: A Reference Harness ..." Cochise: A Reference Harness for Autonomous Penetration Testing Andreas Happe and Jürgen Cito (TU Wien, Austria) Recent work on LLM-driven autonomous penetration testing reports promising results, but existing systems often bundle architectural, prompting, and tool-integration choices together. This makes it difficult to determine what is gained over a simple agent and harness. We present Cochise, a 630 LOC Python reference implementation for autonomous penetration-testing experiments. Cochise connects to a Linux execution host over SSH and supports attacking controlled target environments reachable from that jump host. The prototype implements a Planner--Executor architecture in which long-term state is maintained by the planner, while a ReAct-style executor issues commands over SSH and self-corrects based on command outputs. The scenario prompt can be adapted to different target environments. We evaluate the harness against a live third-party testbed, Game of Active Directory (GOAD). Cochise is intended not as a state-of-the-art penetration-testing agent, but as a reusable experimental infrastructure for comparing models, agent architectures, and penetration-testing traces. Alongside the prototype, we release replay and analysis tools: (i) cochise-replay for offline visualization of captured runs, (ii) cochise-analyze-logs and cochise-analyze-graphs for cost, token, duration, and compromise analysis, and (iii) a corpus of JSON trajectory logs from GOAD runs, so that researchers can study agent behavior without provisioning the 48-64 GB RAM / 190 GB storage testbed themselves. Tool demo video available at https://youtu.be/2mQimB1ufyI. Article Search Artifacts Available Article: ase26tool-p208-p doi:10.1145/3832783.3834651
	Hasan, Alif Al	ASE '26: "What Breaks When LLMs Code? ..." What Breaks When LLMs Code? Characterizing Operational Safety Failures of Agentic Code Assistants Alif Al Hasan and Sumon Biswas (Case Western Reserve University, USA) Autonomous coding agents built on large language models (LLMs) are rapidly being integrated into development workflows, yet their operational safety properties remain poorly understood beyond evaluations of explicitly malicious inputs. In practice, high-impact failures arise during benign, goal-directed use through environment breakage, fabricated success reports, etc. that current benchmarks do not capture. What categories of operational safety failures actually occur when coding agents are used for everyday development tasks and what is their impact? We present an incident-driven empirical study grounded in two complementary evidence streams. We screen 68,816 papers from 22 premier venues, curating 185 safety-relevant studies, and mine 16,586 GitHub issues from widely deployed LLM-powered coding tools, manually confirming 547 genuine safety failures. Applying systematic open coding over both corpora, we derive a multi-dimensional safety taxonomy of 33 operational risk types organized across seven dimensions, and annotate each incident with contributing factors, task context, severity, and downstream impact. Our findings show that coding-agent failures are often severe, with 326 of 547 incidents rated high or critical. The dominant risks are constraint violations, destructive operations, authorization bypasses, and deception, and over 65% of incidents arise in bug fixing and setup or configuration, patterns largely missing from prior literature. These results have direct implications for SE tool designers and benchmark developers: guardrails must go beyond adversarial-prompt defenses to enforce environmental constraints, failure transparency, and safe-halt behaviors. Article Search Artifacts Available Article: ase26main-p1517-p doi:10.1145/3832783.3834393
	Hasan, Md Rashedul	ASE '26: "Formal Verification-Integrated ..." Formal Verification-Integrated Reinforcement Learning for Automated ORM Schema Synthesis Md Rashedul Hasan and Hamid Bagheri (University of Nebraska-Lincoln, USA) Object-relational mapping (ORM) frameworks are widely used to bridge object-oriented models and relational databases, but conventional tools generate only single point solutions and often miss optimal trade-offs between performance and storage consumption. Exhaustive tradespace analysis can discover Pareto-optimal database designs, but it is computationally prohibitive for realistic systems. This paper introduces ReinforceORM, an automated and scalable framework that formulates ORM schema synthesis as a multi-objective optimization problem solved via reinforcement learning with formal verification. Our approach integrates multiple RL algorithms to efficiently search the vast space of mapping strategies, balancing insertion time, query performance, and storage consumption, while employing Alloy-based formal analysis to provide bounded verification of structural and semantic correctness in generated schemas. Evaluation across fifteen diverse, real-world software systems shows that ReinforceORM identifies over 80% of ground-truth Pareto-optimal ORM configurations—an 18-fold improvement over leading ORM frameworks such as Hibernate, Django ORM, SQLAlchemy, and Entity Framework. Compared to state-of-the-art specification-driven search, ReinforceORM reduces analysis runtime and memory usage by four and five orders of magnitude, respectively, while maintaining near-optimal solution quality. Article Search Artifacts Available Article: ase26main-p1565-p doi:10.1145/3832783.3837501 ASE '26: "Self-Discovering Security ..." Self-Discovering Security Oracles: Meta-learning Vulnerability Detection Strategies through Adversarial Self-Play Md Rashedul Hasan and Hamid Bagheri (University of Nebraska-Lincoln, USA) Current Large Language Model (LLM) based vulnerability detection systems rely on static prompting strategies and fixed analysis pipelines that fail to adapt to evolving threat landscapes. These approaches struggle to discover unknown vulnerability patterns beyond their training distributions, limiting their effectiveness against emerging security threats. This paper explores adversarial meta-learning where foundation models autonomously discover vulnerability detection strategies through reinforcement learning and competitive self-play. We present MetaMorphSES, a framework that enables Foundational models to evolve in terms of both vulnerability generation capabilities (as a red team) and detection strategies (as a blue team) through adversarial co-evolution without predetermined prompts or fixed architectures. The system learns to generate increasingly sophisticated synthetic vulnerabilities while simultaneously developing detection strategies that generalize to real-world security flaws. Through a dual-loop optimization process, the inner loop generates and detects vulnerabilities while the outer meta-learning loop discovers optimal detection strategies through reinforcement learning. Our experiments on six real-world vulnerability corpora demonstrate that meta-learned security strategies yield substantially stronger detection of unseen vulnerabilities (up to 0.90 F1) against nine strong baselines spanning rule-based static analysis, zero-shot and fine-tuned LLMs, and recent vulnerability detectors, with the system reaching a stable equilibrium. While training remains resource-intensive, the approach establishes adversarial meta-learning as a novel and effective way to discover security vulnerabilities with foundational models through self-directed adaptation without explicit programming of detection rules. Article Search Artifacts Available Article: ase26main-p1822-p doi:10.1145/3832783.3837512
	Hashemi, Milad	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Hassan, Ahmed E.	ASE '26: "When Elo Lies: Hidden Biases ..." When Elo Lies: Hidden Biases in Codeforces-Based Evaluation of Large Language Models in Practice Shenyu Zheng, Ximing Dong, Xiaoshuang Liu, Chun Yong Chong, Gustavo Oliva, Dayi Lin, Boyuan Chen, Shaowei Wang, and Ahmed E. Hassan (Huawei Canada, Canada; Huawei, China; Monash University, Malaysia; Queen's University, Canada; University of Manitoba, Canada) As Large Language Models (LLMs) achieve breakthroughs in complex reasoning, Codeforces-based Elo ratings have emerged as a prominent metric for evaluating competitive programming capabilities in industry. However, these ratings are often reported without critical experimental details, leading to significant discrepancies-illustrated by recent reports where the same model version’s score fluctuated by nearly 500 points (out of 2,029). This paper presents a systematic empirical study on the hidden factors biasing Elo evaluations: (1) the temporal ordering of submissions, (2) contest difficulty selection, and (3) run-to-run stochastic variability of LLMs. Utilizing a controlled benchmark of 37 recent Codeforces contests and 13,691 generated test cases, we demonstrate that Elo scores are highly sensitive to these parameters. Our findings reveal that varying submission orders can shift scores by 394 points, while contest selection can cause differences of up to 1,122 points for the same model. Run-to-run performance exhibits substantial instability, with a maximum difference of 349 points in mean scores observed when evaluating identical contests. We conclude that direct Elo comparisons are unreliable and potentially misleading without strict standardization and transparent reporting of experimental settings. Article Search Article: ase26ind-p20-p doi:10.1145/3832783.3834458 ASE '26: "DCAS: Decoupling CLI Agent ..." DCAS: Decoupling CLI Agent Scaffolding to Internalize Planning across Scaffolds Kishanthan Thangarajah, Boyuan Chen, and Ahmed E. Hassan (Huawei Canada, Canada; Queen's University, Canada) CLI-based software-engineering agents have matured rapidly, yet the open ecosystem has converged on a single training environment: trajectory datasets used to fine-tune open models are collected almost exclusively under OpenHands. Models fine-tuned on this data score well under OpenHands but degrade substantially when deployed under any non-training scaffold. Untrained base models do not show this divergence, indicating the gap is fine-tuning-induced and tied to the conventions of the training scaffold. We argue that a load-bearing scaffold-specific behavior is planning structure, in two senses this paper distinguishes: explicit planning, a pre-execution plan produced as a first-class artifact, and implicit planning, the structural conventions that shape execution throughout the agent loop. Under this hypothesis, closing the gap requires moving planning from a fixed scaffold artifact to a learned model capability. We introduce Decoupling CLI Agent Scaffolding (DCAS), a backend-substitution interception layer that routes API traffic between any CLI scaffold and any backend model without modifying the scaffold, enabling cross-scaffold evaluation and planning-aware trajectory collection. Using DCAS, a controlled plan-source intervention confirms planning quality is a high-leverage component, with gains exceeding the cross-scaffold drops we observe. A model fine-tuned on a small set of DCAS-collected planning-aware trajectories under a single scaffold gains consistently across non-training scaffolds, and the two senses of planning are empirically separable in training data. Article Search Article: ase26ind-p106-p doi:10.1145/3832783.3834485
	Hassan, Zyad	ASE '26: "Kani: A Model Checker for ..." Kani: A Model Checker for Rust Rémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech (Amazon Web Services, USA; Amazon Web Services, UK; Queen Mary University, UK; Brown University, USA; Datadog, USA; Massachusetts Institute of Technology, USA) Rust's ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust's Mid-level Intermediate Representation (MIR) into CBMC's bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign. Article Search Artifacts Available Article: ase26ind-p163-p doi:10.1145/3832783.3834499
	Haupt, Steve	ASE '26: "DepWareTrans: Dependency-Aware ..." DepWareTrans: Dependency-Aware Incremental Repository Migration across Co-executable Languages Sivajeet Chand, Alexander Pretschner, Steve Haupt, Derui Zhu, and Sushant Kumar Pandey (TU Munich, Germany; andrena objects, Munich, Germany; University of Groningen, Netherlands) Repository-level code translation is critical for modernizing legacy systems, yet existing approaches based on large language models (LLMs) operate at the file level and fail to scale to codebases with complex inter-file dependencies. This limitation is evident in our industrial setting, where we aim to migrate a production repository (STAR) from Java to Kotlin, but file-level approaches produce fragmented results and fail to achieve end-to-end correctness. In this paper, we show that the primary cause of failure at the repository level is dependency inconsistency. Through an empirical study on open-source and industrial systems, we find that most errors arise from unresolved cross-file dependencies that cannot be effectively addressed by iterative feedback alone. We propose a dependency-aware incremental migration framework that elevates the unit of translation from individual files to dependency-consistent batches. Our approach constructs a dependency graph, groups interdependent files, and performs batched translation with iterative compile- and test-driven validation. We evaluate our method on a 51K line of code (LOC) industrial system and multiple repositories across interoperable language pairs (Java–Kotlin, Java–Scala, and C#–F#). On the STAR repository, file-level approaches achieve 38.16% compilation and 9.39% test success, whereas our approach achieves 100% compilation and test success across the evaluated settings, converging within a small number of iterations. These results show that dependency-aware batching improves scalability and reliability in repository-level code translation. Article Search Article: ase26ind-p197-p doi:10.1145/3832783.3834505
	Hauswirth, Manfred	ASE '26: "Stop When It Matters: Detectability-Guided ..." Stop When It Matters: Detectability-Guided Microbenchmarking for Performance Regression Testing Zongxiong Chen, Derui Zhu, Jinfu Chen, Kundi Yao, Alexander Pretschner, Weiyi Shang, Manfred Hauswirth, and Sonja Schimmler (Fraunhofer FOKUS, Germany; TU Munich, Germany; Wuhan University, China; Ontario Tech University, Canada; fortiss, Germany; University of Waterloo, Canada) Performance microbenchmarks are widely used for detecting performance regressions in continuous integration, yet existing execution policies remain computationally expensive. We present detectability-guided microbenchmarking, a principled framework that reformulates benchmark execution as a Minimum-Detectable-Effect (MDE) problem, achieving substantial speedups with formal statistical guarantees. Our approach introduces a two-threshold specification: a lower threshold, δ0, for negligible slowdowns, and an upper threshold, δ1, for meaningful regressions. We theoretically and empirically show that this specification enables bounded false-positive rates below δ0 and guaranteed statistical power around δ1, while dramatically reducing execution time. To realize this framework, we propose a two-phase procedure: Phase 1 adaptively controls execution via online sample-size re-estimation guided by minimum detectable effect, enabling early stop when sufficient statistical resolution is reached and futile abort when target detectability is unattainable within the execution budget; Phase 2 performs regression analysis under the same specification, yielding decisions with provable error bounds. Experiments on 1702 microbenchmarks from three large-scale open-source projects demonstrate up to 93% reduction in execution time while empirical false-positive rates and power closely match their theoretical targets. Our findings reveal that detectability-guided execution offers a theoretically grounded yet practical path toward efficient microbenchmark-based regression detection. Article Search Artifacts Available Article: ase26main-p833-p doi:10.1145/3832783.3834367
	He, Bingyi	ASE '26: "Are Reasoning Traces Faithful ..." Are Reasoning Traces Faithful in LLM-Based Code Vulnerability Detection? Jialai Wang, Juncheng Lu, Songtao Yang, Bingyi He, Zeyu Gao, Chao Zhang, and Shuai Wang (National University of Singapore, Singapore; Tsinghua University, China; Zhongguancun Laboratory, China; Huazhong University of Science and Technology, China; Hong Kong University of Science and Technology, Hong Kong) Reasoning traces generated by large language models (LLMs) provide interpretability by exposing the factors that purportedly support their predictions. Such interpretability is important because model decisions may rely on spurious factors, and it can help practitioners identify such reliance and respond appropriately. However, the usefulness of reasoning traces hinges on their faithfulness, namely whether they reflect the factors that the model actually relies on when producing its prediction. Unfaithful traces may instead serve as plausible narratives that do not correspond to the true decision process. Despite its importance, reasoning-trace faithfulness has not been systematically studied in LLM-based vulnerability detection. We present VulFaith, the first framework for evaluating reasoning-trace faithfulness in this domain. We formalize two complementary criteria: completeness, which requires that all decision-relevant factors sustaining an insecure prediction are exposed, and per-factor faithfulness, which requires that each cited factor is genuinely relied upon by the model. To operationalize these criteria, we design an automated repair-based evaluation scheme that removes cited insecurity factors through code repairs and re-queries the model to test whether the prediction remains sustained. We implement VulFaith and conduct experiments on both repository-level and function-level vulnerability datasets, evaluating ten state-of-the-art open-source models and four commercial LLMs. Our results show that unfaithfulness is widespread, with completeness unfaithfulness reaching up to 66.14% and per-factor unfaithfulness up to 94.00%. We further validate that the unfaithfulness cases identified by VulFaith can support data augmentation for supervised fine-tuning, reducing completeness unfaithfulness by up to 47.89% and per-factor unfaithfulness by up to 59.18%. Article Search Article: ase26main-p776-p doi:10.1145/3832783.3834364
	He, Dengcheng	ASE '26: "FlowChecker: One Command to ..." FlowChecker: One Command to Model Check Control-Flow Rules in Industrial Java Qiuye Wang, Liqing Cao, Wei Hu, and Dengcheng He (Alibaba Cloud Computing, China) Industrial correctness rules often remain implicit, enforced only by review and team convention. Many such rules are temporal control-flow obligations: a cache-loading path must not pollute the cache, an error must not be raised before validity is decided, or a failure must remain visible across component boundaries. Existing formal verification and static analysis techniques can support related checks, but routine use remains hard when each team rule must be recast as custom traversal logic, harness-driven execution exploration, or a tool-specific protocol specification. We present FlowChecker, a developer-facing model-checking system for project-specific temporal control-flow rules. Engineers express rules as reviewable CTL formulas over familiar program events; FlowChecker extracts a finite control-flow model, preserves rule-relevant exception and framework-mediated paths, and checks the formula by evaluating CTL fixpoints in Soufflé, an optimized Datalog engine. This makes temporal control-flow checks repeatable locally and in CI, while keeping verdicts explicitly scoped to the extracted model. Across seven public Java projects, we evaluate 42 checks covering reachability, exception propagation, event ordering, and wrapping/capture, with formulas ranging from single temporal obligations to nested compositions. We additionally study synthetic models up to 10 million states and five sanitized internal adoption cases from Alibaba Cloud Computing. Article Search Article: ase26ind-p388-p doi:10.1145/3832783.3834530
	He, Fei	ASE '26: "Precise and Efficient Static ..." Precise and Efficient Static Data Race Detection Pei Wang, Zhihang Sun, and Fei He (Tsinghua University, China) Data races pose a serious threat to the correctness of concurrent programs. Traditional model-checking-based race detection techniques typically encode race detection as assertion verification, but this introduces substantial overhead due to numerous auxiliary variables and statements. In this paper, we present a precise modeling of data races based on event-level ordering constraints, which avoids any instrumentation while capturing the exact semantics and covering all potential race occurrences within the given bounded scope. We integrate it into a concurrent program verification framework and prove its correctness. Moreover, we enhance the existing theory solvers for ordering consistency theory with two new components, enabling effective reasoning about data races. Finally, we introduce an encoding optimization that leverages the novel concept of value-critical events to eliminate redundant value constraints. We implement our approach in a prototype tool, Deagle-DR, and compare it against state-of-the-art tools, including Dartagnan, Ugemcutter, Cseq-DR, LaDR, and Iekke. Experiments show that our approach is competitive with state-of-the-art methods. Article Search Artifacts Available Article: ase26main-p369-p doi:10.1145/3832783.3837438
	He, Guiyi	ASE '26: "LARA: Static ReDoS Detection ..." LARA: Static ReDoS Detection for Regular Expressions with Lookahead via Matching Automata Mengxi Wang, Chengyao Peng, Weihao Su, Guiyi He, Rongchen Li, Hong Huang, and Haiming Chen (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) with lookahead assertions are widely used in modern software, yet their interaction with backtracking engines can cause Regular expression Denial of Service (ReDoS) vulnerabilities. Existing static methods rely on 𝜀-NFA ambiguity analysis, which cannot capture lookahead evaluation cost, while dynamic and hybrid methods incur high cost or incomplete coverage. We present LARA, a static ReDoS detector for regular expressions with lookahead (REwLA), which subsumes standard regexes. Our core contribution is the matching NFA, which transforms a REwLA into a standard 𝜀-NFA. The matching NFA is not language-equivalent to the original REwLA; however, we prove that its match degree equals the la-match degree of the original REwLA, so the same complexity upper bound is preserved, including lookahead overhead. This reduces lookahead-aware ReDoS detection to standard 𝜀-NFA ambiguity analysis, enabling existing detection techniques to be applied directly to the matching NFA. We evaluate LARA on 42,794 deduplicated real-world REwLA. Among 5,889 vulnerabilities jointly confirmed by multiple tools and validated on real backtracking engines, LARA identifies 5,871, outperforming all baselines. On 400 confirmed vulnerable regexes from 177 real-world ReDoS CVEs, LARA achieves 99.50% recall. LARA successfully exploits 4,468 vulnerabilities on real engines, with a median analysis time of 0.05 s and 7.67 MB memory. Article Search Article: ase26main-p997-p doi:10.1145/3832783.3837475 ASE '26: "ReSEDA: Automatic and Precise ..." ReSEDA: Automatic and Precise Program-Level ReDoS Triage via Interprocedural Taint Analysis and Agentic Exploit Generation Rongchen Li, Weihao Su, Chengyao Peng, Hong Huang, Haiming Chen, and Guiyi He (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) are widely used in computer science, particularly in web services. However, Regular Expression Denial-of-Service (ReDoS) has become a growing security threat. ReDoS is an asymmetric Denial-of-Service attack that exploits the super-linear runtime behavior of regex engines. However, existing ReDoS detection tools only report whether regexes cause the super-linear matching behavior, instead of considering whether the behavior can be triggered in the program context. As a result, triaging such findings remains expensive for developers in practice. We present ReSEDA, an automatic and precise workflow that triages ReDoS alerts and generates executable proofs of concept (PoCs) for vulnerable JavaScript programs. The workflow employs (i) Interprocedural Finite Distributive Subset (IFDS) taint analysis, (ii) Satisfiability Modulo Theories (SMT) solving for supported path-feasibility and ReDoS constraints, and (iii) Large Language Model (LLM) agents for PoC construction with Model Context Protocol (MCP) tools that provide static evidence. From 86 most starred JavaScript projects in GitHub, we confirm that among 637 regexes reported to be vulnerable, there are only 63 regexes which can be exploited by injection through external interfaces, where ReSEDA is able to identify and generate PoCs for 61 of them automatically. We also discover that the assistance of ReSEDA reduces analyst-hours by 8.78× using $2.01 per vulnerability, or by 7.86× for free in a local-LLM setting. Furthermore, ReSEDA uncovered 27 impactful ReDoS vulnerabilities with assigned CVE IDs, including 8 disclosed fully automatically. Article Search Article: ase26main-p2923-p doi:10.1145/3832783.3837545
	He, Hao	ASE '26: "A Few Pages of Markdown: Committed ..." A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, and Sanmi Koyejo (Stanford University, USA; Carnegie Mellon University, USA; Grid Dynamics, USA) Coding agents increase development velocity but also technical debt. Prior work reports only average effects across adopters, hiding wide differences between teams. We introduce RAMP (Repository AI Maturity Profile), a four-level cumulative maturity model grounded in version-controlled artifacts that teams commit to configure AI tools. RAMP runs from behavioral rules and coding standards through named agent definitions to multi-agent orchestration, with observed practice concentrated in the first three levels. Across 441 repositories the levels behave as a cumulative scale, and independent human annotation reproduces RAMP’s repository-level labels on 97 Article Search Article: ase26main-p2970-p doi:10.1145/3832783.3837546
	He, Junda	ASE '26: "Beyond Text Matching: Towards ..." Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering Xiuwei Shang, Li Hu, Xiao Jiang, Jieke Shi, Junda He, Zhou Yang, Shaoyin Cheng, Guoqiang Chen, Weiming Zhang, and David Lo (University of Science and Technology of China, China; Singapore Management University, Singapore; University of Alberta, Canada) Human-Oriented Binary Reverse Engineering (HOBRE) aims to transform decompiled pseudocode into a more human-friendly representation, thereby reducing the cognitive burden of reverse analysis and improving efficiency. However, reliably evaluating HOBRE outputs remains a fundamental challenge. On one hand, human evaluation is costly, time-consuming, as well as difficult to scale. On the other hand, existing automated metrics either rely on executable test cases and runtime environments, which are often unavailable for real-world binaries, or depend on high-quality source code references that are typically inaccessible and fail to capture semantically equivalent but lexically diverse outputs. Although the emerging LLM-as-a-Judge paradigm is naturally well-suited to HOBRE evaluation, its effectiveness has not yet been fully studied. This paper presents the first systematic investigation of the LLM-as-a-Judge paradigm for HOBRE, covering three representative tasks: function name recovery, binary code summarization, and decompilation optimization. We introduce BinJudgeBench, the first expert-annotated, reference-free evaluation benchmark based on multi-dimensional human judgment. Our empirical study reveals that LLM-as-a-Judge achieves an average correlation of 63.20% with human judgment, significantly outperforming traditional automated metrics at 35.04%. By analyzing the impact of various judge configurations, including backbone LLMs, prompting strategies, and decoding temperatures, on both correlation and cost, we find that no “one-size-fits-all” configuration exists, as the optimal setup varies across tasks and individual samples. To address this, we propose BinJudge, which employs a lightweight routing mechanism to adaptively select the optimal judge configuration for each specific task and sample. BinJudge improves correlation with human experts by 4.5%–24.7% and reduces API cost to 0.06×–0.84× of that of static best configurations, providing a scalable, cost-effective, and high-fidelity automated evaluation scheme for HOBRE. Article Search Article: ase26main-p130-p doi:10.1145/3832783.3834339 ASE '26: "AgentChaos: Chaos Engineering ..." AgentChaos: Chaos Engineering for Agent Systems via Programmatic Fault Injection Gou Tan, Zhensu Sun, Jieke Shi, Ting Zhang, Zilong He, Qingfu Wu, Shuai Liang, Weifeng Sun, Junda He, Pengfei Chen, Chuanfu Zhang, Lwin Khin Shar, and David Lo (Sun Yat-sen University, Guangzhou, China; Singapore Management University, Singapore; Monash University, Australia; China Unicom Software Research Institute, Beijing, China) Agent systems rely on LLM APIs for every response, but these APIs can return server errors, truncated responses, or corrupted content that propagates through downstream agents and causes task failure. Evaluating robustness under these faults is crucial for reliable deployment. Existing fault injection methods are offline, require source code modification, or cannot modify specific response fields. A comprehensive evaluation also requires a systematic fault taxonomy because different fault types affect downstream agents differently. We propose AgentChaos, a chaos engineering framework for controlled, runtime, non-intrusive LLM API fault injection. Since all agent systems access LLMs through the same HTTP interface, we inject faults at this shared layer without modifying source code. We define crash, omission, and value faults on content and tool call fields, intercept and modify LLM API responses at runtime, and verify whether each fault is triggered to filter untriggered tasks and avoid underestimating fault impact. Evaluations across agent systems, benchmarks, and backbone LLMs under 65 fault configurations show that all systems degrade under fault injection, with pass@1 dropping by up to 50 percentage points. The ranking is consistent across models, suggesting that robustness depends on system implementation rather than model capability. Existing fault diagnosis methods achieve below 53% accuracy on fault type and below 56% on fault step, leaving room for improvement. We further reveal practical findings for agent system developers. Article Search Artifacts Available Article: ase26main-p355-p doi:10.1145/3832783.3837437
	He, Junjie	ASE '26: "MalSkills: Detecting Malicious ..." MalSkills: Detecting Malicious Skills in the Agentic Supply Chain via Neuro-symbolic Reasoning Shenao Wang, Junjie He, Yanjie Zhao, Yayi Wang, Kan Yu, and Haoyu Wang (Huazhong University of Science and Technology, China; Ant Group, China) Skills are increasingly used to extend LLM agents by packaging prompts, code, and configurations into reusable modules. As public registries and marketplaces expand, they form an emerging agentic supply chain, but also introduce a new attack surface for malicious skills. Detecting malicious skills is challenging because relevant evidence is often distributed across heterogeneous artifacts and must be reasoned in context. Existing static, LLM-based, and dynamic approaches each capture only part of this problem, making them insufficient for robust real-world detection. In this paper, we present MalSkills, a neuro-symbolic framework for malicious skills detection. MalSkills first extracts security-sensitive operations from heterogeneous artifacts through a combination of symbolic parsing and LLM-assisted semantic analysis. It then constructs the skill dependency graph that links artifacts, operations, operands, and value flows across the skill. On top of this graph, MalSkills performs neuro-symbolic reasoning to infer malicious patterns or previously unseen suspicious workflows. We evaluate MalSkills on a benchmark of 200 real-world skills against 5 state-of-the-art baselines. MalSkills achieves 93% F1, outperforming the baselines by 5-87 percentage points. We further apply MalSkills to analyze 150,108 skills collected from 7 public registries, flagging 620 potentially malicious skills. Through manual review, we confirm that 400 of them are indeed malicious, all of which were responsibly reported and are currently awaiting confirmation from the platforms and maintainers. These results demonstrate the practical potential of MalSkills in securing the agentic supply chain. Article Search Article: ase26main-p951-p doi:10.1145/3832783.3834375
	He, Kun	ASE '26: "Breaking the Isolation: Coordinated ..." Breaking the Isolation: Coordinated Multi-agent Fuzzing for Smart Contracts with Multi-dimensional Objective Learning Ruichao Liang, Ruochen Cao, Jing Chen, Kun He, Yebo Feng, Yue Xue, and Cong Wu (Wuhan University, China; Nanyang Technological University, Singapore; MetaTrust Labs, Singapore) Smart contracts manage critical assets in decentralized systems but are prone to vulnerabilities. While fuzzing has proven effective in software testing, existing contract fuzzers often rely on ad-hoc optimization strategies with limited objective guidance, typically driven by coverage or simple heuristics. This narrow focus leads to high false negative rates, as important perspectives of smart contracts, like semantic, state, and economic effects, are overlooked during transaction sequence generation. Moreover, coordinating these dimensions into fuzzing is challenging because their divergent objectives and complex interactions make ad-hoc adaptations to fitness functions or mutation strategies largely ineffective. To fill the gaps, we propose SynerFuzz, a multi-agent deep reinforcement learning-based fuzzer. We formulate fuzzing as a Decentralized Partially Observable Markov Decision Process, where each agent is assigned a distinct testing objective extracted from the target contract. Through coordinated learning, DRL agents integrate multi-dimensional signals to construct high-quality sequences, enabling SynerFuzz to uncover both subtle semantic flaws and economically profitable behaviors. Compared to 9 SOTA tools, SynerFuzz detects up to 4.2× more vulnerabilities while reducing time and transaction overhead by 70.6% and 86.8%. In real-world scenarios, SynerFuzz reproduces 33 historical DeFi exploits with over $40 million losses and discovers 17 0-day vulnerabilities in 4 projects managing over $179.8 million, earning $3,800 bug bounties. Article Search Article: ase26main-p791-p doi:10.1145/3832783.3837466
	He, Mengda	ASE '26: "Understanding Real-World Ordering-Related ..." Understanding Real-World Ordering-Related Concurrency Bugs under Weak-Memory and Cross-Architecture Settings Shaohao Wang, Cheng Wen, Yuandao Cai, Shengchao Qin, Jie Su, Mengda He, Xiaoxue Ma, and Cong Tian (Xidian University, China; Hong Kong University of Science and Technology, China; Fermat Labs, China) Modern systems software is increasingly deployed across heterogeneous architectures such as x86, ARM, and RISC‑V, which provide substantially different memory-ordering guarantees. Under weak memory models, hardware and compilers may reorder memory operations or delay their visibility, causing concurrent code that appears correct on x86 to fail in subtle and security-critical ways. In real systems, however, such failures are not limited to instruction-level reorderings: cross-architecture execution can also expose higher-level ordering assumptions about object lifecycle and protocol state. To study this gap, we curate a dataset of 58 manually confirmed real-world concurrency bugs from the Linux Kernel and open-source projects (e.g., MySQL, MariaDB, DPDK, and sofa-pbrpc). We propose Multi-Granularity Ordering (MGO), a taxonomy that organizes these bugs into three layers: micro-instruction, resource lifecycle, and semantic-logic ordering violations. Our analysis shows that micro‑instruction bugs form the largest category in the dataset (32/58, 55.2%) and typically manifest as stale reads or missed signals, whereas resource lifecycle bugs (24/58, 41.4%) are frequently associated with severe memory-safety failures such as use‑after‑free. We further show that these layers differ in architectural exposure and repair strategies: micro-instruction bugs directly capture weak-memory anomalies, while lifecycle and semantic bugs reflect macro-level failures whose manifestation can be amplified in cross-architecture execution. Finally, we identify common mismatches between root causes and repair strategies, and summarize practical implications for future concurrency analysis tools for cross-architecture safety and reliability. Article Search Article: ase26ind-p129-p doi:10.1145/3832783.3834494
	He, Minghua	ASE '26: "Bifrost: Empowering Pretrained ..." Bifrost: Empowering Pretrained Language Model with Fallibility Representation for Log-Based Fault Diagnosis Minghua He, Tong Jia, Lingzhe Zhang, Chiming Duan, Xinlong Zhao, Leyi Pan, Cheng Wang, Kangjin Wang, Yinghao Yu, Liping Zhang, Yifan Wu, and Ying Li (Peking University, China; Tsinghua University, China; Alibaba Group, China) Log-based fault diagnosis is crucial for runtime debugging and maintenance. Existing fault diagnosis methods use language models pre-trained on natural language (PLMs) for log representation. However, system faults are reflected in the multi-level structure of system logs. PLMs pre-trained on natural language struggle to comprehensively capture multi-level fault information, failing to meet the requirements of fault diagnosis. We refer to this information as fallibility representations. To address this problem, we propose a novel log representation learning method, Bifrost. It draws inspiration from the log analysis experience of Site Reliability Engineers and meticulously designs strategies based on self-supervised contrastive learning to learn the fallibility representations of logs. Across three public systems and one industrial ML-as-a-Service system, the log representations produced by Bifrost outperform existing PLMs by average margins of 9.83% in F1 for anomaly detection, 18.28% in HR@k for root cause localization, and 20.88% in Macro-F1 for fault identification. Article Search Article: ase26main-p3295-p doi:10.1145/3832783.3834433
	He, Ningyu	ASE '26: "Airdrop Scams in Practice: ..." Airdrop Scams in Practice: An Industry-Oriented Taxonomy, Benchmark, and Tool Audit Ningyu He, Xiaohui Hu, and Haoyu Wang (Hong Kong Polytechnic University, Hong Kong; Huazhong University of Science and Technology, China) Decentralized finance (DeFi) scams related to airdrops have become a practical security problem for wallet providers, exchanges, and Web3 security teams. Evidence of these scams spans promotional posts, websites, wallet prompts, transactions, token contracts, and incident reports, which makes them difficult to organize systematically and evaluate with automated defenses. In this paper, we review 43 academic sources and 31 industry/grey sources and propose a three-layer framework to characterize the airdrop process. Based on our systematic review, we construct a hierarchical taxonomy of 34 distinct airdrop scam types, including six newly identified categories. We also identify nine academic datasets and seven reliable industry data resources, normalize an integrated corpus with 7,518 malicious addresses, 479,205 website links, and 18,432 real-world scam incidents, and derive a benchmark of 116 airdrop scam cases for automated tool evaluation. We then conduct a behavioral audit of the 12 academic and industry tools identified as accessible by January 2025. Our results show that 16 of 17 academic tools could not be executed through their documented workflows. Among the accessible industry tools, the audit revealed gaps between documented capabilities and observed behavior. The evaluated tools performed better on supported contract and transaction artifacts than on supported promotion- and interaction-layer inputs. These findings lead to practical lessons for preserving workflow evidence, maintaining source provenance during dataset integration, and auditing tools as executable systems rather than feature lists. Article Search Article: ase26ind-p54-p doi:10.1145/3832783.3834465 ASE '26: "SPSYN: Synthesizing DeFi Price-Manipulation ..." SPSYN: Synthesizing DeFi Price-Manipulation Exploits via Semantic Recovery and State-Guided Search Bosi Zhang, Ningyu He, Guangdong Bai, and Haoyu Wang (Huazhong University of Science and Technology, China; Hong Kong Polytechnic University, Hong Kong; City University of Hong Kong, Hong Kong) Price manipulation is one of the most damaging vulnerability classes in decentralized finance (DeFi) protocols. Existing approaches mainly stop at warning generation or rely on rigid attack templates, and therefore struggle to determine whether a victim protocol is profitably exploitable under a concrete chain state. This problem is challenging because the attack-relevant victim-side steps are highly protocol-specific, while successful exploitation further depends on brittle runtime conditions such as reserve states, token-specific guards, and narrow numeric ratios. In this paper, we present SPSYN, a DeFi price-manipulation exploit synthesizer that combines semantic recovery with state-guided search. SPSYN first extracts structured cross-contract contexts and uses an LLM to recover attack-relevant victim-side function roles. It then organizes the recovered functions into stage-consistent candidates and scenario-guided initial seeds. Finally, it synthesizes exploit witnesses on a concrete chain snapshot through state-guided search under a semantic-aware state machine. Runtime observations reveal whether the transformed sequence has established a meaningful anomaly, whether it should continue to be expanded, and how later mutations should be refined. In this design, semantic recovery narrows the search to the right victim-side actions, while exploitability is validated through actual execution on the target snapshot. On 29 historical incidents, SPSYN synthesizes profitable exploit witnesses for 27 cases (93.1%), outperforming ItyFuzz (11/29), CPMMX (19/29), and FlashSyn (7/29), with a median time-to-first witness of 114 seconds on successful cases. During on-chain deployment across Ethereum and Binance Smart Chain, SPSYN further discovers 9 previously unreported profitable vulnerabilities with a cumulative potential profit of $35.1K. Article Search Article: ase26main-p2062-p doi:10.1145/3832783.3837520
	He, Pinjia	ASE '26: "OrthCoder: Balancing Security ..." OrthCoder: Balancing Security and Utility in Secure Code Generation via Orthogonal Adaptation Menghan Tian, Youliang Yuan, Zhiqing Zhong, and Pinjia He (Chinese University of Hong Kong, Shenzhen, China) Large Language Models (LLMs) have significantly advanced automated code generation, yet they frequently produce code with critical security vulnerabilities. While recent alignment techniques (e.g., supervised fine-tuning and preference optimization) have attempted to mitigate this, existing methods often suffer from the notorious safety tax—a severe degradation in general functional utility, particularly on complex programming tasks. This trade-off can arise from parameter interference, where security-driven updates interact with the model’s pre-trained functional representations. Alternative approaches that avoid modifying model parameters (e.g., inference-time methods) can alleviate this issue but often introduce additional inference overhead or instability. In this work, we focus on snippet-level secure code generation, where a model generates a self-contained function or short code routine from a natural-language prompt. Within this setting, we propose OrthCoder, a novel secure code generation framework based on subspace decoupling. OrthCoder employs a Dual-LoRA architecture, dedicating separate adapters to functional utility and security alignment. By introducing a geometric orthogonality constraint (Lorth) during joint training, we encourage the utility and security adapters to learn less-overlapping parameter updates. Extensive evaluations across four diverse foundational models (∼7B scale) on seven benchmarks covering snippet-level security and general code-generation utility demonstrate that OrthCoder achieves state-of-the-art performance on joint security-utility benchmarks such as CodeGuard+ and CWEval. More importantly, OrthCoder mitigates the severe safety tax observed in existing alignment baselines. Furthermore, analyses of the learned adapter parameters show substantially reduced overlap between utility and security updates, supporting the effectiveness of the proposed decoupling mechanism. Article Search Artifacts Available Article: ase26main-p1510-p doi:10.1145/3832783.3837499 ASE '26: "PAIChecker: Uncovering and ..." PAIChecker: Uncovering and Checking PR-Issue Misalignment in SWE-Bench-Like Benchmarks Manyi Wang, Junjielong Xu, and Pinjia He (Chinese University of Hong Kong, Shenzhen, China) SWE-bench-like benchmarks are widely used for evaluating LLM's issue resolution capability. They typically follow a common construction pipeline: each PR (Pull Request) is paired with its linked issue by extracting issue references from the PR description; the issue description is used as the problem statement, and the PR patch serves as the test oracle. However, due to the inherent complexity of developing and maintaining large repositories, such PR-Issue pairings are often misaligned in practice. In this work, we systematically study SWE-bench Verified instances, finding that 13.6% exhibit misalignment across five patterns in eleven fine-grained scenarios. To enable reliable and scalable construction of those benchmarks in the future, we propose PAIChecker, a multi-agent system for checking PR-Issue misalignment in SWE-bench-like benchmarks. Specifically, PAIChecker adopts a three-phase design that combines specific pattern identification, cross-agent label synthesis, and code-level validation, thereby enabling more accurate, generalizable, and progressively verified detection. Experiments on SWE-Gym and SWE-bench Multilingual show that PAIchecker achieves the best performance across all four LLM backbones, reaching up to 92.12% and 91.67% binary accuracy, respectively. Article Search Article: ase26main-p3982-p doi:10.1145/3832783.3837557
	He, Ruirui	ASE '26: "From Vibe to Spec: An Empirical ..." From Vibe to Spec: An Empirical Study to Demystify Specifications in Code Generation Ruirui He, Hanqing Lu, Lezhi Ma, Kai Ye, Qiong Wu, Shangqing Liu, Lei Bu, and Xuandong Li (Nanjing University, China) Recent advances in large language models (LLMs) for code generation have given rise to vibe coding, a programming practice in which developers interact with LLMs through unstructured natural language and primarily validate implementations by inspecting overall execution outputs. However, the inherent ambiguity and inconsistency of natural language present substantial challenges for generating complex and large-scale software systems. To mitigate these limitations, an emerging AI programming paradigm—specification-driven development—advocates providing LLMs with precise and consistent specifications to guide code generation. Despite its promise, fundamental questions regarding the appropriate forms of specifications and the granularity at which they should be supplied to LLMs remain largely unexplored. To address this gap, we present the first empirical study that systematically investigates the impact of two orthogonal dimensions of specifications—form and granularity—on the effectiveness of LLM-based code generation. We construct a dataset comprising five medium-sized software projects, ranging from several hundred to over one thousand lines of code, implemented in multiple programming languages and spanning diverse application domains (e.g., system utilities and games). For each project, we design specifications in three forms—natural language, coarse-grained pseudocode, and fine-grained pseudocode—to capture the form dimension. To examine granularity, we further decompose the fine-grained pseudocode into four levels of input granularity: line-level, function-level, module-level, and project-level. Using this dataset, we evaluate code generated by three representative models, GPT-5, DeepSeek-V3.1, and Qwen-3.7. Evaluation is conducted using a comprehensive set of metrics, including text-similarity-based metrics (e.g., BLEU-4 and CodeBLEU), test-based metrics (e.g., accuracy), and human-centered metrics (e.g., usability and logical consistency). Our results demonstrate that using fine-grained, structured pseudocode specifications significantly enhances generation stability and quality. Regarding granularity, while coarser-grained specifications (project and module level) generally achieve higher code quality, organizing specifications at the module level provides the best overall balance between quality, stability, and token efficiency. Moreover, additional analyses indicate that this module-level granularity yields the most user-friendly outcome for human developers. Article Search Article: ase26main-p1876-p doi:10.1145/3832783.3837515
	He, Runzhi	ASE '26: "To Ban or Not to Ban? How ..." To Ban or Not to Ban? How Open Source Projects Govern GenAI Contributions Wenhao Yang, Runzhi He, and Minghui Zhou (Peking University, China) Generative AI (GenAI) is playing an increasingly important role in open source software (OSS). Beyond completing code and documentation, GenAI is increasingly involved in issues, pull requests, code reviews, and security reports. Yet, cheaper generation does not mean cheaper review — and the resulting maintenance burden has pushed OSS projects to experiment with GenAI-specific rules in contribution guidelines, security policies, and repository instructions, even including a total ban on AI-assisted contributions. However, governing GenAI in OSS is far more than a ban-or-not question. The responses remain scattered, with neither a shared governance framework in practice nor a systematic understanding in research. Therefore, in this paper, we conduct a multi-stage analysis on various qualitative materials related to GenAI governance retrieved from 67 highly visible OSS projects. Our analysis identifies recurring concerns across contribution workflows, derives three governance orientations, and maps out 12 governance strategies and their policy instruments. We show that governing GenAI in OSS extends well beyond banning — it requires coordinated responses across accountability, verification, review capacity, code provenance, and platform infrastructure. Overall, our work distills dispersed community practices into a structured overview, providing a conceptual baseline for researchers and a practical reference for maintainers and platform designers. Article Search Artifacts Available Article: ase26main-p575-p doi:10.1145/3832783.3837448
	He, Xiaoyu	ASE '26: "Panorama: Unveiling Latent ..." Panorama: Unveiling Latent Dependencies for Microservice Autoscaling via Meta-learning Zhuangbin Chen, Hongjiang Feng, Yang Liu, Juzheng Zheng, Xiaoyu He, and Zibin Zheng (Sun Yat-sen University, China) Existing autoscaling approaches primarily leverage direct service calls to model the propagation effects of scaling decisions across inter-service dependencies. However, the intricate and implicit service interactions (i.e., latent dependencies) often go beyond such direct invocations, rendering suboptimal scaling actions and poor adaptability. To address these limitations, we propose Panorama, a novel autoscaling framework that explicitly unveils and exploits indirect service interactions. In particular, we formalize two fundamental categories of latent dependencies, i.e., resource interference dependencies (RIDs), which emerge from shared infrastructure resources, and execution blocking dependencies (EBDs), which stem from temporal constraints in the execution logic of business workflows. Panorama employs a hybrid attention mechanism to model these multifaceted service dependencies alongside temporal dynamics. We also design a meta-learning paradigm to enable rapid adaptation to evolving workload patterns and dependency structures without extensive retraining. Evaluation across four representative microservice benchmarks shows that Panorama consistently outperforms state-of-the-art baselines, achieving up to 68% reduction in resource consumption while improving response time by 42%. This highlights the critical importance of explicitly modeling latent dependencies for effective microservice resource management. Article Search Article: ase26main-p1217-p doi:10.1145/3832783.3837485
	He, Xincheng	ASE '26: "HyBinMAS: LLM-Powered Hybrid ..." HyBinMAS: LLM-Powered Hybrid Analysis for Function Name Recovery of Stripped Binaries Chenxi Wang, Lei Xu, Xincheng He, Gaozhan Yu, and Ye Wang (Nanjing University, Nanjing, China; Jiangnan University, China; Southeast University, China) Binary function name recovery is vital for understanding stripped binaries, yet existing learning-based methods face significant hurdles. Current approaches often struggle to capture inter-procedural context and complex control flows, leading to semantic ambiguity. Furthermore, their reliance on static analysis and fixed training distributions severely limits their generalization across heterogeneous architectures and unseen binaries. In this paper, we propose a novel approach HyBinMAS that reformulates binary function name recovery as an evidence-driven semantic-state update process with LLM-Powered hybrid analysis. For each target function, HyBinMAS maintains a semantic state ⟨ name, summary ⟩ and iteratively refines it using static evidence, inter-procedural semantic propagation, and dynamic evidence. Specifically, it introduces an Attributed Call Graph (ACG) as a stateful semantic memory and incorporates runtime feedback to validate and correct semantic hypotheses. It further employs a collaborative multi-agent workflow, consisting of SemanticRestorer, TestGenerator, and ExecutionValidator to realize the state updates through semantic hypothesis generation, executable validation, and behavioral feedback interpretation. To address the lack of ARM-64 datasets, we construct an ARM-64 Benchmark comprising over 8,000 binary functions. Extensive experiments across five architectures demonstrate that HyBinMAS consistently outperforms existing approaches, achieving an average F1 score of 0.343 and improving the F1 score by 39.43% over the strongest baseline. Moreover, on a controlled subset, incorporating execution-grounded evidence yields an 18.14% F1 improvement over static-only analysis, demonstrating the complementary value of dynamic feedback for semantic-state update. Article Search Article: ase26main-p2478-p doi:10.1145/3832783.3837532
	He, Yibo	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477
	He, Yudi	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	He, Zilong	ASE '26: "AgentChaos: Chaos Engineering ..." AgentChaos: Chaos Engineering for Agent Systems via Programmatic Fault Injection Gou Tan, Zhensu Sun, Jieke Shi, Ting Zhang, Zilong He, Qingfu Wu, Shuai Liang, Weifeng Sun, Junda He, Pengfei Chen, Chuanfu Zhang, Lwin Khin Shar, and David Lo (Sun Yat-sen University, Guangzhou, China; Singapore Management University, Singapore; Monash University, Australia; China Unicom Software Research Institute, Beijing, China) Agent systems rely on LLM APIs for every response, but these APIs can return server errors, truncated responses, or corrupted content that propagates through downstream agents and causes task failure. Evaluating robustness under these faults is crucial for reliable deployment. Existing fault injection methods are offline, require source code modification, or cannot modify specific response fields. A comprehensive evaluation also requires a systematic fault taxonomy because different fault types affect downstream agents differently. We propose AgentChaos, a chaos engineering framework for controlled, runtime, non-intrusive LLM API fault injection. Since all agent systems access LLMs through the same HTTP interface, we inject faults at this shared layer without modifying source code. We define crash, omission, and value faults on content and tool call fields, intercept and modify LLM API responses at runtime, and verify whether each fault is triggered to filter untriggered tasks and avoid underestimating fault impact. Evaluations across agent systems, benchmarks, and backbone LLMs under 65 fault configurations show that all systems degrade under fault injection, with pass@1 dropping by up to 50 percentage points. The ranking is consistent across models, suggesting that robustness depends on system implementation rather than model capability. Existing fault diagnosis methods achieve below 53% accuracy on fault type and below 56% on fault step, leaving room for improvement. We further reveal practical findings for agent system developers. Article Search Artifacts Available Article: ase26main-p355-p doi:10.1145/3832783.3837437
	He, Ziran	ASE '26: "Large Language Model Enabled ..." Large Language Model Enabled Symbolic Execution for Automated Functional Analysis Meixi Liu, Zhenbang Chen, Xudong Wang, Ziran He, Jiachen Gu, Minghui Chen, Lei Wang, and Wei Dong (National University of Defense Technology, China) Symbolic execution shows promise in automated program analysis by systematically exploring the path space of the program. However, due to the inherent limitations of program analysis techniques, symbolic execution cannot understand the program’s functionality, which hinders its application in functional analysis and defect detection. This paper introduces FuSE, a method that enhances symbolic execution with Large Language Models (LLMs) to automatically annotate program paths with functional specifications. A program path is annotated with a natural language description of its functionality, a precondition, and a postcondition. Our method significantly reduces the effort required for functional testing and defect detection. Based on UnitTestBot, FuSE can successfully annotate functional specifications for C, C++, Java, and Python programs, with success rates of 98.2%, 95.52%, 87%, and 95.37%, respectively. In our user study with professional developers and testers, FuSE helps users identify 21.67% more functional defects and improves functional coverage by 15.83%, demonstrating its practical utility. Article Search Artifacts Available Article: ase26main-p2155-p doi:10.1145/3832783.3837524
	Hempel, Kristoffer	ASE '26: "A Comprehensive Evaluation ..." A Comprehensive Evaluation of Code Language Models for Security Patch Detection Nils Loose, Joseph Bienhüls, Kristoffer Hempel, Felix Mächtle, and Thomas Eisenbarth (University of Lübeck, Germany) Automated detection of vulnerability-fixing commits (VFCs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and many fixes never receive advisories. Code language models are increasingly adopted for identifying , yet whether they can recognize a security fix from the code change itself remains unclear, as reported performance is shaped by commit messages, project-level data leakage, and uncertain data quality. We present a rigorous re-evaluation that jointly controls these factors through a unified framework consolidating 20 fragmented datasets spanning more than 180000 commits. Training 270 models from 125M to 80B parameters, we isolate the code signal under group-stratified code-only evaluation and assess the impact of model capacity and additional code context, ranging from intra-procedural enrichment to inter-procedural repository context. Model capacity yields clear but insufficient gains, and the evaluated context signals provide no reliable improvement under strict false positive budgets. At a false positive rate of 0.5 Article Search Article: ase26main-p2677-p doi:10.1145/3832783.3837538
	Hermann, Kevin	ASE '26: "Agent-HAnS: Maintaining Feature ..." Agent-HAnS: Maintaining Feature and Code Traceability in Agentic Development Johan Martinson, Jacob Bengtsson, Moltas Hultin, Kevin Hermann, and Thorsten Berger (Ruhr University Bochum, Germany; University of Gothenburg and Chalmers University of Technology, Sweden) Agentic coding tools using LLMs enable developers to quickly generate software. However, developers quickly lose the overview over their increasingly complex codebases. During code generation, no knowledge about what features exist or where they are implemented is documented. We present Agent-HAnS, an agentic workflow which instructs the LLM to update a feature model and generate embedded feature annotations after each code-generation step. It visualizes the evolving structure on a live dashboard served via a Model Context Protocol server. We demonstrate Agent-HAnS on a C#/.NET 9 web API evolved through 27 prompts across 10 evolution steps, with most annotations maintained automatically and no active annotation effort from the developer. In a manual audit, 92% of fragment annotations and 70% of file mappings remain correct, with errors concentrating at feature merges and splits. In a user study, Agent-HAnS scored 73.9 on the System Usability Scale. Tool video: https://youtu.be/Nb-eDrGokI8 Article Search Article: ase26tool-p225-p doi:10.1145/3832783.3834652
	Hey, Tobias	ASE '26: "Can Formal Specifications ..." Can Formal Specifications Be Synthesized from Tests Alone? Tianhai Liu, Maximilian Müller, Tobias Hey, Vitus Lüntzel, Muhammad Minhas, Anne Koziolek, and Bernhard Beckert (KIT, Germany) Formal specifications offer strong guarantees, but remain costly to write manually. Recent LLM-based approaches automate this by inferring specifications from source code, yet their reliance on white-box access poses barriers to industrial adoption due to intellectual property risks and deployment costs. Our approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden. Candidate specifications are validated locally using bounded model checking, with feedback guiding iterative refinement. Initial results on the SpecGenBench benchmark suggest that tests can guide LLMs towards meaningful Java Modeling Language specifications, while also highlighting checker compatibility and diagnostic feedback as key challenges for reliable refinement. Article Search Artifacts Available Article: ase26nier-p62-p doi:10.1145/3832783.3834549 ASE '26: "The EVerest Dataset for Secure ..." The EVerest Dataset for Secure Software Engineering Sophie Corallo, Debora Grupp, Dominik Fuchß, Jan Keim, Frederik Reiche, Tobias Hey, and Anne Koziolek (KIT, Germany) End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available [4]. A short video is available at https://youtu.be/pnn1uqpomvQ. Article Search Artifacts Available Article: ase26tool-p56-p doi:10.1145/3832783.3834614 ASE '26: "The ARDoCo Tool Landscape: ..." The ARDoCo Tool Landscape: REST API, TraceView, and TraceViz for Architecture Traceability Jan Keim, Dominik Fuchß, Sophie Corallo, Tobias Hey, Julian Winter, and Kevin Feichtinger (KIT, Germany) Context and Problem. Software development produces interrelated artifacts like software architecture documentation (SAD), software architecture models (SAMs), and source code, whose relationships are essential for maintenance and consistency checking. However, automatically recovering links between these artifacts (traceability link recovery (TLR)) remains difficult to deploy in practice. Method and Aim. We present an accessible tool landscape for ARDoCo’s TLR approaches: the ARDoCo REST API exposes four TLR pipelines (SAD-SAM, SAM-Code, SAD-Code, and SAD-SAM-Code) via HTTP endpoints with asynchronous execution and caching; TraceView is a browser-based frontend with a guided wizard and interactive multi-panel exploration of recovered links and inconsistencies; and TraceViz, which is a VS Code extension that overlays trace links directly onto documentation in the IDE. Results and Conclusion. All three components are publicly deployed and usable. A preliminary study for TraceViz’s in-IDE visualization confirmed that it improves developer comprehension during software understanding tasks. The tool landscape makes state-of-the-art TLR accessible to architects, developers, and tool integrators. Video. We provide a screencast of our ARDoCo Tool Landscape and how it is used here: https://youtu.be/IOTEPZQ3tVs Article Search Artifacts Available Article: ase26tool-p73-p doi:10.1145/3832783.3834621
	Hilton, Michael	ASE '26: "FlakeFighters: A Pytest Plugin ..." FlakeFighters: A Pytest Plugin to Detect Flaky Test Failures Michael Foster, Owain Parry, Michael Hilton, Gregory M. Kapfhammer, and Phil McMinn (University of Sheffield, UK; University of Edinburgh, UK; Carnegie Mellon University, USA; Allegheny College, USA) Flaky tests — tests which non-deterministically pass and fail against the same version of code — pose a well-established painful issue for developers due to the unpredictability of failures. The current state of practice to detect and work around flaky tests is to simply rerun them. However, this can erode confidence in failing test outcomes and represents a significant waste of time and compute resources. A better solution is to detect flaky tests based on static data (collectable without running any tests) and/or execution data (collected by running the test suite) to determine if a test failure has occurred due to flaky behaviour or a genuine bug. Several such techniques have appeared in recent literature, but these exist in isolation as prototype research tools, and typically only support Java codebases. This paper presents FlakeFighters, an extensible pytest extension that implements a "Swiss army knife" of flaky test classification tools to help developers classify the underlying cause of failing tests as genuine bugs or flakiness in Python codebases. We ran pytest with the FlakeFighters extension on 23 failing workflows from the home-assistant/core repository and found that it was able to identify all of the failing flaky tests. A video demonstration of FlakeFighters can be found at https://youtu.be/3J4odtgzQX0. Article Search Artifacts Available Article: ase26tool-p127-p doi:10.1145/3832783.3834641
	Hirzel, Martin	ASE '26: "From Plan to Action: How Well ..." From Plan to Action: How Well Do Agents Follow the Plan? Shuyang Liu, Saman Dehghan, Jatin Ganhotra, Martin Hirzel, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; IBM, USA) Agents are commonly instructed to follow a task-specific plan for guidance.However, it is unknown to what extent agents actually follow instructed plans. Without such an analysis---determining the extent agents comply with a given plan---it is impossible to assess whether a solution was reached through correct strategic reasoning or through other means, e.g., data contamination or overfitting to a benchmark. This paper presents the first extensive, systematic analysis of plan compliance in programming agents, examining 21,120 trajectories from SWE-agent across four LLMs on SWE-bench Verified and SWE-bench Pro under eight plan variations. Without an explicit plan, agents fall back on internalized workflows during training, which are often incomplete, overfit, or inconsistently applied. Providing the standard plan improves issue resolution, and we observe that periodic plan reminders can mitigate plan violations and improve task success. A subpar plan hurts performance even more than no plan at all. Surprisingly, inserting additional task-relevant phases in the early stage can degrade performance, particularly when these phases do not align with the model’s internal problem-solving strategy. These findings call for fine-tuning paradigms that teach models to follow instructed plans, rather than encoding task-specific plans in them, so that they reason and act adaptively, rather than memorizing workflows. Article Search Article: ase26main-p1675-p doi:10.1145/3832783.3834400
	Ho, Tommy	ASE '26: "CppPerf: An Automated Pipeline ..." CppPerf: An Automated Pipeline and Dataset for Performance-Improving C++ Commits Tommy Ho, Khashayar Etemadi, and Zhendong Su (ETH Zurich, Switzerland) Recent progress in automated repair of performance bugs demands realistic, executable benchmarks. However, existing C++ performance benchmarks are largely built from competitive programming submissions, and recent real-world benchmarks predominantly target Python and .NET. To fill this gap, we present CppPerf-Mine, a configurable pipeline that mines execution-time-improving patches from open-source C++ repositories on GitHub by combining structural commit filtering, an LLM-based commit classifier, and a containerized build & test stage that produces fully reproducible Docker images for each patch. Using CppPerf-Mine, we build CppPerf-DB, a benchmark comprising 347 manually verified patches from 42 mature C++ repositories, 39% of which are multi-file, enabling the evaluation of repository-level repair tools. In our preliminary study, OpenHands correctly fixes only 13.5% of the patches in CppPerf-DB, confirming that real-world C++ performance repair remains an open challenge. CppPerf-Mine and CppPerf-DB are open-source and publicly available at: https://doi.org/10.5281/zenodo.20097425. In addition, a demonstration video is available at: https://www.youtube.com/watch?v=nixlupIgSdM. Article Search Article: ase26tool-p37-p doi:10.1145/3832783.3834606
	Hofmann, Benedikt	ASE '26: "Closing the Gap: Automated ..." Closing the Gap: Automated Discovery of Secure Dockerfile Reference Standards via Semantic Clustering in Enterprise Inner Source Jessica Hösl, Benedikt Hofmann, and Patrick Stöckle (TU Munich, Germany; Siemens, Germany) Containerization dominates enterprise software delivery, yet Dockerfiles that assemble container images frequently harbor security misconfigurations and structural technical debt. This problem is poorly understood in corporate inner-source environments, where proprietary context and isolated governance prevent direct application of open-source findings. We present an automated, six-stage pipeline that: (1) crawls an enterprise GitLab instance, (2) enriches each Dockerfile with static security and quality metrics (Hadolint, ShellCheck, Trivy) and lifecycle data, (3) groups functionally identical workloads using LLM-generated semantic descriptions and HDBSCAN, and (4) quantifies the optimization gap against cluster-internal reference implementations. Applied to 11,470 Dockerfiles from over 6,200 repositories at a single large industrial company, we find a systemic deficit: 99% of files contain at least one security misconfiguration, 80.8% violate Dockerfile best practices, and the median artifact has not been revised for 838 days. Despite this, high-quality reference implementations already exist within 83% of functional clusters. Adopting these internal standards would increase the average security posture score by 60.4% without developing any new templates. These findings, grounded in one organization’s inner-source ecosystem, provide a data-driven foundation for future automated, context-aware recommender systems targeting enterprise supply-chain security; whether the observed technical-debt distribution and optimization gap generalize to other enterprises remains an open question for future multi-organization study. Article Search Article: ase26ind-p179-p doi:10.1145/3832783.3834500
	Hong, Feng	ASE '26: "PELSE: Asymmetric-Evidence-Guided ..." PELSE: Asymmetric-Evidence-Guided MCU Peripheral Model Synthesis Guohao Wu, Chunlin Wang, Rui Yao, Feng Hong, Hongliang Liang, and Qiuping Yi (Beijing University of Posts and Telecommunications, China; Fudan University, China; Beijing Institute of Computer Technology and Applications, China) Faithful executable peripheral modeling remains a major bottleneck in microcontroller unit (MCU) firmware rehosting. Reference manuals provide broad but non-executable semantic descriptions, while binary analysis yields execution-grounded but incomplete observations. We present PELSE, a framework that synthesizes executable peripheral models by jointly leveraging these two asymmetric evidence sources. Our key insight is that manual-derived semantic structures and binary-derived execution witnesses can be unified under a shared register/field abstraction to mutually constrain model construction. Specifically, PELSE uses large language models (LLMs) to extract semantic candidates from vendor manuals and organize them into manual-derived finite-state machine (FSM) scaffolds, and performs memory-mapped I/O (MMIO)-aware symbolic execution to collect register/field-level witness fragments from firmware binaries. It then applies evidence-guided fusion in a unified register/field namespace to cross-validate and concretize compatible manual-derived transitions, recover well-formed trace-extracted transitions absent from the FSM scaffolds, isolate contradictions, and construct evidence-labeled fused FSMs before compiling them into QEMU-compatible peripheral models. We evaluate PELSE using QEMU-referenced MMIO/IRQ conformance and an enhanced 106-test P2IM suite. PELSE achieves 97.0% conformance on a 42-test overlap set, improving over PERRY by 6.4 percentage points, and a 96.2% pass rate across all 106 tests, outperforming FUZZWARE by 5.6 percentage points. As downstream evidence of improved rehosting fidelity, PELSE-enabled rehosting supports security analyses that reproduce known vulnerabilities and uncover 15 previously unknown real-world vulnerabilities. Article Search Artifacts Available Article: ase26main-p2735-p doi:10.1145/3832783.3837541
	Hong, Jingun	ASE '26: "Disassembly-Augmented Root ..." Disassembly-Augmented Root Cause Analysis for C/C++ Segmentation Faults in SAP HANA Jihoon Jung, Chansong You, Jingun Hong, Thomas Bach, and Gabin An (SAP Labs Korea, Republic of Korea; SAP, Germany; Korea University, Republic of Korea) Production failures in large-scale systems are inherently difficult to diagnose, and crash dumps are often the only artifact available for debugging. In C++ programs, this difficulty is further compounded by misleading crash locations in stack traces caused by compiler optimizations such as function inlining. In our dataset of production SIGSEGV crashes from SAP HANA, 66% exhibit such misleading crash locations, which can misdirect both developers and LLM-based debugging agents to the source code of inlined functions rather than the true execution context of the faulting instruction. In this work, we investigate whether explicitly providing disassembly information that reveals the faulting instruction and recovers inlining chains improves bug diagnosis quality in both autonomous agent and tool-disabled LLM modes. Experiments on 91 real-world SIGSEGV crashes show that disassembly context improves root cause analysis quality and generally improves fault localization, especially for misleading crash locations. Moreover, in agent mode, the additional disassembly context does not increase total session cost of diagnosis, as its added input-token cost is offset by reduced exploration of the codebase. Article Search Artifacts Available Article: ase26ind-p32-p doi:10.1145/3832783.3834461
	Hösl, Jessica	ASE '26: "Closing the Gap: Automated ..." Closing the Gap: Automated Discovery of Secure Dockerfile Reference Standards via Semantic Clustering in Enterprise Inner Source Jessica Hösl, Benedikt Hofmann, and Patrick Stöckle (TU Munich, Germany; Siemens, Germany) Containerization dominates enterprise software delivery, yet Dockerfiles that assemble container images frequently harbor security misconfigurations and structural technical debt. This problem is poorly understood in corporate inner-source environments, where proprietary context and isolated governance prevent direct application of open-source findings. We present an automated, six-stage pipeline that: (1) crawls an enterprise GitLab instance, (2) enriches each Dockerfile with static security and quality metrics (Hadolint, ShellCheck, Trivy) and lifecycle data, (3) groups functionally identical workloads using LLM-generated semantic descriptions and HDBSCAN, and (4) quantifies the optimization gap against cluster-internal reference implementations. Applied to 11,470 Dockerfiles from over 6,200 repositories at a single large industrial company, we find a systemic deficit: 99% of files contain at least one security misconfiguration, 80.8% violate Dockerfile best practices, and the median artifact has not been revised for 838 days. Despite this, high-quality reference implementations already exist within 83% of functional clusters. Adopting these internal standards would increase the average security posture score by 60.4% without developing any new templates. These findings, grounded in one organization’s inner-source ecosystem, provide a data-driven foundation for future automated, context-aware recommender systems targeting enterprise supply-chain security; whether the observed technical-debt distribution and optimization gap generalize to other enterprises remains an open question for future multi-organization study. Article Search Article: ase26ind-p179-p doi:10.1145/3832783.3834500
	Hossain, Mainul	ASE '26: "DesignFix: Context-Augmented ..." DesignFix: Context-Augmented Repair of Design Rule Violations Mainul Hossain and Thomas D. LaToza (George Mason University, USA) Design rules make project-specific design decisions explicit and checkable, helping teams preserve architectural intent as systems evolve. Although automated checkers can detect violations, developers must still interpret the rule, locate the code that must change, and construct a repair consistent with project conventions. We present DesignFix, an IDE-integrated approach that turns checker-reported violations into project-grounded, reviewable repairs. DesignFix augments each violation with the rule description, a rule-satisfying example from the same project, and focused structural context, while a two-step LLM pipeline separates repair reasoning from structured edit extraction. We report three complementary evaluations. A systematic study of seven prompt configurations across 9,450 repair trials found that the full workflow achieved up to 90% repair success, 89% explanation correctness, and 90% preservation of unrelated code: 26 percentage points above a baseline prompt. We conducted a controlled experiment with 14 developers. Compared to a control condition with browser-based LLMs, developers completed repairs 36% faster with DesignFix, increased correct repairs from 43% to 93%, and reported significantly lower workload on five of six NASA-TLX dimensions. Finally, we ran the autonomous in-IDE agent Cline on six repair task types drawn from our user study. Cline produced a correct repair for only half of them, while averaging 12.1× DesignFix’s token use and substantially higher API cost per run. Together, these results suggest that effective design-rule repair depends on grounding the LLM in checker-derived, project-specific design intent and on keeping repairs under developer review, needs that repository autonomy alone does not meet. Article Search Article: ase26main-p184-p doi:10.1145/3832783.3837422
	Hossain, Soneya Binta	ASE '26: "Documentation vs. Code Patterns: ..." Documentation vs. Code Patterns: What Drives LLM-Based Exception Oracle Generation? Soneya Binta Hossain, Matthew B. Dwyer, and Tasfia Tasnim (University of Texas at Dallas, USA; University of Virginia, USA) LLM-based test oracle generation (TOG) methods report high accuracy on exception-oracle generation, but it remains unclear what evidence drives these predictions. In particular, do models use explicit exceptional-behavior documentation such as Javadoc @throws clauses, or do they rely on recurring patterns in tests, code, and documentation? We investigate this question through a large-scale intervention-based study of three TOG systems spanning classifier-based and generative architectures and model sizes from roughly 110M to 7B parameters, evaluated on three real-world benchmarks comprising two generated-test datasets and a new benchmark of developer-written tests. We first remove Javadoc @throws clauses and find that accuracy changes only marginally, with the largest drop below one percentage point. This indicates that structured exception documentation is not the primary driver of exception-oracle prediction. We then apply attribution-guided substitution ablations to identify the signals that predictions depend on. The results show that high accuracy can be driven by shortcut signals: some models are highly sensitive to a small number of structural tokens, while others distribute reliance across many lexical cues. These findings challenge the assumption that strong exception-oracle accuracy reflects robust use of exception semantics. Future TOG systems should therefore be evaluated not only by whether they predict the correct oracle type, but also by whether their predictions are grounded in meaningful exception-triggering evidence. Article Search Article: ase26main-p773-p doi:10.1145/3832783.3837464 ASE '26: "PITMuS: A Tool for Automated ..." PITMuS: A Tool for Automated Bug Dataset Generation via Source-Level Mutant Reconstruction Tasfia Tasnim and Soneya Binta Hossain (University of Texas at Dallas, USA) Mutation testing provides a scalable way to generate controlled faults for software testing and empirical software engineering. In Java, PIT is a widely used mutation testing tool that creates large numbers of mutants for evaluating test suites. However, PIT creates mutants at the bytecode level and reports mutation metadata rather than the corresponding source-level edits. Consequently, these mutants are difficult to inspect, replay, and reuse as structured bug artifacts. We present PITMuS, a tool that reconstructs PIT mutants at the source level and automatically generates reusable mutation-based bug datasets. Given standard PIT reports and the original Java source, and using compiled bytecode when available, PITMuS localizes the affected source statement, applies the corresponding edit, and associates the result with its enclosing method, documentation, and mutation metadata. The tool also supports source-level mutant injection for inspection, replay, and downstream experimentation. We evaluate PITMuS on eight open-source Java systems. From 69,229 mutations reported by PIT, PITMuS produces 69,198 source- level original–mutant method pairs across 1,913 source files, yield- ing a source-level pair for 99.96% of the reported mutation records. These results show that bytecode-level mutation reports can be converted at high coverage into inspectable, context-rich source artifacts for software testing, program repair, and learning-based software engineering. Article Search Article: ase26tool-p80-p doi:10.1145/3832783.3834626
	Hou, Ping	ASE '26: "Specification-Guided Synthesis ..." Specification-Guided Synthesis of Deadlock-Free Communication Protocol Refinements with Large Language Models Yang Li, Ping Hou, and Nobuko Yoshida (University of Oxford, UK) Ensuring behavioural correctness in communication protocols is a central challenge in distributed software systems, as subtle inconsistencies can lead to deadlocks. In such settings, protocol refinement – the safe substitution of a protocol that preserves correctness and compatibility with other components – is essential. Large language models (LLMs) have demonstrated strong capabilities in code generation and program synthesis, yet lack mechanisms to reliably produce outputs with correct behaviour. Formal specification approaches, such as multiparty session types (MPST), offer rigorous guarantees, including deadlock freedom, but provide limited support for automatically constructing protocol refinements. In this paper, we present Syntropy, a framework for synthesising protocol refinements guided by MPST specifications and LLMs. It incorporates refinement constraints directly into the generation process, ensuring the generated variants satisfy these guarantees. Our comprehensive evaluation indicates that Syntropy achieves 95.6%–99.5% validity while maintaining high syntactic correctness, and produces diverse, non-trivial refinements across multiple LLMs. Article Search Article: ase26main-p825-p doi:10.1145/3832783.3837469
	Hou, Zhe	ASE '26: "Towards Fully Automated Medical ..." Towards Fully Automated Medical Imaging Code Generation via Validation-Based Context Engineering Zixiao Zhao, Jing Sun, Zhe Hou, Cheng-Hao Cai, Qian Liu, Mengze Li, Zijian Zhang, and Jin Song Dong (University of Auckland, New Zealand; Griffith University, Australia; Monash University, Suzhou, China; Beijing Institute of Technology, China; National University of Singapore, Singapore) Large language models (LLMs) have demonstrated considerable promise in program generation for small-scale and conventional application development; however, they remain limited when applied to complex, domain-specific tasks such as medical image processing. General-purpose models lack explicit domain knowledge and robust validation mechanisms to ensure correctness, often requiring substantial human intervention to produce reliable processing pipelines. To address these limitations, we propose AutoMedImg, a multi-agent framework for fully automated medical image processing code generation. AutoMedImg orchestrates specialised agents across two phases: a Planning Phase that performs dataset analysis and architecture design with semantic and formal verification, and a Coding Phase that generates modules in parallel with static checking, execution testing, and assembly validation. This multi-stage validation mitigates error propagation throughout generation, while comprehensive auto-context engineering combining domain-specific knowledge bases, shared memory, and validation feedback automates context construction without manual prompting. A cross-project adaptive pipeline synthesis mechanism further accumulates validated pipelines and retrieves proven components for new tasks based on project similarity, enhancing generation efficiency through cross-project learning. Extensive evaluation across six diverse and well-established medical imaging datasets with five backbone LLMs demonstrates that AutoMedImg achieves zero human intervention, with Dice scores of up to 0.90 for segmentation tasks and 99% accuracy for classification. Article Search Article: ase26main-p1668-p doi:10.1145/3832783.3834399
	Hou, Zhijian	ASE '26: "GraphDroid: Asynchronous LLM-Based ..." GraphDroid: Asynchronous LLM-Based Mobile App GUI Testing via History-Aware Exploration and Hybrid Intent Fulfillment Xiaolei Li, Jialun Cao, Zhijian Hou, Yuzhi Zhao, Yepang Liu, and Shing-Chi Cheung (Hong Kong University of Science and Technology, China; Southern University of Science and Technology, China; Guangzhou HKUST Fok Ying Tung Research Institute, China; City University of Hong Kong, China) Automated GUI testing is a widely adopted technique for ensuring mobile application quality by simulating user interactions to exercise functionalities. Despite the research breakthroughs in the past decades, covering complex functionalities that require multi-step action sequences still remains challenging. Traditional tools lack semantic understanding capability and can rarely synthesize such action sequences. Recent LLM-based tools can generate test intents describing target functionalities and leverage the LLM to fulfill the intents, but suffer from three key limitations: 1) loss of historical context for identifying uncovered functionalities, 2) synchronous intent generation that blocks exploration, and 3) per-step LLM-driven fulfillment incurring high cost and latency. To address these limitations, we propose GraphDroid, an intent-driven GUI testing framework that integrates a cluster-based memory mechanism to effectively identify uncovered functionalities from historically visited states for comprehensive application testing. For improving testing efficiency, GraphDroid adopts an asynchronous intent generation paradigm that eliminates the latency bottleneck and a hybrid intent fulfillment strategy that reserves the LLM for fulfilling complex intents while delegating simple intents to a lightweight heuristic algorithm. We evaluate GraphDroid on 41 real-world Android apps against six state-of-the-art baselines. Results show that GraphDroid outperforms all baselines, achieving up to 36.4% higher code coverage while incurring less than one eighth of the cost of the best pure LLM-based baseline. GraphDroid also exposes 19 bugs in the 41 apps and detects 13 of 52 crashes in the Themis bug benchmark, surpassing all the six baselines. Seven of the 19 bugs were previously unknown and we reported them to the developers. So far, four bugs have been confirmed and fixed. Article Search Article: ase26main-p609-p doi:10.1145/3832783.3837449
	Hsu, Min-Chien	ASE '26: "Learning to Triage Vulnerability ..." Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js Ronghao Ni, Aidan Z.H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, and Kevin Cheang (Carnegie Mellon University, USA; Athanor AI, USA; University of California at Berkeley, USA) Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNNs and LLMs, trained on data derived from program analysis tool outputs (NodeMedic-FINE in our case study). The top LLM achieves F1=0.915, while the best provenance-graph-based method achieves F1=0.904. On the reports that the upstream tool flags but cannot automatically confirm, at a target of recovering 90% of the exploitable reports, the leading model eliminates 75% of the benign reports from manual review. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives among all warnings), our approach can report 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage. Article Search Article: ase26main-p1614-p doi:10.1145/3832783.3837503
	Hu, Anshun	ASE '26: "Revisiting LLMs on New Feature ..." Revisiting LLMs on New Feature Implementation in Real-World Software Development Practices Jia Li, Tingxuan Huang, Tiankuo Zhao, Yiming Wang, Yiran Zhang, Anshun Hu, Kechi Zhang, Lecheng Wang, Zinan Sheng, Kui Liu, Ge Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Peking University, China; Huawei Technologies, China) Implementing new features in existing repositories is a key activity in software development. With the rapid advances in large language models (LLMs), benchmarking their capability in this task has attracted growing attention. However, existing benchmarks deviate from real-world practices in two aspects. First, they provide LLMs with unrealistic information such as target code signatures and file paths, which developers do not have access to in practice. Second, they only evaluate the final generated code using functional tests, without examining intermediate steps like requirement understanding and implementation planning. These limitations make it difficult to faithfully assess LLMs’ actual capabilities and diagnose their weaknesses. To address the above limitations, we conduct a systematic evaluation to revisit the capability of large language models (LLMs) in new feature implementation, with a task setup strictly aligned with real-world software development practices. Our evaluation is built on NFEI, a curated benchmark sourced from merged feature pull requests of active GitHub repositories, where each target feature involves cross-snippet multiple code modifications, and LLMs are only provided with the feature description and the target repository throughout the evaluation. Beyond the realistic input settings, we further annotate fine-grained labels for the intermediate steps of the development workflow, including requirement clarification and implementation planning. This enables our evaluation to support a comprehensive stage-wise assessment across three granularities with seven dedicated metrics. We evaluate seven popular LLMs under two development paradigms and three generation strategies. Results show that new feature implementation remains highly challenging, with an overall average Test Pass Rate of only 29.84%. Our stage-wise analysis reveals that intermediate step quality is closely linked to final code performance, and injecting ground-truth intermediate artifacts yields an average absolute gain of about 18%, yet performance remains limited. Qualitative error analysis further identifies three recurrent failure patterns, suggesting that new feature implementation of LLMs adhering to real-world world software development practices remains challenges. Article Search Article: ase26main-p1768-p doi:10.1145/3832783.3837511
	Hu, Cenjie	ASE '26: "Smart Brain: Semantic Anomaly ..." Smart Brain: Semantic Anomaly Detection for Operational Time Series in Large Scale Service Systems Hang Cui, Zexin Wang, Jingjing Li, Juncheng Hu, Haotian Si, Cenjie Hu, Quan Zhou, Yongchang Hu, Lei Han, Dan Pei, Changhua Pei, and Gaogang Xie (University of Chinese Academy of Sciences, China; Computer Network Information Center at Chinese Academy of Sciences, China; Jilin University, China; Independent Researcher, China; Shenyang Institute of Automation at Chinese Academy of Sciences, China; Huawei Technologies, China; Tsinghua University, China) Time series anomaly detection is a core component of operational automation in large scale service systems. However, most existing methods model anomalies as numerical deviations in the data space, while real software operations require decisions over whether an observed behavior constitutes an actionable abnormal event. This mismatch often leads to brittle thresholds, excessive false alerts, and outputs that are difficult for operators to interpret and act upon. In this paper, we argue that practical anomaly detection should move from point-centric data anomaly detection to semantic anomaly detection. We present Smart Brain, a two stage framework for semantic anomaly detection in operational time series. Stage I extracts structured temporal evidence by recognizing interpretable anomaly patterns. Stage II combines the extracted evidence with metric semantics and operator authored rules to produce semantic anomaly decisions and human-readable explanations. Through evaluation on benchmark datasets and real industrial monitoring scenarios, we show that Smart Brain improves operationally meaningful anomaly identification while providing stronger interpretability and deployment suitability than score centric pipelines. Beyond the framework itself, our study offers practical lessons for building anomaly detection systems in production software environments, highlighting the importance of semantic grounding, structured evidence, and lightweight adaptation to evolving services. Article Search Article: ase26main-p337-p doi:10.1145/3832783.3837436
	Hu, Chao	ASE '26: "FPSieve: LLM-Powered Cascade ..." FPSieve: LLM-Powered Cascade for Filtering False Positives in OS Migration Testing Jie Dong, Ying Fu, Chao Hu, Yuhang Chen, Qi Xiao, and Heyuan Shi (Central South University, China; Tsinghua University, China; Hunan Congmao Technology, China) Operating system migration requires validating thousands of software packages for behavioral compatibility on the target distribution. Differential testing is the dominant industrial approach. OS level outputs contain many benign differences that are unrelated to package compatibility. These differences produce many false positives. They also bury real compatibility issues under heavy triage load. To address this issue, we first conduct a study of false positive root causes on industrial enterprise Linux migration data. This study yields a five-category taxonomy and a share–cost decision matrix. These findings guide our design. We propose FPSieve, a cost routed filtering pipeline for OS migration validation. FPSieve integrates rule based filtering, semantic similarity filtering, case library retrieval, package level LLM reasoning with confidence based routing, and closed loop container based verification. We evaluate FPSieve on a large scale OS migration differential testing dataset collected from industrial practice. FPSieve reduces the overall manual review queue to 5.9% of its original size while preserving 86.7% recall. It also improves review queue precision from 3.16% to 46.0%. After deduplication, FPSieve surfaced 66 compatibility issues submitted upstream. Of these, 14 received maintainer feedback, and 6 have been fixed. These results show that FPSieve can reduce false positives, reduce manual effort, and improve OS migration validation throughput. Article Search Article: ase26ind-p24-p doi:10.1145/3832783.3834460
	Hu, Chi	ASE '26: "Best-Effort GR(1) Synthesis: ..." Best-Effort GR(1) Synthesis: Exploiting Environmental Cooperation under Unrealizability Sirui Liu, Yating Zhang, Chi Hu, and Wei Dong (National University of Defense Technology, China; China Academy of Engineering Physics, China) Reactive synthesis automatically derives correct-by-construction controllers from temporal logic specifications. GR(1) synthesis is widely adopted due to its polynomial-time complexity and practical expressiveness. In practice, however, a significant proportion of GR(1) specifications are unrealizable. Conventional synthesis tools report failure in such cases, yet real-world environments are often governed by their own objectives rather than purely adversarial behavior, presenting opportunities for the system to leverage environmental cooperation toward satisfying its justice guarantees. For unrealizable GR(1) specifications, this paper proposes best-effort GR(1) synthesis. The approach requires the system strategy to satisfy two properties: best-effort extensibility, which preserves at every state reached by the play the possibility of satisfying all system justice guarantees, and persistent satisfiability of environment assumptions, which ensures that environmental cooperation does not preclude the environment from satisfying its own justice assumptions. For unrealizable but well-separated specifications, we construct a 3-nested µ-calculus fixpoint formula that characterizes the best-effort system winning region and prove its soundness and completeness. The resulting algorithm performs O(n|Q|) symbolic next-state computations, compared with O(mn|Q|2) for standard GR(1) synthesis. We further analyze the relationship between the best-effort and standard GR(1) winning regions through finite cooperative reachability, yielding a hierarchical classification of dependence on environmental cooperation at the region and initial-state levels for well-separated but unrealizable specifications, thereby quantifying the degree of unrealizability. We implement best-effort checking, controller construction, and classification in the Spectra GR(1) synthesizer and evaluate the approach on a diversified corpus of SYNTECH, AMBA, and GenBuf specifications. Experimental results demonstrate that best-effort realizability is common among well-separated but unrealizable specifications and that all top-level unrealizability categories occur in the combined benchmark corpus. Article Search Artifacts Available Article: ase26main-p372-p doi:10.1145/3832783.3837439
	Hu, Chong	ASE '26: "Beyond Single-Level PGO: Understanding ..." Beyond Single-Level PGO: Understanding and Harnessing Cross-Level Optimization Effects in Industrial Systems Dong Liu, Yifan Cheng, Yunfeng Cui, Ting Chen, Jiachi Chen, Zhihong Xue, Chong Hu, and Shengyu Cheng (ZTE Corporation, China; University of Electronic Science and Technology of China, China; Zhejiang University, China) Profile-guided optimization (PGO) is used to improve software performance in applications and operating system kernels. However, prior work applies PGO to a single layer in isolation, overlooking cross-layer interactions in systems, where kernel and application are optimized independently using different workloads. This practice is common in production environments and makes its impact on end-to-end performance important to understand. It introduces a mismatch between training and deployment, where profiling workloads may not reflect the final co-executed system. Despite its prevalence, the implications of such cross-layer mismatch remain poorly understood. In this paper, we present a large-scale industrial study of multi-level PGO across three representative products. We evaluate the combined effects of independently optimized kernel and application under realistic deployment conditions. Our results show that multi-level PGO can yield performance gains of up to 17.04%, but may lead to severe regressions of up to 81.90%. Through performance counter analysis, we attribute these effects to microarchitectural factors such as cache contention and branch misprediction arising from mismatched profiling assumptions. These findings show that PGO benefits are not necessarily compositional across software layers. Based on these insights, we propose Multi-Level PGO (ML-PGO), a practical guideline for applying PGO safely across system layers. Our work highlights the importance of workload representativeness and cross-layer awareness for achieving reliable performance improvements. Article Search Article: ase26ind-p100-p doi:10.1145/3832783.3834484
	Hu, Chunming	ASE '26: "MicroWeaver: A Constraint-Guided ..." MicroWeaver: A Constraint-Guided Structure–Semantic Aware Approach to Automated Microservice Decomposition Huitian Xue, Kairui Zhang, Chenxi Zhang, Zheng Li, Chuan Luo, Yilong Yang, Tianyu Wo, Chunming Hu, Yanliang Li, Yang Zhou, Penghao Zhang, Tiezi Zhang, and Renyu Yang (Beihang University, China; Xidian University, China; Queen's University Belfast, UK; Independent Researcher, China; Kuaishou, China) Microservice architecture is a pivotal paradigm for refactoring monolithic systems to improve maintainability and evolvability. However, automated, explainable decomposition remains a difficult task, especially when balancing structural soundness with semantic consistency in complex legacy systems. We present MicroWeaver, an automated microservice decomposition approach that reconciles both structural and semantic characteristics. MicroWeaver combines static program analysis and dynamic tracing at runtime to construct a high-fidelity, class-level dependency model, and learns numerical embeddings that capture both the structural characteristics and semantic properties embodied in these dependencies. We introduce multiple constraints for representing core design principles (e.g., high cohesion, low coupling, etc.) and formulate the decomposition as a multi-objective optimization problem. MicroWeaver uses an LLM-agent-based optimization strategy to automatically navigate the solver towards a Pareto-optimal region that balances structural dependencies, semantic coherence and inter-service communication cost. We conduct comprehensive experiments on five real-world systems. Results show that MicroWeaver overcomes key limitations of clustering-based methods that ignore semantic context and LLM-based approaches that lack robust structural constraints, and thus attains competitive structural and semantic scores. MicroWeaver is used as a production-ready architectural refactoring framework in industrial settings. Its robust, multidimensional performance and high degree of interpretability furnish practitioners with actionable and comprehensive insights, thereby facilitating more informed and systematic refactoring processes. Article Search Article: ase26ind-p19-p doi:10.1145/3832783.3834457 ASE '26: "Characterizing and Mitigating ..." Characterizing and Mitigating Productivity Loss in Large-Scale Model Training: An Empirical Study Dinghao Xue, Yanxiang Chen, Junhong Liu, Yepeng Zhang, Guangsen Ni, Menghao Zhang, Tianyu Wo, Zheng Zheng, Chunming Hu, Jin Ouyang, and Renyu Yang (Beihang University, China; Kuaishou, China; Unaffiliated, China) Training large-scale foundation models often uses thousands of GPUs for weeks or months. In production clusters, training productivity is reduced not only by explicit failures but also by scheduling delays, repeated recoveries, alive-but-unproductive hangs, and performance degradation during seemingly normal execution. However, existing metrics such as Effective Training Time Ratio (ETTR) mainly account for time lost to failures and restarts, and do not directly capture jobs that remain alive but make slow progress. Prior diagnosis and mitigation efforts typically target specific failure modes, leading to case-by-case fixes and offering limited support for cluster-wide attribution of productivity loss or systematic reliability improvements. In this paper, we present the Effective Training Productivity Ratio (ETPR), a reliability-oriented decomposition of end-to-end training productivity to stabilize the large-scale machine learning (ML) systems. ETPR characterizes productivity loss by accounting for pre-execution loss, unproductive allocated compute time, and reduced execution quality. We conduct an empirical study of thousands of training jobs over three months on Kuaishou's production cluster. Our analysis shows that productivity is mainly degraded by diagnosis and recovery for fail-stop and fail-hang incidents, as well as subtle fail-slow anomalies that delay fault localization and worsen overall efficiency. Based on these findings, we build and deploy an automated stability governance framework that integrates: (i) a multi-stage log-based fail-stop diagnosis pipeline, (ii) temporal stack invariance analysis for fail-hang localization, (iii) an adaptive fail-slow detector with straggler detection, and (iv) hierarchical recovery strategies. Experiments show that this framework accelerates failure diagnosis, accurately localizes anomalous ranks, mitigates silent slowdowns, and improves cluster-wide ETPR in production. Article Search Article: ase26ind-p34-p doi:10.1145/3832783.3834462 ASE '26: "CAPMix: Robust KPI Anomaly ..." CAPMix: Robust KPI Anomaly Detection for AIOps in Noisy and Dynamic Environments Xudong Mou, Rui Wang, Tiejun Wang, Zexin Wu, Fangda Guo, Jie Sun, Shiru Chen, Penghao Zhang, Tiezi Zhang, Tianyu Wo, Hao Peng, Chunming Hu, Xudong Liu, and Renyu Yang (Beihang University, China; Chinese Academy of Sciences, China; Inspur, China; Kuaishou, China) Time-series anomaly detection is crucial in AIOps for maintaining large-scale service reliability. In production, streams of Key Performance Indicators (KPI) are high-dimensional, non-stationary, and affected by noise, deployment changes, and latent anomalies, making real failures hard to distinguish from benign variation. Most existing methods assume either normality (learning from “normal” history) or rely on injected anomalies for training. Yet injected patterns often misalign with real failure modes, skewing decision boundaries – aka. Anomaly Shift. We propose CAPMix, a controllable anomaly augmentation framework with prior-guided injection for realistic temporal behaviors. CAPMix combines label revision and dual-space mixup to enhance robustness under contaminated and mixed data. CAPMix consistently outperforms state-of-the-art methods on public AIOps and time-series benchmarks. It has been deployed in a large-scale production system, reducing false alarms and improving monitoring reliability. A real-world dataset is also released to enrich the research on robust KPI anomaly detection. Article Search Article: ase26ind-p110-p doi:10.1145/3832783.3834487 ASE '26: "DynCA: An Effective Algorithm ..." DynCA: An Effective Algorithm for 3-Wise Combinatorial Interaction Testing in Highly Configurable Systems Ruizhi Shi, Shuangyu Lyu, Renyu Yang, Wei Wu, Chanjuan Liu, Chunming Hu, and Chuan Luo (Beihang University, China; Central South University, China; Dalian University of Technology, China) With the increasing demand for software customization, highly configurable systems have become increasingly important. Combinatorial interaction testing (CIT) is widely recognized as an effective technique for testing such systems. The most critical problem in CIT is constrained covering array generation (CCAG), which aims to construct a t-wise covering array (CA) with as small a size as possible, where t denotes the testing strength. Compared with the widely adopted pairwise testing ( 2-wise CIT), 3-wise CIT is capable of detecting more faults and provides greater practical benefits. However, it also introduces significantly higher computational complexity. Although many existing algorithms perform well on 2-wise CCAG, current state-of-the-art CCAG algorithms still suffer from the severe scalability challenge in 3-wise CCAG and have difficulty generating small-sized CAs for large-scale instances. Since the size of a CA directly affects testing efficiency in practice, generating small-sized 3-wise CAs is of great importance. In this work, we propose , a novel 3-wise CCAG algorithm that effectively generates small-sized CAs for large-scale instances. Experimental results on extensive real-world highly configurable systems demonstrate that, compared with existing state-of-the-art algorithms, reduces the size of generated 3-wise CAs by 10.8%. Moreover, is efficient, requiring only half of the running time to generate smaller 3-wise CAs than existing algorithms. Article Search Artifacts Available Article: ase26main-p354-p doi:10.1145/3832783.3834349 ASE '26: "SplitCA: An Effective Tool ..." SplitCA: An Effective Tool for Generating 4-wise Covering Arrays for Large-Scale Highly Configurable Systems Shuangyu Lyu, Ruizhi Shi, Yuechen Duan, Chunming Hu, and Chuan Luo (Beihang University, China) Highly configurable software systems are difficult to test exhaustively because their configuration spaces grow exponentially with the number of options. Combinatorial interaction testing (CIT) addresses this problem by generating t-wise covering arrays (CAs), and prior studies show that 4-wise CIT can detect important faults missed by lower-strength testing. However, existing constrained covering array generation (CCAG) tools still struggle to generate 4-wise CAs for large-scale systems with more than one thousand options. To address this limitation, we propose , an effective tool for large-scale 4-wise CA generation. We evaluate on 118 public real-world large-scale highly configurable software instances, each with more than one thousand options. Under reasonable time and memory limits, existing 4-wise CCAG tools fail to generate a 4-wise CA for any of these instances. In contrast, successfully generates 4-wise CAs for 117 instances, substantially improving the scalability of 4-wise CCAG. Video: https://youtu.be/9uM1Vl2ph-o Repository: https://github.com/chuan-luo-group/SplitCA or https://doi.org/10.5281/zenodo.21360896 Article Search Artifacts Available Article: ase26tool-p76-p doi:10.1145/3832783.3834623 ASE '26: "UCT: A Versatile Code Translation ..." UCT: A Versatile Code Translation Framework Based on a Unified Intermediate Representation Wangcai Li, Dongyan Wang, Zehong Yu, Yifan Cheng, Ning Ge, Chunming Hu, and Zhuo Su (Beihang University, China; Renmin University of China, China; Tsinghua University, China; University of Electronic Science and Technology of China, China) Model-driven design often requires the same model to support multiple downstream tasks, such as simulation, testing, verification, and deployment. However, existing tools usually build separate translation workflows for different tasks, causing repeated model parsing, redundant semantic reconstruction, and limited reuse across toolchains. In this paper, we present UCT, a versatile code translation framework based on a unified intermediate representation (CIR). UCT translates models into CIR once, preserves executable semantics, structural information, scheduling relations, and model-code mappings, and then generates task-specific code through unified instrumentation and backend translation. We implemented UCT and evaluated it on Simulink benchmark models. The results show that UCT can generate usable customized code for simulation, testing, verification, and deployment. The generated binary artifacts also provide additional benefits, improving model testing coverage by 85.9% on average and accelerating simulation by 19.8× on average over Simulink Rapid Accelerator. The video is presented at https://youtu.be/CCu5iO853p4. The implementation is available at https://github.com/CodeGen123/UCT. Article Search Article: ase26tool-p111-p doi:10.1145/3832783.3834636
	Hu, Haichuan	ASE '26: "PSearch: Search-Based Patch ..." PSearch: Search-Based Patch Generation in the Era of LLM-Based Automated Program Repair Haichuan Hu, Ye Shang, Weifeng Sun, and Quanjun Zhang (Nanjing University of Science and Technology, China; Nanjing University, China; Singapore Management University, Singapore) Large Language Models (LLMs) have substantially advanced Automated Program Repair (APR), yet most existing LLM-based APR methods still rely on trial-and-error to generate patches. Such a strategy explores candidate patches in a weakly structured manner, making it difficult to assess the future potential of search directions and allocate search budget effectively. To address this limitation, we propose Psearch, a search-based patch generation framework for LLM-based APR centered on iterative patch evaluation and refinement. Instead of treating patch generation as repeated independent sampling, Psearch maintains a structured search state over intermediate patches, continuously evaluates the promise of explored search paths, and prioritizes the most promising ones for further refinement. This design enables Psearch to abandon weak directions early and progressively approach correct fixes through long-horizon search. Importantly, Psearch can be integrated with different search algorithms, while our current implementation adopts Monte Carlo Tree Search as one effective instantiation. We evaluate Psearch on five widely used bug and vulnerability benchmarks. Experimental results show that Psearch correctly repairs 201 out of 835 bugs in Defects4J, outperforming all 12 state-of-the-art baselines. Psearch also fixes 27 of 79 vulnerabilities in VUL4J and resolves 164 of 300 issues in SWE-Bench-Lite. Moreover, with a patch size of 16, Psearch reduces monetary cost to roughly 50% of strong baselines while maintaining superior repair effectiveness. These results highlight the effectiveness of Psearch for improving LLM-based APR. Article Search Article: ase26main-p2681-p doi:10.1145/3832783.3834422 ASE '26: "MultiFixer: A Coordinator-Proposer ..." MultiFixer: A Coordinator-Proposer Based Multi-agent Framework for Fixing Multi-hunk Bugs Haichuan Hu, Chunrong Fang, Ye Shang, Jiawei Liu, Weifeng Sun, Guoqing Xie, Chenxing Zhong, and Quanjun Zhang (Nanjing University of Science and Technology, China; Nanjing University, China; Singapore Management University, Singapore) Automated Program Repair (APR) has benefited greatly from Large Language Models (LLMs), but existing LLM-based APR methods still struggle with multi-hunk bugs that require coordinated changes across multiple locations. These bugs demand repository-level context understanding, repair-order scheduling, and effective hunk-level patch generation and selection. To address these challenges, we propose MultiFixer, a novel Coordinator-Proposer based multi-agent framework for multi-hunk repair. MultiFixer performs tool-augmented bug analysis, constructs fine-grained repair context, iteratively generates patches through a Coordinator-Proposer architecture, and applies two-stage patch refinement for syntactic and semantic correctness. We evaluate MultiFixer on 835 bugs from Defects4J and three vulnerability benchmarks. On Defects4J, MultiFixer fixes 326 bugs, including 62 multi-method and 27 multi-file bugs, and outperforms prior APR baselines in the reported comparisons with the same base model. Moreover, MultiFixer also fixes 46 multi-hunk bugs among 95 unique fixes. When combined with Claude-3.5-Sonnet, MultiFixer repairs 420 bugs, establishing a new state of the art on Defects4J. On VUL4J, MultiFixer repairs 24 real-world vulnerabilities, including 5 multi-hunk cases. On the multi-hunk subsets of SEC-bench and PatchEval, MultiFixer fixes 11 and 19 vulnerabilities, respectively, outperforming all compared baselines under GPT-3.5. These results demonstrate the effectiveness of MultiFixer for multi-hunk repair. Article Search Article: ase26main-p2372-p doi:10.1145/3832783.3837527
	Hu, Han	ASE '26: "Source-Free Detection and ..." Source-Free Detection and Impact Analysis of Compiler Optimization Problems in Mobile Applications Han Hu, Xiaoheng Xie, Bo Sun, Jian Gu, Gang Fan, and Li Li (Independent Researcher, Hong Kong; Independent Researcher, China; Monash University, Australia; Beihang University, China) Mobile apps frequently suffer from frame drops, overheating, and excessive power consumption. While developers optimize algorithms and debug code, a critical bottleneck often goes unnoticed: native libraries compiled with low optimization levels (O0/O1 instead of O2/O3). Because these libraries execute without functional errors, the resulting performance degradation remains hidden in production apps. We present OptDetect, a source-free framework that detects compiler optimization problems directly from app binaries. OptDetect handles mixed optimization levels through binary disassembly, chunk-level classification, and weighted score aggregation, achieving 93.0% accuracy on controlled datasets and 81.9% on real-world datasets. Applying OptDetect to 21,972 native libraries from 830 top-ranked Google Play apps, we find that 30.5% of libraries use low optimization levels, affecting 91.7% of apps. Through case studies on 12 production apps, fixing detected issues reduces CPU instructions by 10-63% (median: 20.5%) for commercial apps and 15-58% (median: 32%) for open-source apps. Performance complaints decrease in 5 of 6 commercial apps, and ratings increase in 5 of 6. Further investigation reveals that widely-used third-party libraries are themselves distributed at low optimization levels, with 49.7% of 1,073 libraries in a major repository exhibiting this problem. These findings show that compiler optimization problems are common, source-free detectable, and practically consequential in mobile app ecosystems. Article Search Article: ase26main-p135-p doi:10.1145/3832783.3834340
	Hu, Hao	ASE '26: "Making Theft Useless: Adulteration-Based ..." Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems Weijie Wang, Peizhuo Lv, Yan Wang, Weiqing Huang, Rujie Dai, Guokun Xu, Qiujian Lv, Hangcheng Liu, Hao Hu, and Jiaheng Zhang (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Henan Key Laboratory of Information Security, China; National University of Singapore, Singapore) Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants. Article Search Article: ase26main-p131-p doi:10.1145/3832783.3837418
	Hu, Haoji	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Hu, Jiaxin	ASE '26: "TDiFf: Detecting Bugs in DataFrame ..." TDiFf: Detecting Bugs in DataFrame Systems via Transferred DBMS Test Cases Jiaxin Hu, Shaowei Chen, and Rongxin Wu (Xiamen University, China; Fujian Agriculture and Forestry University, China) DataFrame systems are core components of modern data analytics platforms and achieve high performance through various optimization techniques. However, these optimizations can introduce subtle defects that are difficult to detect, undermining system reliability. Existing testing approaches primarily rely on manually written unit tests or automated unit test generation tools, which often produce invalid or low-quality test cases and have limited ability to exercise complex API sequences and optimization-induced behaviors. In this paper, we present TDiFf, a novel LLM-based testing framework for DataFrame systems. TDiFf leverages the database-like characteristics of DataFrame systems by translating SQL query statements into Python DataFrame test cases for differential testing. To address limitations of LLMs in mapping SQL constructs to DataFrame APIs and preserving semantic consistency, TDiFf incorporates feature knowledge extracted from SQL and DataFrame API documentation. In addition, it utilizes data flow graphs derived from SQL query plans to guide the generation of syntactically valid and semantically consistent DataFrame API sequences. We evaluate TDiFf on six widely used DataFrame systems: Pandas, Dask, CuDF, Modin, PySpark, and Polars. The results show that more than 99% of the generated DataFrame test cases are valid. Using these test cases, TDiFf uncovers 35 unique and previously unknown bugs confirmed by developers, and outperforms state-of-the-art baseline approaches by 2.5× to 14×. Article Search Article: ase26main-p3190-p doi:10.1145/3832783.3837548
	Hu, Juncheng	ASE '26: "Smart Brain: Semantic Anomaly ..." Smart Brain: Semantic Anomaly Detection for Operational Time Series in Large Scale Service Systems Hang Cui, Zexin Wang, Jingjing Li, Juncheng Hu, Haotian Si, Cenjie Hu, Quan Zhou, Yongchang Hu, Lei Han, Dan Pei, Changhua Pei, and Gaogang Xie (University of Chinese Academy of Sciences, China; Computer Network Information Center at Chinese Academy of Sciences, China; Jilin University, China; Independent Researcher, China; Shenyang Institute of Automation at Chinese Academy of Sciences, China; Huawei Technologies, China; Tsinghua University, China) Time series anomaly detection is a core component of operational automation in large scale service systems. However, most existing methods model anomalies as numerical deviations in the data space, while real software operations require decisions over whether an observed behavior constitutes an actionable abnormal event. This mismatch often leads to brittle thresholds, excessive false alerts, and outputs that are difficult for operators to interpret and act upon. In this paper, we argue that practical anomaly detection should move from point-centric data anomaly detection to semantic anomaly detection. We present Smart Brain, a two stage framework for semantic anomaly detection in operational time series. Stage I extracts structured temporal evidence by recognizing interpretable anomaly patterns. Stage II combines the extracted evidence with metric semantics and operator authored rules to produce semantic anomaly decisions and human-readable explanations. Through evaluation on benchmark datasets and real industrial monitoring scenarios, we show that Smart Brain improves operationally meaningful anomaly identification while providing stronger interpretability and deployment suitability than score centric pipelines. Beyond the framework itself, our study offers practical lessons for building anomaly detection systems in production software environments, highlighting the importance of semantic grounding, structured evidence, and lightweight adaptation to evolving services. Article Search Article: ase26main-p337-p doi:10.1145/3832783.3837436
	Hu, Junjie	ASE '26: "ACSLBench: A Verified C/ACSL ..." ACSLBench: A Verified C/ACSL Corpus and Benchmark with Compositional Call Chains for Formal Specification Synthesis Junjie Hu, Cheng Wen, Bin Yu, Jialun Cao, Dugang Liu, Weidi Sun, Haokun Li, Shengchao Qin, and Cong Tian (Xidian University, China; Hong Kong University of Science and Technology, Hong Kong; Shenzhen University, China; Peking University, China) Formal specification synthesis for C programs is a key step toward scalable deductive verification, yet current learning-based approaches lack large verified C/ACSL data and evaluation tasks that exercise reasoning across function calls. We present ACSLBench, a reusable dataset artifact for training and evaluating C/ACSL specification synthesis models. ACSLBench contains two resources: a corpus of 504,587 formally verified C/ACSL programs, and a curated benchmark of 495 tasks designed around function-call composition. The corpus is built by translating verified Rust/Verus seeds into C/ACSL via an LLM-guided semantic mapping loop, in which Frama-C/WP feedback repairs failed candidates. The benchmark is synthesized from verified components by constructing caller functions whose specifications depend on multiple callee contracts. Experiments with six LLMs show that performance drops as the number of function calls increases. The dataset is available at https://huggingface.co/datasets/noBuggie/AcslBench, and the video is available at https://youtu.be/kgvvTajX2Mk. Article Search Article: ase26tool-p82-p doi:10.1145/3832783.3834628
	Hu, Li	ASE '26: "Beyond Text Matching: Towards ..." Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering Xiuwei Shang, Li Hu, Xiao Jiang, Jieke Shi, Junda He, Zhou Yang, Shaoyin Cheng, Guoqiang Chen, Weiming Zhang, and David Lo (University of Science and Technology of China, China; Singapore Management University, Singapore; University of Alberta, Canada) Human-Oriented Binary Reverse Engineering (HOBRE) aims to transform decompiled pseudocode into a more human-friendly representation, thereby reducing the cognitive burden of reverse analysis and improving efficiency. However, reliably evaluating HOBRE outputs remains a fundamental challenge. On one hand, human evaluation is costly, time-consuming, as well as difficult to scale. On the other hand, existing automated metrics either rely on executable test cases and runtime environments, which are often unavailable for real-world binaries, or depend on high-quality source code references that are typically inaccessible and fail to capture semantically equivalent but lexically diverse outputs. Although the emerging LLM-as-a-Judge paradigm is naturally well-suited to HOBRE evaluation, its effectiveness has not yet been fully studied. This paper presents the first systematic investigation of the LLM-as-a-Judge paradigm for HOBRE, covering three representative tasks: function name recovery, binary code summarization, and decompilation optimization. We introduce BinJudgeBench, the first expert-annotated, reference-free evaluation benchmark based on multi-dimensional human judgment. Our empirical study reveals that LLM-as-a-Judge achieves an average correlation of 63.20% with human judgment, significantly outperforming traditional automated metrics at 35.04%. By analyzing the impact of various judge configurations, including backbone LLMs, prompting strategies, and decoding temperatures, on both correlation and cost, we find that no “one-size-fits-all” configuration exists, as the optimal setup varies across tasks and individual samples. To address this, we propose BinJudge, which employs a lightweight routing mechanism to adaptively select the optimal judge configuration for each specific task and sample. BinJudge improves correlation with human experts by 4.5%–24.7% and reduces API cost to 0.06×–0.84× of that of static best configurations, providing a scalable, cost-effective, and high-fidelity automated evaluation scheme for HOBRE. Article Search Article: ase26main-p130-p doi:10.1145/3832783.3834339 ASE '26: "RegoMender: A Multi-agent ..." RegoMender: A Multi-agent Framework for Automated Rego Policy Repair Ruijie Zhang, Huaxiao Yin, Li Hu, Fanqi Kong, Haozhe Liang, Shaoyin Cheng, Kun Zhang, and Bibo Tu (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Science and Technology of China, China; Peking University, China; University of Chinese Academy of Sciences, China) Policy-as-Code (PaC) has emerged as a foundational paradigm in cloud-native systems. However, repairing Rego policies remains challenging due to their strict syntax, declarative semantics, and specific verification requirements. Existing automated program repair (APR) methods are mainly designed for mainstream languages and struggle to accommodate the unique policy logic and repair workflows of Rego. Thus, Rego policy repair remains a manual process driven by trial and error. To address this, we introduce RegoBench, the first automated Rego policy benchmark comprising 1,159 real-world defects, and propose RegoMender, a feedback-guided multi-agent framework. Collaborating via a shared blackboard and an atomic toolkit, RegoMender dynamically executes patching, rewriting, or rolling back, to resolve complex repair scenarios. Evaluated on RegoBench, RegoMender achieves syntactic and test-based semantic success rates of 82.9% and 77.9%, respectively, outperforming the strongest baseline by 13.4%. Unlike other approaches whose performance drops in complex scenarios, RegoMender maintains effectiveness across single-step and chained repair tasks. Furthermore, it generalizes strongly across HCL and SQL and achieves an 86.4% repair rate on 132 real-world CVE vulnerabilities, proving its robustness and practical utility for security. Article Search Article: ase26main-p1325-p doi:10.1145/3832783.3837490
	Hu, Lianhe	ASE '26: "NL2VBench: A Benchmark for ..." NL2VBench: A Benchmark for End-to-End Natural-Language to Verifiable Rust Generation Lianhe Hu, Cheng Wen, Dugang Liu, Zhiwu Xu, Zhuohua Li, Jie Su, Bin Yu, and Shengchao Qin (Xidian University, China; Shenzhen University, China; Chinese University of Hong Kong, Hong Kong) Large language models (LLMs) have shown promise in code generation, but generating formally verifiable Rust programs from natural-language descriptions remains highly challenging. We present a benchmark called NL2VBench for generating verifiable Rust programs from natural-language descriptions using Verus.NL2VBench contains 762 verifier-checked tasks derived from five public sources and curated through filtering, deduplication, canonicalization, LLM-assisted drafting, and human revision. Each task provides a natural-language description, task-defining interface information, and a verifier-checked reference solution. To demonstrate its utility, we evaluate five representative LLMs on a direct NL-to-Verus baseline. The results show that current LLMs achieve low verification success and even lower strict semantic correctness, demonstrating that NL2VBench is a challenging and reusable benchmark for future research on LLM-based verified code generation. A demonstration video of NL2VBench is available at https://youtu.be/CNOXHejni1c. Article Search Artifacts Available Article: ase26tool-p66-p doi:10.1145/3832783.3834619
	Hu, Ming	ASE '26: "Clarity Is Not Assumed: Understanding ..." Clarity Is Not Assumed: Understanding LLM-Based Code Generation under Ambiguous Requirements Di Yang, Xinou Xie, Xiuwen Yang, Ming Hu, Yihao Huang, Yueling Zhang, Weikai Miao, Ting Su, Chengcheng Wan, and Geguang Pu (East China Normal University, China; Shanghai Innovation Institute, China) Software requirement ambiguity is ubiquitous in real-world development, stemming from the inherent imprecision of natural language and the varying interpretations of stakeholders. While Large Language Models (LLMs) have demonstrated impressive capabilities in generating code from precise specifications, such ambiguity poses a significant obstacle to reliable automated code generation. Existing benchmarks typically assume clear and unambiguous requirements, leaving an empirical gap in understanding how LLMs behave when faced with the inherent uncertainty of real-world software requirements. In this paper, we introduce Orchid, a code generation benchmark specifically designed with ambiguous requirements. It comprises 1,304 function-level tasks covering four distinct types of ambiguity: lexical, syntactic, semantic, and vagueness. Leveraging this dataset, we conduct the first systematic empirical study to evaluate the impact of requirement ambiguity on LLM-based code generation. Our results demonstrate that ambiguity consistently degrades the performance of all evaluated LLMs, with the most pronounced negative effects observed in highly advanced models. Furthermore, we observe that LLMs frequently produce functionally divergent implementations for the same ambiguous requirement and lack the capability to identify or resolve such ambiguity autonomously. These findings reveal a significant performance gap between clear and ambiguous requirements, underscoring the urgent need for ambiguity-aware techniques in the next generation of automated software engineering tools. The Orchid benchmark is publicly available at https://huggingface.co/datasets/SII-YDD/Orchid. Article Search Article: ase26main-p1878-p doi:10.1145/3832783.3834403
	Hu, Ning	ASE '26: "InfraAPR: An Agent-Based Repair ..." InfraAPR: An Agent-Based Repair Framework for Cloud Infrastructure-as-Code Programs Quan Chen, Zhao Liu, Chunfang Li, Yifan Zhang, Ning Hu, and Qing Liao (Harbin Institute of Technology, Shenzhen, China; Pengcheng Laboratory, China; Hunan University, China; Nanchang University, China) Infrastructure as Code (IaC) is now a routine part of industrial cloud delivery, and Programming Languages IaC (PL-IaC) frameworks further enable engineers to build infrastructure using familiar programming abstractions. However, repairing buggy PL-IaC programs in practice remains costly and highly challenging. Existing quality assurance efforts for PL-IaC have largely concentrated on defect analysis and static checking, while end-to-end automated repair frameworks for PL-IaC programs remain largely absent. In addition, automated program repair techniques designed for general-purpose software often lack PL-IaC-specific domain knowledge, as well as effective modeling and guidance for topology dependencies, making them ineffective for repairing topology-dependent bugs in PL-IaC settings. This paper presents InfraAPR, an agent-based automated repair framework for PL-IaC programs. To enable end-to-end automated repair, InfraAPR integrates three coordinated modules: (1) an InfraAPR Agent Module for phase-specialized LLM reasoning, (2) a Semantic Mapping Module for reconstructing graph-based PL-IaC semantics, and (3) a Constraint-Guided Repair Module that diagnoses constraint violations and generates repaired programs based on structured diagnostics. We evaluate InfraAPR on an industrial benchmark. Experimental results show that InfraAPR consistently outperforms the baselines, achieving a repair success rate of up to 61.8% and improving the strongest baseline by 15.4% on average. These results demonstrate its substantial practical value and improved reliability for industrial PL-IaC workflows. Article Search Article: ase26ind-p338-p doi:10.1145/3832783.3834526
	Hu, Qiang	ASE '26: "IntOAgent: A Practical Framework ..." IntOAgent: A Practical Framework for Automated Detection and Triggering of Integer Overflow Vulnerabilities Yuelin Wang, Jiongchi Yu, Xiaofei Xie, Yaohui Sun, Tianyu Shi, Yanbang Sun, Qiang Hu, and Junjie Wang (Tianjin University, China; Singapore Management University, Singapore) Integer overflows remain a long-standing yet often underestimated class of vulnerabilities in C/C++ software, often leading to logic errors and severe downstream security consequences. Despite their simple arithmetic nature, accurately detecting integer overflows in real-world codebases remains challenging. Existing approaches suffer from poor scalability due to the large search space of arithmetic operations, and often fail to generate triggerable proof-of-concept (PoCs) because jointly satisfying statement reachability and overflow-triggering constraints is inherently difficult. In this paper, we propose IntOAgent, a scalable agent-based framework for automated detection and triggering of integer overflow vulnerabilities. IntOAgent is built on the key insight that reachability and overflow triggering should be treated as distinct yet coordinated tasks. To improve scalability, IntOAgent employs a two-stage filtering strategy to prune provably safe operations and a boundary-aware path prioritization to focus on overflow-prone executions. To enable effective PoC generation, IntOAgent infers input structures and integrates overflow-guided range analysis to drive inputs toward boundary violations while preserving path feasibility. We evaluate IntOAgent on established benchmarks Juliet c and five widely-used real-world projects (SQLite, Libxml2, Libplist, V8, and Libpng) against state-of-the-art directed fuzzing and LLM-based techniques. IntOAgent outperforms existing approaches in both effectiveness and efficiency, discovering all existing vulnerabilities and 117 previously unknown integer overflow vulnerabilities (68 assigned CVEs). These results demonstrate that IntOAgent enables scalable generation of triggerable PoCs, significantly improving the practical detection of integer overflow vulnerabilities. Article Search Article: ase26main-p66-p doi:10.1145/3832783.3834336
	Hu, Qinheping	ASE '26: "Kani: A Model Checker for ..." Kani: A Model Checker for Rust Rémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech (Amazon Web Services, USA; Amazon Web Services, UK; Queen Mary University, UK; Brown University, USA; Datadog, USA; Massachusetts Institute of Technology, USA) Rust's ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust's Mid-level Intermediate Representation (MIR) into CBMC's bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign. Article Search Artifacts Available Article: ase26ind-p163-p doi:10.1145/3832783.3834499
	Hu, Shilong	ASE '26: "An Empirical Study of Security ..." An Empirical Study of Security Risks in the Android Push Notification Ecosystem Shilong Hu, Zikan Dong, Chao Wang, Tianming Liu, and Haoyu Wang (Huazhong University of Science and Technology, China) Push notification services are widely used in mobile apps to deliver time-sensitive content. In the fragmented Android ecosystem, however, no single push service works reliably across all devices and markets, leading developers to integrate multiple push SDKs from device manufacturers and third-party providers. Despite their widespread use, prior studies have focused mainly on Google’s Firebase Cloud Messaging, leaving the security risks of other push services largely unexplored. In this paper, we present a systematic security assessment of the Android push notification ecosystem, covering 11 mainstream push SDKs and 52,748 apps across multiple Android app markets. Our analysis reveals three classes of security risks across the push notification workflow: server secret leakage, notification hijacking, and plaintext exposure of notification payloads. Specifically, we identify 517 apps that leak server secrets, accounting for at least 78.79 billion cumulative installs. These leaks enable attackers to forge notifications with attacker-controlled titles and bodies, redirect users to arbitrary URLs after a click, and, in 9 of the 11 evaluated push services, broadcast such notifications to all users. We further show that four widely used push SDKs are vulnerable to notification hijacking, enabling attackers to reroute victim notifications. In addition, among the 110 communication-oriented apps we evaluated, none protects notification payloads before they enter push service infrastructure, leaving sensitive content exposed in plaintext. These findings show that securing real-world push services requires stronger protections from both app developers and push service providers, highlighting the need for more secure push deployment in industry practice. We responsibly disclosed the issues to push service providers and app developers, and received acknowledgments from affected parties. Article Search Article: ase26ind-p82-p doi:10.1145/3832783.3834475
	Hu, Wei	ASE '26: "FlowChecker: One Command to ..." FlowChecker: One Command to Model Check Control-Flow Rules in Industrial Java Qiuye Wang, Liqing Cao, Wei Hu, and Dengcheng He (Alibaba Cloud Computing, China) Industrial correctness rules often remain implicit, enforced only by review and team convention. Many such rules are temporal control-flow obligations: a cache-loading path must not pollute the cache, an error must not be raised before validity is decided, or a failure must remain visible across component boundaries. Existing formal verification and static analysis techniques can support related checks, but routine use remains hard when each team rule must be recast as custom traversal logic, harness-driven execution exploration, or a tool-specific protocol specification. We present FlowChecker, a developer-facing model-checking system for project-specific temporal control-flow rules. Engineers express rules as reviewable CTL formulas over familiar program events; FlowChecker extracts a finite control-flow model, preserves rule-relevant exception and framework-mediated paths, and checks the formula by evaluating CTL fixpoints in Soufflé, an optimized Datalog engine. This makes temporal control-flow checks repeatable locally and in CI, while keeping verdicts explicitly scoped to the extracted model. Across seven public Java projects, we evaluate 42 checks covering reachability, exception propagation, event ordering, and wrapping/capture, with formulas ranging from single temporal obligations to nested compositions. We additionally study synthetic models up to 10 million states and five sanitized internal adoption cases from Alibaba Cloud Computing. Article Search Article: ase26ind-p388-p doi:10.1145/3832783.3834530
	Hu, Xiaohui	ASE '26: "Airdrop Scams in Practice: ..." Airdrop Scams in Practice: An Industry-Oriented Taxonomy, Benchmark, and Tool Audit Ningyu He, Xiaohui Hu, and Haoyu Wang (Hong Kong Polytechnic University, Hong Kong; Huazhong University of Science and Technology, China) Decentralized finance (DeFi) scams related to airdrops have become a practical security problem for wallet providers, exchanges, and Web3 security teams. Evidence of these scams spans promotional posts, websites, wallet prompts, transactions, token contracts, and incident reports, which makes them difficult to organize systematically and evaluate with automated defenses. In this paper, we review 43 academic sources and 31 industry/grey sources and propose a three-layer framework to characterize the airdrop process. Based on our systematic review, we construct a hierarchical taxonomy of 34 distinct airdrop scam types, including six newly identified categories. We also identify nine academic datasets and seven reliable industry data resources, normalize an integrated corpus with 7,518 malicious addresses, 479,205 website links, and 18,432 real-world scam incidents, and derive a benchmark of 116 airdrop scam cases for automated tool evaluation. We then conduct a behavioral audit of the 12 academic and industry tools identified as accessible by January 2025. Our results show that 16 of 17 academic tools could not be executed through their documented workflows. Among the accessible industry tools, the audit revealed gaps between documented capabilities and observed behavior. The evaluated tools performed better on supported contract and transaction artifacts than on supported promotion- and interaction-layer inputs. These findings lead to practical lessons for preserving workflow evidence, maintaining source provenance during dataset integration, and auditing tools as executable systems rather than feature lists. Article Search Article: ase26ind-p54-p doi:10.1145/3832783.3834465
	Hu, Xing	ASE '26: "RACE-Bench: A Reasoning-Augmented ..." RACE-Bench: A Reasoning-Augmented Benchmark for Repository-Level Code Agents on Feature Addition Shuhan Liu, Zhiyi Zhao, Xing Hu, Kui Liu, Xiaohu Yang, and Xin Xia (Zhejiang University, China) Repository-level code agents have shown strong promise in real-world feature addition tasks, making reliable evaluation of their capabilities increasingly important. However, existing benchmarks primarily evaluate these agents as black boxes based on final test correctness, providing limited insight into how they reason and where failures arise. To address this limitation, we introduce RACE-Bench, a reasoning-augmented benchmark for evaluating code agents on repository-level feature addition tasks. RACE-Bench contains 528 real-world feature addition instances from 12 open-source repositories. Each instance is paired with executable patch verification and structured intermediate reference reasoning covering issue understanding, file localization, implementation tasks, and step decomposition. Based on this design, we introduce a dual-track evaluation framework that jointly measures patch correctness and intermediate reasoning alignment with developer-accepted reference trajectories. We evaluate three representative repository-level code agents on RACE-Bench. On the full benchmark, Resolved Rate ranges from 29% to 70% across different agents. Our reasoning-level analysis further shows that while current agents perform well at understanding high-level intent, their performance degrades substantially when translating intent into concrete implementation steps. We also find patches that can be applied but still fail the tests cover fewer reference-reasoning elements (35.7% lower recall) and contain more unsupported reasoning elements (94.1% higher over-prediction) than successful patches. These findings highlight the importance of evaluating repository-level code agents beyond final patch correctness by examining the quality of their reasoning processes. Article Search Article: ase26main-p208-p doi:10.1145/3832783.3837426 ASE '26: "Bridging the Gap between Intent ..." Bridging the Gap between Intent and Impact: An Empirical Study of GPU Optimizations in Deep Learning Frameworks Siqi Wang, Fanjing Luo, Xing Hu, Xinyu Wang, and Xin Xia (Zhejiang University, China) Performance optimization is a critical concern in the evolution of deep learning frameworks, as GPU execution dominates training and inference costs. While hundreds of optimizations are proposed to accelerate training and inference, it is unclear how often these changes deliver meaningful gains in practice, and why they sometimes fail. To bridge this gap, we conduct an empirical study of GPU performance optimizations in deep learning frameworks. We analyze 202 performance-related pull requests from the major deep learning frameworks, and categorize them into 22 distinct optimization strategies (e.g., kernel fusion, auto-tuning, and vectorization). This taxonomy reveals a rich set of developer-intended performance improvements spanning logic, execution, and infrastructure levels. Our evaluation reveals that optimization benefits are far from guaranteed. While some strategies achieve substantial speedups, a significant portion exhibit limited gains or even performance regressions when deployed in realistic workloads. To understand these discrepancies, we conduct multi-level benchmarking and microarchitectural profiling, uncovering three recurring root causes of performance degradation: (1) increased register pressure from aggressive fusion, (2) synchronization overhead migration in small kernels, and (3) memory arbitration under high-load kernels. These findings highlight a fundamental challenge in performance engineering: optimizations interact with hardware resources in complex and often counterintuitive ways, making their outcomes difficult to predict. Our study provides the first systematic characterization of these effects, offering insights to guide more reliable and performance-aware optimization in deep learning frameworks. Article Search Article: ase26main-p162-p doi:10.1145/3832783.3834344 ASE '26: "VARIES: Verification Harness ..." VARIES: Verification Harness Synthesis and Efficient Scheduling for Unsoundness Detection in Rust Libraries Huan Li, Xing Hu, Xin Xia, and Xinyu Wang (Zhejiang University, China) Rust provides strong compile-time safety guarantees, but unsafe code in real-world libraries can still introduce unsoundness bugs that may undermine this guarantee. Compared with prior work, bounded model checking (BMC) offers a promising direction by adapting formal verification to unsoundness detection. In practice, however, BMC requires harnesses that are tedious to construct, and many unsoundness bugs arise only under specific program states that a single harness may miss. To this end, we propose Varies, a BMC-based framework that treats unsoundness detection in Rust libraries as a joint problem of harness synthesis and budget-aware verification. During the synthesis stage, Varies builds seed harnesses for each target API and then expands them into derived harnesses through mutator injection. Over the resulting harness derivation tree, Varies applies feedback-driven pruning strategies to schedule verification efficiently. In our benchmark, Varies identifies defects involving target APIs in more evaluated crates than any baseline while maintaining a low false-positive rate. In a broader deployment on popular crates.io libraries, it identifies previously unknown unsoundness in 10 crates, with reports for 6 crates acknowledged by maintainers. The results indicate that stateful harness synthesis and feedback-driven scheduling can make BMC practical for targeted unsoundness detection in Rust libraries. Article Search Article: ase26main-p638-p doi:10.1145/3832783.3837450 ASE '26: "AgentExecutor: Partial Code ..." AgentExecutor: Partial Code Execution via Agentic Context Generation Junkai Chen, Chengran Yang, Xing Hu, Zhenhao Li, Xin Xia, and David Lo (Singapore Management University, Singapore; Zhejiang University, China; York University, Canada) Executing code snippets is essential for dynamic program analysis, but it remains challenging to execute an arbitrary code snippet due to issues like missing context and incomplete dependencies. Existing approaches to partial code execution, such as LExecutor and Treefix, leverage the power of language models to infer missing information and enable execution. However, they suffer from (i) limited action spaces and feedback, and (ii) rigid optimization strategies, which restrict their effectiveness and efficiency. In this paper, we propose AgentExecutor, a novel multi-agent framework for partial code execution. Our approach introduces a three-phase design: execution environment preparation, dynamic exploration with iterative refinement, and prefix evolution via program synthesis. Supported by the power of LLM agents who can think, act, and get feedback iteratively, AgentExecutor is able to autonomously explore a richer action space, enabling diverse operations such as creating resource files and resolving environment configuration. Furthermore, it adopts adaptive optimization strategies, including coverage-guided context pruning and prefix evolution via program synthesis, to systematically improve the execution quality of partial code. We evaluate AgentExecutor on two widely used datasets comprising Stack Overflow snippets and open-source project code. The results show that AgentExecutor achieves up to 94% and 90% code coverage, outperforming the state-of-the-art approach Treefix by 19.9% and 13.8%, respectively. In addition, AgentExecutor significantly reduces execution time (by up to 80.3%) and cost (by up to 56.6%). These findings demonstrate that AgentExecutor provides an effective and efficient solution for partial code execution. Article Search Article: ase26main-p477-p doi:10.1145/3832783.3834355 ASE '26: "Assessing the Cross-Version ..." Assessing the Cross-Version Applicability of Java Library Vulnerability Exploits Zirui Chen, Qi Zhan, Jiayuan Zhou, Xing Hu, Xin Xia, and Xiaohu Yang (Zhejiang University, China; Queen's University, Canada; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China) Open-source software supply chain security relies heavily on assessing affected versions of library vulnerabilities. While prior studies have leveraged exploits for verifying vulnerability-affected versions, they point out a key limitation that exploits are version-specific and cannot be directly applied across library versions. Despite being widely acknowledged, this limitation has not been systematically validated at scale, leaving the actual applicability of exploits across versions unexplored. To fill this gap, we conduct the first large-scale empirical study on exploit applicability across library versions. We construct a comprehensive dataset consisting of 259 exploits spanning 128 Java libraries and 28,150 historical versions, covering 61 CWEs that account for 76.3% of vulnerabilities in Maven. Leveraging this dataset, we investigate the root causes of inconsistencies between exploit cross-version execution behaviors and ground truth, while also exploring strategies for exploit migration. Our results (RQ1) show that, even without migration, exploits achieve 83.0% recall and 99.3% precision in identifying affected versions in Java, outperforming most widely used vulnerability databases and assessment tools. Notably, this capability enables us to contribute more than 1,400 confirmed missing affected versions to the CPE dictionary. We investigate the remaining exploit failures (RQ2) and find that they mainly stem from compatibility issues introduced by library evolution and changing environmental constraints. Based on these observations, we manually migrate exploits for 1,885 versions and distill a taxonomy of 10 strategies from these successful adaptation cases (RQ3), thereby increasing the overall recall to 96.1%. Our findings underscore the cross-version potential of exploits and lay a foundation for future research. Article Search Article: ase26main-p1292-p doi:10.1145/3832783.3834383 ASE '26: "EMERGE: Checking Implementation ..." EMERGE: Checking Implementation Equivalence for LLMs via Rule Synthesis Qi Zhan, Xing Hu, Xin Xia, and Shanping Li (Zhejiang University, China) Verifying whether two implementations of the same large language model are equivalent across frameworks is difficult in practice. Even when they implement the same computation, the graphs may differ in operator decomposition, tensor layout, and the use of fused or opaque kernels, making manual rewrite rules hard to build and maintain. We present Emerge, a framework for checking Implementation Equivalence over computation graphs extracted from model implementations. Instead of writing rules manually, Emerge infers candidate relations from execution values, and synthesizes rewrite rules on demand when existing rules are insufficient. Each synthesized rule is then validated using SMT solving when possible and constraint-aware randomized testing for opaque kernels. As these local equivalences accumulate, Emerge eventually establishes whether the two implementations are equivalent. Our implementation targets inference computation graphs captured from HuggingFace Transformers and vLLM. Our evaluation shows that Emerge establishes equivalence for correct implementation pairs at practical cost. It also detects 10 of 13 known implementation bugs, uncovers 8 previously unknown implementation issues that were later confirmed by developers, and localizes the first mismatch when equivalence cannot be established. Article Search Article: ase26main-p1924-p doi:10.1145/3832783.3834405 ASE '26: "SmellCC: A Tool for Automated ..." SmellCC: A Tool for Automated Code Smells Remediation Xiaoting Zhang, Yujie Zhang, Zhipeng Gao, Xing Hu, and Xin Xia (Zhejiang University, China; Shanghai Institute for Advanced Study of Zhejiang University, China) Code smells significantly threaten software maintainability by accumulating technical debt, yet developers often lack the resources to manually address these flaws under tight release schedules. While static analysis tools like SonarQube provide precise detection, they function largely as passive alert systems, leaving the burden of refactoring on developers. To bridge this gap, we present a novel cleaning tool, namely SmellCC, a Visual Studio Code extension that augments SonarQube with an LLM-based pipeline to automatically detect and refactor Python code smells. By employing Chain-of-Thought (CoT) and few-shot learning, SmellCC provides in-place, one-click remediation for the top-10 most frequent smells, effectively preventing the accumulation of technical debt during development. Our quantitative evaluation demonstrates that our is promising in helping developers effectively eliminate code smells (96.8% cleaning rate) with high accuracy (i.e., 91.3%), ensuring that the refactored code remains syntactically correct and behavior-preserving, thereby significantly improving long-term software maintainability. The full paper underlying this tool has been published in ACM Transactions on Software Engineering and Methodology [], where SmellCC was introduced and evaluated as an offline pipeline for large-scale code corpus cleaning. Extending this prior work, the present paper focuses on an IDE-native implementation of SmellCC that translates SonarQube for IDE diagnostics into interactive, in-place refactoring actions within Visual Studio Code. Article Search Article: ase26tool-p47-p doi:10.1145/3832783.3834611
	Hu, Yong	ASE '26: "Fuzz4DB: A Practice of LLM-Agent-Guided ..." Fuzz4DB: A Practice of LLM-Agent-Guided Fuzzing for Database Feature-Level Delta Testing Chunling Qin, Yong Hu, Xiao Zhang, Jinchuan Chen, Fangtao Gu, Baoxun Wang, Yuxing Chen, Anqun Pan, and Lixiong Zheng (Renmin University of China, China; Tencent, China) Modern database management systems (DBMSs) evolve rapidly via frequent feature commits, yet validating each code delta within a 24-hour Continuous Integration (CI) budget remains an industrial challenge. Traditional manual regression testing is labor-intensive, while existing automated tools fall short: generation-based fuzzers achieve high throughput but are change-unaware, whereas LLM-based agents understand feature deltas but are orders of magnitude too slow for systematic testing. This paper presents Fuzz4DB, an LLM-agent-guided fuzzer designed for targeted DBMS feature testing. Fuzz4DB decouples LLM-based semantic planning from grammar-based test instantiation, bridging the gap between semantic awareness and generation efficiency. The LLM-powered agent of Fuzz4DB analyzes code deltas and coverage feedback to synthesize test directives—structured specifications at three precision levels, namely grammar scopes, derivation paths, and context–query template pairs. A grammar-based fuzzer then expands each directive into batches of valid SQL test cases. A coverage feedback loop escalates directive precision as coverage growth stalls. Running in the TDSQL production environment for over six months, Fuzz4DB has intercepted 74 zero-day bugs, accounting for ∼40% of all SQL-subsystem bugs. In evaluations across 12 feature commits from 5 mainstream DBMSs, Fuzz4DB achieved 86.9% delta code coverage, outperforming the best automated baseline by 36.9%. Over its full lifecycle on four open-source DBMSs, Fuzz4DB discovered a total of 62 unique bugs (45 newly confirmed by upstream communities), 59 of which were undetectable by state-of-the-art tools within the 24-hour CI window. Furthermore, Fuzz4DB reduces per-commit validation effort from ∼5 person-days to ∼1 person-day, an ∼80% reduction. Article Search Article: ase26ind-p161-p doi:10.1145/3832783.3834498
	Hu, Yongchang	ASE '26: "Smart Brain: Semantic Anomaly ..." Smart Brain: Semantic Anomaly Detection for Operational Time Series in Large Scale Service Systems Hang Cui, Zexin Wang, Jingjing Li, Juncheng Hu, Haotian Si, Cenjie Hu, Quan Zhou, Yongchang Hu, Lei Han, Dan Pei, Changhua Pei, and Gaogang Xie (University of Chinese Academy of Sciences, China; Computer Network Information Center at Chinese Academy of Sciences, China; Jilin University, China; Independent Researcher, China; Shenyang Institute of Automation at Chinese Academy of Sciences, China; Huawei Technologies, China; Tsinghua University, China) Time series anomaly detection is a core component of operational automation in large scale service systems. However, most existing methods model anomalies as numerical deviations in the data space, while real software operations require decisions over whether an observed behavior constitutes an actionable abnormal event. This mismatch often leads to brittle thresholds, excessive false alerts, and outputs that are difficult for operators to interpret and act upon. In this paper, we argue that practical anomaly detection should move from point-centric data anomaly detection to semantic anomaly detection. We present Smart Brain, a two stage framework for semantic anomaly detection in operational time series. Stage I extracts structured temporal evidence by recognizing interpretable anomaly patterns. Stage II combines the extracted evidence with metric semantics and operator authored rules to produce semantic anomaly decisions and human-readable explanations. Through evaluation on benchmark datasets and real industrial monitoring scenarios, we show that Smart Brain improves operationally meaningful anomaly identification while providing stronger interpretability and deployment suitability than score centric pipelines. Beyond the framework itself, our study offers practical lessons for building anomaly detection systems in production software environments, highlighting the importance of semantic grounding, structured evidence, and lightweight adaptation to evolving services. Article Search Article: ase26main-p337-p doi:10.1145/3832783.3837436
	Hu, Zhichao	ASE '26: "RepoProbe: Benchmarking Architecture-Aware ..." RepoProbe: Benchmarking Architecture-Aware Repository Comprehension with Checklists Yuexi Yang, Alyssa Wu, Ji Luo, Richeng Xuan, Zhichao Hu, Yuhong Liu, and Zhen Qin (Zhejiang University, China; Tencent, China) The integration of Large Language Models (LLMs) into software engineering has shifted the focus from function-level generation to repository-scale assistance. However, existing benchmarks largely rely on bug reports from GitHub Issues, which often allow models to bypass genuine understanding via pattern matching on error logs. This misalignment under-measures Edit Bias, which refers to premature generation, where models prematurely propose code modifications instead of understanding the existing repository architecture. Furthermore, current LLM-as-a-Judge scalar scoring suffers from high variance and low interpretability. This work introduces RepoProbe, a novel benchmark for evaluating repository-level code understanding through open-ended Q&A using GitHub Discussions, which focuses on open-ended architectural inquiries rather than defect reporting. To ensure rigorous evaluation, we propose a Checklist-Based Verification Protocol that decomposes answers into atomic, verifiable facts, thereby replacing subjective ratings with objective verification. Our evaluation of state-of-the-art (SOTA) LLMs reveals a persistent gap between high clarity and evidence-grounded technical correctness. It also quantitatively confirms the prevalence of edit bias, in which models prioritize code generation instead of architectural analysis. Finally, we demonstrate that our verification protocol significantly improves evaluation reliability compared to traditional evaluations with scalar scoring. Article Search Artifacts Available Article: ase26main-p676-p doi:10.1145/3832783.3837452
	Hua, Amy	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Hua, Hoang-Quoc-Bao	ASE '26: "GraphLedger: Repository-Level ..." GraphLedger: Repository-Level Vulnerability Detection via Graph-Based Compression and Assumption Validation Thi-Hong-Cuc Le, Hoang-Quoc-Bao Hua, and Xuan-Bach Le (Ho Chi Minh City University of Technology, Vietnam) Repository-level vulnerability detection requires reasoning across files, procedures, and long-range dependency chains. This is difficult for both dominant families of methods: static analysis often over-approximates and produces many false positives, while LLM-based approaches struggle with large repository context and may generate plausible but unsupported claims. We present GraphLedger, a framework that combines Adaptive Assumption-Corroborating Compression (AACC) with an Assumption Ledger for structured hypothesis verification. AACC reduces repository context while preserving vulnerability-relevant dependency structure. The LLM then proposes explicit vulnerability hypotheses over the compressed context, and the ledger validates their assumptions against repository evidence, producing Verified, Rejected, or Inconclusive outcomes. This makes repository-scale reasoning more auditable and less prone to unsupported conclusions. GraphLedger targets taint-style, source–sink vulnerability hypotheses with bounded inter-procedural evidence, rather than arbitrary vulnerability classes. We conduct a controlled cross-method evaluation on CWE-Bench-Java and a complementary within-system component analysis on CVEfixes. On CWE-Bench-Java, AACC achieves 0.71 token reduction while retaining 0.90 of dependency edges and 0.88 of taint paths. On a documented, repository-disjoint 100-repository CWE-Bench-Java evaluation partition, GraphLedger achieves 0.77 precision, 0.76 recall, and 0.76 F1, and reduces false discovery rate from 0.41 to 0.23 relative to VulAgent under a controlled shared-backend evaluation. These results show that combining structure-aware compression with assumption validation improves the reliability and transparency of repository-level vulnerability detection. Article Search Artifacts Available Article: ase26main-p2655-p doi:10.1145/3832783.3834420
	Hua, Ziyue	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477
	Huang, Chengzi	ASE '26: "MIMOS-Tools: An Integrated ..." MIMOS-Tools: An Integrated Toolchain for Model-Based Design of Embedded Systems Wang Yi, Chengzi Huang, Behnam Khodabandeloo, and Duc Anh Nguyen (Uppsala University, Sweden) Despite decades of progress in model-based methods and tools for embedded real-time systems, there is still no integrated environment that supports the entire development lifecycle. This paper presents MIMOS-Tools, a comprehensive toolchain spanning the key phases of development, including modeling, simulation, formal verification, real-time scheduling, schedulability and end-to-end latency analysis, and code generation for heterogeneous multicore platforms. All phases are grounded in a single, coherent, and deterministic model of computation: the MIMOS model, a multi-rate task graph formalism for which we present a formal operational semantics and establish both functional and timing determinism. This semantic foundation ensures that properties verified at the model level are preserved throughout the development process and in the generated implementation. A distinguishing feature of MIMOS-Tools is its support for not only deterministic but also modular, compositional design. Unlike synchronous design environments such as SCADE and Simulink, which rely on a global base clock and offline static scheduling, MIMOS-Tools supports time-triggered asynchronous communication together with flexible real-time scheduling of computation. This removes the tight global coupling of the synchronous paradigm: components can be added, modified, or updated without recomputing a system-wide schedule, enabling scalable and incremental design and dynamic updates throughout the system lifecycle. However, MIMOS-Tools also supports Simulink models when the deadlines of tasks are set to zero to emulate the zero-time semantics of synchronous design. The toolchain is available at https://uu-mimos.github.io. Article Search Article: ase26tool-p77-p doi:10.1145/3832783.3834624
	Huang, DaWei	ASE '26: "SpecFSM: Extracting and Repairing ..." SpecFSM: Extracting and Repairing Finite State Machines from Protocol Specification Documents Xiangdong Li, DaWei Huang, Jingjing Guan, and Hui Li (Beijing University of Posts and Telecommunications, Beijing, China) Finite state machines (FSMs) are a fundamental abstraction for modeling dynamic system behavior and are widely used in protocol analysis. However, automatically extracting FSMs from natural-language specifications remains challenging. Protocol documents are often lengthy and structurally complex, with state-transition descriptions scattered across the text. As a result, large language models (LLMs) operating under incomplete context are prone to generating spurious transitions and logically flawed FSMs. In this paper, we propose SpecFSM, a framework for the automatic extraction and repair of protocol FSMs from natural-language specifications. SpecFSM combines state completion, evidence tracing, and formal verification into a unified pipeline that infers missing states, constrains incorrect transitions, and repairs logical defects in the extracted models. Experiments on multiple protocol documents show that SpecFSM improves the average number of correctly extracted state transitions by 54.7% over existing methods, while producing FSMs with stronger logical validity and better interpretability. Article Search Artifacts Available Article: ase26main-p13-p doi:10.1145/3832783.3834331
	Huang, Haiyu	ASE '26: "OpsLens: Runbook-Free Root ..." OpsLens: Runbook-Free Root Cause Analysis via Multi-agent Collaboration and Tool Management Haiyu Huang, Jiewei Lyu, Gou Tan, Pengfei Chen, Zhihan Jiang, Guangba Yu, Penghui Mi, Fuqiang Wang, Jian Han, Chongkang Tan, and Michael R. Lyu (Sun Yat-sen University, China; Chinese University of Hong Kong, China; Huawei, China; Independent Researcher, China) Root Cause Analysis (RCA) is critical for cloud service reliability, requiring correlation of multi-modal observability data (i.e., traces, logs, and metrics) to identify failure causes. Current LLM-based RCA approaches face two key limitations: over-reliance on system-specific artifacts (e.g., runbooks), limiting transferability; and difficulty ensuring the quality and reuse of LLM-generated diagnostic tools across modalities. To address these issues, we propose OpsLens, an RCA framework that combines modality-specialized multi-agent collaboration with quality-focused tool management , including feedback-driven refinement and a tool graph with scoreboard. On OpenRCA (335 real-world incidents from three production systems), OpsLens achieves a score rate of 0.80, outperforming baselines by 1.79–4.75×. More importantly, OpsLens has been tested on Platform A in Huawei since June 2025, achieving over 80% RCA accuracy across two industrial datasets and reducing diagnosis time from over 1 hour to under 5 minutes. Article Search Artifacts Available Article: ase26ind-p181-p doi:10.1145/3832783.3834501
	Huang, Hong	ASE '26: "LARA: Static ReDoS Detection ..." LARA: Static ReDoS Detection for Regular Expressions with Lookahead via Matching Automata Mengxi Wang, Chengyao Peng, Weihao Su, Guiyi He, Rongchen Li, Hong Huang, and Haiming Chen (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) with lookahead assertions are widely used in modern software, yet their interaction with backtracking engines can cause Regular expression Denial of Service (ReDoS) vulnerabilities. Existing static methods rely on 𝜀-NFA ambiguity analysis, which cannot capture lookahead evaluation cost, while dynamic and hybrid methods incur high cost or incomplete coverage. We present LARA, a static ReDoS detector for regular expressions with lookahead (REwLA), which subsumes standard regexes. Our core contribution is the matching NFA, which transforms a REwLA into a standard 𝜀-NFA. The matching NFA is not language-equivalent to the original REwLA; however, we prove that its match degree equals the la-match degree of the original REwLA, so the same complexity upper bound is preserved, including lookahead overhead. This reduces lookahead-aware ReDoS detection to standard 𝜀-NFA ambiguity analysis, enabling existing detection techniques to be applied directly to the matching NFA. We evaluate LARA on 42,794 deduplicated real-world REwLA. Among 5,889 vulnerabilities jointly confirmed by multiple tools and validated on real backtracking engines, LARA identifies 5,871, outperforming all baselines. On 400 confirmed vulnerable regexes from 177 real-world ReDoS CVEs, LARA achieves 99.50% recall. LARA successfully exploits 4,468 vulnerabilities on real engines, with a median analysis time of 0.05 s and 7.67 MB memory. Article Search Article: ase26main-p997-p doi:10.1145/3832783.3837475 ASE '26: "ReSEDA: Automatic and Precise ..." ReSEDA: Automatic and Precise Program-Level ReDoS Triage via Interprocedural Taint Analysis and Agentic Exploit Generation Rongchen Li, Weihao Su, Chengyao Peng, Hong Huang, Haiming Chen, and Guiyi He (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) are widely used in computer science, particularly in web services. However, Regular Expression Denial-of-Service (ReDoS) has become a growing security threat. ReDoS is an asymmetric Denial-of-Service attack that exploits the super-linear runtime behavior of regex engines. However, existing ReDoS detection tools only report whether regexes cause the super-linear matching behavior, instead of considering whether the behavior can be triggered in the program context. As a result, triaging such findings remains expensive for developers in practice. We present ReSEDA, an automatic and precise workflow that triages ReDoS alerts and generates executable proofs of concept (PoCs) for vulnerable JavaScript programs. The workflow employs (i) Interprocedural Finite Distributive Subset (IFDS) taint analysis, (ii) Satisfiability Modulo Theories (SMT) solving for supported path-feasibility and ReDoS constraints, and (iii) Large Language Model (LLM) agents for PoC construction with Model Context Protocol (MCP) tools that provide static evidence. From 86 most starred JavaScript projects in GitHub, we confirm that among 637 regexes reported to be vulnerable, there are only 63 regexes which can be exploited by injection through external interfaces, where ReSEDA is able to identify and generate PoCs for 61 of them automatically. We also discover that the assistance of ReSEDA reduces analyst-hours by 8.78× using $2.01 per vulnerability, or by 7.86× for free in a local-LLM setting. Furthermore, ReSEDA uncovered 27 impactful ReDoS vulnerabilities with assigned CVE IDs, including 8 disclosed fully automatically. Article Search Article: ase26main-p2923-p doi:10.1145/3832783.3837545
	Huang, Jiayi	ASE '26: "From Function to Repository: ..." From Function to Repository: Towards Understanding and an Agentic Approach for Repo-Level Directed Input Generation Haoyu Wang, Ming Wen, Haoran Yan, Jiayi Huang, Xuanhua Shi, and Hai Jin (Huazhong University of Science and Technology, China) Directed Input Generation (DIG) aims to automatically construct an input that reaches a specified target program location. Although recent studies have shown promising results for Large Language Models (LLMs) in function-level DIG, it remains unclear whether such effectiveness generalizes to realistic repository-level testing scenarios. Unlike function-level settings, repository-level DIG requires reasoning over long call chains, project-specific input semantics, and complex execution conditions distributed across real software repositories. To address this gap, we present a comprehensive empirical study of repository-level directed input generation with LLMs. Specifically, we construct a benchmark, RepoEval, containing hard-to-cover target lines across mainstream programming languages, and evaluate multiple state-of-the-art LLMs under different context and output settings. Our results show that repository-level DIG remains substantially more challenging than prior simplified settings. While advanced models can cover a portion of targets (from 16.02% to 37.35%), their effectiveness is strongly compromised by repository specific semantic constraints, context settings, output formats, and external execution conditions. Based on these findings, we design AgenticDIG, an agentic workflow that integrates target-oriented analysis, intention extraction, fault injection, and iterative feedback to improve repository-level DIG. Evaluation shows that AgenticDIG improves target coverage by 43.56% relative to the best baseline. Article Search Article: ase26main-p2631-p doi:10.1145/3832783.3837537
	Huang, Jielong	ASE '26: "KRCA: An Efficient Root Cause ..." KRCA: An Efficient Root Cause Analysis System in Hyper-scale Microservice Systems via Agentic AI Jiamin Jiang, Jingfei Feng, Yu Luo, Qingliang Zhang, Yongqian Sun, Wenwei Gu, Shenglin Zhang, Tianyu Cui, Yao Wu, Jielong Huang, Nan Qi, and Dan Pei (Nankai University, China; Kuaishou Technology, China; Tsinghua University, China) Hyper-scale microservice systems have become the standard infrastructure for large-scale Internet companies. These systems consist of numerous loosely coupled microservices that evolve independently through continuous development and deployment. Such complexity makes failures unavoidable, necessitating efficient Root Cause Analysis (RCA) to help Site Reliability Engineers (SREs) quickly localize root cause services and classify failure types. However, existing RCA methods often struggle to adapt to the extreme dynamism and massive scale of these systems. In this paper, we present KRCA, an end-to-end RCA system designed for hyper-scale microservice systems. To manage the vast search space, KRCA employs a multi-stage pipeline that begins with an API-level drilldown to isolate suspicious services. It then instantiates a skeleton-based causal graph from anomalous metrics to serve as a high-recall structural prior, before utilizing a memory-augmented multi-agent framework to verify causality and generate the final failure report. By combining structured causal constraints with multi-agent reasoning, KRCA balances diagnostic accuracy with the efficiency requirements of real-time production use. Experimental results show that KRCA achieves AC@1 scores of 0.88 and 0.79 for root cause service localization and failure type classification, outperforming the strongest baseline by at least 31% in absolute gains. KRCA has been deployed in Kuaishou's production environment for over six months, reducing the average diagnosis time by 77.3%. Article Search Article: ase26ind-p61-p doi:10.1145/3832783.3834468
	Huang, Jinhao	ASE '26: "RustGTC: Constraint-Guided ..." RustGTC: Constraint-Guided Test Generation for Rust APIs via Comment Analysis and Code Context Yichi Zhang, Jinhao Huang, and Yang Feng (Peking University, China; Institute of Software at Chinese Academy of Sciences, China; Nanjing University, China) Manually crafting test cases for Rust APIs is labor-intensive and error-prone, especially because of Rust’s advanced features and complex trait system. Recent advances in large language models (LLMs) have shown promise in automated test generation; however, existing approaches often underuse documented input requirements embedded in API comments. We present RustGTC, a framework that uses API comments to guide Rust API test generation. RustGTC extracts documented parameter constraints from comments, constructs tests around boundary cases, and repairs generated tests to improve compilability. We evaluate RustGTC on 12 Rust crates, achieving high coverage and uncovering 41 defects. Additionally, we submitted 132 test cases; 123 were accepted, 9 were rejected. These results show that RustGTC uses documented constraints to guide Rust API test generation and reveal comment-code inconsistencies around boundary cases. Article Search Article: ase26main-p2466-p doi:10.1145/3832783.3837531
	Huang, Jinjun	ASE '26: "RealisticTritonBench: A Benchmark ..." RealisticTritonBench: A Benchmark for Triton-Kernel Generation in Real-World AI Frameworks Jinjun Huang, Zhongzhen Wen, Tongtong Xu, Meng Yan, Xin Xia, and Zhongxin Liu (Zhejiang University, China; Nanjing University, China; Huawei, China; Chongqing University, China) In modern AI frameworks, the GPU kernel is a key determinant of overall system performance. By combining usability, portability, and near-handwritten CUDA performance, Triton has been widely adopted for implementing GPU kernels. Recent advances have shown the potential of using large language models (LLMs) to automatically generate Triton kernels, helping reduce the manual effort required by expert kernel developers. To evaluate the quality of LLM-generated Triton kernels, several benchmarks have been proposed. However, existing benchmarks primarily target isolated kernel generation tasks and suffer from three key limitations: (1) they restrict the task to only PyTorch-to-Triton translation, thus failing to reflect the diversity and complexity of real-world Triton tasks; (2) they evaluate only the performance of individual kernels, limiting the evaluation of real-world performance of generated kernels in AI frameworks, where end-to-end performance is the core criterion for real deployment; (3) they rely on manually written evaluation scripts for single kernel, which may introduce vulnerabilities and allow models to exploit evaluation flaws to bypass correctness checks and obtain inflated scores. To address these limitations, we introduce RealisticTritonBench, the first benchmark that derives Triton kernel generation tasks from real-world pull requests in popular AI frameworks, enabling evaluation under realistic, production-like settings. RealisticTritonBench systematically extracts real-world PRs with Triton kernel modified from popular open-source AI frameworks and transforms them into kernel generation tasks with concrete engineering contexts. Each task takes a natural language requirement as input and requires to generate a corresponding Triton kernel implementation. RealisticTritonBench also provides a complete and reproducible evaluation environment for each task. In contrast to prior benchmarks that focus on isolated kernel performance, RealisticTritonBench integrates generated kernels into their original frameworks and evaluates them under end-to-end test, enabling a more faithful assessment. We conduct a systematic evaluation of the state-of-the-art LLMs on RealisticTritonBench, revealing that they still struggle to handle the challenges in real-world Triton generation tasks. Article Search Article: ase26main-p721-p doi:10.1145/3832783.3837457
	Huang, Junjie	ASE '26: "MicroAgent: Context-Augmented ..." MicroAgent: Context-Augmented Multi-agent Framework for Automatic Microservice Decomposition Zishan Su, Junjie Huang, Shiwen Shan, Xingyan Chen, Hui Zeng, Yuxin Su, Yanlin Wang, and Michael R. Lyu (Chinese University of Hong Kong, China; Sun Yat-sen University, China) The adoption of Microservice Architecture (MSA) has revolutionized software engineering by enhancing scalability, agility, and maintainability over traditional monolithic applications. As more developers transition their legacy systems to microservice-based architectures, effective microservice decomposition—partitioning monolithic applications into highly cohesive services—becomes vital. However, this decomposition task presents significant challenges. Manual approaches are time-consuming and labor-intensive. Existing automated methods often fail to capture the necessary semantic insights from complex applications, while naive applications of Large Language Models tend to overlook crucial contextual information and design principles, leading to suboptimal results. To address these challenges, we propose MicroAgent, a Context-Augmented Multi-Agent Framework for Microservice Decomposition. Our framework divides the decomposition process into five distinct subtasks and assigns each to a specialized agent. To enhance the effectiveness of each agent, we provide tailored, multi-granularity context that keeps its analysis focused and mitigates information overload. Furthermore, to ensure the decomposition adheres to established design principles, we integrate analytical tools that guide the agents’ decision-making. Experimental evaluations on 10 Java Web applications demonstrate that MicroAgent achieves an average decomposition accuracy of 89.2%, outperforming the state-of-the-art method by 24.6%. We also conduct a case study to highlight the practical benefits of our design. Article Search Artifacts Available Article: ase26main-p3640-p doi:10.1145/3832783.3834441
	Huang, Kai	ASE '26: "A11YRepair: Bridging Web Accessibility ..." A11YRepair: Bridging Web Accessibility Barriers via Knowledge-Enhanced Divide-and-Conquer Repair Kai Huang, Ling Zhu, Jian Zhang, Xiaofei Xie, and Chunyang Chen (TU Munich, Germany; Nanyang Technological University, Singapore; Singapore Management University, Singapore) Web accessibility (A11Y), which ensures web content is perceivable and usable for users with disabilities, is a critical requirement for modern web applications. Yet existing tooling overwhelmingly focuses on detecting A11Y violations rather than repairing them. Automated program repair (APR) techniques appear promising for this setting, but our study shows that state-of-the-art APR systems perform poorly when applied to real-world A11Y violations. Unlike conventional sparse-bug scenarios, web A11Y issues often manifest as multiple structurally related violations per page, requiring coordinated edits across multiple files. Existing repair systems fail to manage this multi-fault scale, as they handle each bug individually without considering their relationships or incorporating domain rules such as the Web Content Accessibility Guidelines (WCAG). We propose A11YRepair, an LLM-based framework designed specifically for web A11Y repair. A11YRepair introduces a divide-and-conquer workflow that first clusters violations requiring coordinated edits to reduce redundant localization, and then decomposes each cluster by root cause so the LLM can generate focused and consistent patches. The framework further incorporates WCAG-driven knowledge to strengthen domain awareness during both fault localization and patch synthesis. To support systematic evaluation, we construct A11YBench, a benchmark of 60 real-world web projects collected from GitHub. Experimental results show that A11YRepair achieves higher repair effectiveness and lower cost than state-of-the-art baselines, and ablation studies confirm the importance of its divide-and-conquer design and selective domain knowledge integration. Specifically, patches generated by A11YRepair have been merged into open-source projects from Google, Microsoft, Facebook, IBM, K8s, Docker, and Alibaba, demonstrating its practical value in real-world dev scenarios. This work demonstrates the promise of LLM-driven accessibility repair and highlights the importance of combining structured repair strategies with domain expertise to advance inclusive software engineering. Article Search Artifacts Available Article: ase26main-p37-p doi:10.1145/3832783.3834334
	Huang, Lejing	ASE '26: "GraphQLer: Enhancing GraphQL ..." GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing Omar Tsai, Jianing Li, Tsz Tung Cheung, Lejing Huang, Hao Zhu, Jianrui Xiao, Iman Sharafaldin, and Mohammad A. Tayebi (Simon Fraser University, Canada; Forward Security, Canada) GraphQL APIs power production systems across financial services, e-commerce, and social platforms, yet their most critical access-control vulnerabilities—Insecure Direct Object Reference (IDOR), Use-After-Free (UAF), and state-dependent injection—routinely escape automated security testing. Industry-standard scanners (ZAP) and the leading research fuzzer (EvoMaster) test operations in isolation and cannot compose the multi-step sequences these flaws require. We present GraphQLer, an open-source automated security testing framework built for production GraphQL APIs. GraphQLer constructs a typed dependency graph from live schema introspection and synthesizes vulnerability chains—ordered operation sequences targeting specific flaw classes. Three strategies cover the critical attack surface: topological SCC-traversal for general reachability, cross-user IDOR replay for broken access control, and CREATE→DELETE→READ synthesis for UAF. On a production financial API (FinServ), GraphQLer identified eight potential vulnerabilities—including denial-of-service vectors that exposed stack traces and sensitive implementation details—without prior documentation or authentication credentials. On a self-hosted Saleor instance pinned to the CVE-2022-39275 commit, GraphQLer reproduced all four broken-access-control mutations cited in the security advisory. On the 11 public APIs of the coverage set, GraphQLer achieves 85.52% mean PositiveCoverage versus 29.29% (EvoMaster) and 21.80% (ZAP); across the 21 evaluated APIs it detects all 5 confirmed IDOR endpoints, UAF behavior on two controlled schemas, and confirms XSS and SQLi on DVGA (an independent third-party oracle)—while all baselines detect zero chain-based vulnerabilities. Article Search Artifacts Available Article: ase26ind-p143-p doi:10.1145/3832783.3834496
	Huang, Liang	ASE '26: "One Is Not Enough: The Untold ..." One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability Fangyuan Zhang, Lyuye Zhang, Lingling Fan, Chengwei Liu, Yinan Li, Liang Huang, Yang Liu, Zheli Liu, and Sen Chen (Nankai University, China; Nanyang Technological University, Singapore; Qi An Xin Technology Group, China) Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling. Article Search Article: ase26main-p694-p doi:10.1145/3832783.3837455
	Huang, Lin	ASE '26: "KVerus: Scalable and Resilient ..." KVerus: Scalable and Resilient Formal Verification Proof Generation for Rust Code Yuwei Liu, Xinyi Wan, Yanhao Wang, Minghua Wang, Lin Huang, and Tao Wei (Ant Group, China; Independent Researcher, China) Repository-scale formal verification is becoming practical for Rust systems, but maintaining and extending proofs remains expensive in real projects. In the Asterinas Rust OS kernel, the CortenMM memory-management module requires Verus proofs that cross file and module boundaries, reuse project-specific lemmas with limited documentation, and survive frequent Verus/toolchain evolution. Existing LLM-based proof-generation methods are mostly designed for small or single-file tasks, and they do not provide the structural project knowledge or verifier-aware repair needed in such a repository-scale verification workflow. This paper presents KVerus, a practical LLM-assisted workflow for Verus proof generation in evolving Rust repositories. KVerus builds a dynamic knowledge base over code metadata, lemma semantics, and Verus/toolchain knowledge. It combines dependency-aware context extraction, semantic lemma retrieval, and error-driven refinement to generate Verus proof code that is checked by the verifier and then reviewed by engineers. In CortenMM, KVerus generated verifier-passing proof patches that verified 23 previously unverified functions, introduced 6 reusable lemmas, and accounted for 21.0% of the proof code in the module; these patches were accepted upstream by Asterinas developers. The CortenMM experience also exposed practical boundary cases, including incorrect specifications that required human repair and generated proofs that benefited from human cleanup. Across benchmarks, KVerus achieves a 51.0% success rate on three repository-level benchmarks with cross-file dependencies, compared with 4.5% for a multi-round prompting baseline, and verifies 80.2% of tasks on three single-file benchmarks. These experiences and results show that LLM-assisted proof generation can move beyond benchmark-oriented synthesis and become a maintainable workflow for repository-scale Rust verification. Article Search Artifacts Available Article: ase26ind-p190-p doi:10.1145/3832783.3834503 ASE '26: "Beyond Benchmarks: A Case ..." Beyond Benchmarks: A Case Study of LLM-Generated Verus Specification Failures on Asterinas Vostd Dugang Liu, Ding Wang, Chao Jiang, Cheng Wen, Zhiwu Xu, Zhong Ming, Yuwei Liu, Xinyi Wan, and Lin Huang (Shenzhen University, China; Ant Group, China) Large language models (LLMs) have recently shown promise in automating formal specification generation, but their effectiveness has mainly been demonstrated on self-contained benchmark tasks. This paper examines the changes that occur when LLM-generated specifications are applied to an industrial verification project. To answer this question, we conducted experiments on Asterinas OSTD's Vostd repository, a Rust-based OS-kernel verification codebase built around cross-file dependencies and Entity--Model proof abstractions. We analyze six formal verification targets spanning 156 function-level tasks, 50 Rust source files, and 7,149 lines of code; the failure corpus contains 1,587 reviewed failure episodes nested within 270 model-specific repair traces produced by DeepSeek-V4-Flash, GPT-4o, and Qwen-Coder. Our results show that existing methods effective on benchmarks face significant challenges on Vostd, and that framework customization for industrial validation is necessary and has considerable potential. LLM-generated specifications break in systematic rather than random ways: they cluster across four verification stages (i.e., repository integration, Verus legality, semantic modeling, and proof construction), and their distributions vary across models and targets. We further show that verifier diagnostics do not always identify the true source of failure, and that verifier-guided repair can regress or stall rather than converge. These findings indicate that LLM-generated specifications fail not merely because industrial code is harder, but because failures are structured, stage-dependent, and often repaired in the wrong direction. Future evaluation and tooling should therefore move beyond final pass/fail outcomes and account for where specifications break, whether diagnostics identify the real cause, and whether repair makes progress or simply cycles through new errors. Article Search Artifacts Available Article: ase26ind-p194-p doi:10.1145/3832783.3834504 ASE '26: "Sound and Efficient Statistical ..." Sound and Efficient Statistical Model Checking for Probabilities and Bounded Rewards Hao Bu, Lin Huang, Tao Wei, and Jingyi Wang (Ant Group, China; Zhejiang University, China) Statistical model checking estimates quantitative properties of stochastic systems, such as the probability that a given property holds and the expected rewards. Ideally, an estimation algorithm should be both sound (i.e. satisfying the given confidence bound) and efficient (i.e. using fewer simulations or producing narrower confidence intervals). However, many existing algorithms are either unsound (e.g. relying on asymptotic approximations like the central limit theorem) or inefficient (e.g. using conservative bounds like the Hoeffding bound). In this paper, we present sound and efficient algorithms for estimating probabilities and bounded expected rewards under three settings: point estimation with absolute error, point estimation with relative error, and interval estimation, yielding six problems in total. For estimating probabilities, we employ a hybrid strategy integrating two existing algorithms in the point estimation with absolute error setting. We adopt suitable existing algorithms in the other two settings. For estimating bounded expected rewards, the unknown distribution shape makes it challenging to design sound and efficient algorithms. To address this, we propose a lifting framework to lift the three algorithms for estimating probabilities to three new algorithms for estimating bounded expected rewards. We formally prove the soundness of the three lifted algorithms and demonstrate their efficiency through experiments. Article Search Article: ase26main-p914-p doi:10.1145/3832783.3834371
	Huang, Mingtao	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Huang, Qi	ASE '26: "Li-WaC: A Lightweight WebAssembly ..." Li-WaC: A Lightweight WebAssembly Container for Independently Upgradable IoT Applications in Xiaomi Vela Bin Liao, Canfeng Zheng, Shiwen Shan, Qi Huang, Junjie Dong, Xiang Xiao, Yaoyao Gu, and Yuxin Su (Beijing Xiaomi Mobile Software, China; Sun Yat-sen University, China) In resource-constrained IoT devices, traditional application runtimes often struggle with limited performance and inflexible update mechanisms. WebAssembly (Wasm) has emerged as a promising technology to overcome these bottlenecks. However, existing Wasm implementations are not yet fully optimized for practical IoT environments, particularly in terms of JavaScript performance and modular over-the-air (OTA) updates on production IoT systems. To fill the gap, we propose Li-WaC, a lightweight, high-performance, and efficiently updatable WebAssembly Container framework for IoT operating systems.Specifically, we integrate a Wasm runtime into the event-driven Context Hub Runtime Environment (CHRE) framework. By treating the Wasm runtime as a standalone dispatch entity, Li-WaC runs Wasm modules as standard nanoapps, similar to native C/C++ applications. Performance-intensive tasks that were previously handled in JavaScript can then be offloaded to Wasm. We implemented and deployed Li-WaC within Vela, a production IoT operating system developed and maintained by Xiaomi, a leading global manufacturer of smartphones and IoT devices. On compute-oriented microbenchmarks, the AOT mode of Li-WaC achieves a 13× average speedup over QuickJS, approaching V8 on these microbenchmarks. In a production deployment study, we also observed smaller update packages, shorter installation times, and higher upgrade adoption rates under modular updates, where the upgrade adoption rate is the share of devices in the target cohort that completed an upgrade within a stated observation window. Article Search Article: ase26ind-p186-p doi:10.1145/3832783.3834502
	Huang, Renjie	ASE '26: "Fully Automating Template ..." Fully Automating Template Polyhedral Analysis by Leveraging LLMs Renjie Huang, Liqian Chen, Hongfei Fu, Banghu Yin, Dengping Wei, and Ji Wang (National University of Defense Technology, China; Shanghai University of Finance and Economics, China) Abstract interpretation provides a generic framework to design static analysis, and has been widely applied in analysis of real-world programs. The scalability and precision of these analyses depend largely on the chosen abstract domain. The template polyhedra domain is well-known for offering a compelling trade-off between scalability and precision. However, designing effective templates currently requires intensive manual effort and domain expertise. In this paper, we propose a bottom-up approach based on Large Language Models (LLMs) to automatically generate linear templates for the template polyhedral analysis. By leveraging the advanced code comprehension capabilities of LLMs, our approach automatically generates highly relevant templates. Based on this approach, we have implemented IKOSplus, a program analyzer supporting fully automated context-sensitive and interprocedural template polyhedral analysis, on top of IKOS. We evaluated IKOSplus on a variety of small-scale benchmark programs and complex real-world programs. Experimental results demonstrate that IKOSplus effectively balances analytical precision and scalability in the template polyhedral analysis. Article Search Artifacts Available Article: ase26main-p849-p doi:10.1145/3832783.3837472
	Huang, Tingxuan	ASE '26: "Revisiting LLMs on New Feature ..." Revisiting LLMs on New Feature Implementation in Real-World Software Development Practices Jia Li, Tingxuan Huang, Tiankuo Zhao, Yiming Wang, Yiran Zhang, Anshun Hu, Kechi Zhang, Lecheng Wang, Zinan Sheng, Kui Liu, Ge Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Peking University, China; Huawei Technologies, China) Implementing new features in existing repositories is a key activity in software development. With the rapid advances in large language models (LLMs), benchmarking their capability in this task has attracted growing attention. However, existing benchmarks deviate from real-world practices in two aspects. First, they provide LLMs with unrealistic information such as target code signatures and file paths, which developers do not have access to in practice. Second, they only evaluate the final generated code using functional tests, without examining intermediate steps like requirement understanding and implementation planning. These limitations make it difficult to faithfully assess LLMs’ actual capabilities and diagnose their weaknesses. To address the above limitations, we conduct a systematic evaluation to revisit the capability of large language models (LLMs) in new feature implementation, with a task setup strictly aligned with real-world software development practices. Our evaluation is built on NFEI, a curated benchmark sourced from merged feature pull requests of active GitHub repositories, where each target feature involves cross-snippet multiple code modifications, and LLMs are only provided with the feature description and the target repository throughout the evaluation. Beyond the realistic input settings, we further annotate fine-grained labels for the intermediate steps of the development workflow, including requirement clarification and implementation planning. This enables our evaluation to support a comprehensive stage-wise assessment across three granularities with seven dedicated metrics. We evaluate seven popular LLMs under two development paradigms and three generation strategies. Results show that new feature implementation remains highly challenging, with an overall average Test Pass Rate of only 29.84%. Our stage-wise analysis reveals that intermediate step quality is closely linked to final code performance, and injecting ground-truth intermediate artifacts yields an average absolute gain of about 18%, yet performance remains limited. Qualitative error analysis further identifies three recurrent failure patterns, suggesting that new feature implementation of LLMs adhering to real-world world software development practices remains challenges. Article Search Article: ase26main-p1768-p doi:10.1145/3832783.3837511
	Huang, Weiqing	ASE '26: "Making Theft Useless: Adulteration-Based ..." Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems Weijie Wang, Peizhuo Lv, Yan Wang, Weiqing Huang, Rujie Dai, Guokun Xu, Qiujian Lv, Hangcheng Liu, Hao Hu, and Jiaheng Zhang (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Henan Key Laboratory of Information Security, China; National University of Singapore, Singapore) Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants. Article Search Article: ase26main-p131-p doi:10.1145/3832783.3837418
	Huang, Xiangjie	ASE '26: "How Quantum Bugs Live and ..." How Quantum Bugs Live and Die: A Lifecycle-Based Empirical Study of Bugs in Quantum Software Yasai Shi, Xiangxin Meng, Xiangjie Huang, Jian Zhang, Tianyu Wo, and Xu Wang (Beihang University, China) Despite growing evidence that bugs in quantum software exhibit distinctive characteristics, existing studies are typically scoped to individual frameworks or single quality attributes and do not examine how quantum-specific bugs behave across the broader software lifecycle. To address this gap, we construct QBugsSet, a lifecycle-based benchmark containing 2,429 bugs and 1,793 realistic negative samples, mined from real GitHub bug-fixing commits in the Qiskit, Cirq, and PennyLane ecosystems, and use it to conduct a comprehensive empirical study comparing quantum-specific and classical bugs across lifecycle distribution, bug-fix latency and pre-fix spatial propagation, repair burden, and LLM-based debugging effectiveness. We find that quantum-specific bugs are more concentrated in semantically critical stages, tend to persist longer before repair (median 17 vs. 7 days), and more often require coordinated multi-hunk repairs (37.8% vs. 27.3%). These lifecycle characteristics highlight a practical limitation of current automation: even the best frontier LLM achieves an end-to-end full repair rate of only 3.82% on quantum-specific bugs, compared with 8.51% on classical bugs. Overall, these findings provide evidence-based guidance for future debugging support that integrates stronger quantum-aware semantic reasoning with broader repository context. Article Search Article: ase26main-p3477-p doi:10.1145/3832783.3834439
	Huang, Yihao	ASE '26: "Clarity Is Not Assumed: Understanding ..." Clarity Is Not Assumed: Understanding LLM-Based Code Generation under Ambiguous Requirements Di Yang, Xinou Xie, Xiuwen Yang, Ming Hu, Yihao Huang, Yueling Zhang, Weikai Miao, Ting Su, Chengcheng Wan, and Geguang Pu (East China Normal University, China; Shanghai Innovation Institute, China) Software requirement ambiguity is ubiquitous in real-world development, stemming from the inherent imprecision of natural language and the varying interpretations of stakeholders. While Large Language Models (LLMs) have demonstrated impressive capabilities in generating code from precise specifications, such ambiguity poses a significant obstacle to reliable automated code generation. Existing benchmarks typically assume clear and unambiguous requirements, leaving an empirical gap in understanding how LLMs behave when faced with the inherent uncertainty of real-world software requirements. In this paper, we introduce Orchid, a code generation benchmark specifically designed with ambiguous requirements. It comprises 1,304 function-level tasks covering four distinct types of ambiguity: lexical, syntactic, semantic, and vagueness. Leveraging this dataset, we conduct the first systematic empirical study to evaluate the impact of requirement ambiguity on LLM-based code generation. Our results demonstrate that ambiguity consistently degrades the performance of all evaluated LLMs, with the most pronounced negative effects observed in highly advanced models. Furthermore, we observe that LLMs frequently produce functionally divergent implementations for the same ambiguous requirement and lack the capability to identify or resolve such ambiguity autonomously. These findings reveal a significant performance gap between clear and ambiguous requirements, underscoring the urgent need for ambiguity-aware techniques in the next generation of automated software engineering tools. The Orchid benchmark is publicly available at https://huggingface.co/datasets/SII-YDD/Orchid. Article Search Article: ase26main-p1878-p doi:10.1145/3832783.3834403
	Huang, Yongheng	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Huang, Yonghui (Andie)	ASE '26: "Regression Accumulation in ..." Regression Accumulation in Multi-turn LLM Programming Conversations Yonghui (Andie) Huang, Lin Ma, Amjed Tahir, Qian Zhang, Liwen Xiao, and Lysa Xiao (Massey University, New Zealand; Alibaba Research Center for Complexity Sciences, China; Hangzhou Normal University, China; University of Otago, New Zealand) In LLM-assisted software development, coding is often iterative. In this paper, single-turn refers to settings where the LLM responds in one request with one code suggestion, whereas multi-turn refers to settings where the LLM responds across multiple sequential requests within the same conversation. Regression accumulation refers to a later code suggestion breaking requirements introduced in earlier turns. Reliability depends not only on satisfying the current turn, but also on preserving requirements in earlier turns. Yet, there are limited evaluations of the accumulation of regression in multi-turn coding conversations. To address this gap, we conduct an empirical study of multi-turn regression in LLM programming. We construct 542 tasks from the HumanEval+ and MBPP+ benchmarks, and instantiate each task as an 8-turn requirement-evolution chain. We evaluate six LLM models on 26,016 turn instances (542×6×8). At each turn, we check if the current code suggestion still passes earlier benchmark tests, and we analyze 384 failure cases drawn from the failure population in our 26,016 turn instances to derive and validate a taxonomy of multi-turn regression bugs through independent four-annotator labeling. Our results show that regression accumulation appears across all six models, with 43% to 73% of tasks losing previously correct behavior over the full conversation. Final-turn quality is lower than initial-turn quality across models, and especially in turns adding input validation or broader input types. Manual analysis shows that Cross-Turn Conflict, where later code conflicts with earlier requirements, is the main failure class. We further find that Verification Gate, which checks new code against prior tests and triggers rollback and retry, is the only strategy that consistently improves all models, raising final-turn quality from 75.8% to 87.9% on DeepSeek-V3 and from 31.6% to 47.3% on Llama-3.1-8B. These findings suggest that strong performance on single-turn tasks can overestimate reliability in multi-turn coding conversations. Future evaluation and tool design should test whether later code suggestions preserve requirements from earlier turns and should include Verification Gate mechanisms. Article Search Artifacts Available Article: ase26main-p579-p doi:10.1145/3832783.3834357
	Huang, Youfei	ASE '26: "S2CAgent: A Self-Learning ..." S2CAgent: A Self-Learning Agent Knowledge Graph Framework for Software Supply Chain Analysis Youfei Huang, Zhong Li, Minxue Pan, and Xuandong Li (Nanjing University, China) The extensive reuse of open-source software (OSS) accelerates development. However, it also creates increasingly complex software supply chains (SSCs) and intensifies the attacker-defender asymmetry, making attacks "low-cost, high-impact, and hard-to-detect." Software Bill of Materials (SBOMs) and Software Composition Analysis (SCA) are widely used for SSC analysis, but both have clear limitations. SBOMs frequently lack vulnerability information, while SCA tools are typically limited to specific ecosystems. To address these limitations, we first construct a multi-source software supply chain knowledge graph (SSCKG) that unifies heterogeneous information and supports continuous evolution through automated updates. Building on this foundation, we propose S2CAgent, a neural-symbolic large language model (LLM) agent framework for SSC analysis. S2CAgent supports natural language questions by inducing symbolic reasoning rules from the SSCKG. These rules align complex questions with underlying graph semantics and multi-hop reasoning patterns. Furthermore, the agent leverages structured evidence from the SSCKG and unstructured web knowledge, thereby mitigating LLM hallucinations and alleviating knowledge incompleteness. In addition, it incorporates a self-learning mechanism that synthesizes and refines tool-augmented trajectories to improve future reasoning. We evaluate S2CAgent on a newly constructed cross-ecosystem benchmark that includes three core tasks: vulnerability impact assessment, software dependency analysis, and license compliance checking. Experimental results show that S2CAgent outperforms baselines across multiple metrics and remains stable under complex multi-hop reasoning. In particular, S2CAgent has been deployed at a leading ICT corporation, where it effectively handles complex real-world analysis cases, further demonstrating its practical utility. Article Search Article: ase26main-p1823-p doi:10.1145/3832783.3837513
	Huang, Yu	ASE '26: "Toward Inclusive Programming ..." Toward Inclusive Programming Support for Novice Programmers with Dyslexia: Insights from a Comparative Study Zihan Fang, Janice Chung, Ruijia Chen, Marcia Barnes, Yuhang Zhao, and Yu Huang (Vanderbilt University, USA; University of Wisconsin-Madison, USA) Programming attracts a diverse range of learners, including individuals with dyslexia, a learning difficulty that affects reading, writing, and spelling despite average intelligence and educational opportunities. Although prior work has examined dyslexia in natural-language and code comprehension, we still know little about how dyslexic learners engage with code relative to natural language, and what this implies for inclusive programming environments. This gap is especially important in the AI era, as novice programmers increasingly rely on AI-powered coding and learning tools that may not address the distinct comprehension and cognitive support needs of learners with dyslexia. To address this gap, we conducted an eye-tracking study with a mixed-methods design involving 24 novice programmers (12 with dyslexia, 12 without) who completed paired code-comprehension and English-comprehension tasks. We found that although the two groups showed similar overall visual scanning patterns, eye-gaze features suggest higher cognitive effort among dyslexic novices during code comprehension. We also found that the performance gap between dyslexic and neurotypical learners was smaller in code comprehension than in English comprehension, suggesting that programming-specific representations may reshape, rather than eliminate, dyslexia-related challenges. In addition, dyslexic novices reported lower confidence, viewed general training methods as less effective, and described difficulties with symbolic elements and structurally complex code. These findings provide an empirical basis for designing AI-assisted programming tools that can detect cognitive overload and adapt explanations, feedback, and task support to better support dyslexic novices. Article Search Article: ase26main-p2412-p doi:10.1145/3832783.3834414 ASE '26: "CodeFault: Predicting Fault ..." CodeFault: Predicting Fault Risks from Code Changes via Multi-modal Learning Yifan Xiao, Shijie Li, and Yu Huang (Peking University, China; China Southern Power Grid, China) Just-In-Time defect prediction identifies fault-inducing code changes but relies solely on static code properties, missing runtime fault patterns. Meanwhile, log-based anomaly detection captures runtime behaviors but lacks visibility into causal code modifications. This disconnect delays fault identification and complicates root cause analysis. We present CodeFault, a multi-modal fault prediction framework that fuses code change semantics with runtime log patterns through two novel mechanisms. Hierarchical Fault Spectrum Alignment (HFSA) projects both modalities into a shared, two-level fault taxonomy space—four coarse and eight fine-grained categories—providing a structured information bottleneck that enables principled cross-modal knowledge transfer. Spectrum-Guided Cross-Modal Attention (SGCA) performs token-level fusion conditioned on fault spectrum agreement, avoiding the degeneracy of pooled-vector approaches while focusing attention on fault-relevant token pairs. A dual-granularity contrastive objective further leverages the taxonomy structure to separate fault-inducing from benign embeddings at both instance and fault-type levels. We evaluate CodeFault on two complementary testbeds. On the public benchmark of 31,142 samples from Defects4J, BugsInPy, and ManySStuBs4J, CodeFault reaches 0.891 AUC-ROC and 0.857 F1-score against 15 prior-art baselines and 2 self-constructed strong late-fusion controls, improving over the strongest code-only baseline by 5.1% AUC and over the strongest late-fusion control by 3.1% AUC (Wilcoxon signed-rank test, Cliff's δ ≥ 0.73). On 2,147 real co-occurring CI/CD pairs collected from 55 GitHub Actions repositories with the CI build outcome as ground truth—the largest non-synthetic CI/CD fault test set in JIT defect prediction to date—CodeFault reaches 0.843 AUC, +4.3% over JIT-Smart, retaining 94.6% of the synthetic-set headline. The framework generalizes to unseen projects with 2.5% average AUC improvement and maintains 97.9% AUC under realistic 15% positive rates. A knowledge-distilled code-only variant achieves 0.862/0.831 AUC on synthetic/real test sets without log inputs, enabling pre-commit deployment. Article Search Artifacts Available Article: ase26main-p759-p doi:10.1145/3832783.3837462 ASE '26: "Programming by Chat: A Large-Scale ..." Programming by Chat: A Large-Scale Behavioral Analysis of 11,579 Real-World AI-Assisted IDE Sessions Ningzhi Tang, Chaoran Chen, Zihan Fang, Gelei Xu, Maria Dhakal, Yiyu Shi, Collin McMillan, Yu Huang, and Toby Jia-Jun Li (University of Notre Dame, USA; Vanderbilt University, USA) IDE-integrated AI coding assistants, which operate conversationally within developers' working codebases with access to project context and multi-file editing, are rapidly reshaping software development. However, empirical investigation of this shift remains limited: existing studies largely rely on small-scale, controlled settings or analyze general-purpose chatbots rather than codebase-aware IDE workflows. We present, to the best of our knowledge, the first large-scale study of real-world conversational programming in IDE-native settings, analyzing 74,998 developer messages from 11,579 chat sessions across 1,300 repositories and 899 developers using Cursor and GitHub Copilot. These chats were committed to public repositories as part of routine development, capturing in-the-wild behavior. Our findings reveal three shifts in how programming work is organized: conversational programming operates as progressive specification, with developers iteratively refining outputs rather than specifying complete tasks upfront; developers redistribute cognitive work to AI, delegating diagnosis, comprehension, and validation rather than engaging with code and outputs directly; and developers actively manage the collaboration, externalizing plans into persistent artifacts, and negotiating AI autonomy through context injection and behavioral constraints. These results provide foundational empirical insights into AI-assisted development and offer implications for the design of future programming environments. Article Search Article: ase26main-p1071-p doi:10.1145/3832783.3834377
	Huang, Yuan	ASE '26: "When Comments Mislead: An ..." When Comments Mislead: An Empirical Study of Outdated Comments in LLM-Based Code Completion Zhikun Xia, Yuan Huang, Xiangping Chen, and Zibin Zheng (Sun Yat-sen University, China) Large language models (LLMs) are widely used for code completion, where natural-language comments serve as key contextual signals. While prior work shows that comments and natural-language descriptions can improve generation quality by providing high-level semantic guidance, their reliability in evolving codebases remains unclear. In practice, comments may be outdated or inconsistent with the current implementation, raising the question of whether such context may mislead generation rather than simply degrade it. In this paper, we present an empirical study of outdated comments in LLM-based code completion. We find that outdated comments tend to introduce a systematic misleading effect: instead of merely degrading performance, they can bias generated code toward historical implementations, producing outputs that remain globally plausible while failing in regions where the implementation has changed, as outdated comments often retain partially correct yet inconsistent information. Importantly, this effect is not uniform. Our study shows that the impact of outdated comments varies with factors such as the function signature length and task complexity, reflecting the interaction between structural signals and natural-language guidance. Overall, our findings challenge the common assumption that richer context is uniformly beneficial for code generation. They highlight that natural-language comments can act as strong but unreliable signals, and underscore the need for more robust handling of inconsistent contextual information in LLM-based code generation. Article Search Artifacts Available Article: ase26main-p613-p doi:10.1145/3832783.3834359
	Huang, Yuekai	ASE '26: "Piece by Piece: Automating ..." Piece by Piece: Automating Combination Interaction GUI Testing via Planning and Dual Memory Zhe Liu, Oujin Wang, Junjie Wang, Chunyang Chen, Mengzhuo Chen, Boyu Wu, Yuekai Huang, and Qing Wang (Institute of Software at Chinese Academy of Sciences, China; Tsinghua University, China; TU Munich, Germany; University of Chinese Academy of Sciences, Beijing, China) Combination interactions require coordinated operations across multiple GUI widgets within a page to complete a functional task, which are common in modern mobile apps. However, due to widget dependencies, dynamic interface transitions, and context-sensitive execution, existing automated GUI testing approaches based on predefined models or state exploration struggle to reliably complete such interactions. LLM-based GUI testing methods improve semantic understanding but often generate inconsistent actions due to the lack of coordination modeling and interaction context. To address these challenges, this paper proposes COMBDroid, an automated GUI testing approach that enables reliable completion of combination interactions through structured planning and dual memory. COMBDroid first detects combination interaction patterns from GUI structure, then generates page-level interaction plans and grounds them into widget-level executable actions. Inspired by Sudoku solving, COMBDroid maintains a dual-memory mechanism, where context memory preserves execution states within a functionality and experience memory captures reusable interaction patterns. COMBDroid is designed as an integrable module that activates when combination interactions are detected and allows existing testing tools to resume exploration after completion. We evaluate COMBDroid on 100 combination interaction functionalities collected from 100 mobile apps, comparing it with 15 state-of-the-art GUI testing baselines. COMBDroid achieves 103% higher passing rate than the best baseline and improves activity coverage by 65%-100% when integrated with existing testing tools. Furthermore, GUI testing tools integrated with COMBDroid detect 37 new crash bugs in real-world apps, with 26 fixed and the remaining confirmed by developers, demonstrating its effectiveness in improving GUI testing. Article Search Article: ase26main-p3565-p doi:10.1145/3832783.3837553
	Huang, Yufan	ASE '26: "Debug2Fix: Can Interactive ..." Debug2Fix: Can Interactive Debugging Help Coding Agents Fix More Bugs? Spandan Garg and Yufan Huang (Microsoft Corporation, USA) While significant progress has been made in automating various aspects of software development through coding agents, there is still significant room for improvement in their bug fixing capabilities. Debugging and investigation of runtime behavior remains largely a manual, developer-driven process. Popular coding agents typically rely on either static analysis of the code or iterative test-fix cycles, which is akin to trial and error debugging. We believe that there is a wealth of rich runtime information that developers routinely access while debugging code, which agents are currently deprived of due to design limitations. Despite how prevalent debuggers are in modern IDEs and command-line tools, they have surprisingly not made their way into coding agents. In this work, we introduce Debug2Fix, a novel framework that incorporates interactive debugging as a core component of a software engineering agent via a subagent architecture. We incorporate debuggers for Java and Python into our agent framework and evaluate against GitBug-Java and SWE-Bench-Live and achieve >20% improvement in performance compared to the baseline for certain models. Furthermore, using our framework, we're able to make weaker models like GPT-5 and Claude Haiku 4.5 match or exceed the performances of stronger models like Claude Sonnet 4.5, showing that better tool design is often just as important as switching to a more expensive model. Finally, we conduct systematic ablations demonstrating the importance of both the subagent architecture and debugger integration. Article Search Article: ase26ind-p65-p doi:10.1145/3832783.3834471
	Huang, Yujie	ASE '26: "SimServing: Native-Execution ..." SimServing: Native-Execution Simulation for Evolution-Resilient LLM Serving Configuration Tuning Yujie Huang, Jiazhen Gu, Zhihan Jiang, and Michael R. Lyu (Chinese University of Hong Kong, Hong Kong) Large Language Model (LLM) services expose a large configuration space that critically affects performance, yet tuning these configurations on hardware (e.g., NVIDIA GPUs) is prohibitively expensive. Simulation offers a scalable alternative, but state-of-the-art simulators suffer from a fundamental software engineering pitfall: they re-implement the serving framework's complex control logic (e.g., request scheduling and memory management), creating a semantic copy that inevitably diverges from the rapidly evolving upstream software. Our empirical study across eight consecutive vLLM versions confirms this fidelity drift, with prediction errors widening as the framework evolves. We observe that the serving management software dominates performance fidelity yet accounts for less than 10% of total execution time, with GPU computation consuming over 90%. This asymmetry motivates SimServing, a hybrid simulation framework that executes the native, unmodified serving software while replacing GPU computation with a pluggable latency estimator. This design preserves the serving management software's control flow by executing it rather than modeling it, thereby automatically inheriting upstream updates and substantially reducing the maintenance burden associated with re-implementation. Integrating SimServing with Particle Swarm Optimization for configuration tuning, our evaluation shows that it reduces throughput prediction error from 13.8% to 4.9%, achieves up to 21.18× simulation speedup, and discovers configurations that improve throughput by up to 10.2% over existing baselines. Article Search Article: ase26main-p625-p doi:10.1145/3832783.3834362
	Huang, Zihang	ASE '26: "GALA: Graph-Augmented LLM ..." GALA: Graph-Augmented LLM Agents for Root Cause Analysis and Incident Response in Microservices Yifang Tian, Yaming Liu, Zichun Chong, Zihang Huang, Yiran Li, and Hans-Arno Jacobsen (University of Toronto, Canada) Microservice root cause analysis (RCA) requires correlating failures across heterogeneous telemetry within complex service dependency graphs. Existing methods often rely on a single telemetry modality; recent LLM-based approaches can suffer from unconstrained exploration and hallucination; and most systems stop at fault ranking without producing actionable incident response. We present GALA+, a graph-augmented LLM agentic framework centered on graph-guided investigation, which uses service dependencies to bound exploration and refine diagnosis through localized multi-modal evidence. For initial hypothesis generation, GALA+ combines complementary telemetry signals with STRIX, a novel trace- and graph-structure-aware scoring module. GALA+ then produces ranked diagnoses, incident summaries, and stratified action recommendations. We further introduce SURE-Score, a human-guided evaluation framework co-developed with industry SRE experts for assessing RCA-specific output quality beyond conventional text similarity metrics. On two microservice benchmarks, GALA+ consistently achieves the strongest overall results, surpassing the best LLM-based baseline by more than 25 percentage points in AC@1, while also receiving the highest ratings from both SURE-Score and independent human SRE evaluation. Article Search Article: ase26main-p46-p doi:10.1145/3832783.3834335
	Hughes, John	ASE '26: "Model-Guided Property-Based ..." Model-Guided Property-Based Testing of WeChat Pay at Billion-User Scale Xiangchen Shen, Yiting Wang, Ting Su, Jingjing Liang, Jingling Sun, Xixian Liang, Haiying Sun, Xinjie Xu, Haochuan Lu, Yuetang Deng, Pengcheng Wang, Geguang Pu, Zhendong Su, and John Hughes (East China Normal University, China; University of Electronic Science and Technology of China, China; Tencent, China; ETH Zurich, Switzerland; Chalmers University of Technology, Sweden) Ensuring the correctness of mobile payment applications is critical, as even subtle faults can lead to severe financial losses. To ensure reliability, the WeChat Pay (a popular payment app with over one billion active users worldwide) team developed a User Acceptance Testing (UAT) system based on model-based testing (MBT). It maintains use cases specifying user operation sequences and expected app behaviors under business rules. UAT converts these use cases into formal models and generates test cases to validate the app. Although UAT achieves 100% state coverage by covering all user operations and business rules, it still suffers from two major limitations: insufficient test coverage and predefined test oracles. In this paper, we introduce a model-guided property-based testing approach to improving the existing UAT system. We have two key observations: (1) UAT test cases can effectively reach all app states; and (2) WeChat Pay exhibits some invariant behaviors, which can be used to synthesize generic properties for bug finding. Building on these observations, our approach performs random exploration from UAT-discovered states, and validates app behaviors against the automatically synthesized properties. We also propose a greedy trace shrinking algorithm to reduce failure-inducing traces. We implemented our approach as UAT++, an advanced testing tool built upon the UAT system. Across 20,000 machine hours, UAT++ found 59 previously unknown bugs, including 48 logic bugs and 11 crash bugs (55 confirmed, 45 fixed). These bugs could not be found by the UAT system and classic property-base testing (PBT). UAT++ improved state transition coverage by 82.6% and 600.0% over the UAT system and classic PBT, respectively. The shrinking algorithm attained an average trace reduction rate of 79.9%. To date, UAT++ has been deployed in the continuous testing pipeline of WeChat Pay across Android, iOS, and HarmonyOS platforms. Article Search Article: ase26ind-p569-p doi:10.1145/3832783.3834537
	Hüller, Tom	ASE '26: "xDECAF: An Extensible Data ..." xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security Benjamin Arp, Felix Schwickerath, Alexander Vogt, Tom Hüller, Nils Niehues, and Nicolas Boltz (KIT, Germany) xDECAF is an extensible tool for architecture-based data flow analysis with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domain-specific constraint language with different flow operations, and a browser-based editor backed by an analysis engine. In this paper, we present the xDECAF tool library and a curated catalog of over 20 example models with documented constraints and expected violations, intended as a reusable dataset for the community. The tool has already been adopted by several research lines, providing concrete evidence of its utility. The tool, dataset, and a hosted online editor are publicly available. Screencast: https://youtu.be/L-PGdWoPtlw Code & Dataset: https://github.com/DataFlowAnalysis • https://doi.org/10.5281/zenodo.20083877 Article Search Article: ase26tool-p34-p doi:10.1145/3832783.3834604
	Hultin, Moltas	ASE '26: "Agent-HAnS: Maintaining Feature ..." Agent-HAnS: Maintaining Feature and Code Traceability in Agentic Development Johan Martinson, Jacob Bengtsson, Moltas Hultin, Kevin Hermann, and Thorsten Berger (Ruhr University Bochum, Germany; University of Gothenburg and Chalmers University of Technology, Sweden) Agentic coding tools using LLMs enable developers to quickly generate software. However, developers quickly lose the overview over their increasingly complex codebases. During code generation, no knowledge about what features exist or where they are implemented is documented. We present Agent-HAnS, an agentic workflow which instructs the LLM to update a feature model and generate embedded feature annotations after each code-generation step. It visualizes the evolving structure on a live dashboard served via a Model Context Protocol server. We demonstrate Agent-HAnS on a C#/.NET 9 web API evolved through 27 prompts across 10 evolution steps, with most annotations maintained automatically and no active annotation effort from the developer. In a manual audit, 92% of fragment annotations and 70% of file mappings remain correct, with errors concentrating at feature merges and splits. In a user study, Agent-HAnS scored 73.9 on the System Usability Scale. Tool video: https://youtu.be/Nb-eDrGokI8 Article Search Article: ase26tool-p225-p doi:10.1145/3832783.3834652
	Huo, Yintong	ASE '26: "From Runnable Code to Shippable ..." From Runnable Code to Shippable Applications: Test-Driven Development for Full-Stack Web Application Generation Yuxuan Wan, Tingshuo Liang, Jiakai Xu, Jingyu Xiao, Yintong Huo, and Michael R. Lyu (Chinese University of Hong Kong, Hong Kong; Columbia University in the City of New York, USA; Singapore Management University, Singapore) Coding agents can generate runnable web applications, but their outputs frequently fail to satisfy functional requirements. Although test-driven development (TDD) offers a principled repair loop, applying it to web applications requires deriving executable acceptance tests, validating behavior through dynamic browser interactions, and translating observed failures into actionable feedback. We present TDDev, an experimental instrument that automates these tasks and enables closed-loop TDD with minimal human mediation. Using TDDev, we conduct the first controlled study of TDD for full-stack web application generation across 20 diverse web applications, multiple backbone models, two coding agents, and three TDD implementations. With sufficiently capable backbones, TDD improves accuracy by 15.5-23.7 percentage points and remains effective across both minimal and full-featured coding agents; replacing unreliable feedback with a stronger tester restores positive gains for a lower-capability backbone. Incremental TDD provides bounded control, Whole-Project TDD enables coordinated repair and achieves the highest cost efficiency in most configurations, and Agentic TDD performs best with highly capable models. Based on these findings, we provide a practical decision tree that selects an implementation according to model capability, feedback reliability, and deployment objectives. By automating acceptance testing and failure-guided repair, TDDev also reduces the human testing and intervention required during development. Article Search Article: ase26main-p1397-p doi:10.1145/3832783.3834388 ASE '26: "UIBenchKit: A Unified Toolkit ..." UIBenchKit: A Unified Toolkit for Design-to-Code Model Evaluation Chinh T. Le, Trevor Yee Siang Ong, Jingyu Xiao, Yuxuan Wan, and Yintong Huo (Singapore Management University, Singapore; Chinese University of Hong Kong, Hong Kong) Recent years have seen substantial progress in automated design-to-code generation, with many methods proposed for generating HTML and CSS from webpage screenshots. However, the absence of a standardized evaluation platform makes it difficult to compare these methods fairly, limiting both practical adoption and systematic research progress. To bridge this gap, we introduce UIBenchKit, an open-source, integrated toolkit designed to unify the evaluation of design-to-code tasks. UIBenchKit abstracts the complexities of environment setup, model inference, and code rendering, offering researchers a plug-and-play architecture to compare various methods under consistent settings. In addition, it offers an analytical interface for comparison across multiple metrics. Using UIBenchKit, we conduct a benchmarking study of existing tools and derive several findings that highlight directions for future improvement. By providing a streamlined environment for both experimentation and evaluation, UIBenchKit aims to accelerate future benchmarking and innovations in web engineering. The evaluation platform and toolkit are available at the project pages https://www.uibenchkit.com/ and https://github.com/chinh02/UIBenchKit. A video of UIBenchKit is available at https://youtu.be/UyeYyASovuU. Article Search Artifacts Available Article: ase26tool-p53-p doi:10.1145/3832783.3834612
	Husom, Erik Johannes	ASE '26: "To Think or Not to Think: ..." To Think or Not to Think: Evaluating LLM Reasoning and Agents in Vulnerability Detection Hua Beng Tan, Ratnadira Widyasari, Merve Astekin, Arda Goknil, Hasan Sözer, Yan Naing Tun, Erik Johannes Husom, Lwin Khin Shar, and Lingxiao Jiang (Singapore Management University, Singapore; SINTEF, Norway; Ozyegin University, Türkiye) Large language models (LLMs) are increasingly studied for software vulnerability detection, but the benefits of recent reasoning-enabled (“thinking”) modes remain unclear. At the same time, agentic LLM designs aim to enhance analysis through structured collaboration, while practical software security workflows require explanations that facilitate inspection, validation, and remediation. Because prior studies often examine these dimensions separately or under heterogeneous settings, their individual effects on vulnerability detection remain difficult to disentangle. This paper addresses the gap through a phased, factor-separated empirical study on the PrimeVul Pair benchmark. In the first phase, we compare instruct and thinking variants of four open models under zero- and few-shot prompting without agents. In the second phase, we evaluate single-, dual-, and multi-agent (SA, DA, and MA) designs alongside call-matched single-agent baselines, alert-burden metrics, and cost analysis. In the third, we assess explanations through blinded human and calibrated LLM evaluation across correct and incorrect predictions, controlling for response length and model family. Thinking improves non-agent (NA) F1 in 7 of 8 settings, mainly through recall, while DA achieves the highest F1/recall but flags 88.2% of functions as vulnerable. MA performs better on pairwise discrimination, although call-matched self-revision achieves the best Pair-wise Correct Prediction (P-C) overall. Thinking also uses 2.7–4.4× more energy, and its F1 benefit declines with greater orchestration. Explanation gains are model-specific, partly length-mediated, and do not distinguish correct from incorrect predictions. Article Search Article: ase26main-p2084-p doi:10.1145/3832783.3837521
	Hwang, Sijune	ASE '26: "CLEAR: Causal Context-Based ..." CLEAR: Causal Context-Based Agentic Reasoning for Vulnerability Detection Sungju Yun, Sijune Hwang, Yeonjoon Lee, Kyungtae Kang, and Sungbin Park (Hanyang University, Republic of Korea) Detecting source code vulnerabilities is increasingly difficult as modern security flaws are rooted in complex causal dependencies between execution flows, control conditions, and program states. Despite recent advances in Large Language Models (LLMs) and multi-agent frameworks, existing approaches primarily address superficial similarities between benign and vulnerable functions while failing to capture the complex causal dependencies inherent in security flaws. To address these limitations, we propose Causal Context-based Agentic Reasoning (CLEAR), a novel multi-agent vulnerability detection framework integrated with a causal knowledge graph. CLEAR systematically constructs a Vulnerability Causal Knowledge Graph (VCKG) that models the causal chains between entrypoints, preconditions, root causes, and fix intents across vulnerability instances. Leveraging this structured knowledge, four specialized agents including the Collector, Claim, Critic, and Judge collaboratively verify vulnerability hypotheses through retrieved causal contexts. Experimental results on C/C++ and Java vulnerability benchmarks demonstrate that CLEAR improves Pair-Correct (P-C) performance by 130.7% and 71.56% over state-of-the-art approaches, respectively, demonstrating the effectiveness of causal knowledge graph–guided reasoning for automated vulnerability detection. Article Search Article: ase26main-p2153-p doi:10.1145/3832783.3837523
	Hwang, Sungjae	ASE '26: "Orbis: Guiding Symbolic Execution ..." Orbis: Guiding Symbolic Execution Techniques to Maximize Option-Related Branch Coverage Minjong Kim, Sungjae Hwang, and Sooyoung Cha (Sungkyunkwan University, Republic of Korea) We present Orbis, a complementary approach that guides symbolic execution techniques toward maximizing option-related branch (OB) coverage. Although state-of-the-art symbolic execution techniques have substantially improved code coverage and bug detection, existing techniques often fail to exercise core program functionalities, which are frequently exposed as program options. To quantify this limitation, we evaluate how effectively current techniques cover option-related branches and find that they reach only 8.0% of the targeted OBs, which are accessible only through specific options. Orbis overcomes this challenge by systematically guiding symbolic execution to improve OB coverage. For a given program, Orbis automatically identifies all defined options and determines their associated branches by analyzing dynamic execution traces. It then iteratively constructs target option arguments by stochastically combining identified options according to their estimated potential, directs symbolic execution to explore states influenced by these arguments, and refines their potential while simultaneously reducing SMT-solver invocations using data accumulated during symbolic execution. Experimental results on 15 open-source C programs show that integrating Orbis with four independent state-of-the-art techniques significantly increases OB coverage to 323.0%, boosts total branch coverage by 112.1%, and detects five additional unique bugs on average compared to the standalone techniques. Article Search Article: ase26main-p2260-p doi:10.1145/3832783.3837526 ASE '26: "SpecTrum: Specification-Guided ..." SpecTrum: Specification-Guided Differential Fuzzing for Ethereum Consensus Clients Seokhun Jeong, Gyeongmin Dan, Sukyoung Ryu, and Sungjae Hwang (KAIST, Republic of Korea; Sungkyunkwan University, Republic of Korea) Ethereum's consensus safety relies on independent consensus client implementations agreeing on every state transition. When they diverge due to implementation errors, the network can fork, finality can stall, and severe attacks are possible. To prevent such consensus divergences, Ethereum provides a Python reference implementation (consensus-spec), which acts as a specification, and a hand-crafted official test suite (spectests). However, as an executable implementation, Ethereum's specification defines validity implicitly through runtime behavior. As a result, it lacks a systematic way to ensure that all validity conditions are thoroughly evaluated. We present SpecTrum, a framework that addresses this problem in three stages. First, we introduce Consensus-SpecTec, a mechanized specification of the Ethereum consensus algorithm, which makes validity conditions explicit as if-premises. Second, we define premise coverage, a metric that measures which if-premises are evaluated to true and false across spectests. Third, we develop a specification-based test generator that extracts constraints on premises not evaluated to false by spectests and generates inputs to evaluate them. Applying SpecTrum to five major Ethereum consensus clients, we identify 27 cross-client divergence cases, 22 of which cannot be found without the premises inserted in our mechanization. All 27 cases reproduce across fork versions, and extending the mechanized specification to a new fork takes modest effort proportional to the specification difference. Article Search Artifacts Available Article: ase26main-p1970-p doi:10.1145/3832783.3834406
	Ibrahimzada, Ali Reza	ASE '26: "ReCodeAgent: A Multi-agent ..." ReCodeAgent: A Multi-agent Workflow for Language-Agnostic Translation and Validation of Large-Scale Repositories Ali Reza Ibrahimzada, Brandon Paulsen, Daniel Kroening, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; Amazon, USA) Most repository-level code translation and validation techniques have been evaluated on a single source-target programming language (PL) pair, owing to the complex engineering effort required to adapt new PL pairs. Programming agents can enable PL-agnosticism in repository-level code translation and validation: they can synthesize code across many PLs and autonomously use existing tools specific to each PL’s analysis. However, state-of-the-art has yet to offer a fully autonomous agentic approach for repository-level code translation and validation of large-scale programs. This paper proposes ReCodeAgent, an autonomous multi-agent approach for language-agnostic repository-level code translation and validation. Users only need to provide the project in the source PL and specify the target PL for ReCodeAgent to automatically translate and validate the entire repository. ReCodeAgent is the first technique to achieve high translation success rates across many PLs. We compare the effectiveness of ReCodeAgent with four alternative neuro-symbolic and agentic approaches to translate 118 real-world projects, with 1,975 LoC and 43 translation units for each project, on average. The projects cover 6 PLs and 4 PL pairs. Our results demonstrate that ReCodeAgent consistently outperforms prior techniques on translation correctness, improving test pass rate by 60.8% on ground-truth tests, with an average cost of $15.3. We also perform process-centric analysis of ReCodeAgent trajectories to confirm its procedural efficiency. Finally, we investigate how the design choices (a multi-agent vs. single-agent architecture) influence ReCodeAgent performance: on average, the test pass rate drops by 40.4%, and trajectories become 28% longer and persistently inefficient. Article Search Article: ase26main-p1257-p doi:10.1145/3832783.3837486
	Ichikawa, Yuma	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Imamura, Nobutaka	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Imran, Mia Mohammad	ASE '26: "A Low-Cost Human-in-the-Loop ..." A Low-Cost Human-in-the-Loop Investigation of Toxicity on GitHub at Scale Rahat Rizvi Rahman, Mia Mohammad Imran, and Kostadin Damevski (Virginia Commonwealth University, USA; Missouri University of Science and Technology, USA) Toxic interactions in open source discussions can alienate contributors and threaten project sustainability, yet prior empirical studies of GitHub toxicity have been limited in scale, raising questions about their generalizability. Scaling up is difficult because toxicity on GitHub is often implicit and context-dependent, making both fully manual annotation and LLM-based labeling unreliable. We present a human-in-the-loop (HITL) annotation methodology that makes large-scale, domain-calibrated toxicity labeling practical. A single call to a small, local LLM produces both a toxicity prediction and a set of interpretable event category scores. A lightweight Random Forest validator then uses those scores to flag the small subset of conversations most likely to be mislabeled, directing human review only where it is needed. The validator outperforms confidence-based and multi-LLM baselines while adding low annotation cost. We apply this pipeline to over 124,000 GitHub issue and pull request conversations. Using the resulting dataset, we evaluate key findings from prior small-scale research, confirming some and qualifying others, and present new insights into the prevalence, characteristics, and dynamics of toxicity across diverse open source projects. Article Search Article: ase26main-p1633-p doi:10.1145/3832783.3837505
	Inoue, Katsuro	ASE '26: "Where Does Balance Break? ..." Where Does Balance Break? Boundary Discovery for Game Balance Testing under a Finite Simulation Budget Hiroki Mukai, Yusaku Kato, Norihiro Yoshida, Erina Makihara, and Katsuro Inoue (Ritsumeikan University, Japan) Software testing often relies on assumptions such as reproducible executions and stable correctness criteria. However, many modern software systems exhibit non-deterministic executions and large behavior spaces, making exhaustive exploration impractical and single-run judgments unreliable. These characteristics make it difficult to identify where acceptable behavior ends and problematic behavior begins. Competitive multiplayer games represent a challenging instance of such systems, where balance must be maintained so that no single strategy dominates. Even small parameter changes can trigger abrupt balance disruption, yet detecting such failures requires repeated simulations under non-deterministic outcomes and high-dimensional parameter spaces. In this paper, we formulate game balance regression testing as a boundary-discovery problem under a finite simulation budget. The objective is to efficiently identify inputs near the boundary that separates balanced and unbalanced regions. To address this problem, we propose BBExplorer, which combines multi-directional candidate generation, budget-aware two-stage screening, and adaptive step-size shrinkage for boundary refinement. Experimental results on two games with different levels of complexity show that the approach is strong in low-dimensional settings and remains effective in higher-dimensional ones. It also exhibits stable boundary behavior across unseen random seeds and threshold settings. These results indicate that BBExplorer is effective for practical balance regression testing and, more broadly, for boundary-oriented testing in non-deterministic, budget-constrained systems. Article Search Article: ase26main-p2013-p doi:10.1145/3832783.3834407
	Ishikawa, Yu	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Ishimoto, Yuta	ASE '26: "How Well Do LLMs Generate ..." How Well Do LLMs Generate Taxonomies in the SE Domain? A Multi-perspective Evaluation Framework Sota Nakashima, Yuta Ishimoto, Masanari Kondo, Tao Xiao, and Yasutaka Kamei (Kyushu University, Japan) Taxonomies provide a shared conceptual framework for organizing heterogeneous observations in software engineering (SE) research. Manually constructing such taxonomies is labor-intensive and requires annotators with expertise in the SE domain. While advances in Large Language Models (LLMs) have led to the emergence of automated taxonomy generation methods outside the SE domain, their applicability to technically complex SE artifacts remains unclear. In this experience paper, we present the first comprehensive empirical evaluation of how state-of-the-art automated methods perform on SE artifacts through a multi-perspective evaluation framework, including taxonomy quality, alignment with taxonomies defined by human experts, reliability under independent annotation, and efficiency. To support this evaluation, we systematically collect seven SE papers with publicly available artifacts and human-defined taxonomies, and conduct experiments using two automated methods (TnT-LLM and CLIMB) with five state-of-the-art LLMs. Our evaluation reveals a clear trade-off: TnT-LLM constructs high-quality taxonomies comparable to human-defined ones but incurs substantially higher cost and runtime and tends to generate overly complex taxonomies, whereas CLIMB is 15–40× faster and 8–49× cheaper but tends to score lower on quality when technical inference beyond surface-level similarity is required. These findings suggest that TnT-LLM and CLIMB can be used in practical situations in the SE domain, while researchers should first assess the complexity of the generated taxonomies and their cost using a subset of the target data to decide whether to use automated methods or human experts. Our work represents a first step toward a systematic understanding of automated taxonomy generation in SE, offering actionable insights for future research and practice. Article Search Article: ase26main-p3263-p doi:10.1145/3832783.3837551
	Ivančić, Franjo	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Izzo, Fabiano	ASE '26: "AIGen: Automating AI Bill ..." AIGen: Automating AI Bill of Materials Generation through Hybrid MLOps Integration Federica Pepe, Daniele Bifolco, Costantino Martignetti, Aureliano D'Amici, Fabiano Izzo, Damian Andrew Tamburri, and Massimiliano Di Penta (University of Sannio, Italy; Smart Shaped, Italy) The responsible development and deployment of artificial intelligence (AI) systems requires rigorous documentation of their constituent artifacts, e.g., datasets, model weights, training pipelines, and runtime dependencies. Although the Software Package Data Exchange (SPDX) 3.0 standard introduced native support for AI and dataset profiles, practical tooling capable of generating standards-compliant AI Bills of Materials (AIBoMs) in an automated and extensible manner remains scarce. This paper presents AIGen, a modular AIBoM generator that produces machine-readable, interoperable inventories of AI system components that comply with the SPDX 3.0 AI profile. AIGen works on top of the MLflow MLOps framework and combines mining heuristics with Large Language Models to generate AIBoMs. A plugin interface allows practitioners to extend the tool with domain-specific collectors without modifying the core codebase, supporting heterogeneous AI frameworks such as Hugging Face, PyTorch, and TensorFlow. AIGen is designed to facilitate compliance with the European Union AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001, providing a concrete, reusable foundation for transparent, accountable AI supply chain governance. Tool URL: https://github.com/danielebifolco/AIGen Tool Video: https://youtu.be/_nAbXDWfVL4 Article Search Article: ase26tool-p57-p doi:10.1145/3832783.3834615
	Jabbarvand, Reyhaneh	ASE '26: "ReCodeAgent: A Multi-agent ..." ReCodeAgent: A Multi-agent Workflow for Language-Agnostic Translation and Validation of Large-Scale Repositories Ali Reza Ibrahimzada, Brandon Paulsen, Daniel Kroening, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; Amazon, USA) Most repository-level code translation and validation techniques have been evaluated on a single source-target programming language (PL) pair, owing to the complex engineering effort required to adapt new PL pairs. Programming agents can enable PL-agnosticism in repository-level code translation and validation: they can synthesize code across many PLs and autonomously use existing tools specific to each PL’s analysis. However, state-of-the-art has yet to offer a fully autonomous agentic approach for repository-level code translation and validation of large-scale programs. This paper proposes ReCodeAgent, an autonomous multi-agent approach for language-agnostic repository-level code translation and validation. Users only need to provide the project in the source PL and specify the target PL for ReCodeAgent to automatically translate and validate the entire repository. ReCodeAgent is the first technique to achieve high translation success rates across many PLs. We compare the effectiveness of ReCodeAgent with four alternative neuro-symbolic and agentic approaches to translate 118 real-world projects, with 1,975 LoC and 43 translation units for each project, on average. The projects cover 6 PLs and 4 PL pairs. Our results demonstrate that ReCodeAgent consistently outperforms prior techniques on translation correctness, improving test pass rate by 60.8% on ground-truth tests, with an average cost of $15.3. We also perform process-centric analysis of ReCodeAgent trajectories to confirm its procedural efficiency. Finally, we investigate how the design choices (a multi-agent vs. single-agent architecture) influence ReCodeAgent performance: on average, the test pass rate drops by 40.4%, and trajectories become 28% longer and persistently inefficient. Article Search Article: ase26main-p1257-p doi:10.1145/3832783.3837486 ASE '26: "From Plan to Action: How Well ..." From Plan to Action: How Well Do Agents Follow the Plan? Shuyang Liu, Saman Dehghan, Jatin Ganhotra, Martin Hirzel, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; IBM, USA) Agents are commonly instructed to follow a task-specific plan for guidance.However, it is unknown to what extent agents actually follow instructed plans. Without such an analysis---determining the extent agents comply with a given plan---it is impossible to assess whether a solution was reached through correct strategic reasoning or through other means, e.g., data contamination or overfitting to a benchmark. This paper presents the first extensive, systematic analysis of plan compliance in programming agents, examining 21,120 trajectories from SWE-agent across four LLMs on SWE-bench Verified and SWE-bench Pro under eight plan variations. Without an explicit plan, agents fall back on internalized workflows during training, which are often incomplete, overfit, or inconsistently applied. Providing the standard plan improves issue resolution, and we observe that periodic plan reminders can mitigate plan violations and improve task success. A subpar plan hurts performance even more than no plan at all. Surprisingly, inserting additional task-relevant phases in the early stage can degrade performance, particularly when these phases do not align with the model’s internal problem-solving strategy. These findings call for fine-tuning paradigms that teach models to follow instructed plans, rather than encoding task-specific plans in them, so that they reason and act adaptively, rather than memorizing workflows. Article Search Article: ase26main-p1675-p doi:10.1145/3832783.3834400 ASE '26: "Graphectory Viewer: A Tool ..." Graphectory Viewer: A Tool for Process-Centric Analysis of Agentic Software Trajectories Charlie Jyu, Shuyang Liu, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA) We present Graphectory Viewer, a web-based tool for interactive, process-centric analysis of software-agent trajectories. Building on the Graphectory representation introduced in our previous work, Graphectory Viewer transforms heterogeneous raw trajectories into phase-aware graphs that connect low-level execution details with higher-level behavioral structures. The tool supports trajectories from multiple agent frameworks and provides interactive graph construction; node-level inspection of thoughts, actions, and observations; search and filtering over large trajectory collections; and Sankey-style summaries of problem-solving phase transitions. These capabilities enable researchers and practitioners to inspect individual executions, identify recurring behavioral patterns, compare successful and failed runs, and analyze large trajectory corpora beyond final task outcomes. To support reproducibility and further research, we release Graphectory Viewer as an open-source artifact together with documentation, precomputed graphs, and the large-scale trajectory corpus. Article Search Article: ase26tool-p2-p doi:10.1145/3832783.3834593
	Jacobsen, Hans-Arno	ASE '26: "GALA: Graph-Augmented LLM ..." GALA: Graph-Augmented LLM Agents for Root Cause Analysis and Incident Response in Microservices Yifang Tian, Yaming Liu, Zichun Chong, Zihang Huang, Yiran Li, and Hans-Arno Jacobsen (University of Toronto, Canada) Microservice root cause analysis (RCA) requires correlating failures across heterogeneous telemetry within complex service dependency graphs. Existing methods often rely on a single telemetry modality; recent LLM-based approaches can suffer from unconstrained exploration and hallucination; and most systems stop at fault ranking without producing actionable incident response. We present GALA+, a graph-augmented LLM agentic framework centered on graph-guided investigation, which uses service dependencies to bound exploration and refine diagnosis through localized multi-modal evidence. For initial hypothesis generation, GALA+ combines complementary telemetry signals with STRIX, a novel trace- and graph-structure-aware scoring module. GALA+ then produces ranked diagnoses, incident summaries, and stratified action recommendations. We further introduce SURE-Score, a human-guided evaluation framework co-developed with industry SRE experts for assessing RCA-specific output quality beyond conventional text similarity metrics. On two microservice benchmarks, GALA+ consistently achieves the strongest overall results, surpassing the best LLM-based baseline by more than 25 percentage points in AC@1, while also receiving the highest ratings from both SURE-Score and independent human SRE evaluation. Article Search Article: ase26main-p46-p doi:10.1145/3832783.3834335
	Jahns, Stefan	ASE '26: "Assessing Uncertainty in Performance ..." Assessing Uncertainty in Performance Modeling: Conformal Prediction vs. Bayesian Regression Stefan Jahns, Johannes Dorn, Max Weber, Sven Apel, and Norbert Siegmund (Leipzig University, Germany; Saarland University, Germany) Most software systems today are configurable. As a consequence, predicting performance is inherently challenging due to the sheer number of configurations exhibiting individual performance variations. When predicting the performance of unseen configurations, it is imperative to know how reliable such predictions are. Bayesian methods have been shown to be able to quantify the uncertainty in their estimates, but require prior information about performance distributions and, more importantly, are constrained in their learning technique, effectively limiting their practical applicability. Conformal prediction, an entirely novel approach to uncertainty quantification in this area, augments existing learning algorithms via a statistical post-hoc analysis. This allows us to provide uncertainty estimates even for point-estimate algorithms, such as random forests or deep neural networks. The goal of this study is to evaluate how assumptions of conformal predictions regarding sample size and distribution, as well as the heterogeneity of learning algorithms, affect their applicability to software performance prediction. We conduct a comprehensive study comparing four conformal prediction variants against P4, the current standard for uncertainty-aware performance prediction, analyzing accuracy, scalability, and uncertainty quantification. Our results show that conformal prediction consistently outperforms the state of the art across six out of eight real world scenarios, producing correct confidence intervals that are 46–75 % narrower, and thus more certain. Notably, conformal prediction can be used to enrich existing techniques, with post-hoc uncertainty quantification in a plug and play fashion. Article Search Article: ase26main-p207-p doi:10.1145/3832783.3837425
	Jang, Sechang	ASE '26: "Top-Down Multi-agent LLM System ..." Top-Down Multi-agent LLM System with Runtime Data for MISRA C Violation Detection Ahcheong Lee, Yeongbin Kang, Sechang Jang, Heechan Yang, and Moonzoo Kim (KAIST, Republic of Korea; VplusLab, Republic of Korea) Ensuring MISRA C compliance is crucial for the safety and reliability of embedded software. For this purpose, industries utilize static rule checkers but suffer high ratios of both missed violations and false alarms. Although companies also try to utilize LLMs for this purpose, existing LLM-based approaches have suboptimal performance for large, complex programs. We introduce LASIK, the world-first top-down multi-agent LLM compliance-checking framework for MISRA C, which combines on-demand repository-level context provision with runtime execution evidence. This design enables LASIK to report more true violations than state-of-the-art static analyzers and a naive vanilla LLM approach, while maintaining a low false positive ratio. Our evaluation on 10 embedded projects shows that LASIK detects 1.3-2.7 times more true violations than the static analyzers and the vanilla LLM approach, while achieving the lowest false alarm ratio (26.7%). Furthermore, on an industrial software developed by VPlusLab Inc., LASIK detects up to 2.1 times more true violations with a low false alarm rate (i.e., 10.8%) than the baseline techniques. Article Search Article: ase26ind-p152-p doi:10.1145/3832783.3834497
	Jannussi, Davide	ASE '26: "Cam2Sim: Neural Scenario Reconstruction ..." Cam2Sim: Neural Scenario Reconstruction for Closed-Loop Autonomous Driving Simulation Davide Jannussi, Stefano Carlo Lambertenghi, Constantin Carste, and Andrea Stocco (Politecnico di Torino, Italy; TU Munich, Germany; fortiss, Germany) Simulation-based testing enables safe and repeatable evaluation of autonomous driving systems, but its effectiveness is limited by the gap between synthetic simulator outputs and real-world camera observations. We present Cam2Sim, a tool that transforms real-world driving recordings into executable CARLA scenarios. Starting from camera images and poses, Cam2Sim reconstructs road geometry, ego trajectories, parked vehicles, and simulation assets, and augments the environment with Gaussian Splatting to render camera observations resembling the original recording. The framework supports ROS-based data extraction, parked-vehicle detection, OpenStreetMap-based map generation, CARLA scenario construction, Gaussian Splatting training, trajectory replay, and closed-loop testing. We validate Cam2Sim on a real urban-driving scenario with an end-to-end driving model, evaluating reconstruction quality, image-generation quality, and closed-loop behavior against a simulation-only baseline and the real-world reference. Results show that Gaussian-Splatting-based rendering reduces the visual gap with respect to simulator rendering and improves behavioral similarity to the real-world reference. The artifact is publicly available at https://github.com/ast-fortiss-tum/cam2sim, and a screencast is available at https://youtu.be/KmZ74l1__lI. Article Search Article: ase26tool-p120-p doi:10.1145/3832783.3834639
	Jeon, Yuseok	ASE '26: "Testing IFrame Rendering in ..." Testing IFrame Rendering in Web Browsers Dahyeon Park, Yuseok Jeon, Seongil Wi, and Mijung Kim (UNIST, Republic of Korea; Korea University, Republic of Korea) Iframes are widely used in modern web development, but their separation from the parent page can lead to iframe-specific rendering bugs, which occur only when content is embedded within an iframe. These bugs may degrade user experience and, in some cases, lead to serious security vulnerabilities. However, existing rendering bug detection techniques are largely ineffective since their oracles compare rendering outputs only within the same context and fail to capture discrepancies across different rendering contexts. This paper presents ICheck, an automated testing technique for iframe rendering in web browsers. Specifically, given an HTML document, ICheck introduces a cross-context oracle that detects inconsistencies by comparing the same HTML content in both top-level and iframe contexts. To further assist debugging, ICheck performs layout-aware input reduction by redefining the effective search space of bug-inducing elements. As a result, ICheck helps developers more effectively and efficiently identify and diagnose iframe-specific rendering bugs. Evaluated on the most popular browsers, Chrome and Firefox, ICheck detected 21 previously unknown bugs, all of which were confirmed. On average, ICheck uncovered 3.8× more bugs than state-of-the-art rendering bug detection work. In addition, ICheck effectively reduced HTML inputs by 93% in DOM nodes while achieving up to 10.1× faster reduction time compared with state-of-the-art delta debugging approaches. Article Search Artifacts Available Article: ase26main-p2611-p doi:10.1145/3832783.3834417
	Jeong, Dae R.	ASE '26: "CtxFuzz: Context-Aware Directed ..." CtxFuzz: Context-Aware Directed Fuzzing via Runtime Fuzzer-Agent Cooperation Jiho Kim, Dongkwan Kim, HyungSeok Han, Youngjoon Kim, Soyeon Park, Sangwoo Ji, Joshua Wang, Dae R. Jeong, and Taesoo Kim (Georgia Institute of Technology, USA; Microsoft, USA; Independent Researcher, USA; Samsung Electronics, Republic of Korea; Seoul National University, Republic of Korea) Automated tools produce vulnerability reports at unprecedented scale, but turning a report into a confirmed proof-of-vulnerability remains challenging. Directed grey-box fuzzers are widely used for validation but lack the ability to consume the rich context these reports carry, reducing each target to a bare location. In contrast, LLM-based approaches can consume this context but are often unable to identify the true triggering mechanism or to synthesize a working proof-of-vulnerability. We present CtxFuzz, a context-aware directed fuzzer that enables an LLM agent and a coverage-guided fuzzer to iteratively exchange and refine bug-triggering context throughout the campaign. The fuzzer contributes execution context, such as what inputs were tried and how the program behaved, grounding the agent’s reasoning in concrete evidence. The agent contributes semantic context, including hypotheses about the triggering conditions, explanations of failed attempts, and targeted mutations to overcome them, guiding the fuzzer toward relevant regions of the input space. Failed attempts are not discarded but decomposed into mutation scripts that translate each identified blocker into a fuzzer-executable strategy. This iterative exchange enables CtxFuzz to trigger vulnerabilities that neither directed fuzzers nor LLM agents reach independently. On 62 vulnerabilities across 16 open-source projects from the AIxCC Final competition (39 C, 23 Java), CtxFuzz exposes 61 of 62 targets, including 29 that no state-of-the-art directed fuzzer reaches, and exposes two zero-day vulnerabilities through a real-world vulnerability report validation pipeline. Article Search Article: ase26main-p797-p doi:10.1145/3832783.3834365
	Jeong, Minwoo	ASE '26: "AgenticSCR: An Autonomous ..." AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection Wachiraphan Charoenwet, Kla Tantithamthavorn, Patanamon Thongtanunam, Hong Yi Lin, Minwoo Jeong, and Ming Wu (University of Melbourne, Australia; Monash University, Australia; Atlassian, USA) Secure code review is critical during pre-integration, where Atlassian developers rely on lightweight analysis tools, while deep security assessment is deferred to later stages, delaying feedback and increasing remediation costs. Existing static analyzers are often noisy and struggle with context-dependent or partially manifested vulnerabilities, while static large language model (LLM) reviewers are constrained by context windows and lack tool interaction. Agentic AI, which combines LLMs with code navigation, shows promise; however, its effectiveness for early-stage secure code review remains underexplored. We present AgenticSCR, an agentic secure code reviewer augmented with security-focused semantic memory that grounds reasoning in structured security knowledge to detect vulnerabilities before they fully manifest. AgenticSCR achieves at least 153% relative improvement in generating comments with correct localization, vulnerability type, and relevance over static LLM baseline, multi-agent reviewer, and SAST tools. In a shadow deployment, 54% of its comments were validated by security engineers for developer reporting, demonstrating practical utility while underscoring the difficulty of the task. These findings position the security-focused semantic memory as a promising direction for agentic secure code review, enabling early-stage vulnerability identification. Our approach builds an important step toward reliable localization, detection, and explanation in shift-left security practices. Article Search Article: ase26ind-p302-p doi:10.1145/3832783.3834523 ASE '26: "Agentic Code Review in the ..." Agentic Code Review in the Terminal: A Trajectory-Level Analysis of Behavior, Cost, and Human-Alignment Wachiraphan Charoenwet, Kla Tantithamthavorn, Patanamon Thongtanunam, Hong Yi Lin, Minwoo Jeong, and Ming Wu (University of Melbourne, Australia; Monash University, Australia; Atlassian, USA) Agentic code review in terminal-based environments enables early feedback during local development before pull request creation. However, existing evaluations remain performance-centric and fail to capture the dynamic behaviors of repository-grounded agentic reviewers. Understanding these behaviors is critical for identifying how agentic reviewers succeed, fail, and incur hidden operational costs in practice. Then, we analyze the reviewers’ behavior based on their trajectories. Our results show that agentic reviewers achieve higher review precision but incur substantial exploration and validation overhead, while successful reviews are associated with stronger planning and less downstream validation. These findings highlight the potential benefits of trajectory-aware and cost-sensitive evaluation of future agentic code review systems. Article Search Article: ase26nier-p49-p doi:10.1145/3832783.3834546
	Jeong, Seokhun	ASE '26: "SpecTrum: Specification-Guided ..." SpecTrum: Specification-Guided Differential Fuzzing for Ethereum Consensus Clients Seokhun Jeong, Gyeongmin Dan, Sukyoung Ryu, and Sungjae Hwang (KAIST, Republic of Korea; Sungkyunkwan University, Republic of Korea) Ethereum's consensus safety relies on independent consensus client implementations agreeing on every state transition. When they diverge due to implementation errors, the network can fork, finality can stall, and severe attacks are possible. To prevent such consensus divergences, Ethereum provides a Python reference implementation (consensus-spec), which acts as a specification, and a hand-crafted official test suite (spectests). However, as an executable implementation, Ethereum's specification defines validity implicitly through runtime behavior. As a result, it lacks a systematic way to ensure that all validity conditions are thoroughly evaluated. We present SpecTrum, a framework that addresses this problem in three stages. First, we introduce Consensus-SpecTec, a mechanized specification of the Ethereum consensus algorithm, which makes validity conditions explicit as if-premises. Second, we define premise coverage, a metric that measures which if-premises are evaluated to true and false across spectests. Third, we develop a specification-based test generator that extracts constraints on premises not evaluated to false by spectests and generates inputs to evaluate them. Applying SpecTrum to five major Ethereum consensus clients, we identify 27 cross-client divergence cases, 22 of which cannot be found without the premises inserted in our mechanization. All 27 cases reproduce across fork versions, and extending the mechanized specification to a new fork takes modest effort proportional to the specification difference. Article Search Artifacts Available Article: ase26main-p1970-p doi:10.1145/3832783.3834406
	Jha, Smriti	ASE '26: "REAP: Automatic Curation of ..." REAP: Automatic Curation of Coding Agent Benchmarks from Interactive Production Usage Smriti Jha, Matteo Paltenghi, Chandra Maddila, Vijayaraghavan Murali, Shubham Ugare, and Satish Chandra (Meta Platforms, USA) Production deployment of AI coding agents requires fast, reproducible evaluation signals. Existing industrial practices trade off speed and fidelity: online A/B testing takes weeks and risks user experience, shadow deployment yields signals that are not reproducible across runs, and public benchmarks diverge from production workloads in language distribution, prompt style, and codebase structure. This paper presents REAP (Relevance and Execution-Audited Pipeline), an automated curation pipeline that constructs production-derived benchmarks from real developer-agent sessions without manual labeling. Such curation, while in-distribution to production usage, runs into several challenges. Untestable prompts, misaligned tests, and test flakiness all compromise evaluation reliability. While tasks can be manually audited to ensure only high-quality tasks remain in the benchmark, this approach is infeasible in the monorepo setting: the build infrastructure state is often ephemeral in large monorepos and requires the benchmark to be continuously re-curated against the current codebase. As manual verification cannot be sustained at this cadence, REAP adds an automated verification layer using LLM-based task classification, agentic test-relevance validation, and multi-run stability checks to ensure the executable benchmark yields trustworthy signals. We use REAP to curate Harvest, a benchmark where each task feeds the coding agent a real developer prompt and verifies the resulting code change against fail-to-pass tests retrieved from production. Harvest’s distribution spans more than four programming languages with a majority of tasks drawn from Hack, a meaningful divergence from public benchmarks which are skewed towards Python. Model and harness evaluations reveal that solve rates range from 42.9% to 58.2% across five frontier models, surfacing capability differences that inform concrete deployment decisions. The underlying corpus contains proprietary source code and cannot be released publicly; we share our automated curation methodology and case studies to enable other organizations to construct similar production-derived benchmarks at scale. Article Search Artifacts Available Article: ase26ind-p266-p doi:10.1145/3832783.3834519
	Jhi, Yoon-Chan	ASE '26: "EvoLLM: High-Coverage, Readable, ..." EvoLLM: High-Coverage, Readable, and Token-Efficient Unit Test Generation for Industrial Java Codebases Seokhyeon Moon, Myungho Lee, Jihun Kim, Yoon-Chan Jhi, Jihoon Cho, and Hakjoo Oh (Samsung SDS, Republic of Korea; Korea University, Republic of Korea) Adopting automated Java unit-test generation in industrial settings requires high coverage, readability, token efficiency, and modern-Java deployability. No existing technique meets all four: search-based test generators struggle with readability and modern-Java deployability, LLM-centric generators consume tens of millions of tokens, and prior LLM-based test refactoring methods drop baseline coverage by 8–21 percentage points (pp) in our controlled setups. We report on EvoLLM, a hybrid Java unit-test generator we built and deployed to address all four requirements. EvoLLM combines EvoSuiteng—a failure-analysis-driven hardening of EvoSuite that resolves deployability issues and strengthens baseline coverage—with cluster-wise LLM-based refactoring that groups tests by coverage goals and rewrites each cluster in a single LLM call grounded in compact program-under-test context. Across six open-source and three industrial projects, EvoLLM outperforms six state-of-the-art baselines, improving line coverage by 8.2–20.7 pp, branch coverage by 6.2–19.4 pp, and mutation score by 6.8–24.5 pp, while reducing LLM token usage by 47.3%–93.0%. In addition, the test generation stage of EvoLLM demonstrates robust deployability across target projects built with JDKs 8, 11, and 17, while achieving strong effectiveness on a Spring-core release requiring JDK 17. Finally, a 14-participant developer survey further suggests that EvoLLM-generated tests ranked higher in readability than those from prior tools and developer-written tests. Article Search Article: ase26ind-p335-p doi:10.1145/3832783.3834525
	Ji, Liqiang	ASE '26: "Every Scenario Matters: Scenario-Guided ..." Every Scenario Matters: Scenario-Guided White-Box Testing for Static Code Checkers Powered by LLMs Jun Liu, Liqiang Ji, Jiwei Yan, Linjie Pan, Jinsong Ren, Jun Yan, and Jian Zhang (Institute of Software at Chinese Academy of Sciences, China; Huawei Technologies, China) In static analysis tools, each detection rule corresponds to a dedicated code checker. The checker's quality directly determines the validity of reported defects. Thus, comprehensive testing of these checkers is crucial. Existing checker testing approaches usually generate test cases from high-level rule descriptions while treating checkers as black boxes. However, these descriptions usually omit implementation-level conditions and checking scenarios. To bridge this gap, our key insight is that the rule description and checker implementation provide complementary information for comprehensive testing. The implementation supplies concrete checking logic, while the rule anchors the intended semantics. Building on this, we propose ScenSCT, a novel scenario-guided white-box checker testing approach powered by LLMs. ScenSCT first translates the checker's source code into a unified logic-based representation (CheckerIR) and applies both logic-decomposition and scenario-validation strategies to extract concrete checking scenarios. It then converts these scenarios into test cases through execution-feedback-guided test alignment to instantiate scenario constraints and scenario-invariant test augmentation to generate variants that preserve the target scenario. We evaluate ScenSCT on real-world Java checkers from five mainstream static analysis tools. In single-tool evaluation, ScenSCT extracts an average of ~9 scenarios and generates ~39 tests per checker, uncovering 270 potential issues (58 false positives and 212 false negatives) with an overall precision of 86.4%. Furthermore, cross-tool evaluation reveals 177 capability differences among shared checkers. Overall, ScenSCT offers a systematic testing method to improve the reliability of static analysis tools. Article Search Article: ase26main-p1253-p doi:10.1145/3832783.3834381
	Ji, Sangwoo	ASE '26: "CtxFuzz: Context-Aware Directed ..." CtxFuzz: Context-Aware Directed Fuzzing via Runtime Fuzzer-Agent Cooperation Jiho Kim, Dongkwan Kim, HyungSeok Han, Youngjoon Kim, Soyeon Park, Sangwoo Ji, Joshua Wang, Dae R. Jeong, and Taesoo Kim (Georgia Institute of Technology, USA; Microsoft, USA; Independent Researcher, USA; Samsung Electronics, Republic of Korea; Seoul National University, Republic of Korea) Automated tools produce vulnerability reports at unprecedented scale, but turning a report into a confirmed proof-of-vulnerability remains challenging. Directed grey-box fuzzers are widely used for validation but lack the ability to consume the rich context these reports carry, reducing each target to a bare location. In contrast, LLM-based approaches can consume this context but are often unable to identify the true triggering mechanism or to synthesize a working proof-of-vulnerability. We present CtxFuzz, a context-aware directed fuzzer that enables an LLM agent and a coverage-guided fuzzer to iteratively exchange and refine bug-triggering context throughout the campaign. The fuzzer contributes execution context, such as what inputs were tried and how the program behaved, grounding the agent’s reasoning in concrete evidence. The agent contributes semantic context, including hypotheses about the triggering conditions, explanations of failed attempts, and targeted mutations to overcome them, guiding the fuzzer toward relevant regions of the input space. Failed attempts are not discarded but decomposed into mutation scripts that translate each identified blocker into a fuzzer-executable strategy. This iterative exchange enables CtxFuzz to trigger vulnerabilities that neither directed fuzzers nor LLM agents reach independently. On 62 vulnerabilities across 16 open-source projects from the AIxCC Final competition (39 C, 23 Java), CtxFuzz exposes 61 of 62 targets, including 29 that no state-of-the-art directed fuzzer reaches, and exposes two zero-day vulnerabilities through a real-world vulnerability report validation pipeline. Article Search Article: ase26main-p797-p doi:10.1145/3832783.3834365
	Jia, Haoxiang	ASE '26: "Compressing Code Context for ..." Compressing Code Context for LLM-Based Issue Resolution Haoxiang Jia, Earl T. Barr, and Sergey Mechtaev (Peking University, China; University College London, UK) Large Language Models (LLMs) are now capable of resolving real-world GitHub issues. However, current approaches overapproximate the code context and suffer from two compounding problems: the prohibitive cost of processing massive inputs, and low effectiveness as noise floods the context window and distracts the model from the bug-fixing signal. Existing compression techniques fail to resolve this tension: generic compressors compromise the semantic integrity of code, while code-specific tools lack awareness of code structure and task context to preserve essential patch ingredients. To address this, we propose a novel framework consisting of two components. First, Oracle-guided Context Distillation (OCD), a context distillation algorithm that combines genetic search and delta debugging to systematically reduce code contexts to their minimal sufficient subsequence — retaining only the ingredients required for a successful fix. We use this distilled data to fine-tune , a lightweight model that learns to compress code context at inference time, filtering noise and combating distraction while preserving fix ingredients. Evaluated on SWE-bench Verified across three frontier LLMs, maintains a stable compression rate of about 6× across models, reduces the total token budget by 51.8%–71.3% relative to the uncompressed setting, improves issue resolution rates by 5.0%–9.2%, and delivers the best overall balance among effectiveness, compression ratio, and latency compared with state-of-the-art context compression baselines. Article Search Article: ase26main-p1597-p doi:10.1145/3832783.3834397
	Jia, Limin	ASE '26: "Learning to Triage Vulnerability ..." Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js Ronghao Ni, Aidan Z.H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, and Kevin Cheang (Carnegie Mellon University, USA; Athanor AI, USA; University of California at Berkeley, USA) Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNNs and LLMs, trained on data derived from program analysis tool outputs (NodeMedic-FINE in our case study). The top LLM achieves F1=0.915, while the best provenance-graph-based method achieves F1=0.904. On the reports that the upstream tool flags but cannot automatically confirm, at a target of recovering 90% of the exploitable reports, the leading model eliminates 75% of the benign reports from manual review. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives among all warnings), our approach can report 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage. Article Search Article: ase26main-p1614-p doi:10.1145/3832783.3837503
	Jia, Ruoxi	ASE '26: "IcFuzz: Fuzzing Isaac Sim ..." IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation Zhixiang Chen, Zhuangbin Chen, Ruoxi Jia, Zeqin Liao, Wei Li, Jinyang Liu, and Zibin Zheng (Sun Yat-sen University, China; Nanyang Technological University, Singapore; Chinese University of Hong Kong, Hong Kong) Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190%–205% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers. Article Search Article: ase26main-p3261-p doi:10.1145/3832783.3837550
	Jia, Songlin	ASE '26: "Adaptive Proof Refinement ..." Adaptive Proof Refinement with LLM-Guided Strategy Selection Minghai Lu, Zhe Zhou, Danning Xie, Songlin Jia, Benjamin Delaware, and Tianyi Zhang (Purdue University, USA; Meta, USA) Formal verification via theorem proving enables rigorous proofs of software correctness, but it is difficult to scale due to the significant manual effort and expertise required. While Large Language Models (LLMs) have shown potential in automating proof generation, they frequently produce incorrect proofs on the first attempt that require iterative refinement to fix. However, most existing approaches employ fixed refinement strategies and cannot dynamically choose an effective strategy, which limits their performance. To overcome this limitation, we introduce Adapt, a novel proof refinement framework that leverages an LLM-guided decision-maker to dynamically select a suitable refinement strategy according to the state of the proof assistant and available context of an incorrect proof. We evaluate Adapt on two benchmark suites against five existing methods and find that it significantly outperforms the best baseline on both by proving 11.26% and 18.58% more theorems, respectively. Furthermore, we demonstrate Adapt’s generalizability by evaluating it across six different LLMs. We also conduct ablation studies to measure the contribution of each component and compare the trade-offs of alternative decision-maker designs. Article Search Article: ase26main-p1291-p doi:10.1145/3832783.3834382
	Jia, Tao	ASE '26: "Introducing Safe LLM-Agent ..." Introducing Safe LLM-Agent Execution via Typed Tool Mediation and World-Effect Evaluation Jun Zhou and Tao Jia (Chongqing Normal University, China; Chongqing Electric Power College, China; Southwest University, China) LLM-based agents are increasingly used as action-taking systems that operate over files, databases, networks, and external services. In this setting, safety failures can become unauthorized world effects, such as data deletion, protected-resource modification, or secret exfiltration, rather than merely unsafe text outputs. We present AgentOS, a Buildroot-based execution environment for safe tool-using LLM agents. Its core component, the Verified Toolchain Reference Monitor (VTRM), mediates model-generated tool requests before execution by converting untrusted model outputs into typed requests and enforcing capability-aware and label-aware decisions over filesystem, database, and network operations. AgentOS further includes a host-side World Effect Judge (WEJ) for evaluation. WEJ measures task completion and safety using filesystem snapshots, database diffs, audit logs, and network observations rather than model self-report. We evaluate AgentOS on benign and adversarial task suites using two LLMs. Across both models, AgentOS matches prompt-only and naive baselines on benign-task utility. On adversarial tasks, AgentOS blocks all evaluated harmful cases, while both baselines leave substantially more unsafe effects unblocked. We also model the core VTRM decision path in TLA+ and check representative confidentiality and fail-closed properties. These results suggest that typed tool mediation and host-side world-effect evaluation can improve LLM-agent execution safety while preserving benign-task utility. The source code and documentation are publicly available under the MIT License at https://github.com/zhoujune/AgentOS, with an archived artifact at https://doi.org/10.5281/zenodo.20046861; the demonstration screencast is available at https://youtu.be/bqJsTRJbIkU. Article Search Article: ase26tool-p115-p doi:10.1145/3832783.3834637
	Jia, Tong	ASE '26: "AlarmClaw: Context-Enriched ..." AlarmClaw: Context-Enriched Alarm Management with Category-/Severity-Aware Incident Graphs Siyu Yu, Meizhen Li, Jiacheng Yang, Yifan Wu, Ning Wang, Zhaoxing Chen, Ming Liu, Xinchi Ren, Xincheng Ren, Chan Li, Tong Jia, Xiang Zhang, and Ying Li (Peking University, China; ByteDance, China) Large-scale production systems rely on monitoring rules and anomaly detectors to trigger alarms that notify site reliability engineers (SREs) of potential failures. Before diagnosis and mitigation can begin, alarm management must construct incident state online by deciding whether each arriving alarm is noise, indicates a potential new incident, or should be associated with an existing incident to enrich its evolving state. Existing alarm-management methods remain difficult to deploy because some rely on reusable operational artifacts such as SOPs or historical prototypes to judge alarm relationships, while graph-based methods often apply the same topology-derived propagation patterns across incidents. In production, such artifacts are often missing or service-specific, and valid propagation paths vary with incident type and severity. We present AlarmClaw, a context-enriched alarm-management system built around these two constraints. AlarmClaw uses bounded context clawing to retrieve compact evidence from auditable operational sources and a category- and severity-aware incident graph to constrain a large language model (LLM) decision agent. An evolution mechanism refreshes reusable context and graph evidence from validated outcomes. On a temporally held-out replay from a production corpus of 51,000 alarms and 9,661 incidents, AlarmClaw achieves 86.0% association Precision and 78.5% Recall, improving F1 by 7.4 points over the strongest adapted baseline. During six months of online operation, evolution updates improve F1 by 2.3 points over a matched fixed-knowledge counterfactual. From January to June 2026, AlarmClaw automatically associated more than 4,800 alarms, conservatively saving at least 4,800 engineer-minutes and reducing the per-alarm association operation from approximately 90 s manually to under 10 s. Article Search Article: ase26ind-p313-p doi:10.1145/3832783.3834524 ASE '26: "Bifrost: Empowering Pretrained ..." Bifrost: Empowering Pretrained Language Model with Fallibility Representation for Log-Based Fault Diagnosis Minghua He, Tong Jia, Lingzhe Zhang, Chiming Duan, Xinlong Zhao, Leyi Pan, Cheng Wang, Kangjin Wang, Yinghao Yu, Liping Zhang, Yifan Wu, and Ying Li (Peking University, China; Tsinghua University, China; Alibaba Group, China) Log-based fault diagnosis is crucial for runtime debugging and maintenance. Existing fault diagnosis methods use language models pre-trained on natural language (PLMs) for log representation. However, system faults are reflected in the multi-level structure of system logs. PLMs pre-trained on natural language struggle to comprehensively capture multi-level fault information, failing to meet the requirements of fault diagnosis. We refer to this information as fallibility representations. To address this problem, we propose a novel log representation learning method, Bifrost. It draws inspiration from the log analysis experience of Site Reliability Engineers and meticulously designs strategies based on self-supervised contrastive learning to learn the fallibility representations of logs. Across three public systems and one industrial ML-as-a-Service system, the log representations produced by Bifrost outperform existing PLMs by average margins of 9.83% in F1 for anomaly detection, 18.28% in HR@k for root cause localization, and 20.88% in Macro-F1 for fault identification. Article Search Article: ase26main-p3295-p doi:10.1145/3832783.3834433
	Jia, Xiaohua	ASE '26: "No Isolated Evolution, No ..." No Isolated Evolution, No Blind Search: Memory-Guided Prompt Co-evolution for Industrial Multi-agent Vulnerability Detection Jie Xu, Zihan Wu, Yun Peng, Chun Yong Chong, Linghan Meng, Kui Liu, and Xiaohua Jia (City University of Hong Kong, Hong Kong; Chinese University of Hong Kong, Hong Kong; Monash University, Malaysia; Huawei Technologies, China) Large Language Model (LLM)-based multi-agent systems have shown promise for automated vulnerability detection, but our industrial deployment reveals two limitations: 1) each agent's prompt is typically optimized in isolation, degrading global end-to-end performance; and 2) evolutionary prompt search lacks memory across iterations, wasting computation costs. To address these limitations, we propose MemCo, a memory-guided prompt co-evolution framework applied to industrial vulnerability detection. First, MemCo takes an end-to-end prompt co-evolution strategy, which evaluates prompts based on the system's final output rather than assessing each agent in isolation. In each evolutionary iteration, only the prompts of agents responsible for the misclassification undergo further evolution, thereby enhancing the system's global accuracy. Second, MemCo adopts a memory-guided search mechanism, which edits prompts based on records of successful and failed modifications. This reduces redundant blind exploration and significantly lowers computation costs. Comprehensive experiments show that MemCo improves Macro-F1 by +8.4 to +18.0 points on public benchmarks and up to 36.9% relative improvement on a proprietary industrial benchmark, while reducing per-generation evolution tokens by 48.5% and inference tokens by 63.8%. MemCo is deployed as a vulnerability detection assistant in our production security pipeline. Article Search Article: ase26ind-p297-p doi:10.1145/3832783.3834522
	Jia, Zhouyang	ASE '26: "CTForge: Automatically Generating ..." CTForge: Automatically Generating Test Suites for Software Configuration Yuanliang Zhang, Zhizheng Zheng, Shanshan Li, Zhouyang Jia, Chaopeng Luo, Liqian Chen, Zhenbang Chen, Ji Wang, and Xiangke Liao (National University of Defense Technology, China) Software configuration plays a critical role in modern software systems, yet it also frequently leads to severe failures. Existing approaches, whether static analysis or LLM-based validation, struggle to capture implicit semantic constraints and validate configuration-code interactions. Leveraging existing unit tests is also insufficient due to their lack of configuration-specific focus. Thus, we present CTForge, an LLM-powered framework that automatically generates configuration-specific test suites. Its core innovation is a three-stage configuration-aware optimization pipeline that moves beyond vanilla test generation, specifically using parameter semantics to improve LLM outputs. This optimization pipeline iteratively aligns tests through: (1)enhance configuration-related code coverage to ensure relevance, (2) assertion validation across valid parameter values to eliminate false assertions, and (3) configuration-sensitivity verification to select tests that semantically exercise the intended configuration behavior. Evaluated on five large-scale systems, CTForge detects 63 out of 79 real-world configuration issues and achieves an F1-score of 0.88 in misconfiguration detection. CTForge also uncovers six previously unknown defects. Our work demonstrates that structured configuration-aware refinement is essential for LLM to produce effective test suites. Article Search Article: ase26main-p1197-p doi:10.1145/3832783.3837484
	Jian, Rong	ASE '26: "Evidence-Grounded Logic Vulnerability ..." Evidence-Grounded Logic Vulnerability Detection for Smart Contracts via Runtime Context Reasoning Guang Gong, Yucong Jiang, Rong Jian, Xiaotao Feng, Zhihan Wei, Qi Li, and Ke Xu (Tsinghua University, China; 360 Vulnerability Research Institute, China) Smart contracts are foundational to DeFi, yet detecting business-logic vulnerabilities, i.e., execution is syntactically correct but violates a contract’s intended behavior, remains difficult. Most recent LLM-based approaches still follow a largely static, source-code–centric auditing paradigm. In practice, however, smart contracts are inherently stateful: many logic flaws emerge only under specific contract states and across particular state transitions. As a result, code-only auditing can produce false positives and miss true vulnerabilities. To address this gap, we present RcAudit, a system for detecting smart-contract logic vulnerabilities via runtime-context–enhanced LLM reasoning. RcAudit constructs a Contract Logic Knowledge Base that captures contract behavior from multiple perspectives to support LLM analysis. It then applies a state- and intent-aware fuzzing strategy to generate logic-critical runtime contexts, and performs LLM reasoning over selected contexts that exhibit potential intent–behavior inconsistencies to pinpoint vulnerabilities. We evaluate RcAudit on three real-world datasets. RcAudit identifies 74 of 132 known logic vulnerabilities with high precision (96.9%), achieving 117.6% higher detection than the strongest baseline. Importantly, RcAudit further uncovers 22 zero-day vulnerabilities in real-world projects. Article Search Artifacts Available Article: ase26main-p839-p doi:10.1145/3832783.3837471
	Jiang, Anni	ASE '26: "FaultForge: A Business-Semantics-Driven ..." FaultForge: A Business-Semantics-Driven Cross-Layer Fault Injection Framework for Microservice Yongxin Yang, Yang Yang, Anni Jiang, Mingyuan Yang, and Peng Yu (Beijing University of Posts and Telecommunications, Beijing, China) Production microservice failures may leave only weak metric signals while silently violating business semantics. Existing fault injection tools primarily target infrastructure-level faults and lack business-level modeling capabilities. We propose FaultForge, a business-semantics-driven cross-layer fault injection framework that derives a fault space from business invariants. The framework validates pure business faults using business-layer evidence; for infrastructure-induced faults, it additionally requires technical-layer and cross-layer evidence. A preliminary evaluation on an extended Train-Ticket system produced 124 admitted fault samples covering most services and business journeys, providing initial evidence that business-layer signals can complement infrastructure telemetry in localizing silent semantic failures. Article Search Artifacts Available Article: ase26nier-p75-p doi:10.1145/3832783.3834552
	Jiang, Binhong	ASE '26: "Expanding Guard Reach: Online ..." Expanding Guard Reach: Online Learning-Driven Incremental Kernel Panic Diagnosis Yicheng Sui, Xiaotian Wang, Hailin Zhang, Shenglin Zhang, Binhong Jiang, Heng Zheng, Yongqian Sun, Yuzhi Zhang, Yang Zhang, Xin Wu, Liangyan Peng, Linlin Han, Feng Wang, Xiaozhou Liu, and Yu Zhang (Nankai University, China; ByteDance, China) Kernel panic faults (KPFaults) disrupt large-scale infrastructures. While logs are the primary diagnostic resource, they exhibit continuous semantic drift driven by the evolution of diverse online services and hardware heterogeneity. Existing methods fail to adapt to this drift. However, employing online learning to address this drift encounters two operational bottlenecks: the sparsity of KPFault-indicating logs and the heavy burden of manual intervention. To address this, we propose PanicGuard, an incremental diagnosis framework driven by online learning. PanicGuard integrates Fault-Indicating Representation Extraction (FIRE) to autonomously filter noise from sparse logs and Emergent Drift Guard Engine (EDGE) to verify evolving patterns within known fault categories and escalate genuinely novel types for expert registration using LLM-assisted reasoning. Evaluations on two real-world datasets comprising 6,789 and 6,779 KPFault cases demonstrate that PanicGuard achieves high accuracy (0.996 and 0.993) and Macro-F1 score (0.977 and 0.990) with only 29 and 33 human interventions, respectively. Compared to the strongest baseline, PanicGuard reduces human effort by 69% and 95%, respectively, while maintaining high precision. It has been operating in production for over three months, proving its effectiveness in achieving superior diagnostic performance compared to legacy methods, while significantly reducing manual intervention. The source code is publicly available at https://doi.org/10.5281/zenodo.19826984. Article Search Artifacts Available Article: ase26ind-p78-p doi:10.1145/3832783.3834474
	Jiang, Chao	ASE '26: "Beyond Benchmarks: A Case ..." Beyond Benchmarks: A Case Study of LLM-Generated Verus Specification Failures on Asterinas Vostd Dugang Liu, Ding Wang, Chao Jiang, Cheng Wen, Zhiwu Xu, Zhong Ming, Yuwei Liu, Xinyi Wan, and Lin Huang (Shenzhen University, China; Ant Group, China) Large language models (LLMs) have recently shown promise in automating formal specification generation, but their effectiveness has mainly been demonstrated on self-contained benchmark tasks. This paper examines the changes that occur when LLM-generated specifications are applied to an industrial verification project. To answer this question, we conducted experiments on Asterinas OSTD's Vostd repository, a Rust-based OS-kernel verification codebase built around cross-file dependencies and Entity--Model proof abstractions. We analyze six formal verification targets spanning 156 function-level tasks, 50 Rust source files, and 7,149 lines of code; the failure corpus contains 1,587 reviewed failure episodes nested within 270 model-specific repair traces produced by DeepSeek-V4-Flash, GPT-4o, and Qwen-Coder. Our results show that existing methods effective on benchmarks face significant challenges on Vostd, and that framework customization for industrial validation is necessary and has considerable potential. LLM-generated specifications break in systematic rather than random ways: they cluster across four verification stages (i.e., repository integration, Verus legality, semantic modeling, and proof construction), and their distributions vary across models and targets. We further show that verifier diagnostics do not always identify the true source of failure, and that verifier-guided repair can regress or stall rather than converge. These findings indicate that LLM-generated specifications fail not merely because industrial code is harder, but because failures are structured, stage-dependent, and often repaired in the wrong direction. Future evaluation and tooling should therefore move beyond final pass/fail outcomes and account for where specifications break, whether diagnostics identify the real cause, and whether repair makes progress or simply cycles through new errors. Article Search Artifacts Available Article: ase26ind-p194-p doi:10.1145/3832783.3834504
	Jiang, Daoping	ASE '26: "Manifesting Implicit Dependencies ..." Manifesting Implicit Dependencies in Requirements Task: An Automated Method Integrating Code Awareness and Change Analysis Hui Ma, Jiajun Yang, Yan Chen, Pingjia Liao, Baoyu Zhao, and Daoping Jiang (Shenzhen Poweroak Newener, China) In modern software development, accurately assessing the impact scope of requirement changes is crucial for software quality, yet this task faces two major challenges. First, highly simplified requirement descriptions (one-sentence requirements) tend to conceal complex business logic and extensive system dependencies. Second, commits often intertwine code changes for multiple requirements, leading to impact assessments that are both incomplete and time-consuming. Traditional manual assessment methods are not only inefficient but also prone to cognitive biases, which often result in the omission of critical impact points. To address these problems, this paper proposes AIST (Analysis of the Impact Scope of the Task), an automated impact scope analysis approach based on Large Language Models (LLMs). AIST leverages the semantic understanding and planning capabilities of LLMs to automatically parse requirement descriptions, retrieve relevant code context from the codebase, and integrate code change information, thereby generating a comprehensive impact scope assessment report. We evaluated AIST on 40 historical requirement changes from three real-world industrial projects. The experimental results show that it achieves a precision of $80.19\%$, a recall of $94.95\%$, and an F1-score of $86.35\%$, thereby significantly improving the completeness of impact scope identification and demonstrating high sensitivity in detecting tangled code changes. In a user survey, the novelty score was 6.32 out of 7.00, and the overall satisfaction score was 6.36 out of 7.00, indicating that users perceive that the tool effectively improves efficiency and reduces the risk of omissions. Article Search Article: ase26ind-p257-p doi:10.1145/3832783.3834516
	Jiang, Jiamin	ASE '26: "KRCA: An Efficient Root Cause ..." KRCA: An Efficient Root Cause Analysis System in Hyper-scale Microservice Systems via Agentic AI Jiamin Jiang, Jingfei Feng, Yu Luo, Qingliang Zhang, Yongqian Sun, Wenwei Gu, Shenglin Zhang, Tianyu Cui, Yao Wu, Jielong Huang, Nan Qi, and Dan Pei (Nankai University, China; Kuaishou Technology, China; Tsinghua University, China) Hyper-scale microservice systems have become the standard infrastructure for large-scale Internet companies. These systems consist of numerous loosely coupled microservices that evolve independently through continuous development and deployment. Such complexity makes failures unavoidable, necessitating efficient Root Cause Analysis (RCA) to help Site Reliability Engineers (SREs) quickly localize root cause services and classify failure types. However, existing RCA methods often struggle to adapt to the extreme dynamism and massive scale of these systems. In this paper, we present KRCA, an end-to-end RCA system designed for hyper-scale microservice systems. To manage the vast search space, KRCA employs a multi-stage pipeline that begins with an API-level drilldown to isolate suspicious services. It then instantiates a skeleton-based causal graph from anomalous metrics to serve as a high-recall structural prior, before utilizing a memory-augmented multi-agent framework to verify causality and generate the final failure report. By combining structured causal constraints with multi-agent reasoning, KRCA balances diagnostic accuracy with the efficiency requirements of real-time production use. Experimental results show that KRCA achieves AC@1 scores of 0.88 and 0.79 for root cause service localization and failure type classification, outperforming the strongest baseline by at least 31% in absolute gains. KRCA has been deployed in Kuaishou's production environment for over six months, reducing the average diagnosis time by 77.3%. Article Search Article: ase26ind-p61-p doi:10.1145/3832783.3834468 ASE '26: "OpsAgent: An Evolving Multi-agent ..." OpsAgent: An Evolving Multi-agent System for Incident Management in Microservices Yu Luo, Jiamin Jiang, Jingfei Feng, Lei Tao, Qingliang Zhang, Xidao Wen, Yongqian Sun, Shenglin Zhang, Tong Liu, Wenjie Zhang, and Dan Pei (Nankai University, China; Alibaba Cloud, China; Lenovo, China; Tsinghua University, China) Incident management (IM) is central to the reliability of large-scale microservice systems. Yet manual IM, where on-call engineers examine metrics, logs, and traces is labor-intensive and error-prone in the face of massive and heterogeneous observability data. Existing automated IM approaches often struggle to generalize across systems, provide limited interpretability, and incur high deployment costs, which hinders adoption in practice. In this paper, we present OpsAgent, a lightweight, self-evolving multi-agent system for IM that employs a training-free data processor to convert heterogeneous observability data into structured textual descriptions, along with a multi-agent collaboration framework that makes diagnostic inference transparent and auditable. To support continual capability growth, OpsAgent also introduces a dual self-evolution mechanism that integrates internal model updates with external experience accumulation, thereby closing the deployment loop. Comprehensive experiments on the OPENRCA benchmark demonstrate state-of-the-art performance and show that OpsAgent is generalizable, interpretable, cost-efficient, and self-evolving, making it a practically deployable and sustainable solution for long-term operation in real-world microservice systems. Notably, its deployment in Lenovo’s production environment further validates its effectiveness in real-world industrial settings. Article Search Article: ase26ind-p92-p doi:10.1145/3832783.3834479
	Jiang, Jinan	ASE '26: "Zero-Knowledge VMs: Security ..." Zero-Knowledge VMs: Security and Usability in Practice Jinan Jiang, Jinzhao Chu, Pengyu Xue, Xinghao Peng, Haoran Qin, and Xiapu Luo (Hong Kong Polytechnic University, Hong Kong) Zero-knowledge Virtual Machines (zkVMs) are emerging critical infrastructure for blockchain Layer 2 scaling solutions, enabling execution of arbitrary programs while generating succinct proofs of correct computation. Despite hundreds of millions of investment, the rapidly evolving zkVM ecosystem lacks comprehensive empirical analysis of its security and usability challenges. We present the first systematic study of zkVM vulnerability and usability issues, analyzing production zkVMs through three perspectives covering 314 security vulnerabilities (professional audits), 11,854 commits (developer practices), and 1,150 user issues (user experiences). We identify prevalent, severe, and non-traditional vulnerability categories and their root causes, reveal high-value attack surfaces that consistently emerge across zkVMs, and identify major usability issues that users struggle with. Comparing our findings against existing research reveals four gaps representing research and tool development opportunities for the testing and analysis of zkVMs. Article Search Article: ase26main-p1549-p doi:10.1145/3832783.3837500
	Jiang, Lingxiao	ASE '26: "To Think or Not to Think: ..." To Think or Not to Think: Evaluating LLM Reasoning and Agents in Vulnerability Detection Hua Beng Tan, Ratnadira Widyasari, Merve Astekin, Arda Goknil, Hasan Sözer, Yan Naing Tun, Erik Johannes Husom, Lwin Khin Shar, and Lingxiao Jiang (Singapore Management University, Singapore; SINTEF, Norway; Ozyegin University, Türkiye) Large language models (LLMs) are increasingly studied for software vulnerability detection, but the benefits of recent reasoning-enabled (“thinking”) modes remain unclear. At the same time, agentic LLM designs aim to enhance analysis through structured collaboration, while practical software security workflows require explanations that facilitate inspection, validation, and remediation. Because prior studies often examine these dimensions separately or under heterogeneous settings, their individual effects on vulnerability detection remain difficult to disentangle. This paper addresses the gap through a phased, factor-separated empirical study on the PrimeVul Pair benchmark. In the first phase, we compare instruct and thinking variants of four open models under zero- and few-shot prompting without agents. In the second phase, we evaluate single-, dual-, and multi-agent (SA, DA, and MA) designs alongside call-matched single-agent baselines, alert-burden metrics, and cost analysis. In the third, we assess explanations through blinded human and calibrated LLM evaluation across correct and incorrect predictions, controlling for response length and model family. Thinking improves non-agent (NA) F1 in 7 of 8 settings, mainly through recall, while DA achieves the highest F1/recall but flags 88.2% of functions as vulnerable. MA performs better on pairwise discrimination, although call-matched self-revision achieves the best Pair-wise Correct Prediction (P-C) overall. Thinking also uses 2.7–4.4× more energy, and its F1 benefit declines with greater orchestration. Explanation gains are model-specific, partly length-mediated, and do not distinguish correct from incorrect predictions. Article Search Article: ase26main-p2084-p doi:10.1145/3832783.3837521
	Jiang, Linxi	ASE '26: "Lost in Translation, Found ..." Lost in Translation, Found in Summary: Summary-Driven Supervision for Cross-Language Code Retrieval Zhijie Liu, Yisi Liu, Linxi Jiang, Yutian Tang, Lili Xiao, and Zhipeng Xue (Independent Researcher, China; Donghua University, China; University of Glasgow, UK; Zhejiang University, China) Cross-language code retrieval (CLCR) is critical to modern software development, and recent studies have shown that contrastive learning is an effective way to learn cross-language code semantics. However, these methods are still limited by two fundamental challenges. First, they rely on online judge platforms or multilingual NL-to-code datasets, which either lack diversity or fail to ensure semantic alignment between code snippets, thereby limiting the effectiveness of cross-language semantic learning. Second, during training, code snippets from different languages are often encoded into heterogeneous representation distributions. This distribution inconsistency introduces similarity bias and weakens the model's ability to capture accurate cross-language semantics. To address these challenges, we propose SemSIR, an end-to-end framework for CLCR. The key insight is to use Summary IR, a natural-language intermediate representation, to bridge semantic gaps across languages. Built on this insight, SemSIR automatically constructs scalable cross-language supervision from real-world repositories, and further combines distribution alignment with CLIP-style contrastive training to learn more discriminative language-independent code semantics. In our evaluation, we collect 24 million real-world code snippets across 9 languages and automatically construct 7 million semantic groups. Manual inspection of 1,000 sampled groups shows that 92.7% are fully semantically coherent, with an average Group Purity of 96.8%. On CLCR, SemSIR consistently outperforms all baselines on two benchmarks, surpassing the state-of-the-art method by up to 24.7% in MRR and 50.1% in MAP on average. In addition, experimental results on a security case study of tracing rewritten malware across languages show that SemSIR achieves 92.20 MRR and 88.40 MAP, highlighting its potential for security-oriented CLCR. Article Search Article: ase26main-p479-p doi:10.1145/3832783.3837444
	Jiang, Sheila	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Jiang, Siwei	ASE '26: "Requirements-Augmented Generation ..." Requirements-Augmented Generation for Trustworthy Acceptance Testing of LLM-Based Software Fanyu Wang, Chetan Arora, Zhenping Xie, Yonghui Liu, Kla Tantithamthavorn, Aldeida Aleti, and Siwei Jiang (Monash University, Australia; Jiangnan University, China; Australian National University, Australia; Yiwuyishi Intelligent Technology (Nantong), China; Tianjin University, China) LLM-based software (LBS) integrates large language models as core components to deliver flexible and personalised responses. Unlike traditional software with deterministic outputs, LBSs exhibit context-dependent, stochastic behaviour that renders classical acceptance testing and test oracles insufficient: the same query may require fundamentally different responses depending on users' personas and software context. This gap creates an urgent need for automated acceptance testing frameworks that can autonomously interpret users' instructions, while also raising the challenge of how we can reliably interpret users' intentions in a changing environment. In this paper, we present an automated acceptance testing framework for LBS with calibrated verdict reliability through two technical contributions. First, we introduce REquirements-Augmented Generation (REAG), which interprets user intentions by retrieving relevant software requirements, domain knowledge, and personas via adaptive RAG and self-reasoning to generate context-aware test oracles. Second, recognising that oracle generation may retrieve irrelevant constraints, misinterpret intent, or hallucinate requirements, we introduce a confidence-calibrated cascade judgment that quantifies verdict reliability via simulated expert agreement, accepting high-confidence verdicts, escalating ambiguous cases, or abstaining when uncertain, with empirical reliability guarantees backed by conformal risk control. An industrial case study on a production nutrition advisory application demonstrates that REAG achieves a 3.91/5 oracle quality score, successfully achieving qualified or marginal oracle quality in 82% of cases. The confidence-calibrated cascade achieves 98.8% accuracy, improves oracle quality from 3.91 to 4.30 by filtering unqualified outputs, and delivers a 31.7% cost-efficiency improvement over single-judge baselines, validating industrial viability. Article Search Article: ase26ind-p113-p doi:10.1145/3832783.3834491
	Jiang, Xiao	ASE '26: "Beyond Text Matching: Towards ..." Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering Xiuwei Shang, Li Hu, Xiao Jiang, Jieke Shi, Junda He, Zhou Yang, Shaoyin Cheng, Guoqiang Chen, Weiming Zhang, and David Lo (University of Science and Technology of China, China; Singapore Management University, Singapore; University of Alberta, Canada) Human-Oriented Binary Reverse Engineering (HOBRE) aims to transform decompiled pseudocode into a more human-friendly representation, thereby reducing the cognitive burden of reverse analysis and improving efficiency. However, reliably evaluating HOBRE outputs remains a fundamental challenge. On one hand, human evaluation is costly, time-consuming, as well as difficult to scale. On the other hand, existing automated metrics either rely on executable test cases and runtime environments, which are often unavailable for real-world binaries, or depend on high-quality source code references that are typically inaccessible and fail to capture semantically equivalent but lexically diverse outputs. Although the emerging LLM-as-a-Judge paradigm is naturally well-suited to HOBRE evaluation, its effectiveness has not yet been fully studied. This paper presents the first systematic investigation of the LLM-as-a-Judge paradigm for HOBRE, covering three representative tasks: function name recovery, binary code summarization, and decompilation optimization. We introduce BinJudgeBench, the first expert-annotated, reference-free evaluation benchmark based on multi-dimensional human judgment. Our empirical study reveals that LLM-as-a-Judge achieves an average correlation of 63.20% with human judgment, significantly outperforming traditional automated metrics at 35.04%. By analyzing the impact of various judge configurations, including backbone LLMs, prompting strategies, and decoding temperatures, on both correlation and cost, we find that no “one-size-fits-all” configuration exists, as the optimal setup varies across tasks and individual samples. To address this, we propose BinJudge, which employs a lightweight routing mechanism to adaptively select the optimal judge configuration for each specific task and sample. BinJudge improves correlation with human experts by 4.5%–24.7% and reduces API cost to 0.06×–0.84× of that of static best configurations, providing a scalable, cost-effective, and high-fidelity automated evaluation scheme for HOBRE. Article Search Article: ase26main-p130-p doi:10.1145/3832783.3834339
	Jiang, Yu	ASE '26: "WiDepFuzz: Finding Wi-Fi Protocol ..." WiDepFuzz: Finding Wi-Fi Protocol Bugs in Mobile Hotspot via Field Dependency Model Yuanliang Chen, Fuchen Ma, Taotao Gu, and Yu Jiang (Tsinghua University, China) Wi-Fi is a widely used wireless protocol, and mobile hotspot functionality has become essential for on-the-go connectivity. Bugs in the hotspot protocol stack can cause crashes, performance degradation, and semantic inconsistencies. Fuzzing is a promising technique for detecting such vulnerabilities. However, existing fuzzers typically test by modeling protocol inputs but ignore some critical dependencies among Wi-Fi fields, leading to inefficient testing. In this work, we present WiDepFuzz, a fuzzing framework designed to detect bugs in Mobile Hotspot implementations by modeling field dependencies in the Wi-Fi protocol. First, WiDepFuzz automatically identifies the semantic dependencies among Wi-Fi fields based on the IEEE 802.11 standard and constructs a Field Dependency Model (FDModel) to characterize various direct and indirect dependencies. Second, leveraging the FDModel, WiDepFuzz utilizes dependency-combination guided fuzzing to constantly generate Wi-Fi test frames that efficiently explore deep paths and trigger hidden bugs. Finally, we propose liveness and dependency detectors that enable real-time monitoring to identify abnormal states and uncover potential bugs in mobile hotspots. We implemented WiDepFuzz and evaluated it in six widely used mobile hotspots, covering major smartphone manufacturers, including Samsung, Xiaomi, OPPO, Honor, Huawei, and Nokia. Compared to SOTA Wi-Fi fuzzers like Peach, OwFuzz, wpaspy, and Greyhound, WiDepFuzz detects 15 more bugs and improves bug detection speed by 37% on average. In total, it uncovered 20 new bugs. Article Search Article: ase26main-p1165-p doi:10.1145/3832783.3837483
	Jiang, Yucong	ASE '26: "Evidence-Grounded Logic Vulnerability ..." Evidence-Grounded Logic Vulnerability Detection for Smart Contracts via Runtime Context Reasoning Guang Gong, Yucong Jiang, Rong Jian, Xiaotao Feng, Zhihan Wei, Qi Li, and Ke Xu (Tsinghua University, China; 360 Vulnerability Research Institute, China) Smart contracts are foundational to DeFi, yet detecting business-logic vulnerabilities, i.e., execution is syntactically correct but violates a contract’s intended behavior, remains difficult. Most recent LLM-based approaches still follow a largely static, source-code–centric auditing paradigm. In practice, however, smart contracts are inherently stateful: many logic flaws emerge only under specific contract states and across particular state transitions. As a result, code-only auditing can produce false positives and miss true vulnerabilities. To address this gap, we present RcAudit, a system for detecting smart-contract logic vulnerabilities via runtime-context–enhanced LLM reasoning. RcAudit constructs a Contract Logic Knowledge Base that captures contract behavior from multiple perspectives to support LLM analysis. It then applies a state- and intent-aware fuzzing strategy to generate logic-critical runtime contexts, and performs LLM reasoning over selected contexts that exhibit potential intent–behavior inconsistencies to pinpoint vulnerabilities. We evaluate RcAudit on three real-world datasets. RcAudit identifies 74 of 132 known logic vulnerabilities with high precision (96.9%), achieving 117.6% higher detection than the strongest baseline. Importantly, RcAudit further uncovers 22 zero-day vulnerabilities in real-world projects. Article Search Artifacts Available Article: ase26main-p839-p doi:10.1145/3832783.3837471
	Jiang, Yuhang	ASE '26: "FAiLGen: Calibrating LLM for ..." FAiLGen: Calibrating LLM for Failing Test Generation with Monte Carlo Tree Search Tsz-On Li, Xiaochuan Yan, Dehui Yi, Yuhang Jiang, Kexin Li, Congying Xu, Ying Wang, and Shing-Chi Cheung (Hong Kong University of Science and Technology, Hong Kong; Northeastern University, China) Failing test generation is an important yet challenging task in software engineering. It involves searching a vast space to identify fault-triggering test inputs and the oracles that assert these faulty executions. Several approaches have been proposed for generating failing tests. Specifically, given a program-under-test (PUT) and its requirements, these approaches leverage large language models (LLMs) to generate alternative implementations of the PUT that comply with the requirements, followed by differential testing between the PUT and the alternative implementations. Failing tests can be constructed by adopting the inconsistency-revealing inputs as the test inputs and treating the outputs returned by the alternative implementations as expected outputs. As alternative implementations may also contain faults and thus return incorrect outputs, current methods rely on either output consistency across alternative implementations or pre-constructed test cases for validation. However, the former is susceptible to LLM training biases or stochasticity, while the latter can be impractical due to the scarcity or unavailability of pre-constructed test cases in real-world scenarios. To address existing works’ limitations, we employ LLM as an alternative oracle for output validation, and calibrate its reasoning steps to reduce its susceptibility to LLM training biases or stochasticity. One critical challenge is that the calibration process inherently requires correct input-output pairs for the output validation task as ground-truth for reference when validating/calibrating LLMs’ reasoning, yet correct input-outputs (i.e., passing tests) are often scarce or unavailable in real-world scenarios. To address this challenge, our insight is that outputs consistently returned by both the PUT and all alternative implementations have a high probability of being the correct outputs of the PUT, as the PUT and alternative implementations are generated by independent agents (i.e., human developers and LLMs). Based on this insight, we propose FAiLGen, a novel approach that calibrates LLM’s reasoning for failing tests generation via a representative reasoning calibration paradigm, Monte Carlo Tree Search. We evaluate FAiLGen on 100 subjects from CodeForces and 100 subjects from SWE-Bench-Live. Our evaluation results show that FAiLGen achieves a recall of 58.1%, which is 62.4% higher than that of the best baseline (35.8%). Meanwhile, FAiLGen attains a precision of 75.2%, favorably compared to the best baseline (61.1%). Article Search Artifacts Available Article: ase26main-p1022-p doi:10.1145/3832783.3837478
	Jiang, Yunlin	ASE '26: "Trace-Driven Automated PoC ..." Trace-Driven Automated PoC Synthesis for On-Chain Attacks Xing Su, Hao Wu, Hanzhong Liang, Yunlin Jiang, Yuxi Cheng, Yating Liu, Fengyuan Xu, and Sheng Zhong (Nanjing University, Nanjing, China) Blockchain systems are increasingly targeted by on-chain attacks that exploit vulnerabilities in smart contracts, resulting in billions of dollars in losses. Understanding and reproducing these attacks is critical for defense, yet currently relies on manually crafting proofs-of-concept (PoCs), which is labor-intensive, expertise-driven, and difficult to scale. In this work, we take the first step toward automating PoC synthesis directly from transaction traces. Our key insight is that a concrete execution trace provides not only behavioral evidence for recovering exploit logic, but also runtime semantics that enable precise code synthesis and verification. We design TracExp, a trace-driven framework that combines a dual decompiler, which fuses symbolic lifting with concrete runtime values to produce semantically enriched pseudocode, and a sketch-based synthesis and refinement mechanism that grounds LLM generation in execution context and ensures semantic correctness. Evaluated on 321 real-world DeFi attacks collected over 20 months, TracExp achieves 94.70% generation, 83.80% compilable, and 57.01% verifiable rates, at an average cost of ∼$0.1 per case. Moreover, we contributed 33 previously unavailable PoCs within 2 days to DeFiHackLabs, and all were accepted and merged, earning $900 in bounties, demonstrating both the practical effectiveness and real-world impact. Article Search Article: ase26main-p24-p doi:10.1145/3832783.3834332
	Jiang, Zhihan	ASE '26: "OpsLens: Runbook-Free Root ..." OpsLens: Runbook-Free Root Cause Analysis via Multi-agent Collaboration and Tool Management Haiyu Huang, Jiewei Lyu, Gou Tan, Pengfei Chen, Zhihan Jiang, Guangba Yu, Penghui Mi, Fuqiang Wang, Jian Han, Chongkang Tan, and Michael R. Lyu (Sun Yat-sen University, China; Chinese University of Hong Kong, China; Huawei, China; Independent Researcher, China) Root Cause Analysis (RCA) is critical for cloud service reliability, requiring correlation of multi-modal observability data (i.e., traces, logs, and metrics) to identify failure causes. Current LLM-based RCA approaches face two key limitations: over-reliance on system-specific artifacts (e.g., runbooks), limiting transferability; and difficulty ensuring the quality and reuse of LLM-generated diagnostic tools across modalities. To address these issues, we propose OpsLens, an RCA framework that combines modality-specialized multi-agent collaboration with quality-focused tool management , including feedback-driven refinement and a tool graph with scoreboard. On OpenRCA (335 real-world incidents from three production systems), OpsLens achieves a score rate of 0.80, outperforming baselines by 1.79–4.75×. More importantly, OpsLens has been tested on Platform A in Huawei since June 2025, achieving over 80% RCA accuracy across two industrial datasets and reducing diagnosis time from over 1 hour to under 5 minutes. Article Search Artifacts Available Article: ase26ind-p181-p doi:10.1145/3832783.3834501 ASE '26: "AutoSQL: Extracting SQL Templates ..." AutoSQL: Extracting SQL Templates from Imperative ORM Code in Large-Scale Repositories Junsong Pu, Yichen Li, Zhuangbin Chen, Zhihan Jiang, and Zibin Zheng (Sun Yat-sen University, Zhuhai, China; Chinese University of Hong Kong, Hong Kong) Suboptimal SQL queries can significantly degrade the performance of cloud systems, motivating the extraction and auditing of SQL statements before deployment. However, Go ORM frameworks construct SQL imperatively through scattered method-call sequences, making it difficult to statically recover the resulting SQL templates. We present AutoSQL, a system that reconstructs SQL templates from Go ORM code. AutoSQL constructs a Code Index, a directed graph that captures structural dependencies between functions, types, and global variables as navigable edges. It then traces upstream call chains from ORM invocation sites to identify database-interacting functions as entry points. For each entry point, an LLM agent traverses the Code Index to collect code slices that influence SQL generation, switching to pattern-based search when the graph cannot resolve a retrieval goal. We call this strategy Hybrid Context Retrieval. Once sufficient context is collected, the agent synthesizes SQL templates. Evaluation on a benchmark of 579 test-covered entry points and 1,186 runtime-traced SQL statements from five large-scale Go repositories shows that AutoSQL achieves 68.04% to 72.18% recall, exceeding the static reachability baseline by 11.80% to 15.94% and outperforming existing methods by 8.52% to 48.57%. Article Search Article: ase26main-p169-p doi:10.1145/3832783.3837420 ASE '26: "SimServing: Native-Execution ..." SimServing: Native-Execution Simulation for Evolution-Resilient LLM Serving Configuration Tuning Yujie Huang, Jiazhen Gu, Zhihan Jiang, and Michael R. Lyu (Chinese University of Hong Kong, Hong Kong) Large Language Model (LLM) services expose a large configuration space that critically affects performance, yet tuning these configurations on hardware (e.g., NVIDIA GPUs) is prohibitively expensive. Simulation offers a scalable alternative, but state-of-the-art simulators suffer from a fundamental software engineering pitfall: they re-implement the serving framework's complex control logic (e.g., request scheduling and memory management), creating a semantic copy that inevitably diverges from the rapidly evolving upstream software. Our empirical study across eight consecutive vLLM versions confirms this fidelity drift, with prediction errors widening as the framework evolves. We observe that the serving management software dominates performance fidelity yet accounts for less than 10% of total execution time, with GPU computation consuming over 90%. This asymmetry motivates SimServing, a hybrid simulation framework that executes the native, unmodified serving software while replacing GPU computation with a pluggable latency estimator. This design preserves the serving management software's control flow by executing it rather than modeling it, thereby automatically inheriting upstream updates and substantially reducing the maintenance burden associated with re-implementation. Integrating SimServing with Particle Swarm Optimization for configuration tuning, our evaluation shows that it reduces throughput prediction error from 13.8% to 4.9%, achieves up to 21.18× simulation speedup, and discovers configurations that improve throughput by up to 10.2% over existing baselines. Article Search Article: ase26main-p625-p doi:10.1145/3832783.3834362
	Jiang, Zhonghao	ASE '26: "Effective and Efficient Context ..." Effective and Efficient Context Retrieval via Partial Dependency Graph for Repository-Level Code Generation Zhongxin Liu, Zhonghao Jiang, Zhifan Ye, Haoye Wang, Jiakun Liu, and Xiaoxue Ren (Zhejiang University, China; Hangzhou City University, China; Harbin Institute of Technology, China) LLM-based repository-level code generation aims to generate code according to the available context within a software repository, requiring LLMs to understand and reason over complex code dependencies. Due to limited context windows and insufficient understanding of repository-specific code, LLMs typically rely on retrieval-augmented generation (RAG) to incorporate relevant contextual code. Early RAG approaches primarily employ similarity-based retrieval, which often fails to retrieve code snippets that the target function actually depends on. Recent work introduces graph-based retrieval to model such dependencies, but typically relies on manually designed rules and static global graphs, leading to limited flexibility and high construction and maintenance costs. In contrast, human developers typically collect helpful context by implicitly constructing a partial dependency graph and iteratively inspecting along it. Inspired by human behavior, we propose DyRetriever, an effective and efficient context retrieval method via partial dependency graphs. DyRetriever leverages an LLM to simulate how human developers collect helpful context by first selecting a set of entry-point functions and then performing multi-hop reasoning along the code dependency graph. During multi-hop reasoning, DyRetriever leverages the LLM’s semantic understanding to explicitly validate whether a function can help to generate the target function, thereby eliminating reliance on manually designed rules and enabling flexibility across application scenarios. Instead of statically constructing a global dependency graph, DyRetriever builds a partial graph on demand and discards it after use, reducing construction overhead and avoiding maintenance costs. We integrate DyRetriever with a similarity-based code retriever to build a new code generation approach, DyCoder, and evaluate it on two widely used repository-level code generation benchmarks, CoderEval and DevEval. Experimental results show that DyCoder achieves relative Pass@1 improvements of 25.63% and 59.73% on CoderEval and DevEval, respectively, compared with existing RAG-based methods, while being 7.4× faster than baselines based on static dependency graph construction. Article Search Article: ase26main-p356-p doi:10.1145/3832783.3834350 ASE '26: "Doc2Feat-Bench: Evaluating ..." Doc2Feat-Bench: Evaluating Documentation-Driven Feature Addition Zhonghao Jiang, Le Deng, Jialun Cao, Michael Pradel, and Zhongxin Liu (Zhejiang University, China; Hong Kong University of Science and Technology, Hong Kong; CISPA Helmholtz Center for Information Security, Germany) Documentation changes in mature software projects often describe newly introduced or modified behavior. This makes them a natural basis for documentation-driven feature addition, where software engineering agents implement features from public-facing documentation updates. However, existing benchmarks for agentic software development primarily rely on issue reports written for maintainer coordination and often contain implementation-level details. Motivated by this observation, this work introduces Doc2Feat-bench, a benchmark for documentation-driven feature addition. Doc2Feat-bench consists of 634 tasks across 10 mature open-source software projects, involving about 114k code changes in total. Each task pairs a documentation change with the corresponding implementation and developer-written tests, enabling evaluation of whether a software engineering agent can implement the feature described by the documentation diff. The benchmark is constructed through a five-phase pipeline, starting from release notes, and offers broad coverage across libraries, developer tools, and frameworks while preserving real-world development settings. To facilitate lightweight and reliable evaluation under limited resources, we further curate a human-validated subset named Doc2Feat-bench Verified. It contains 114 high-quality instances whose task clarity and evaluation validity are manually verified. We use Doc2Feat-bench to assess a range of state-of-the-art software engineering agents with two widely used scaffolds. Experimental results show that despite significant token consumption, the best task success rate remains as low as 37.72% (OpenHands with Qwen3-Coder-480B). Our analysis reveals that software engineering agents face key challenges in performing cross-file edits, understanding existing code modules, and correctly interpreting documentation semantics. Article Search Article: ase26main-p1306-p doi:10.1145/3832783.3837489
	Jiao, Rui	ASE '26: "LaMAR: Latent Multi-agent ..." LaMAR: Latent Multi-agent Collaboration via KV-Cache Communication for Automated Program Repair Rui Jiao, Yue Zhang, Zhexuan Feng, and Jinku Li (Xidian University, China; Shandong University, China) Multi-agent systems for automated program repair communicate through text tokens, requiring each agent to decode its internal state into discrete symbols and the next agent to re-encode them. This conversion loses information and incurs token overhead that grows quadratically with the agent count. We develop Latent Agent Communication (LAC), a theoretically grounded framework that formalizes how agents can share KV-cache representations directly in continuous space, and prove it provides a communication channel with strictly higher information capacity while reducing token complexity from O(N^2) to O(N). We instantiate LAC as LaMAR, a dual-chain repair system: Bug Analysis Chain diagnoses the bug through four collaborating latent agents; Repair Chain refines the patch through multi-agent latent collaboration with cross-chain context transfer, and supports optional multi-round iteration for complex defects. Evaluated across three benchmarks spanning Java, Python, and C++ with three model families, LaMAR with Qwen3-8B achieves 24.5% repair success rate on Defects4J and 62.1%--87.5% on DebugBench and QuixBugs, outperforming all baselines in the large majority of settings. Ablation experiments identify the bug analysis chain and latent communication as the most critical components. Article Search Article: ase26main-p198-p doi:10.1145/3832783.3837423
	Jiao, Wenpin	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477
	Jiao, Xiaoqian	ASE '26: "ReLog: Execution-Aware Logging ..." ReLog: Execution-Aware Logging with Runtime Feedback for LLM-Oriented Debugging Xin Wang, Yang Feng, Xiaoqian Jiao, Yang Zhang, Zhenhao Li, and Zishuo Ding (Hong Kong University of Science and Technology, Guangzhou, China; Hebei University of Science and Technology, China; York University, Canada) Logging statements are essential for software debugging and maintenance. However, existing approaches to automatic logging generation rely on static analysis and produce statements in a single pass without considering runtime behavior. They are also typically evaluated by similarity to developer-written logs, assuming these logs form an adequate gold standard. This assumption is increasingly limiting in the LLM era, where logs are consumed not only by developers but also by LLMs for downstream tasks. As a result, optimizing logs for human similarity does not necessarily reflect their practical utility. To address these limitations, we introduce ReLog, an iterative logging generation framework guided by runtime feedback. ReLog leverages LLMs to generate, execute, evaluate, and refine logging statements so that runtime logs better support downstream tasks. Instead of comparing against developer-written logs, we evaluate ReLog through downstream debugging tasks, including defect localization and repair. We construct a benchmark based on Defects4J under both direct and indirect debugging settings. Results show that ReLog consistently outperforms all baselines, achieving an F1 score of 0.520 and repairing 97 defects in the direct setting, and the best F1 score of 0.408 in the indirect setting where source code is unavailable. Additional experiments across multiple LLMs demonstrate the generality of the framework, while ablations confirm the importance of iterative refinement and compilation repair. Overall, our work reframes logging as a runtime-guided, task-oriented process and advocates evaluating logs by their downstream utility rather than textual similarity. Article Search Article: ase26main-p769-p doi:10.1145/3832783.3837463
	Jin, Beomjin	ASE '26: "RAVEN: Measuring Detection ..." RAVEN: Measuring Detection Instability in Anti-virus Engines under Semantics-Preserving Perturbations Younghoon Ban, Beomjin Jin, Doowon Kim, Hyoungshick Kim, and Haehyun Cho (Soongsil University, Republic of Korea; Ajou University, Republic of Korea; University of Tennessee, Knoxville, USA; Sungkyunkwan University, Republic of Korea) Real-world anti-virus (AV) engines continue to rely heavily on signature-based detection, whereas academic adversarial research has largely focused on ML-based models, leaving an evaluation gap. To better understand signature-based detection behavior, we analyze ClamAV’s open-source signature database as a white-box reference point. Our analysis shows that raw byte-level signatures account for 94.54 Article Search Article: ase26main-p1356-p doi:10.1145/3832783.3837492
	Jin, Dongming	ASE '26: "Aligning User Requirement ..." Aligning User Requirement with Large Language Model in Code Generation Jia Li, Ruiqi Bai, Yangkang Luo, Yiran Zhang, Wentao Yang, Zeyu Sun, Tiankuo Zhao, Dongming Jin, Lei Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Institute of Software at Chinese Academy of Sciences, China; Peking University, China; University of Hong Kong, Hong Kong) Code generation refers to automatically producing executable programs from user requirements. Recently, researchers have explored approaches to enhance the correctness of generated code with advanced large language models. Although achieving improvements, existing approaches focus on designing reasoning strategies or post-refinement methods to enhance code generation performance. Despite their differences, all these methods share a common assumption: the LLM can correctly understand the given requirement. However, this assumption does not always hold. To fill this gap, we propose REA-Coder, a requirement alignment approach to enhance the code generation performance of LLMs. REA-Coder involves first identifying the requirement content that does not align with LLMs and aligning the requirements. Then, based on the aligned requirements, LLMs generate code and further verify whether the generated code aligns with the requirements, iterating this process of requirement alignment and code generation until generating correct code or achieving the maximum number of iterations. Experimental results show that REA-Coder outperforms all advanced baselines on four LLMs across five programming benchmarks. Concretely, REA-Coder achieves average improvements of 7.93%, 30.25%, 26.75%, 8.59%, and 8.15% on the five benchmarks, demonstrating the effectiveness of requirement alignment for improving the code generation performance of LLMs. Article Search Article: ase26main-p1298-p doi:10.1145/3832783.3837487 ASE '26: "FallibleUser: An Imperfect ..." FallibleUser: An Imperfect User Agent for Realistic Evaluation of Interactive AI Systems Yaotian Yang, Zhi Jin, Dongming Jin, and Xiaohong Chen (Beijing Forestry University, China; Peking University, China; East China Normal University, China) Interactive LLM and agent evaluations often rely on oracle users or ground-truth-aware simulators that provide complete and unambiguous answers once the system asks a relevant question. This idealized assumption makes evaluation scalable and reproducible, but can overestimate robustness when real users omit information, give vague answers, or use unclear references. We present FallibleUser, a pluggable fallible-user simulation toolkit for evaluating interactive AI systems under imperfect user answers. FallibleUser preserves the original oracle-user pipeline, but inserts a configurable answer-rewriting layer before the answer is returned to the evaluated system. The current toolkit supports three representative fallibility operators: slot omission, specificity reduction, and referential ambiguity. It also pairs rewriting with a strict post-answer Q&A-level hit judge, so that a target is credited only when the final interaction actually elicits complete, specific, and unambiguous information. We demonstrate FallibleUser in a requirements-elicitation evaluation setting and show that oracle-user evaluation can substantially overestimate the robustness of the same interviewer agent. FallibleUser is open-sourced at https://doi.org/10.5281/zenodo.20136882, with a demonstration video available at https://youtu.be/T8-I9pb8rAI. Article Search Article: ase26tool-p74-p doi:10.1145/3832783.3834622
	Jin, Hai	ASE '26: "From Function to Repository: ..." From Function to Repository: Towards Understanding and an Agentic Approach for Repo-Level Directed Input Generation Haoyu Wang, Ming Wen, Haoran Yan, Jiayi Huang, Xuanhua Shi, and Hai Jin (Huazhong University of Science and Technology, China) Directed Input Generation (DIG) aims to automatically construct an input that reaches a specified target program location. Although recent studies have shown promising results for Large Language Models (LLMs) in function-level DIG, it remains unclear whether such effectiveness generalizes to realistic repository-level testing scenarios. Unlike function-level settings, repository-level DIG requires reasoning over long call chains, project-specific input semantics, and complex execution conditions distributed across real software repositories. To address this gap, we present a comprehensive empirical study of repository-level directed input generation with LLMs. Specifically, we construct a benchmark, RepoEval, containing hard-to-cover target lines across mainstream programming languages, and evaluate multiple state-of-the-art LLMs under different context and output settings. Our results show that repository-level DIG remains substantially more challenging than prior simplified settings. While advanced models can cover a portion of targets (from 16.02% to 37.35%), their effectiveness is strongly compromised by repository specific semantic constraints, context settings, output formats, and external execution conditions. Based on these findings, we design AgenticDIG, an agentic workflow that integrates target-oriented analysis, intention extraction, fault injection, and iterative feedback to improve repository-level DIG. Evaluation shows that AgenticDIG improves target coverage by 43.56% relative to the best baseline. Article Search Article: ase26main-p2631-p doi:10.1145/3832783.3837537
	Jin, Wuxia	ASE '26: "ChangeWiki: Repository-Level ..." ChangeWiki: Repository-Level Change Summarization Augmented with Architecture Semantics Zijun Wang, Wuxia Jin, Jiale Li, Zhanhong Mou, and Ting Liu (Xi'an Jiaotong University, China) Understanding software evolution at the repository level is essential for tasks such as release management, code review, and regression testing. However, existing change summarization techniques are largely confined to single commits or functions, failing to capture cross-commit evolutionary context, while recent repository-level understanding tools focus on static documentation of single-version codebases, overlooking evolution over time. To bridge this gap, we propose ChangeWiki, an architecture semantic-augmented approach for repository-level change summarization. ChangeWiki first constructs hierarchical, multi-granularity change entity trees enriched with multi-source contexts to infer change intent and impact. It then recovers modular structures across versions and employs a bidirectional context-guided aggregation mechanism, synthesizing code-level changes from the bottom up while injecting architectural semantics as top-down constraints. ChangeWiki finally generates coherent, traceable summaries that capture both local modifications and system-level evolution. We construct comprehensive benchmarks and evaluate ChangeWiki on real-world projects. Experimental results demonstrate significant improvements in semantic accuracy, completeness, and cross-granularity traceability. A prototype of ChangeWiki has been deployed in an industrial setting for upstream-downstream code evolution, where developers reported that the hierarchical summaries significantly reduced manual effort in issue localization caused by upstream changes and show potential for automating version release notes. Article Search Article: ase26main-p3335-p doi:10.1145/3832783.3834436
	Jin, Yibo	ASE '26: "WiseSword: An Automated Computation ..." WiseSword: An Automated Computation Graph Partitioning Tool for Industrial DLRM Deployment on Ascend NPUs Ke Cheng, Yuhan Zhang, Bo Pan, Jiawei Zhu, Qidong Zhang, Yuting Yan, Sheng Zhang, Yibo Jin, and Zhengyong Zhang (Nanjing University, China; Huawei Technologies, China) Ascend neural processing units (NPUs) integrate vector cores (VCs) for compute-light operations and cube cores (CCs) for matrix multiplications. In deep learning recommendation models (DLRMs), lightweight operators overload VCs, while leaving CCs underutilized, resulting in severe execution imbalance and degraded inference throughput. We observe that many VC-intensive operators reside in independent feature-processing branches, which can be offloaded to CPUs to enable CPU-NPU pipelined inference. However, adaptively optimizing partition schemes for diverse model architectures and resource specifications remains a significant challenge, especially under request tail latency and CPU utilization constraints in industrial production. To address this challenge, we propose WiseSword, an automated computation graph partitioning tool for high-throughput DLRM deployment. WiseSword employs a progressive subgraph search guided by the light-first principle, which incrementally offloads feature-processing branches based on their batch-size compressibility and computation overhead until the CPU utilization constraint is violated or throughput degrades, thus fully exploiting available CPU resources. Furthermore, it leverages concurrency tuning to satisfy the tail-latency constraint. Experiments on production hardware confirm that WiseSword greatly improves throughput while strictly adhering to both CPU utilization and tail latency constraints. Currently, WiseSword has been deployed in Huawei’s production environment. Article Search Article: ase26ind-p52-p doi:10.1145/3832783.3834464
	Jin, Zhi	ASE '26: "Aligning User Requirement ..." Aligning User Requirement with Large Language Model in Code Generation Jia Li, Ruiqi Bai, Yangkang Luo, Yiran Zhang, Wentao Yang, Zeyu Sun, Tiankuo Zhao, Dongming Jin, Lei Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Institute of Software at Chinese Academy of Sciences, China; Peking University, China; University of Hong Kong, Hong Kong) Code generation refers to automatically producing executable programs from user requirements. Recently, researchers have explored approaches to enhance the correctness of generated code with advanced large language models. Although achieving improvements, existing approaches focus on designing reasoning strategies or post-refinement methods to enhance code generation performance. Despite their differences, all these methods share a common assumption: the LLM can correctly understand the given requirement. However, this assumption does not always hold. To fill this gap, we propose REA-Coder, a requirement alignment approach to enhance the code generation performance of LLMs. REA-Coder involves first identifying the requirement content that does not align with LLMs and aligning the requirements. Then, based on the aligned requirements, LLMs generate code and further verify whether the generated code aligns with the requirements, iterating this process of requirement alignment and code generation until generating correct code or achieving the maximum number of iterations. Experimental results show that REA-Coder outperforms all advanced baselines on four LLMs across five programming benchmarks. Concretely, REA-Coder achieves average improvements of 7.93%, 30.25%, 26.75%, 8.59%, and 8.15% on the five benchmarks, demonstrating the effectiveness of requirement alignment for improving the code generation performance of LLMs. Article Search Article: ase26main-p1298-p doi:10.1145/3832783.3837487 ASE '26: "Revisiting LLMs on New Feature ..." Revisiting LLMs on New Feature Implementation in Real-World Software Development Practices Jia Li, Tingxuan Huang, Tiankuo Zhao, Yiming Wang, Yiran Zhang, Anshun Hu, Kechi Zhang, Lecheng Wang, Zinan Sheng, Kui Liu, Ge Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Peking University, China; Huawei Technologies, China) Implementing new features in existing repositories is a key activity in software development. With the rapid advances in large language models (LLMs), benchmarking their capability in this task has attracted growing attention. However, existing benchmarks deviate from real-world practices in two aspects. First, they provide LLMs with unrealistic information such as target code signatures and file paths, which developers do not have access to in practice. Second, they only evaluate the final generated code using functional tests, without examining intermediate steps like requirement understanding and implementation planning. These limitations make it difficult to faithfully assess LLMs’ actual capabilities and diagnose their weaknesses. To address the above limitations, we conduct a systematic evaluation to revisit the capability of large language models (LLMs) in new feature implementation, with a task setup strictly aligned with real-world software development practices. Our evaluation is built on NFEI, a curated benchmark sourced from merged feature pull requests of active GitHub repositories, where each target feature involves cross-snippet multiple code modifications, and LLMs are only provided with the feature description and the target repository throughout the evaluation. Beyond the realistic input settings, we further annotate fine-grained labels for the intermediate steps of the development workflow, including requirement clarification and implementation planning. This enables our evaluation to support a comprehensive stage-wise assessment across three granularities with seven dedicated metrics. We evaluate seven popular LLMs under two development paradigms and three generation strategies. Results show that new feature implementation remains highly challenging, with an overall average Test Pass Rate of only 29.84%. Our stage-wise analysis reveals that intermediate step quality is closely linked to final code performance, and injecting ground-truth intermediate artifacts yields an average absolute gain of about 18%, yet performance remains limited. Qualitative error analysis further identifies three recurrent failure patterns, suggesting that new feature implementation of LLMs adhering to real-world world software development practices remains challenges. Article Search Article: ase26main-p1768-p doi:10.1145/3832783.3837511 ASE '26: "FallibleUser: An Imperfect ..." FallibleUser: An Imperfect User Agent for Realistic Evaluation of Interactive AI Systems Yaotian Yang, Zhi Jin, Dongming Jin, and Xiaohong Chen (Beijing Forestry University, China; Peking University, China; East China Normal University, China) Interactive LLM and agent evaluations often rely on oracle users or ground-truth-aware simulators that provide complete and unambiguous answers once the system asks a relevant question. This idealized assumption makes evaluation scalable and reproducible, but can overestimate robustness when real users omit information, give vague answers, or use unclear references. We present FallibleUser, a pluggable fallible-user simulation toolkit for evaluating interactive AI systems under imperfect user answers. FallibleUser preserves the original oracle-user pipeline, but inserts a configurable answer-rewriting layer before the answer is returned to the evaluated system. The current toolkit supports three representative fallibility operators: slot omission, specificity reduction, and referential ambiguity. It also pairs rewriting with a strict post-answer Q&A-level hit judge, so that a target is credited only when the final interaction actually elicits complete, specific, and unambiguous information. We demonstrate FallibleUser in a requirements-elicitation evaluation setting and show that oracle-user evaluation can substantially overestimate the robustness of the same interviewer agent. FallibleUser is open-sourced at https://doi.org/10.5281/zenodo.20136882, with a demonstration video available at https://youtu.be/T8-I9pb8rAI. Article Search Article: ase26tool-p74-p doi:10.1145/3832783.3834622 ASE '26: "AutoFLC: An LLM-Based Flowchart ..." AutoFLC: An LLM-Based Flowchart Generation Tool for Legacy Code Repository Yixing Luo, Longxing Yang, Xiaofeng Li, Bin Gu, and Zhi Jin (Beijing Institute of Control Engineering, China; Peking University, China) Code comprehension remains a major bottleneck in maintaining large-scale legacy code repositories, particularly due to their complex intra-procedural control flows and lack of up-to-date documentation. While textual summaries generated by large language models (LLMs) provide semantic insights, they fail to intuitively represent non-linear control logic. Visual flowcharts are therefore highly desirable, yet existing automated approaches either produce cluttered diagrams or generate syntactically invalid scripts that cannot be rendered. To address these challenges, we present AutoFLC, a general-purpose tool to transform repository-scale legacy codebases into comprehensive visual flowcharts. AutoFLC combines static analysis for precise function extraction with a renderer-in-the-loop self-correction mechanism. This tool iteratively refines the generated PlantUML script to guarantee syntactic validity, thereby ensuring the successful rendering of the final visual flowchart. Evaluations on three real-world aerospace systems demonstrate that AutoFLC achieves a flowchart generation success rate exceeding 99%. A user study with 10 industrial practitioners further confirms that the generated flowcharts significantly reduce cognitive load and effectively support logic comprehension. The tool is publicly available at https://github.com/dfjdkjkdf/AutoFLC/tree/main under the MIT License, with a demonstration video accessible at https://youtu.be/AeEi9Nbw7xI. Article Search Article: ase26tool-p107-p doi:10.1145/3832783.3834635
	Jing, Linhai	ASE '26: "Localizing Data Annotation ..." Localizing Data Annotation Faults in Semantic Segmentation Systems Pengyi Yang, Teng Long, Zhiwu Xu, and Linhai Jing (China University of Geosciences (Beijing), China; Shenzhen University, China) Data annotation fault localization is a critical software quality assurance task in deep learning pipelines, as annotation faults can severely compromise model reliability and system dependability in safety-critical applications. Semantic segmentation requires assigning a class label to every pixel in the image, making it one of the most fault-prone annotation tasks, with faults ranging from incorrect class labels to imprecise boundaries. However, existing annotation fault localization methods target simpler annotation types such as classification and object detection, and rely on models trained on potentially noisy data, making them inadequate for dense annotations such as semantic segmentation. We adapt spectrum-based fault localization from program elements to annotation components in semantic segmentation, and propose SegFaultLoc, an annotation fault localization framework that identifies and ranks faulty annotation components by suspiciousness without segmentation model training. SegFaultLoc decomposes annotation masks into connected components and extracts noise-independent features from frozen pretrained encoders to construct dual fault spectra: a semantic spectrum for classification and missing faults, and a geometric spectrum for localization and fragmentation faults. Learning-based suspiciousness aggregation integrates these signals into unified suspiciousness scores for prioritized inspection. Systematic experiments on three benchmarks against seven data-quality baselines demonstrate that SegFaultLoc achieves up to 9.2% improvement in APFD, 21.9% in Precision@10%, and 22.4% in nDCG@10% over the best baseline. Validation on naturally occurring annotation faults in the real-world COCO-Stuff dataset further confirms that correcting detected faults consistently improves segmentation performance. Article Search Article: ase26main-p227-p doi:10.1145/3832783.3837428
	Johnson, Chase	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Johnson, Prince Noah	ASE '26: "Execution-as-Configuration: ..." Execution-as-Configuration: Security Smells in Model Configuration Artifacts Mohammed Latif Siddiq, Prince Noah Johnson, and Joanna C. S. Santos (University of Notre Dame, USA) Model sharing hubs rely on configuration artifacts to control model loading and execution. Although treated as metadata, files such as config.json determine class resolution and dependency selection, effectively making configurations an execution control surface. Yet their security implications remain largely unexplored. In this paper, we present a large-scale study of model configuration-related security smells. We introduce a taxonomy of 12 security smell types capturing execution-enabling constructs, trust boundary confusion, supply-chain risks, information leakage, and operational risks in model configuration files. To operationalize this taxonomy, we design MONTICELLO, a repository-aware security smell detection approach that combines pattern-based rules with contextual reasoning. We analyze 44,812 repositories across Hugging Face, OpenCSG, and ModelScope. Configuration smells are pervasive: 65.5 Article Search Article: ase26main-p830-p doi:10.1145/3832783.3837470
	Jonáš, Martin	ASE '26: "Gray-Box Fuzzing in Local ..." Gray-Box Fuzzing in Local Space Martin Jonáš, Jan Strejček, and Marek Trtík (Masaryk University, Czech Republic) This paper formally defines and tackles a key problem of automated test generation. The coverage problem is specified by a program execution path leading to a certain branching point and an input vector of this execution. The goal is to modify the input vector such that the program running on the modified input follows the same path but the branching point is evaluated to the opposite truth value. Standard fuzzing techniques use bit flips, random fuzzing, and gradient descent to solve this problem. We present an approach that uses numerical methods and linear algebra to transform the problem to so-called local space and applies the mentioned techniques there. An experimental evaluation on the Test-Comp 2025 benchmarks shows some improvements over the standard fuzzing techniques, both for the studied coverage problem and for the problem of test generation for maximal branch coverage. Article Search Artifacts Available Article: ase26main-p1719-p doi:10.1145/3832783.3837510
	Joneckis, Lance	ASE '26: "Clarity: From Formal System ..." Clarity: From Formal System Designs to Verified RL Controllers Austin O'Quinn, Conor Snedeker, Max Taylor, Lance Joneckis, and Christopher Stewart (Ohio State University, USA; Boise State University, USA; Idaho National Lab, USA) Safety-critical cyber-physical systems increasingly use reinforcement learning-based controllers, yet existing engineering methodologies cannot assure these systems’ safety. Assuring safety requires connecting three concerns that are currently addressed in isolation: the system’s design, the reinforcement learning pipeline, and runtime verification. This paper introduces CLARITY, a system that ingests designs written in SysML v2 and, through novel translational semantics to the nuXmv model checker, verifies safety requirements, synthesizes a reinforcement learning pipeline, and generates a runtime monitor. CLARITY enables fully traceable safety assurance arguments for reinforcement learning-based systems, closing the gap between system design, controller synthesis, and runtime assurance. We validate CLARITY on three CPS benchmarks of increasing complexity, demonstrating verified safety requirements, effective learned controllers, and lightweight runtime monitoring from a single SysML v2 specification. Article Search Artifacts Available Article: ase26main-p3070-p doi:10.1145/3832783.3834429
	Joosten, Sebastiaan	ASE '26: "ControlsDSL: A Language for ..." ControlsDSL: A Language for Verifiable Cloud Configuration Controls Miyriee Alair, Shrutarshi Basu, Sean Cai, Loris D'Antoni, Julio Delgado Jr., Antonio Filieri, Andrew Gacek, Anand Goyal, Sebastiaan Joosten, Varad Panch, Sorawee Porncharoenwase, Vishwanath Raman, Niloofar Razavi, Neha Rungta, Mike Schliep, Preethi Sekaran, and Chase Johnson (Amazon Web Services, USA; University of Minnesota, USA) Cloud providers rely on compliance controls to ensure that customer resources are configured according to security best practices -- from encryption of storage to network isolation of compute instances. Today, these controls are typically written as general-purpose programs (e.g., in Python or Java), making them difficult to analyze, test exhaustively, and maintain. We present ControlsDSL, a domain-specific language for writing compliance controls. ControlsDSL's restricted semantics enables analysis based on Satisfiability Modulo Theories (SMT), generating test inputs automatically, verifying semantic equivalence between control versions, and supporting scenario generation. Given a control, ControlsDSL produces a set of human-readable scenarios that describe every possible execution path and its expected result. We prove that generated scenarios are sound (they accurately predict the control's behavior) and complete (every well-typed input is covered by at least one scenario). We evaluate ControlsDSL on 397 compliance controls deployed in production at Amazon Web Services (AWS), demonstrating its expressiveness, the effectiveness of scenario generation, and the practical value of SMT-based analysis for control development and migration. ControlsDSL controls serve over one billion daily compliance evaluations and are 3.3x more concise than their Python/Java counterparts. Scenario generation completes in under one second for the vast majority of controls, and SMT-based test generation achieves complete path coverage—completing in seconds for the median control, with a heavy tail (minutes) for the more complex controls. Article Search Article: ase26ind-p111-p doi:10.1145/3832783.3834488
	Jung, Jihoon	ASE '26: "Disassembly-Augmented Root ..." Disassembly-Augmented Root Cause Analysis for C/C++ Segmentation Faults in SAP HANA Jihoon Jung, Chansong You, Jingun Hong, Thomas Bach, and Gabin An (SAP Labs Korea, Republic of Korea; SAP, Germany; Korea University, Republic of Korea) Production failures in large-scale systems are inherently difficult to diagnose, and crash dumps are often the only artifact available for debugging. In C++ programs, this difficulty is further compounded by misleading crash locations in stack traces caused by compiler optimizations such as function inlining. In our dataset of production SIGSEGV crashes from SAP HANA, 66% exhibit such misleading crash locations, which can misdirect both developers and LLM-based debugging agents to the source code of inlined functions rather than the true execution context of the faulting instruction. In this work, we investigate whether explicitly providing disassembly information that reveals the faulting instruction and recovers inlining chains improves bug diagnosis quality in both autonomous agent and tool-disabled LLM modes. Experiments on 91 real-world SIGSEGV crashes show that disassembly context improves root cause analysis quality and generally improves fault localization, especially for misleading crash locations. Moreover, in agent mode, the additional disassembly context does not increase total session cost of diagnosis, as its added input-token cost is offset by reduced exploration of the codebase. Article Search Artifacts Available Article: ase26ind-p32-p doi:10.1145/3832783.3834461
	Jyu, Charlie	ASE '26: "Graphectory Viewer: A Tool ..." Graphectory Viewer: A Tool for Process-Centric Analysis of Agentic Software Trajectories Charlie Jyu, Shuyang Liu, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA) We present Graphectory Viewer, a web-based tool for interactive, process-centric analysis of software-agent trajectories. Building on the Graphectory representation introduced in our previous work, Graphectory Viewer transforms heterogeneous raw trajectories into phase-aware graphs that connect low-level execution details with higher-level behavioral structures. The tool supports trajectories from multiple agent frameworks and provides interactive graph construction; node-level inspection of thoughts, actions, and observations; search and filtering over large trajectory collections; and Sankey-style summaries of problem-solving phase transitions. These capabilities enable researchers and practitioners to inspect individual executions, identify recurring behavioral patterns, compare successful and failed runs, and analyze large trajectory corpora beyond final task outcomes. To support reproducibility and further research, we release Graphectory Viewer as an open-source artifact together with documentation, precomputed graphs, and the large-scale trajectory corpus. Article Search Article: ase26tool-p2-p doi:10.1145/3832783.3834593
	Kafle, Dipesh	ASE '26: "Certified Program Synthesis ..." Certified Program Synthesis with a Multi-modal Verifier Yueyang Feng, Dipesh Kafle, Vladimir Gladshtein, Vitaly Kurin, George Pîrlea, Qiyuan Zhao, Peter Müller, and Ilya Sergey (National University of Singapore, Singapore; Neapolis University Pafos, Cyprus; ETH Zurich, Switzerland) Certified program synthesis (a.k.a. vericoding) is the process of automatically generating a program, its formal specification, and a machine-checkable proof of program/specification alignment from a natural-language task description. Two key challenges make vericoding difficult. First, specifications synthesised from natural language descriptions are often either too weak to be meaningful or too strong to be implementable, yet existing approaches lack systematic means to detect such defects. Second, the program verifiers used to validate results are fragmented: each tool supports a particular reasoning mode—auto-active (e.g., Dafny, Verus) or interactive (e.g., Rocq, Lean)—with its own trade-off between automation and expressivity. This forces each synthesis methodology to target a single paradigm, limiting the tasks it can handle. We overcome both challenges by structuring the synthesis workflow in stages around a multi-modal verifier—a single tool that combines dynamic validation, automated proofs, and interactive proof scripting within one foundational framework. We realise this idea in LeetProof, a new agentic pipeline built on Velvet, a multi-modal program verifier built in the Lean theorem prover. Multi-modality enables LeetProof to validate generated specifications via randomised property-based testing before any code is synthesised, decompose the synthesis task into sub-problems guided by verification conditions, and delegate residual proof obligations to frontier AI provers specialised for Lean. We evaluate LeetProof on an extensive benchmark suite derived from prior work on certified synthesis. Our specification validation uncovers defects in existing reference benchmarks, and LeetProof's staged pipeline achieves a significantly higher rate of fully certified solutions than a single-mode baseline at the same fixed budget—consistently across two different frontier LLM backends. Article Search Artifacts Available Article: ase26main-p4427-p doi:10.1145/3832783.3837559
	Kakara, Laxman Chowdary	ASE '26: "A Scalable Rule-Based Deep ..." A Scalable Rule-Based Deep Reinforcement Learning Framework for the Next Release Problem Hemanth Gudaparthi, Nan Niu, Prem Swaroopaanda Ramalingam, and Laxman Chowdary Kakara (Governors State University, USA; University of North Florida, USA) Next-release planning and feature selection remain critical challenges in the software deployment cycle, especially with the rapid introduction of updates and AI-driven functionalities. Selecting a subset of high-impact features that balances customer satisfaction with stakeholder business goals requires scalable models capable of producing near real-time predictions from requirements descriptions. However, uncertainty about which features truly align with customer needs makes this task difficult. This paper proposes a scalable feature prioritization framework that leverages rules derived from feature perplexity, probabilistic relevance, and customer-oriented criteria. We introduce a dual deep-reinforcement learning (DDRL) architecture that recommends high-value requirements through a hierarchical strategy. The first level applies graph reinforcement learning (GRL) guided by rule-based reasoning to structure tasks and reduce search space, while the second level uses deep reinforcement learning (DRL) to refine predictions. Experimental results on Zoom, Webex, and Teams datasets show that the approach maintains linear complexity (O(m)) compared to the cubic complexity (O(m^3)) of traditional graph-based methods, where m is the number of edges. The model achieves up to 85.56 Article Search Artifacts Available Article: ase26main-p350-p doi:10.1145/3832783.3834348
	Kamei, Yasutaka	ASE '26: "Recovering Revisions of Pull ..." Recovering Revisions of Pull Requests with Altered History Gengyi Sun, Georges Aaron Randrianaina, Tao Xiao, Yasutaka Kamei, and Shane McIntosh (University of Waterloo, Canada; Kyushu University, Japan) In pull-based development, Pull Requests (PRs) undergo peer review. To address review feedback, authors may "force-push" after amending, squashing, or rebasing commits. Such revisions can conflate PR-specific changes with updates on the base branch, hindering further review and introducing noise into PR-based datasets. In this paper, we empirically study 935,011 PRs from 1,445 well-maintained GitHub projects. We observe 568,218 force-push events in 242,624 PRs that span 1,366 projects. We denote the HEAD commits of the PR before and after force-pushing as a force-push pair, and observe that 210,837 pairs (37.1%) have a relationship that conflates PR changes with updates to the base branch. To systematically isolate PR-specific changes in such revisions, we propose AntiDiffamine---an ancestry-based approach that aligns commits on a common reference. AntiDiffamine can automatically deconflate 98.1% of the studied revisions, decreasing the diff size by one to three orders of magnitude. We also evaluate AntiDiffamine on fail-fix pairs, i.e., revisions that fix failing builds. A case study of Kubernetes reveals that 130 of 523 pairs have conflated diffs. Moreover, the fixing files identified when AntiDiffamine is applied overlap more with a human-labelled ground truth than when conflation is untreated or excluded. AntiDiffamine is a first attempt at addressing force-push-based diff conflation, which is having a real-world impact on practical and research workflows. To ease practical adoption, we provide a template GitHub Action, which scans PR updates for force-push events and applies AntiDiffamine to deconflate the diff. Article Search Artifacts Available Article: ase26main-p120-p doi:10.1145/3832783.3837417 ASE '26: "How Well Do LLMs Generate ..." How Well Do LLMs Generate Taxonomies in the SE Domain? A Multi-perspective Evaluation Framework Sota Nakashima, Yuta Ishimoto, Masanari Kondo, Tao Xiao, and Yasutaka Kamei (Kyushu University, Japan) Taxonomies provide a shared conceptual framework for organizing heterogeneous observations in software engineering (SE) research. Manually constructing such taxonomies is labor-intensive and requires annotators with expertise in the SE domain. While advances in Large Language Models (LLMs) have led to the emergence of automated taxonomy generation methods outside the SE domain, their applicability to technically complex SE artifacts remains unclear. In this experience paper, we present the first comprehensive empirical evaluation of how state-of-the-art automated methods perform on SE artifacts through a multi-perspective evaluation framework, including taxonomy quality, alignment with taxonomies defined by human experts, reliability under independent annotation, and efficiency. To support this evaluation, we systematically collect seven SE papers with publicly available artifacts and human-defined taxonomies, and conduct experiments using two automated methods (TnT-LLM and CLIMB) with five state-of-the-art LLMs. Our evaluation reveals a clear trade-off: TnT-LLM constructs high-quality taxonomies comparable to human-defined ones but incurs substantially higher cost and runtime and tends to generate overly complex taxonomies, whereas CLIMB is 15–40× faster and 8–49× cheaper but tends to score lower on quality when technical inference beyond surface-level similarity is required. These findings suggest that TnT-LLM and CLIMB can be used in practical situations in the SE domain, while researchers should first assess the complexity of the generated taxonomies and their cost using a subset of the target data to decide whether to use automated methods or human experts. Our work represents a first step toward a systematic understanding of automated taxonomy generation in SE, offering actionable insights for future research and practice. Article Search Article: ase26main-p3263-p doi:10.1145/3832783.3837551
	Kang, Dohee	ASE '26: "ThreatCraft: Automated Attack ..." ThreatCraft: Automated Attack Scenario Generation via Hybrid Rule-Based and LLM-Driven Reasoning Dohee Kang, Jiwon Kwak, Geunwoo Baek, and Seungjoo Kim (Korea University, Republic of Korea) Recently, the growing complexity of modern Information Technology (IT) systems has made it increasingly difficult to identify realistic attack scenarios. Although various automated approaches have been proposed, challenges such as dependence on expert knowledge and hallucinations in LLM-based methods remain unresolved. We develop ThreatCraft, an attack-scenario generation tool that combines a rule-based engine with Large Language Models (LLMs). ThreatCraft constructs system-level attack paths using a Unified Kill Chain (UKC) and leverages them to guide LLMs in generating detailed attack scenarios. Experimental results across automotive, Industrial Control Systems (ICS), and enterprise domains show that ThreatCraft achieves an average F1-score of 0.984 and a semantic similarity score of 0.893, improving attack-path reconstruction accuracy and semantic similarity by up to 8.3% and 10.7%, respectively, compared with other tools. These results demonstrate that ThreatCraft can consistently generate realistic and structurally coherent attack scenarios across various domains. GitHub:https://github.com/HackProof/2026_ASE_ThreatCraft.git Demo:https://youtu.be/nrIHEKDLp2E Article Search Artifacts Available Article: ase26tool-p39-p doi:10.1145/3832783.3834608
	Kang, Eunsuk	ASE '26: "Safeguarding LLM Agents from ..." Safeguarding LLM Agents from Misalignment through Provenance Analysis Yining She, Yiliang Liang, and Eunsuk Kang (Carnegie Mellon University, USA) As LLM agents gain increasing access to powerful tools, ensuring that their actions align with the user’s intent becomes critical. When an agent’s proposed action deviates from that intent—a phenomenon called misalignment— it may cause harm that is difficult to undo. Existing runtime guardrails rely on an LLM-as-a-judge paradigm that lacks a systematic framework for reasoning about alignment, often producing inconsistent or difficult-to-audit judgments. Motivated by provenance analysis, we propose a conceptual framework that formalizes misalignment detection as determining whether a proposed tool call is supported by traceable evidence in the agent’s context. Based on this framework, we build ProvenanceGuard, a multi-stage pipeline that analyzes the agent’s action for three types of misalignment before its execution and only allows aligned actions. We evaluated ProvenanceGuard on AgentSafetyBench and WorkBench, across 11 backbone LLMs. Compared to the LLM-as-a-judge baseline, ProvenanceGuard reduces error rate on misaligned traces from 44.3 Article Search Article: ase26main-p2533-p doi:10.1145/3832783.3837535
	Kang, Hong Jin	ASE '26: "Maximal Format-Free Data Repair ..." Maximal Format-Free Data Repair Zijian Luo, Xi Wu, Hong Jin Kang, Alan Fekete, and Rahul Gopinath (University of Sydney, Australia) ERROR in abstract. Article Search Artifacts Available Article: ase26main-p428-p doi:10.1145/3832783.3834354
	Kang, Hosung	ASE '26: "Is Three the Magic Number? ..." Is Three the Magic Number? An Empirical Evaluation of LLM-Based Repair Loops Tobias Kiecker, Eik Reichmann, Hosung Kang, Gabin An, and Lars Grunske (Humboldt-Universität zu Berlin, Germany; Korea University, Republic of Korea) Iterative repair loops have become a core design pattern in LLM-based software engineering systems. These workflows repeatedly generate, validate, and repair artifacts using feedback such as compiler errors or test failures. Despite their widespread use, the impact of repair-loop iteration limits remains poorly understood, as most prior work adopts fixed, often arbitrary, repair budgets. We study repair-loop effectiveness across multiple software engineering tasks, including code generation, test generation, and code translation. Across several representative workflows, datasets, and contemporary low-cost LLMs, we observe a consistent pattern of diminishing returns: the first three to four repair iterations account for most achievable gains, while later iterations contribute only marginal improvements. Across the evaluated models, repair behavior is influenced more strongly by workflow orchestration and feedback design than by the underlying model itself. These results suggest that repair budgets should be treated as an explicit experimental variable, as they directly affect evaluation outcomes, computational cost, runtime, and reproducibility in LLM-based software engineering research. Article Search Article: ase26nier-p58-p doi:10.1145/3832783.3834547
	Kang, Jian	ASE '26: "AIALIB: A Threat Library for ..." AIALIB: A Threat Library for AI-Generated Code Ali Aljaberi, Jian Kang, and Youcheng Sun (MBZUAI, United Arab Emirates) Large language models (LLMs) are increasingly integrated into software development workflows, yet a growing body of evidence shows that the code they generate often contains security vulnerabilities. Prior work has primarily focused on measuring the prevalence of such issues, providing useful evidence of risk but limited support for understanding their causes, tracking how they propagate through development workflows, or integrating this knowledge into practical security processes. To address these gaps, we present aialib, an annotated threat library for AI-generated code. aialib systematically generates, analyzes, and structures potential vulnerabilities from LLM-produced code, enriching each finding with conventional security taxonomies (CWE and OWASP) together with AI-specific information describing why the vulnerability was generated, how it propagates through code reuse and refactoring, and how it relates to AI-system threat models. Article Search Article: ase26tool-p295-p doi:10.1145/3832783.3834655
	Kang, Kyungtae	ASE '26: "CLEAR: Causal Context-Based ..." CLEAR: Causal Context-Based Agentic Reasoning for Vulnerability Detection Sungju Yun, Sijune Hwang, Yeonjoon Lee, Kyungtae Kang, and Sungbin Park (Hanyang University, Republic of Korea) Detecting source code vulnerabilities is increasingly difficult as modern security flaws are rooted in complex causal dependencies between execution flows, control conditions, and program states. Despite recent advances in Large Language Models (LLMs) and multi-agent frameworks, existing approaches primarily address superficial similarities between benign and vulnerable functions while failing to capture the complex causal dependencies inherent in security flaws. To address these limitations, we propose Causal Context-based Agentic Reasoning (CLEAR), a novel multi-agent vulnerability detection framework integrated with a causal knowledge graph. CLEAR systematically constructs a Vulnerability Causal Knowledge Graph (VCKG) that models the causal chains between entrypoints, preconditions, root causes, and fix intents across vulnerability instances. Leveraging this structured knowledge, four specialized agents including the Collector, Claim, Critic, and Judge collaboratively verify vulnerability hypotheses through retrieved causal contexts. Experimental results on C/C++ and Java vulnerability benchmarks demonstrate that CLEAR improves Pair-Correct (P-C) performance by 130.7% and 71.56% over state-of-the-art approaches, respectively, demonstrating the effectiveness of causal knowledge graph–guided reasoning for automated vulnerability detection. Article Search Article: ase26main-p2153-p doi:10.1145/3832783.3837523
	Kang, Liangyi	ASE '26: "SwiftGram: Dynamic Lexical ..." SwiftGram: Dynamic Lexical Forking for Precise and Efficient Grammar-Constrained Decoding Shuyi Ling, Liangyi Kang, Jie Liu, Shuai Wang, Zhirou Ma, and Dan Ye (Institute of Software at Chinese Academy of Sciences, China) Large Language Models (LLMs) must strictly adhere to grammatical constraints for reliable structured generation in agentic workflows, code synthesis, and domain-specific language (DSL) generation. Grammar-Constrained Decoding (GCD) enforces this by masking out tokens incompatible with the target grammar at each decoding step, and has been adopted as a core module in mainstream inference engines such as vLLM. However, existing GCD methods exhibit precision defects under grammars with overlapping terminal definitions. The misalignment between LLM tokens and grammar terminals induces terminal ambiguity, where a token admits multiple plausible terminal interpretations. Existing methods handle this imprecisely, causing both false acceptance and false rejection, while incurring high computational overhead. We propose SwiftGram, a GCD framework that incorporates dynamic lexical forking for precise token masking. By forking only at detected ambiguity boundaries, SwiftGram preserves all admissible terminal interpretations while suppressing spurious ones. It builds on Generalized LR (GLR) parsing with the Graph-Structured Stack (GSS) for compact multi-branch parsing, together with adjacency pruning and terminal tries to reduce online overhead. Experiments show that SwiftGram achieves near-zero grammar violations and no observed false rejection, whereas strong baselines remain prone to masking errors. SwiftGram improves effective throughput by up to 14.7% over the strongest baseline under rejection sampling, and achieves a 5.9× average speedup in per-step mask construction under mask-before-selection. Article Search Article: ase26main-p2654-p doi:10.1145/3832783.3834419
	Kang, Ming	ASE '26: "How Effective Are NPM Malicious ..." How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study Wenbo Guo, Zhongwen Chen, Zhengzi Xu, Chengwei Liu, Ming Kang, Shiwen Song, Chengyue Liu, Yijia Xu, Weisong Sun, and Yang Liu (Nanyang Technological University, Singapore; Sichuan University, China; Imperial Global Singapore, Singapore; Nankai University, China; Singapore Management University, Singapore) The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on disparate datasets with inconsistent settings, making cross-tool comparison unreliable and leaving practitioners without clear guidance. We present the first large-scale empirical study of NPM malicious package detection, evaluating 11 tools with 16 variants on a unified benchmark of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques. Unlike prior work, we inspect each tool’s source code to explain why tools succeed or fail, not merely how often. Our key findings: (1) the precision and recall a tool achieves are structurally determined by how it resolves the ambiguity between code capability and malicious intent, with IntelGuard reaching the best F1 at 95.98% by grounding its judgment in retrieved evidence and GuardDog the best among conventional tools at 93.32%; (2) behavioral coupling amplifies detection signals when behaviors co-occur, raising SAP_DT from 3.2% to 79.3% for the collect-and-exfiltrate chain; (3) 80.3% of malware uses no evasion because the ecosystem lacks mandatory pre-publication scanning; (4) ML degradation is driven by concept convergence rather than concept drift, since malware became simpler and every decision boundary fitted to a corpus ages with it; (5) combination effectiveness equals complementarity minus false-positive introduction, not paradigm diversity. Strategic combinations reach up to 97.21% accuracy and 97.02% F1. We release our benchmark and evaluation framework. Article Search Article: ase26main-p218-p doi:10.1145/3832783.3837427
	Kang, Sungmin	ASE '26: "ExplainBench: Evaluating Code ..." ExplainBench: Evaluating Code Explanations from Agents Zhiyuan Pan, Sungmin Kang, Imam Nur Bani Yusuf, and Abhik Roychoudhury (Zhejiang University, China; National University of Singapore, Singapore) Large Language Model (LLM) agents have seen rapid adoption in software engineering. As agents take a greater role in the actual generation of code, they are making larger changes, spanning tens to hundreds of lines. This makes manual review of agent results increasingly infeasible, leading developers to turn to explanations to understand enacted changes. Despite this, there are no benchmarks that evaluate the trustworthiness of agent-generated explanations. To bridge this gap, we propose ExplainBench, a benchmark to automatically evaluate explanations from coding agents. ExplainBench is based on the intuition that informative explanations should enable an LLM to correctly answer questions, allowing quantitative comparison of explanation quality between agents. With this observation, we construct a suite of questions that evaluates whether explanations accurately describe (1) the intended behavior of buggy code and (2) the effect of applying the agent patch itself. Experiments first reveal that explanation quality is a distinct axis of agent evaluation: ExplainBench ranks agents differently from the widely-used SWE-bench Verified benchmark. A deeper breakdown of explanation quality in agents shows frequent problems in explanations, such that explanations often claim that a patch is correct when it is not. Based on this insight, we implement and evaluate an explanation audit agent which runs additional tests to validate and refine explanations. This agent improved the explanations of all evaluated agents, demonstrating agent explanations can be automatically made more trustworthy. Article Search Article: ase26main-p1571-p doi:10.1145/3832783.3834395
	Kang, Yeongbin	ASE '26: "Top-Down Multi-agent LLM System ..." Top-Down Multi-agent LLM System with Runtime Data for MISRA C Violation Detection Ahcheong Lee, Yeongbin Kang, Sechang Jang, Heechan Yang, and Moonzoo Kim (KAIST, Republic of Korea; VplusLab, Republic of Korea) Ensuring MISRA C compliance is crucial for the safety and reliability of embedded software. For this purpose, industries utilize static rule checkers but suffer high ratios of both missed violations and false alarms. Although companies also try to utilize LLMs for this purpose, existing LLM-based approaches have suboptimal performance for large, complex programs. We introduce LASIK, the world-first top-down multi-agent LLM compliance-checking framework for MISRA C, which combines on-demand repository-level context provision with runtime execution evidence. This design enables LASIK to report more true violations than state-of-the-art static analyzers and a naive vanilla LLM approach, while maintaining a low false positive ratio. Our evaluation on 10 embedded projects shows that LASIK detects 1.3-2.7 times more true violations than the static analyzers and the vanilla LLM approach, while achieving the lowest false alarm ratio (26.7%). Furthermore, on an industrial software developed by VPlusLab Inc., LASIK detects up to 2.1 times more true violations with a low false alarm rate (i.e., 10.8%) than the baseline techniques. Article Search Article: ase26ind-p152-p doi:10.1145/3832783.3834497
	Kapfhammer, Gregory M.	ASE '26: "multiplex: A Modular LLM-Based ..." multiplex: A Modular LLM-Based Mutation Framework Megan Maton, Gregory M. Kapfhammer, and Phil McMinn (University of Sheffield, UK; Allegheny College, USA) Mutation testing introduces synthetic defects into a program under test to assess test suite adequacy. While recent advances in large language models (LLMs) have led to more realistic and hard-to-kill mutants, the field is currently dominated by single-purpose research prototypes that tightly couple the mutant generation technique with the LLM provider and build environment, thereby requiring mutation testing researchers to re-implement techniques for empirical comparison. To address this challenge, this paper introduces multiplex, a modular LLM-based mutation framework. multiplex enables researchers to implement their own LLM-based mutant generation (MG) modules to prototype or compare techniques, as well as configure and create language, LLM or framework-specific modules for extended study. In addition to providing an overview of the system design and implementation, this paper demonstrates how researchers can use multiplex to prototype and compare techniques, along with sharing experiments conducted with multiplex and outlining future extensions. The tool is available at https://github.com/LLM-Mutation/multiplex, and a video demonstration is available at https://youtu.be/l-hj7Pmn3oo. Article Search Article: ase26tool-p60-p doi:10.1145/3832783.3834617 ASE '26: "FlakeFighters: A Pytest Plugin ..." FlakeFighters: A Pytest Plugin to Detect Flaky Test Failures Michael Foster, Owain Parry, Michael Hilton, Gregory M. Kapfhammer, and Phil McMinn (University of Sheffield, UK; University of Edinburgh, UK; Carnegie Mellon University, USA; Allegheny College, USA) Flaky tests — tests which non-deterministically pass and fail against the same version of code — pose a well-established painful issue for developers due to the unpredictability of failures. The current state of practice to detect and work around flaky tests is to simply rerun them. However, this can erode confidence in failing test outcomes and represents a significant waste of time and compute resources. A better solution is to detect flaky tests based on static data (collectable without running any tests) and/or execution data (collected by running the test suite) to determine if a test failure has occurred due to flaky behaviour or a genuine bug. Several such techniques have appeared in recent literature, but these exist in isolation as prototype research tools, and typically only support Java codebases. This paper presents FlakeFighters, an extensible pytest extension that implements a "Swiss army knife" of flaky test classification tools to help developers classify the underlying cause of failing tests as genuine bugs or flakiness in Python codebases. We ran pytest with the FlakeFighters extension on 23 failing workflows from the home-assistant/core repository and found that it was able to identify all of the failing flaky tests. A video demonstration of FlakeFighters can be found at https://youtu.be/3J4odtgzQX0. Article Search Artifacts Available Article: ase26tool-p127-p doi:10.1145/3832783.3834641
	Karimi, Upendra	ASE '26: "Software Engineering Meets ..." Software Engineering Meets the EU AI Act: Artifacts, Patterns, and Future Directions Sridhar Chimalakonda and Upendra Karimi (Indian Institute of Technology Tirupati, India) As AI systems become increasingly integrated into consumer, enterprise, and public-sector software, ensuring compliance with emerging AI regulations has become an important challenge. Under the 2026 Digital Omnibus, the EU AI Act’s high-risk obligations are being phased in through 2027–2028. So far, compliance has been treated mainly as a documentation problem: tools check what organizations write about their AI systems. We argue that software engineering offers a complementary path, because an AI system is also a set of artifacts that carry evidence about what the system does. We re-frame AI Act compliance as a software engineering problem and set out an SE-AI Act compliance taxonomy for Articles 8 to 15 organized into three detectability tiers. We derive sub-clause-level detection patterns for Article 12 on record-keeping and implement them in AIActQ, a prototype static analyzer that recovered evidence from three open-source AI repositories: BentoML, DeepFace, and CompreFace. Across 24 repository-sub-clause pairs, AIActQ achieved 75.0% accuracy, with 73.3% macro precision and 66.3% macro recall, showing stronger performance for automatically detectable logging and monitoring obligations and limitations for context-dependent traceability requirements. Ground-truth labels were validated through inter-rater agreement (Cohen’s kappa = 0.799, substantial agreement). We outline directions for SE researchers, industry, standards bodies, and regulators to consider AI regulation as a software engineering concern. Article Search Article: ase26nier-p101-p doi:10.1145/3832783.3834559
	Kato, Keizo	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Kato, Yusaku	ASE '26: "Where Does Balance Break? ..." Where Does Balance Break? Boundary Discovery for Game Balance Testing under a Finite Simulation Budget Hiroki Mukai, Yusaku Kato, Norihiro Yoshida, Erina Makihara, and Katsuro Inoue (Ritsumeikan University, Japan) Software testing often relies on assumptions such as reproducible executions and stable correctness criteria. However, many modern software systems exhibit non-deterministic executions and large behavior spaces, making exhaustive exploration impractical and single-run judgments unreliable. These characteristics make it difficult to identify where acceptable behavior ends and problematic behavior begins. Competitive multiplayer games represent a challenging instance of such systems, where balance must be maintained so that no single strategy dominates. Even small parameter changes can trigger abrupt balance disruption, yet detecting such failures requires repeated simulations under non-deterministic outcomes and high-dimensional parameter spaces. In this paper, we formulate game balance regression testing as a boundary-discovery problem under a finite simulation budget. The objective is to efficiently identify inputs near the boundary that separates balanced and unbalanced regions. To address this problem, we propose BBExplorer, which combines multi-directional candidate generation, budget-aware two-stage screening, and adaptive step-size shrinkage for boundary refinement. Experimental results on two games with different levels of complexity show that the approach is strong in low-dimensional settings and remains effective in higher-dimensional ones. It also exhibits stable boundary behavior across unseen random seeds and threshold settings. These results indicate that BBExplorer is effective for practical balance regression testing and, more broadly, for boundary-oriented testing in non-deterministic, budget-constrained systems. Article Search Article: ase26main-p2013-p doi:10.1145/3832783.3834407
	Kaulgud, Vikrant	ASE '26: "Prompt Coach: An Empirical ..." Prompt Coach: An Empirical Evaluation of an Agentic Tutor for Learning Prompt Engineering in Software Development Rohit Mehra, Kapil Singi, Vikrant Kaulgud, Vibhu Saujanya Sharma, Swapnajeet Gon Choudhury, Swati Sharma, Adam P. Burden, and Majd Sakr (Accenture Labs, India; Accenture, India; Accenture, USA) Prompt engineering has emerged as a critical yet undertaught skill for software developers, one that traditional learning approaches are ill-equipped to support given its evolving, interactive, and context-dependent nature. In this paper, we introduce Prompt Coach (PC), an agentic tutor that helps developers learn how to craft high-quality code-generation prompts through Socratic guidance embedded in-flow within their IDE. PC evaluates prompt quality across multiple dimensions and surfaces targeted questions to guide self-correction, grounded in the developer's codebase and the behavior of the target LLM. We present an early empirical study with 15 professional developers combining quantitative prompt quality scoring with qualitative perception measures. Participants showed statistically significant improvements after a single 60-minute session, with the largest gains across dimensions commonly overlooked by developers. They also reported strong trust, high adoption readiness, and unanimous agreement that PC improved their prompt-writing skills. Article Search Article: ase26ind-p91-p doi:10.1145/3832783.3834478 ASE '26: "Agents That Teach: Towards ..." Agents That Teach: Towards Designing Incidental Learning Back into AI-Assisted Software Development Rohit Mehra, Samdyuti Suri, Prithviraj K. Tagadinamani, Kapil Singi, Vikrant Kaulgud, and Adam P. Burden (Accenture Labs, India; Accenture, USA) AI coding agents are rapidly reshaping how software is built, with developers increasingly delegating substantial coding tasks to autonomous agents in pursuit of higher productivity. While the gains are real, they come at the cost of incidental learning. Developers historically acquired informal knowledge through effortful problem-solving, and this has long shaped how software engineering expertise develops. However, with over-reliance on agentic coding, unpracticed skills could atrophy silently over time. As this learning pathway is short-circuited, developers risk accruing Knowledge Debt, a developer-level analogue of Technical Debt, where changes the agent executes that the developer cannot fully understand accrue over time. In this paper, we argue that incidental learning will not re-emerge on its own and must be consciously designed back into developer-agent interactions, and propose six design principles to guide such systems. We then present SHIELD, a multi-agent system grounded in the notion of "agents that teach", that operationalizes these principles by leveraging the AI coding agent's own reasoning to surface contextual, out-of-band learning moments without disrupting developer flow. Through this work, we envision a path toward learning-aware development environments where productivity and learning are complementary, not competing. Article Search Article: ase26nier-p97-p doi:10.1145/3832783.3834557 ASE '26: "RELY-SE: A Dashboard for Measuring ..." RELY-SE: A Dashboard for Measuring Operational Reliability of AI Coding Agents Akilesh P, Shivadharshan S, Sridhar Chimalakonda, Vibhu Saujanya Sharma, and Vikrant Kaulgud (IIT Tirupati, India; Accenture Labs, India) AI coding agents such as Aider, Claude Code Pro, and AutoCodeRover are increasingly deployed in production software development workflows. Existing benchmarks measure correctness: whether an agent resolves a given issue. However, correctness alone does not capture operational reliability: whether the agent breaks the CI pipeline, requires human intervention, or behaves inconsistently across repeated runs. We present RELY-SE, a dashboard that measures five reliability metrics: Human Intervention Ratio (HIR), Commit Failure Ratio (CFR), Task Success Rate (TSR), Agent Goal Achievement Reliability (AGAR) and Decision Stability Metric (DSM) adapted from established safety-critical domains (SRE, autonomous vehicles, aviation, medical AI). The tool ingests execution traces, computes all five metrics, and renders comparative reliability profiles across agents and tasks through interactive views. We demonstrate RELY-SE on three contemporary agents evaluated on 15 SWE-bench Lite tasks (10 Django, 5 Matplotlib) with three trials each (135 total runs). Our key finding: Claude Code Pro achieves a TSR of 71.1% with near-zero CFR, while AutoCodeRover achieves 13.3% TSR with 12.2% CFR. This disparity invisible to correctness-only evaluation but critical for CI stability. RELY-SE is publicly available at https://github.com/rishalab/Rely-SE.git. Demo video: https://youtu.be/RjYReUyznqI. Article Search Article: ase26tool-p279-p doi:10.1145/3832783.3834654
	Kavak, Murat	ASE '26: "Mutation Testing of Simulink ..." Mutation Testing of Simulink Cyber-Physical System Models: Challenges and Solutions in Practice Murat Kavak, Onur Kilincceker, Serge Demeyer, Kevin Vandenbroucke, and Halim Abdurrahman Ceylan (University of Antwerp, Belgium; Flanders Make, Belgium; Duco, Belgium; Ege University, Türkiye) Several experience reports illustrate that mutation testing is capable of supporting a "shift-left" testing strategy, especially in industries where late bug discovery incurs very high costs and risks. In the context of cyber-physical systems, a "shift left" implies that engineers need to test the design models used to simulate, prototype, and analyse the feasibility of the system under design. In this paper, we analyse the challenges we encountered and the lessons we learned when incorporating mutation testing in the context of DUCO, a company producing ventilation systems for buildings. The engineers within DUCO have years of experience with model-based engineering centered around Simulink and StateFlow, including unit tests for their models. During a pilot project with our tool prototype MUT4SLX we learned that equivalent mutants, requirement traceability, and mutation testing for StateFlow represent particular challenges not yet reported in the academic literature. Article Search Article: ase26ind-p356-p doi:10.1145/3832783.3834529
	Ke, Wenjun	ASE '26: "TLCrafter: Peeling the Layers ..." TLCrafter: Peeling the Layers of Natural Language to Reveal Temporal Logic Specifications Cheng Wen, Wenjun Ke, Xiao Liang, Zhi Ma, Xiaoyong Xue, Shengchao Qin, and Cong Tian (Xidian University, China; Northwest University, China; Peking University, China) Natural-language (NL) requirements are widely used in industrial systems, but formal verification typically requires precise temporal logic (TL) specifications. This paper presents TLCrafter, an interactive tool for translating NL requirements into TL formulas, including LTL, CTL, and STL. Given an NL requirement, TLCrafter constructs OnionL+, a hierarchical intermediate representation that supports more robust NL-to-TL formalization by combining LLM-based semantic decomposition with deterministic rule-based synthesis. Its visual interface allows engineers to inspect and correct the intermediate structure before formula generation. Experiments on domain datasets across LTL, CTL, and STL show that TLCrafter improves formula accuracy while maintaining full syntactic validity. A video of TLCrafter is available at https://youtu.be/jp-Pp_amjks. The tool and artifacts are available at https://sites.google.com/view/tlcrafter/. Article Search Article: ase26tool-p13-p doi:10.1145/3832783.3834598
	Keim, Jan	ASE '26: "The EVerest Dataset for Secure ..." The EVerest Dataset for Secure Software Engineering Sophie Corallo, Debora Grupp, Dominik Fuchß, Jan Keim, Frederik Reiche, Tobias Hey, and Anne Koziolek (KIT, Germany) End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available [4]. A short video is available at https://youtu.be/pnn1uqpomvQ. Article Search Artifacts Available Article: ase26tool-p56-p doi:10.1145/3832783.3834614 ASE '26: "The ARDoCo Tool Landscape: ..." The ARDoCo Tool Landscape: REST API, TraceView, and TraceViz for Architecture Traceability Jan Keim, Dominik Fuchß, Sophie Corallo, Tobias Hey, Julian Winter, and Kevin Feichtinger (KIT, Germany) Context and Problem. Software development produces interrelated artifacts like software architecture documentation (SAD), software architecture models (SAMs), and source code, whose relationships are essential for maintenance and consistency checking. However, automatically recovering links between these artifacts (traceability link recovery (TLR)) remains difficult to deploy in practice. Method and Aim. We present an accessible tool landscape for ARDoCo’s TLR approaches: the ARDoCo REST API exposes four TLR pipelines (SAD-SAM, SAM-Code, SAD-Code, and SAD-SAM-Code) via HTTP endpoints with asynchronous execution and caching; TraceView is a browser-based frontend with a guided wizard and interactive multi-panel exploration of recovered links and inconsistencies; and TraceViz, which is a VS Code extension that overlays trace links directly onto documentation in the IDE. Results and Conclusion. All three components are publicly deployed and usable. A preliminary study for TraceViz’s in-IDE visualization confirmed that it improves developer comprehension during software understanding tasks. The tool landscape makes state-of-the-art TLR accessible to architects, developers, and tool integrators. Video. We provide a screencast of our ARDoCo Tool Landscape and how it is used here: https://youtu.be/IOTEPZQ3tVs Article Search Artifacts Available Article: ase26tool-p73-p doi:10.1145/3832783.3834621
	Kellogg, Martin	ASE '26: "Command Coding: A Methodological ..." Command Coding: A Methodological Framework for AI-Accelerated Software Development Thomas S. Villani and Martin Kellogg (New Jersey Innovation Institute, USA; New Jersey Institute of Technology, USA) AI coding agents have created a new paradigm in software development, yet practitioners largely operate without systematic methodology: either using AI for ad-hoc assistance (”vibe coding”) or dismissing it as unsuitable for production work. This paper introduces command coding, a structured methodology that applies traditional software engineering management principles, such as architecture, planning, iterative review, and automated quality gates, to the orchestration of AI coding agents. Through an empirical case study of all2md, a production-grade document conversion library supporting 40+ formats ( 88,000 code-lines) completed by one senior engineer in 41 working days, we show via triangulated estimation (COCOMO II and Function Point Analysis) that command coding can achieve 25-40× acceleration over traditional development timelines while maintaining production-quality standards. Command coding amplifies existing expertise rather than replacing it. The methodology requires senior-level skills in architecture, security, and code review, shifting the developer’s role from implementer to orchestrator. We propose “contextual quality contagion” as a key mechanism in AI-assisted development affecting code quality: LLMs generate code that matches the quality patterns of their context, creating feedback loops wherein early code quality decisions compound throughout development. This finding suggests that investment in early code quality yields higher returns in AI-assisted projects than in traditional development. Furthermore, the use of automated tooling (linters, type checkers, static analyzers, etc.) within agentic development cycles is critical to avoiding contextual quality contagion. Article Search Article: ase26ind-p500-p doi:10.1145/3832783.3834536 ASE '26: "On the Reliability of Code ..." On the Reliability of Code Comprehension Proxies Erfan Arvan, Nadeeshan De Silva, Oscar Chaparro, and Martin Kellogg (New Jersey Institute of Technology, USA; William & Mary, USA) Prior work on code comprehension uses different comprehension proxies—for example, Likert-scale ratings or answers to input-output questions about program snippets, usually collected from students, to approximate whether code is comprehensible to software engineers, but the relative reliability of these proxies is not known. This paper investigates the relative reliability of a collection of proxies common in the extant literature with a pair of human studies. First, we conducted an expert-consensus study with a panel of five professional software engineers to establish a ground-truth comprehensibility ranking of eight code snippets by adapting the Delphi expert-consensus protocol. The Delphi protocol is widely used for expert consensus under conditions of uncertainty in other domains such as medicine and national-security forecasting, but to our knowledge, this is its first application to code comprehension research. Second, we conducted a study with 44 student participants who completed comprehension tasks, allowing us to measure 14 comprehension proxies derived from the literature on the same set of eight code snippets. Finally, we conducted a correlation analysis on the results, concluding that proxies 1) derived from input-output questions and 2) that measure response time rather than accuracy are especially reliable. We also found that proxies derived from questions about program syntax (rather than semantics) are especially unreliable, regardless of measurement strategy, which draws into question the reliability of parts of the existing comprehensibility literature. Article Search Artifacts Available Article: ase26main-p2877-p doi:10.1145/3832783.3834425
	Kennedy, Luke	ASE '26: "IAM Policy Autopilot: Static ..." IAM Policy Autopilot: Static Analysis for Policy Generation from Application Code Antonio Filieri, Luke Kennedy, Kevin Luo, Matt Luttrell, Adrián Palacios, Akash Panda, Neha Rungta, Matthias Schlaipfer, Karan Jit Singh, Anvesh Tanuku, Nick Winans, Diana Yin, and Weiben Zhang (Amazon Web Services, USA; Amazon Web Services, Germany) Every application deployed on Amazon Web Services (AWS) requires Identity and Access Management (IAM) policies that specify which API actions the application is authorized to perform. AWS offers managed policies as a convenience to simplify policy authoring. However, these policies are designed to cover common scenarios which can lead to unnecessarily broad permissions beyond what a specific use case requires. AI coding assistants offer an alternative, but can be unreliable: they hallucinate invalid policy content, and lag behind newly launched services and APIs. Moreover, some organizations distrust nondeterministic processes for security-critical artifacts such as access policies. We present IAM Policy Autopilot (IPA), a deterministic static-analysis tool that generates IAM policies by examining API usage in Python, Java, Go, and TypeScript/JavaScript code. The tool occupies a middle ground between hand-crafted least-privilege policies, which require deep IAM expertise, and potentially overpermissive managed policy selection. It implements a three-phase pipeline that parses source files to identify AWS SDK calls via AST pattern matching; maps SDK operations to the required permissions by consulting authoritative, up-to-date service metadata; and synthesizes policy documents with provenance, tracing each permission to its origin in the source code. We evaluate IPA in two settings: (1) on 10 synthetic benchmark applications across four languages, comparing generated policies against minimal baseline policies, AI-generated policies, and an optimal selection of managed policies. IPA-generated policies prove sufficient to run 9 of the 10 applications; and (2) on a production-style multi-service chatbot application in Python, where IPA-generated policies prove sufficient for executing 11 of 12 handlers. Our findings show that policies generated by our tool are sufficient to run applications on a level similar to, or outperforming, AI-generated policies, while being generated deterministically. On average, the policies permit about an order of magnitude fewer permissions than the optimal selection of managed policies and about 60% fewer permissions than an expert developer-authored set of policies, indicating that IAM Policy Autopilot provides a good starting point when writing application policies. Article Search Article: ase26ind-p234-p doi:10.1145/3832783.3834512
	Khader, Shahbaz Abdul	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Khakpour, Narges	ASE '26: "VeriSBOM: Secure and Verifiable ..." VeriSBOM: Secure and Verifiable SBOM Sharing via Zero-Knowledge Proofs Gianpietro Castiglione, Shahriar Ebrahimi, and Narges Khakpour (Newcastle University, UK) SBOMs often contain sensitive information that organizations are unwilling to disclose in full. To avoid disruption of privacy and confidentiality in delivering plaintext SBOMs, we present VeriSBOM, a trustless SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs, i.e., third-parties can validate if software contains authentic dependencies distributed by official package managers and that the same dependencies are compliant with policy constraints. The verification process requires no trust in the SBOM publisher beyond the soundness of the underlying primitives, and third parties can independently check proofs against the public cryptographic commitments. We design and implement VeriSBOM, analyze its security, evaluate its performance on real-world package registries and SBOMs, and evaluate its usability. Article Search Artifacts Available Article: ase26main-p3290-p doi:10.1145/3832783.3834432
	Khati, Dipin	ASE '26: "ECLAIR: A Causally-Grounded ..." ECLAIR: A Causally-Grounded AI Framework for Scientific Discovery in Empirical Software Engineering Alejandro Velasco, Daniel Rodriguez-Cardenas, Dipin Khati, David N. Palacio, and Denys Poshyvanyk (William & Mary, USA; Microsoft, USA) The scientific method has long guided empirical research in Software Engineering (SE), but the complexity of modern software systems often hinders its systematic application. This paper introduces ECLAIR, a causally grounded AI framework that integrates Large Language Models (LLMs) into every stage of the scientific process, from hypothesis generation to analysis and interpretation. ECLAIR treats LLMs as active scientific agents operating under the principles of causal inference, within a human-in-the-loop design that safeguards against the risks of unsound automated reasoning. We demonstrate the framework through a case study examining how prompt design influences code generation accuracy in two LLMs. Results show that, for both models, instruction-style, longer few-shot, and signature-augmented prompts yield small negative causal effects on accuracy, illustrating how causal reasoning provides a principled foundation for explaining why software phenomena occur. This study presents the first causally grounded structured methodology for embedding LLMs within the scientific method in SE, designed around the epistemological demands of empirical SE research, establishing a basis for rigorous AI-assisted research. Article Search Article: ase26nier-p39-p doi:10.1145/3832783.3834544
	Khelladi, Djamel Eddine	ASE '26: "Code Transformation Rule Synthesis ..." Code Transformation Rule Synthesis using LLMs: Potential and Limits Axel Allain, Aymeric Blot, Djamel Eddine Khelladi, and Mathieu Acher (INSA, France; University of Rennes, France; Inria, France; CNRS, France; IRISA, France) Due to their black-box nature, LLMs suffer from limited explain- ability and a lack of determinism. Their usage cost can also rise, particularly with repetitive tasks on large codebases. Code transfor- mation rules mitigate those challenges. This paper fills this gap, with a novel empirical study targeting three domain-specific languages for transformation rules, namely Comby, GritQL, and Ast-Grep We evaluate three LLMs (GPT-5.4, GPT-oss-120B, and Llama3.1-8B) on six diverse datasets covering four software-evolution tasks: API misuse correction, program repair, API migration, and language ver- sion migration. Our results provide evidence that transformation rule synthesis moves beyond proof-of-concept with strong frontier models. GPT-5.4 achieves consistently high rule applicability rates and produces transformations closest to the ground truth across most benchmarks. Smaller and open-weight GPT-oss-120B and Llama3.1-8B models remain effective for simpler, localized changes but struggle with complex migration scenarios. We also observe non-negligible generalizability through the usage of meta-variables and through a high reuse score in the first quartile of many datasets. Finally, when compared to the anti-unification algorithm, LLMs outperform it in correctness, but underperform in rule applicabil- ity. Overall, our results show great potential for LLMs to generate sound, correct, generalizable, and reusable rules. Article Search Artifacts Available Article: ase26main-p1631-p doi:10.1145/3832783.3837504
	Khodabandeloo, Behnam	ASE '26: "MIMOS-Tools: An Integrated ..." MIMOS-Tools: An Integrated Toolchain for Model-Based Design of Embedded Systems Wang Yi, Chengzi Huang, Behnam Khodabandeloo, and Duc Anh Nguyen (Uppsala University, Sweden) Despite decades of progress in model-based methods and tools for embedded real-time systems, there is still no integrated environment that supports the entire development lifecycle. This paper presents MIMOS-Tools, a comprehensive toolchain spanning the key phases of development, including modeling, simulation, formal verification, real-time scheduling, schedulability and end-to-end latency analysis, and code generation for heterogeneous multicore platforms. All phases are grounded in a single, coherent, and deterministic model of computation: the MIMOS model, a multi-rate task graph formalism for which we present a formal operational semantics and establish both functional and timing determinism. This semantic foundation ensures that properties verified at the model level are preserved throughout the development process and in the generated implementation. A distinguishing feature of MIMOS-Tools is its support for not only deterministic but also modular, compositional design. Unlike synchronous design environments such as SCADE and Simulink, which rely on a global base clock and offline static scheduling, MIMOS-Tools supports time-triggered asynchronous communication together with flexible real-time scheduling of computation. This removes the tight global coupling of the synchronous paradigm: components can be added, modified, or updated without recomputing a system-wide schedule, enabling scalable and incremental design and dynamic updates throughout the system lifecycle. However, MIMOS-Tools also supports Simulink models when the deadlines of tasks are set to zero to emulate the zero-time semantics of synchronous design. The toolchain is available at https://uu-mimos.github.io. Article Search Article: ase26tool-p77-p doi:10.1145/3832783.3834624
	Khojah, Ranim	ASE '26: "Same Scrutiny, More Time: ..." Same Scrutiny, More Time: Eye Tracking Insights into Reviewing LLM-Labelled Code Ranim Khojah, Francisco Gomes de Oliveira Neto, Mazen Mohamad, Julian Frattini, and Philipp Leitner (Chalmers University of Technology, Sweden; University of Gothenburg, Sweden; RISE Research Institutes of Sweden, Sweden) Modern software development increasingly involves the use of large language models (LLMs) to generate code. Despite their rapid advancement, LLMs remain prone to errors and hallucinations, emphasizing the importance of careful code inspection. However, in practice, developers' trust in LLM-generated code and their willingness to review it thoroughly may not align with these recommendations, which is a gap that remains largely unexplored. In this study, we conduct a Wizard-of-Oz experiment to examine how software engineers behave when code is explicitly labelled as LLM-generated during a code review task. We collect both behavioral data and participant feedback through eye-tracking and exit interviews. Combining Bayesian data analysis with qualitative analysis, we found that while the thoroughness of code review did not change for participants, they spent more time fixating on LLM-labelled code, indicating that the label itself influences attention. Practitioners also adapted their review strategy for LLM-labelled code by assessing the code based on specific criteria (e.g., logical correctness), or using the prompt to guide their review. These findings inform LLM-based tool design on labelling while incorporating the prompt as a software artifact. Our study reveals a gap between reviewers' intentions and actual reviewing behaviour, highlighting the need for software companies to revisit their AI policies (particularly regarding LLM-assisted development) to better support developers in reviewing LLM-generated code. Article Search Artifacts Available Article: ase26main-p2693-p doi:10.1145/3832783.3834423
	Khomh, Foutse	ASE '26: "Discovering Performance Archetypes: ..." Discovering Performance Archetypes: Critical-Path-Aware Pattern Analysis and Regression Detection Kaveh Shahedi, Heng Li, Maxime Lamothe, and Foutse Khomh (Polytechnique Montréal, Canada) Software performance analysis and prediction requires integrating multiple signals, as code structure alone cannot capture runtime behavior shaped by execution frequency, resource contention, and I/O patterns. We present a critical-path-aware performance analysis methodology that automatically discovers recurring performance patterns by synthesizing static code features, dynamic execution traces, and kernel-level resource data. In a preliminary study across six real-world C/C++ applications (SQLite, OpenSSL, Zstandard, FFmpeg, cURL, and jq), we first empirically confirm that static complexity metrics explain only 10.4% of the variance (ρ2) in critical path execution time, quantifying a gap that, while theoretically expected, had not been measured systematically across applications. Motivated by this finding, we analyze nearly 80,000 critical execution paths and address two research questions. First, we discover 13 distinct performance archetypes: recurring behavioral patterns that appear consistently across different applications, independent of their domain or implementation. Five of these patterns are near-universal and appear in at least five of the six applications studied. Notably, three of these archetypes are present in all six applications, and together, these common patterns account for 56.4% of all observed paths. Each archetype maps to specific resource profiles and optimization strategies that transfer across domains. Second, we leverage these archetypes within a multi-signal regression detection framework that triangulates path structure, resource consumption, and archetype deviations, achieving an F1-score of 0.867 and a 60.4% improvement over resource-only methods. Article Search Article: ase26main-p2896-p doi:10.1145/3832783.3834426 ASE '26: "RefineAct: Automatic Runtime ..." RefineAct: Automatic Runtime Verification of LLM Agent Actions Fraol Batole, Foutse Khomh, and Hridesh Rajan (Tulane University, USA; Polytechnique Montréal, Canada) LLM-based agents that invoke external tools can cause irreversible harm when their actions diverge from user intent, from deleting critical files to exposing private data or executing untrusted code. Unlike traditional software, where test suites and contracts define expected behavior, LLM agents operate without a specification: there is no artifact against which to check their actions before execution. Existing safeguards rely on prompt engineering or post-hoc evaluation, neither of which closes this gap. We present RefineAct, a runtime verification framework that automatically derives a task-specific specification from the user’s natural-language instruction and enforces it during agent execution. RefineAct operates in three stages: (1) intent formalization translates instructions into first-order Prolog predicates capturing the user’s goal and safety requirements; (2) refinement-based planning decomposes the specification into a concrete action plan with pre-/postcondition chains and risky-action patterns; and (3) runtime verification intercepts each agent-proposed action, queries the Prolog knowledge base to verify precondition satisfaction and constraint compliance, and returns a disposition state that determines whether the action proceeds, requires user confirmation, or is blocked with corrective feedback. We evaluate RefineAct on 144 agent tasks across five domains from the ToolEmu benchmark. RefineAct reduces failure incidence from 77% to 39% while improving task completion quality from 1.0 to 1.9 on a 0–3 scale, demonstrating that deriving and enforcing specifications at runtime can improve both safety and helpfulness of LLM agent behavior. Article Search Article: ase26main-p2301-p doi:10.1145/3832783.3834409
	Kiecker, Tobias	ASE '26: "Is Three the Magic Number? ..." Is Three the Magic Number? An Empirical Evaluation of LLM-Based Repair Loops Tobias Kiecker, Eik Reichmann, Hosung Kang, Gabin An, and Lars Grunske (Humboldt-Universität zu Berlin, Germany; Korea University, Republic of Korea) Iterative repair loops have become a core design pattern in LLM-based software engineering systems. These workflows repeatedly generate, validate, and repair artifacts using feedback such as compiler errors or test failures. Despite their widespread use, the impact of repair-loop iteration limits remains poorly understood, as most prior work adopts fixed, often arbitrary, repair budgets. We study repair-loop effectiveness across multiple software engineering tasks, including code generation, test generation, and code translation. Across several representative workflows, datasets, and contemporary low-cost LLMs, we observe a consistent pattern of diminishing returns: the first three to four repair iterations account for most achievable gains, while later iterations contribute only marginal improvements. Across the evaluated models, repair behavior is influenced more strongly by workflow orchestration and feedback design than by the underlying model itself. These results suggest that repair budgets should be treated as an explicit experimental variable, as they directly affect evaluation outcomes, computational cost, runtime, and reproducibility in LLM-based software engineering research. Article Search Article: ase26nier-p58-p doi:10.1145/3832783.3834547
	Kilincceker, Onur	ASE '26: "Mutation Testing of Simulink ..." Mutation Testing of Simulink Cyber-Physical System Models: Challenges and Solutions in Practice Murat Kavak, Onur Kilincceker, Serge Demeyer, Kevin Vandenbroucke, and Halim Abdurrahman Ceylan (University of Antwerp, Belgium; Flanders Make, Belgium; Duco, Belgium; Ege University, Türkiye) Several experience reports illustrate that mutation testing is capable of supporting a "shift-left" testing strategy, especially in industries where late bug discovery incurs very high costs and risks. In the context of cyber-physical systems, a "shift left" implies that engineers need to test the design models used to simulate, prototype, and analyse the feasibility of the system under design. In this paper, we analyse the challenges we encountered and the lessons we learned when incorporating mutation testing in the context of DUCO, a company producing ventilation systems for buildings. The engineers within DUCO have years of experience with model-based engineering centered around Simulink and StateFlow, including unit tests for their models. During a pilot project with our tool prototype MUT4SLX we learned that equivalent mutants, requirement traceability, and mutation testing for StateFlow represent particular challenges not yet reported in the academic literature. Article Search Article: ase26ind-p356-p doi:10.1145/3832783.3834529
	Kim, Dongkwan	ASE '26: "CtxFuzz: Context-Aware Directed ..." CtxFuzz: Context-Aware Directed Fuzzing via Runtime Fuzzer-Agent Cooperation Jiho Kim, Dongkwan Kim, HyungSeok Han, Youngjoon Kim, Soyeon Park, Sangwoo Ji, Joshua Wang, Dae R. Jeong, and Taesoo Kim (Georgia Institute of Technology, USA; Microsoft, USA; Independent Researcher, USA; Samsung Electronics, Republic of Korea; Seoul National University, Republic of Korea) Automated tools produce vulnerability reports at unprecedented scale, but turning a report into a confirmed proof-of-vulnerability remains challenging. Directed grey-box fuzzers are widely used for validation but lack the ability to consume the rich context these reports carry, reducing each target to a bare location. In contrast, LLM-based approaches can consume this context but are often unable to identify the true triggering mechanism or to synthesize a working proof-of-vulnerability. We present CtxFuzz, a context-aware directed fuzzer that enables an LLM agent and a coverage-guided fuzzer to iteratively exchange and refine bug-triggering context throughout the campaign. The fuzzer contributes execution context, such as what inputs were tried and how the program behaved, grounding the agent’s reasoning in concrete evidence. The agent contributes semantic context, including hypotheses about the triggering conditions, explanations of failed attempts, and targeted mutations to overcome them, guiding the fuzzer toward relevant regions of the input space. Failed attempts are not discarded but decomposed into mutation scripts that translate each identified blocker into a fuzzer-executable strategy. This iterative exchange enables CtxFuzz to trigger vulnerabilities that neither directed fuzzers nor LLM agents reach independently. On 62 vulnerabilities across 16 open-source projects from the AIxCC Final competition (39 C, 23 Java), CtxFuzz exposes 61 of 62 targets, including 29 that no state-of-the-art directed fuzzer reaches, and exposes two zero-day vulnerabilities through a real-world vulnerability report validation pipeline. Article Search Article: ase26main-p797-p doi:10.1145/3832783.3834365
	Kim, Dongyeon	ASE '26: "GANADI: Uncovering C/C++ OSS ..." GANADI: Uncovering C/C++ OSS Reuse Genealogies via Pivotal Function-Based Clustering to Enhance Supply Chain Security Dongyeon Kim, Seunghoon Woo, and Heejo Lee (Korea University, Republic of Korea) We present GANADI, a systematic approach for identifying C/C++ OSS reuse genealogies to enhance software supply chain security. Understanding OSS reuse genealogy is crucial for improving SBOM completeness and prioritizing security remediation across supply chains. Although existing approaches can identify reused components and vulnerabilities within a project, they fail to trace OSS reuse paths through intermediate projects, limiting their effectiveness in securing supply chain ecosystems. To address this limitation, GANADI constructs reuse genealogies by clustering downstream projects based on shared characteristics of origin-derived code (called pivotal functions), and then inferring reuse direction among the projects within each cluster. When applied to 20 widely reused OSS projects with over 1,500 propagation paths, GANADI achieved 84.85% precision and 95.76% recall in identifying reuse genealogies, outperforming existing approaches that achieved at most 23.21% recall. Leveraging OSS reuse genealogy for vulnerability detection, we identified 48 unpatched vulnerabilities in real-world popular C/C++ projects. Among them, 23 were patched following our responsible disclosure (including one CVE ID assigned), demonstrating the practical impact of genealogy-based vulnerability management. Article Search Artifacts Available Article: ase26main-p1485-p doi:10.1145/3832783.3837498
	Kim, Doowon	ASE '26: "RAVEN: Measuring Detection ..." RAVEN: Measuring Detection Instability in Anti-virus Engines under Semantics-Preserving Perturbations Younghoon Ban, Beomjin Jin, Doowon Kim, Hyoungshick Kim, and Haehyun Cho (Soongsil University, Republic of Korea; Ajou University, Republic of Korea; University of Tennessee, Knoxville, USA; Sungkyunkwan University, Republic of Korea) Real-world anti-virus (AV) engines continue to rely heavily on signature-based detection, whereas academic adversarial research has largely focused on ML-based models, leaving an evaluation gap. To better understand signature-based detection behavior, we analyze ClamAV’s open-source signature database as a white-box reference point. Our analysis shows that raw byte-level signatures account for 94.54 Article Search Article: ase26main-p1356-p doi:10.1145/3832783.3837492
	Kim, Hyoungshick	ASE '26: "RAVEN: Measuring Detection ..." RAVEN: Measuring Detection Instability in Anti-virus Engines under Semantics-Preserving Perturbations Younghoon Ban, Beomjin Jin, Doowon Kim, Hyoungshick Kim, and Haehyun Cho (Soongsil University, Republic of Korea; Ajou University, Republic of Korea; University of Tennessee, Knoxville, USA; Sungkyunkwan University, Republic of Korea) Real-world anti-virus (AV) engines continue to rely heavily on signature-based detection, whereas academic adversarial research has largely focused on ML-based models, leaving an evaluation gap. To better understand signature-based detection behavior, we analyze ClamAV’s open-source signature database as a white-box reference point. Our analysis shows that raw byte-level signatures account for 94.54 Article Search Article: ase26main-p1356-p doi:10.1145/3832783.3837492
	Kim, Jiho	ASE '26: "CtxFuzz: Context-Aware Directed ..." CtxFuzz: Context-Aware Directed Fuzzing via Runtime Fuzzer-Agent Cooperation Jiho Kim, Dongkwan Kim, HyungSeok Han, Youngjoon Kim, Soyeon Park, Sangwoo Ji, Joshua Wang, Dae R. Jeong, and Taesoo Kim (Georgia Institute of Technology, USA; Microsoft, USA; Independent Researcher, USA; Samsung Electronics, Republic of Korea; Seoul National University, Republic of Korea) Automated tools produce vulnerability reports at unprecedented scale, but turning a report into a confirmed proof-of-vulnerability remains challenging. Directed grey-box fuzzers are widely used for validation but lack the ability to consume the rich context these reports carry, reducing each target to a bare location. In contrast, LLM-based approaches can consume this context but are often unable to identify the true triggering mechanism or to synthesize a working proof-of-vulnerability. We present CtxFuzz, a context-aware directed fuzzer that enables an LLM agent and a coverage-guided fuzzer to iteratively exchange and refine bug-triggering context throughout the campaign. The fuzzer contributes execution context, such as what inputs were tried and how the program behaved, grounding the agent’s reasoning in concrete evidence. The agent contributes semantic context, including hypotheses about the triggering conditions, explanations of failed attempts, and targeted mutations to overcome them, guiding the fuzzer toward relevant regions of the input space. Failed attempts are not discarded but decomposed into mutation scripts that translate each identified blocker into a fuzzer-executable strategy. This iterative exchange enables CtxFuzz to trigger vulnerabilities that neither directed fuzzers nor LLM agents reach independently. On 62 vulnerabilities across 16 open-source projects from the AIxCC Final competition (39 C, 23 Java), CtxFuzz exposes 61 of 62 targets, including 29 that no state-of-the-art directed fuzzer reaches, and exposes two zero-day vulnerabilities through a real-world vulnerability report validation pipeline. Article Search Article: ase26main-p797-p doi:10.1145/3832783.3834365
	Kim, Jihun	ASE '26: "EvoLLM: High-Coverage, Readable, ..." EvoLLM: High-Coverage, Readable, and Token-Efficient Unit Test Generation for Industrial Java Codebases Seokhyeon Moon, Myungho Lee, Jihun Kim, Yoon-Chan Jhi, Jihoon Cho, and Hakjoo Oh (Samsung SDS, Republic of Korea; Korea University, Republic of Korea) Adopting automated Java unit-test generation in industrial settings requires high coverage, readability, token efficiency, and modern-Java deployability. No existing technique meets all four: search-based test generators struggle with readability and modern-Java deployability, LLM-centric generators consume tens of millions of tokens, and prior LLM-based test refactoring methods drop baseline coverage by 8–21 percentage points (pp) in our controlled setups. We report on EvoLLM, a hybrid Java unit-test generator we built and deployed to address all four requirements. EvoLLM combines EvoSuiteng—a failure-analysis-driven hardening of EvoSuite that resolves deployability issues and strengthens baseline coverage—with cluster-wise LLM-based refactoring that groups tests by coverage goals and rewrites each cluster in a single LLM call grounded in compact program-under-test context. Across six open-source and three industrial projects, EvoLLM outperforms six state-of-the-art baselines, improving line coverage by 8.2–20.7 pp, branch coverage by 6.2–19.4 pp, and mutation score by 6.8–24.5 pp, while reducing LLM token usage by 47.3%–93.0%. In addition, the test generation stage of EvoLLM demonstrates robust deployability across target projects built with JDKs 8, 11, and 17, while achieving strong effectiveness on a Spring-core release requiring JDK 17. Finally, a 14-participant developer survey further suggests that EvoLLM-generated tests ranked higher in readability than those from prior tools and developer-written tests. Article Search Article: ase26ind-p335-p doi:10.1145/3832783.3834525
	Kim, Jinhan	ASE '26: "When Knowledge Changes: Metamorphic ..." When Knowledge Changes: Metamorphic Testing of RAG Systems with Mutations Jinhan Kim, Samuele Pasini, and Paolo Tonella (USI Lugano, Switzerland) Retrieval-Augmented Generation (RAG)-based LLM systems rely on external document corpora that can evolve and change over time. However, current evaluation methodologies (e.g., RAGAS) assess correctness against static snapshots, failing to detect faults when routine updates, factual changes, or noise alter the underlying data. We introduce a metamorphic testing framework that evaluates the consistency of RAG systems under corpus evolution. We formalise a fault taxonomy and 11 mutation operators that systematically perturb the system at both the pre-chunk (retrieval index) and post-chunk (retrieved context) levels. An empirical evaluation across five datasets and over 28k mutants reveals metamorphic violation rates of 4.9-10.2%. In a meta-evaluation against ground truth, our metamorphic oracle achieves F1 scores of 0.927-1.000, while the best RAGAS metric reaches only 0.570. Finally, we provide actionable insights into mitigating these faults through retrieval re-configuration, generator upgrades, and LLM-based reranking. Article Search Article: ase26main-p2811-p doi:10.1145/3832783.3837543
	Kim, Jungwoong	ASE '26: "MiniPoly: Automatic Extraction ..." MiniPoly: Automatic Extraction of Efficient JavaScript Polyfill from Language Specification Jungwoong Kim, Youngmin Cho, and Jihyeok Park (Korea University, Republic of Korea) A polyfill is a JavaScript implementation of built-in APIs for older execution environments lacking native support. Because developers rely on them to run modern features everywhere, strict conformity to the official language specification (ECMA-262) is crucial. However, manual implementation remains the industry standard; this process is labor-intensive, inherently error-prone, and frequently leads to spec-miscompliance bugs in production. To address this, we present MiniPoly, the first compilation framework to automatically extract correct and optimized polyfills directly from the ECMA-262 specification. To ensure correct generation, MiniPoly employs a static analysis that resolves the specification’s internal control-flow representations (i.e., completion records) and translates them into equivalent JavaScript constructs. Furthermore, it utilizes rewrite rules to apply user-defined optimization patterns, replacing algorithmic bottlenecks in the specification with highly efficient implementations. Evaluation shows that MiniPoly successfully generates polyfills for 89 built-in APIs in ECMAScript 2025 (ES2025) using 17 user-defined rewrite rules. It produces a more spec-compliant polyfill than production-standard libraries like core-js and es-shims with a competitive performance profile. Additionally, we demonstrate that MiniPoly can generate polyfills even for the next draft release of ECMA-262 and early-stage proposals, highlighting its potential to future-proof development. Article Search Artifacts Available Article: ase26main-p3249-p doi:10.1145/3832783.3837549
	Kim, Mijung	ASE '26: "Testing IFrame Rendering in ..." Testing IFrame Rendering in Web Browsers Dahyeon Park, Yuseok Jeon, Seongil Wi, and Mijung Kim (UNIST, Republic of Korea; Korea University, Republic of Korea) Iframes are widely used in modern web development, but their separation from the parent page can lead to iframe-specific rendering bugs, which occur only when content is embedded within an iframe. These bugs may degrade user experience and, in some cases, lead to serious security vulnerabilities. However, existing rendering bug detection techniques are largely ineffective since their oracles compare rendering outputs only within the same context and fail to capture discrepancies across different rendering contexts. This paper presents ICheck, an automated testing technique for iframe rendering in web browsers. Specifically, given an HTML document, ICheck introduces a cross-context oracle that detects inconsistencies by comparing the same HTML content in both top-level and iframe contexts. To further assist debugging, ICheck performs layout-aware input reduction by redefining the effective search space of bug-inducing elements. As a result, ICheck helps developers more effectively and efficiently identify and diagnose iframe-specific rendering bugs. Evaluated on the most popular browsers, Chrome and Firefox, ICheck detected 21 previously unknown bugs, all of which were confirmed. On average, ICheck uncovered 3.8× more bugs than state-of-the-art rendering bug detection work. In addition, ICheck effectively reduced HTML inputs by 93% in DOM nodes while achieving up to 10.1× faster reduction time compared with state-of-the-art delta debugging approaches. Article Search Artifacts Available Article: ase26main-p2611-p doi:10.1145/3832783.3834417 ASE '26: "CIPIHunter: Detecting Configuration-Induced ..." CIPIHunter: Detecting Configuration-Induced Prediction Instability in Deep Learning Frameworks Yanzhou Mu, Shuo Meng, Mijung Kim, Xiang Chen, Chunrong Fang, Zhenyu Chen, and Juan Zhai (UNIST, Republic of Korea; Nanjing University, China; Nantong University, China; University of Massachusetts at Amherst, USA) Deep learning (DL) frameworks support diverse execution configurations, including precision modes and model optimizations. Even with a fixed model, input, and framework version, changing these configurations can change model predictions, causing Configuration-Induced Prediction Instability (CIPI). CIPI arises when configuration-dependent numerical perturbations propagate and cause potentially harmful model-level behavior. Existing API-level and model-level testing approaches are not well suited to detecting CIPI, as these approaches lack configuration-conditioned exploration and propagation-aware diagnosis. Therefore, we present CIPIHunter, which combines controlled configuration-pair testing, sensitivity-oriented mutation, feedback-guided search, and intermediate tracing to localize suspicious operators or operator groups. On 13 PyTorch models under a 100-round budget, CIPIHunter reports the highest raw CIPI count and 22 deduplicated Type I manifestations, 83.3% more than the strongest baseline, while remaining competitive in overall deduplicated manifestation coverage. In total, we submit 29 PyTorch issue reports. Developers have acknowledged eight, rejected five, and marked four as duplicates; nine remain pending, and three have been closed without an explicit determination. Separately, three reports are labeled “high-priority”. These results demonstrate the practical utility of CIPI testing for framework quality assurance. Article Search Article: ase26main-p163-p doi:10.1145/3832783.3834345
	Kim, Minjong	ASE '26: "Orbis: Guiding Symbolic Execution ..." Orbis: Guiding Symbolic Execution Techniques to Maximize Option-Related Branch Coverage Minjong Kim, Sungjae Hwang, and Sooyoung Cha (Sungkyunkwan University, Republic of Korea) We present Orbis, a complementary approach that guides symbolic execution techniques toward maximizing option-related branch (OB) coverage. Although state-of-the-art symbolic execution techniques have substantially improved code coverage and bug detection, existing techniques often fail to exercise core program functionalities, which are frequently exposed as program options. To quantify this limitation, we evaluate how effectively current techniques cover option-related branches and find that they reach only 8.0% of the targeted OBs, which are accessible only through specific options. Orbis overcomes this challenge by systematically guiding symbolic execution to improve OB coverage. For a given program, Orbis automatically identifies all defined options and determines their associated branches by analyzing dynamic execution traces. It then iteratively constructs target option arguments by stochastically combining identified options according to their estimated potential, directs symbolic execution to explore states influenced by these arguments, and refines their potential while simultaneously reducing SMT-solver invocations using data accumulated during symbolic execution. Experimental results on 15 open-source C programs show that integrating Orbis with four independent state-of-the-art techniques significantly increases OB coverage to 323.0%, boosts total branch coverage by 112.1%, and detects five additional unique bugs on average compared to the standalone techniques. Article Search Article: ase26main-p2260-p doi:10.1145/3832783.3837526
	Kim, Miryung	ASE '26: "Accurate and Low-Cost Residual ..." Accurate and Low-Cost Residual Risk Assessment via Sampled Profiling and Structure-Aware Coverage Amplification Seongmin Lee, Işıl Özgü, Marcel Böhme, and Miryung Kim (University of California at Los Angeles, USA; MPI-SP, Germany) Estimating the residual risk of undiscovered bugs—and thus when to stop fuzzing—is critical for determining testing adequacy. Traditionally, this assessment relies on coverage instrumentation, which records complete coverage of every execution but imposes a 60-70% performance slowdown, reducing fuzzing throughput and delaying bug discovery. This overhead raises a fundamental question: can partial observation provide high-fidelity confidence at a fraction of the coverage instrumentation cost? We propose a risk assessment method in the context of black-box fuzzing that leverages hardware-enabled performance profiling—replacing coverage instrumentation with instruction pointer (IP) sampling—as the core mechanism for low-overhead observation. To recover the accuracy inevitably lost to the sparse nature of sampling, we employ must-execute analysis, a static control-flow analysis that identifies all statements and basic blocks that must have executed to reach, or must execute after, an observed sample, effectively reconstructing missing execution paths from partial observations. Despite the partial coverage inherent to profiler-based sampling, our risk estimation method achieves 4.27× higher throughput than complete-coverage instrumentation, enabling fuzzing campaigns to reach stopping thresholds 2× faster while maintaining high accuracy (1.73 average relative error compared to the ground truth). Ultimately, this efficiency translates into superior bug discovery, triggering more bugs with speedups of up to 10× within the same time budget. Article Search Article: ase26main-p2006-p doi:10.1145/3832783.3837519
	Kim, Moonzoo	ASE '26: "Top-Down Multi-agent LLM System ..." Top-Down Multi-agent LLM System with Runtime Data for MISRA C Violation Detection Ahcheong Lee, Yeongbin Kang, Sechang Jang, Heechan Yang, and Moonzoo Kim (KAIST, Republic of Korea; VplusLab, Republic of Korea) Ensuring MISRA C compliance is crucial for the safety and reliability of embedded software. For this purpose, industries utilize static rule checkers but suffer high ratios of both missed violations and false alarms. Although companies also try to utilize LLMs for this purpose, existing LLM-based approaches have suboptimal performance for large, complex programs. We introduce LASIK, the world-first top-down multi-agent LLM compliance-checking framework for MISRA C, which combines on-demand repository-level context provision with runtime execution evidence. This design enables LASIK to report more true violations than state-of-the-art static analyzers and a naive vanilla LLM approach, while maintaining a low false positive ratio. Our evaluation on 10 embedded projects shows that LASIK detects 1.3-2.7 times more true violations than the static analyzers and the vanilla LLM approach, while achieving the lowest false alarm ratio (26.7%). Furthermore, on an industrial software developed by VPlusLab Inc., LASIK detects up to 2.1 times more true violations with a low false alarm rate (i.e., 10.8%) than the baseline techniques. Article Search Article: ase26ind-p152-p doi:10.1145/3832783.3834497
	Kim, Seungjoo	ASE '26: "ThreatCraft: Automated Attack ..." ThreatCraft: Automated Attack Scenario Generation via Hybrid Rule-Based and LLM-Driven Reasoning Dohee Kang, Jiwon Kwak, Geunwoo Baek, and Seungjoo Kim (Korea University, Republic of Korea) Recently, the growing complexity of modern Information Technology (IT) systems has made it increasingly difficult to identify realistic attack scenarios. Although various automated approaches have been proposed, challenges such as dependence on expert knowledge and hallucinations in LLM-based methods remain unresolved. We develop ThreatCraft, an attack-scenario generation tool that combines a rule-based engine with Large Language Models (LLMs). ThreatCraft constructs system-level attack paths using a Unified Kill Chain (UKC) and leverages them to guide LLMs in generating detailed attack scenarios. Experimental results across automotive, Industrial Control Systems (ICS), and enterprise domains show that ThreatCraft achieves an average F1-score of 0.984 and a semantic similarity score of 0.893, improving attack-path reconstruction accuracy and semantic similarity by up to 8.3% and 10.7%, respectively, compared with other tools. These results demonstrate that ThreatCraft can consistently generate realistic and structurally coherent attack scenarios across various domains. GitHub:https://github.com/HackProof/2026_ASE_ThreatCraft.git Demo:https://youtu.be/nrIHEKDLp2E Article Search Artifacts Available Article: ase26tool-p39-p doi:10.1145/3832783.3834608
	Kim, Taegyu	ASE '26: "Planner-Fuzz: Overcoming Diagnostic ..." Planner-Fuzz: Overcoming Diagnostic Saturation in UAV Planners via Boundary-Oriented Fuzzing Rongbo Chen, Chengcheng Zhao, Peng Cheng, Jiming Chen, and Taegyu Kim (Zhejiang University, China; Pennsylvania State University, USA) UAV planners are safety-critical software components whose behavior depends on high-dimensional, continuously tunable parameters. While existing fuzzing approaches focus on discovering failures, configurations deep inside failure regions are often diagnostically uninformative.Once the planner moves far beyond the safety boundary, parameter sensitivity diminishes, and inter-parameter dependencies become obscured.We refer to this phenomenon as diagnostic saturation and observe that configurations near the safe-unsafe transition preserve informative parameter sensitivity and interaction structure, making them more suitable for root-cause analysis. To this end, we propose Planner-Fuzz, a boundary-oriented fuzzing framework. It steers search toward a narrow band around the safety boundary while preventing convergence to a single configuration to enable the exploration of diverse boundary behaviors. Using the collected boundary configuration, Planner-Fuzz performs three-level diagnosis through sensitivity analysis, interaction mining, and counterfactual validation to identify and validate the parameters responsible for failure behavior. We evaluate the approach on three open-source UAV planners under four anomaly types. The results show that Planner-Fuzz discovers more diverse and diagnostically useful boundary configurations than failure-driven baselines, provides stronger signals for identifying influential parameters and interactions, and yields stronger intervention-based recovery evidence. These findings suggest that fuzzing for safety-critical planners should go beyond failure discovery and explicitly support diagnosis. Article Search Article: ase26main-p1399-p doi:10.1145/3832783.3834389
	Kim, Taesoo	ASE '26: "CtxFuzz: Context-Aware Directed ..." CtxFuzz: Context-Aware Directed Fuzzing via Runtime Fuzzer-Agent Cooperation Jiho Kim, Dongkwan Kim, HyungSeok Han, Youngjoon Kim, Soyeon Park, Sangwoo Ji, Joshua Wang, Dae R. Jeong, and Taesoo Kim (Georgia Institute of Technology, USA; Microsoft, USA; Independent Researcher, USA; Samsung Electronics, Republic of Korea; Seoul National University, Republic of Korea) Automated tools produce vulnerability reports at unprecedented scale, but turning a report into a confirmed proof-of-vulnerability remains challenging. Directed grey-box fuzzers are widely used for validation but lack the ability to consume the rich context these reports carry, reducing each target to a bare location. In contrast, LLM-based approaches can consume this context but are often unable to identify the true triggering mechanism or to synthesize a working proof-of-vulnerability. We present CtxFuzz, a context-aware directed fuzzer that enables an LLM agent and a coverage-guided fuzzer to iteratively exchange and refine bug-triggering context throughout the campaign. The fuzzer contributes execution context, such as what inputs were tried and how the program behaved, grounding the agent’s reasoning in concrete evidence. The agent contributes semantic context, including hypotheses about the triggering conditions, explanations of failed attempts, and targeted mutations to overcome them, guiding the fuzzer toward relevant regions of the input space. Failed attempts are not discarded but decomposed into mutation scripts that translate each identified blocker into a fuzzer-executable strategy. This iterative exchange enables CtxFuzz to trigger vulnerabilities that neither directed fuzzers nor LLM agents reach independently. On 62 vulnerabilities across 16 open-source projects from the AIxCC Final competition (39 C, 23 Java), CtxFuzz exposes 61 of 62 targets, including 29 that no state-of-the-art directed fuzzer reaches, and exposes two zero-day vulnerabilities through a real-world vulnerability report validation pipeline. Article Search Article: ase26main-p797-p doi:10.1145/3832783.3834365
	Kim, Youngjoon	ASE '26: "CtxFuzz: Context-Aware Directed ..." CtxFuzz: Context-Aware Directed Fuzzing via Runtime Fuzzer-Agent Cooperation Jiho Kim, Dongkwan Kim, HyungSeok Han, Youngjoon Kim, Soyeon Park, Sangwoo Ji, Joshua Wang, Dae R. Jeong, and Taesoo Kim (Georgia Institute of Technology, USA; Microsoft, USA; Independent Researcher, USA; Samsung Electronics, Republic of Korea; Seoul National University, Republic of Korea) Automated tools produce vulnerability reports at unprecedented scale, but turning a report into a confirmed proof-of-vulnerability remains challenging. Directed grey-box fuzzers are widely used for validation but lack the ability to consume the rich context these reports carry, reducing each target to a bare location. In contrast, LLM-based approaches can consume this context but are often unable to identify the true triggering mechanism or to synthesize a working proof-of-vulnerability. We present CtxFuzz, a context-aware directed fuzzer that enables an LLM agent and a coverage-guided fuzzer to iteratively exchange and refine bug-triggering context throughout the campaign. The fuzzer contributes execution context, such as what inputs were tried and how the program behaved, grounding the agent’s reasoning in concrete evidence. The agent contributes semantic context, including hypotheses about the triggering conditions, explanations of failed attempts, and targeted mutations to overcome them, guiding the fuzzer toward relevant regions of the input space. Failed attempts are not discarded but decomposed into mutation scripts that translate each identified blocker into a fuzzer-executable strategy. This iterative exchange enables CtxFuzz to trigger vulnerabilities that neither directed fuzzers nor LLM agents reach independently. On 62 vulnerabilities across 16 open-source projects from the AIxCC Final competition (39 C, 23 Java), CtxFuzz exposes 61 of 62 targets, including 29 that no state-of-the-art directed fuzzer reaches, and exposes two zero-day vulnerabilities through a real-world vulnerability report validation pipeline. Article Search Article: ase26main-p797-p doi:10.1145/3832783.3834365
	Kimura, Kosaku	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Kini, Aditya	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Klein, Jacques	ASE '26: "Evaluating Inference-Time ..." Evaluating Inference-Time Defenses against Package Hallucination in LLM-Generated Code Alberick Euraste Djire, Iyiola E. Olatunji, Melissa Tessa, Earl T. Barr, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg; University College London, UK) LLMs are increasingly used for code generation, yet they frequently hallucinate non-existent software packages, creating exploitable entry points into the software supply chain. We make four contributions to this problem. First, we show that prior evaluation methodologies systematically inflate hallucination rates by misclassifying standard-library modules as hallucinations in some languages. For Python, the overestimation reaches 9.4 percentage points. Second, we evaluate seven inference-time defenses for mitigating package hallucinations, including five guided decoding strategies (Greedy, Contrastive, DoLa, Nudging, and Active Layer-Contrastive Decoding), an iterative self-refinement approach (Self-Refine), and a Retrieval-Augmented Generation (RAG)-based defense. Across eight models spanning five families and four programming languages (Python, JavaScript, Ruby, Rust), RAG reduces the package hallucination rate (PHR) in 18 of 32 model–language configurations. Third, we introduce Package Utility (PU) to assess whether defenses preserve valid and task-relevant recommendations. Among strategies evaluated, Greedy decoding provides the strongest average mitigation–utility trade-off. Fourth, we stress-test all strategies under adversarial prompts seeded with fabricated package names and find that PHR surges by up to 45 percentage points relative to standard prompts, with Ruby consistently the most vulnerable language (80.9–95.2%). Under adversarial conditions, RAG and Self-Refine outperform all decoding-only strategies, indicating that robust defense requires either external grounding or iterative self-verification when prompts are actively hostile. Our results recast package hallucination as both a measurement problem and a decoding-time control problem, and they demonstrate that the choice of defense must be matched to the threat model and recommendation utility. Article Search Article: ase26main-p3592-p doi:10.1145/3832783.3837555 ASE '26: "Do Not Copy/Paste: Soft Barriers ..." Do Not Copy/Paste: Soft Barriers for Copying in AI-Assisted Programming Iyiola E. Olatunji, Alberick Euraste Djire, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg) Copying a function from a chat window into an editor takes less than a second. For many uses of AI coding tools, that speed is the point; in settings such as programming education, code review, and security-sensitive development, it can also be the problem. This paper frames copy-paste as an AI code handoff problem: the moment model-generated text crosses from a conversational context into executable or committed software is a design boundary that current tools leave largely unmanaged. We argue that AI coding assistants should not only be evaluated by the code they generate, but also by how they mediate the transfer of that code into software artifacts. We propose soft barriers as one class of handoff-aware mechanisms. Soft barriers preserve access to AI assistance while making unexamined transfer less frictionless. As an initial technical probe, we instantiate this idea using Unicode output perturbations that preserve visual readability but disrupt naive copy-paste execution. We introduce Copy-Paste Resistance (CPR), the fraction of functionally correct clean solutions that become syntactically invalid after perturbation. Across HumanEval and MBPP with four LLMs and four perturbation families, we find that output-level barriers can achieve high copy-paste resistance, but their effectiveness is highly model- and task-dependent. An exploratory pilot with 18 participants provides early evidence that soft barriers can shift users from direct transfer toward editing and reconstruction. We do not present Unicode perturbations as a deployment-ready solution; rather, we use them as a minimal probe for a broader research agenda on practical, transparent, and policy-aware AI code handoff. Article Search Article: ase26nier-p79-p doi:10.1145/3832783.3834554
	Klimek, Radosław	ASE '26: "Towards Diagnostic Explainability ..." Towards Diagnostic Explainability in Workflow Verification via Shapley Attribution Radosław Klimek and Jakub Błażowski (AGH University of Krakow, Poland) Workflow mining produces hierarchical workflow models from event logs, yet it is often unclear why such models satisfy or violate logical properties, or how individual model elements influence these outcomes. This work explores diagnostic explainability in workflow verification through the lens of attribution. We outline an approach that translates mined workflow models into logical specifications, checks properties, such as satisfiability, liveness and safety using automated theorem provers and interprets verification outcomes via Shapley values from the cooperative game theory. This attribution-based perspective provides a diagnostic view of how different parts of a workflow model contribute to property satisfaction or violation, highlighting elements that are critical, redundant or potentially harmful with respect to formal properties. Preliminary results suggest that Shapley-based attribution may support an interpretable workflow analysis while revealing limitations and trade-offs relevant to future research in explainable verification. Article Search Article: ase26nier-p15-p doi:10.1145/3832783.3834542
	Ko, In-Young	ASE '26: "Evolution-Aware Regression ..." Evolution-Aware Regression Test Prioritization of ML-Enabled Systems using Gradient-Based Behavior Vectors Eunho Cho, Donghwan Shin, and In-Young Ko (KAIST, Republic of Korea; University of Sheffield, UK) The machine learning(ML) component of an ML-enabled system evolves through retraining, fine-tuning, and optimization, so previously valid test results may no longer hold. A single evolution step can worsen performance on some test cases while improving others, making regression test prioritization inherently directional. We present Gradient-based Behavior Vector-Parameter Delta(GBV-PD), the first approach to operationalize the behavior vector space for evolution-aware regression test prioritization. GBV-PD represents each test case as a gradient-based vector(GBV), a low-dimensional projection of its loss gradient under the original model. It then projects the observed parameter update of the evolved model onto the same PCA basis and uses the resulting alignment to estimate whether each test case's loss is likely to increase or decrease, without running the evolved model on test cases during prioritization. In an empirical study across classification and regression tasks, GBV-PD consistently outperformed non-directional baselines and remained competitive with a full-gradient reference, while offering better time and storage profiles for repeated updates via reusable GBV caching. These results show that behavior-space ideas can be operationalized into a practical and efficient mechanism for repeated-update regression-test prioritization of evolving ML components within ML-enabled systems. Article Search Artifacts Available Article: ase26main-p872-p doi:10.1145/3832783.3834368
	Kobashi, Hiro	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Kobayashi, Kenichi	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Kodela, Phanindra	ASE '26: "COBug: A Bug Localization ..." COBug: A Bug Localization Pipeline for COBOL: Does It Work? An Exploratory Study Kavyasri Gajula, Phanindra Kodela, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) COBOL still runs core banking, insurance, and government systems, but the developers who understand it are retiring faster than they are replaced, and defects in this code are costly to diagnose. Bug localization could help, yet the technique has matured on Java and Python, while COBOL lacks the standardized bug reports, faulty revisions, and validated report-to-file links required for retrieval-based evaluation. We present COBug, a leakage-controlled benchmark and evaluation pipeline for file-level bug localization in COBOL: 552 deterministic queries across 12 X-COBOL repositories, each carrying one isolated source mutation with mechanically traceable ground truth and a symptom-focused report generated without reading the target source file. Using COBug, we evaluate lexical retrieval, pointwise re-ranking, LambdaMART, and frozen CodeBERT under leave-one-repository-out evaluation. None reliably outperforms the repository-matched random floor. After Holm correction, no method–baseline comparison is statistically significant. Lexical retrieval comes closest at MAP 0.1508 against a floor of 0.1229, though two repositories holding 15 queries contribute over 80% of that margin. We argue that this may partly reflect the benchmark construction itself: a report synthesized in strict isolation from its target may carry limited information about which file is faulty. We therefore present the result as indicating a possible limitation of this template-based construction, rather than as a verdict on COBOL bug localization, and release the pipeline with its manifests and provenance records. Article Search Article: ase26main-p1990-p doi:10.1145/3832783.3837518 ASE '26: "K-COBAgent: A Knowledge-Driven ..." K-COBAgent: A Knowledge-Driven Multi-agent Framework for COBOL Modernization Kavyasri Gajula, Phanindra Kodela, and Sridhar Chimalakonda (Indian Institute of Technology Tirupati, India) Multi-agent pipelines for legacy code translation have been devel- oped and evaluated largely outside COBOL, in settings such as Java to C#, PL/SQL to Java, and legacy web applications. Work targeting COBOL is predominantly single-model or rule-based. Both lines treat each run as self-contained, so prior translations, validation outcomes, failures, and repairs are not carried into the next run. For COBOL systems that are modernized incrementally across months or years, the absence of such reuse can cause repeated translation- generation work on unchanged code. We present K-COBAgent (Knowledge-driven COBOL Agent), which brings a multi-agent pipeline to COBOL modernization and, to our knowledge, is among the first frameworks in either line to persist a knowledge base across independent runs and measure cross-run reuse over repeated passes. Seven pipeline agents operate under a MAPE-K orchestrator, han- dling comprehension, planning, refactoring, translation, test gen- eration, validation, and learning; an on-demand SelfRepairAgent handles failed modules. A dual-layer knowledge base uses SQLite for exact source-hash lookup and ChromaDB for semantic retrieval of failure records and repair information, preserving outcomes across runs. Translation follows a three-layer strategy: KB cache lookup, deterministic rules grounded in COB2PY, and LLM fall- back. Applied to 14 X-COBOL repositories across three passes, the framework persisted 543 translation-output records after Pass 1. The translation-cache hit rate was 0.00% in Pass 1 and 99.82% in Passes 2 and 3 for previously seen source hashes, suggesting that exact-hash reuse may avoid repeated translation-generation work on unchanged modules. Final PASS outcomes varied from 53 to 58 under rerun validation and stochastic repair, while final FAIL out- comes varied from 29 to 24; these variations do not establish a stable quality trend. This is an early study; we report both the promise and the limitations of knowledge-persistent agentic COBOL mod- ernization Article Search Article: ase26nier-p105-p doi:10.1145/3832783.3834560
	Kokkonis, Dimitri	ASE '26: "Not In My Git Yard: Catching ..." Not In My Git Yard: Catching Backdoors at Commit and Release Time Dimitri Kokkonis, Michaël Marcozzi, and Stefano Zacchiroli (Université Paris-Saclay, France; CEA List, France; Télécom Paris, France) Code-level backdoors—stealthy code changes that grant hidden privileges via secret triggers—pose a persistent threat to open-source software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions. Lily offers two key contributions. First, it enhances CI-compatible fuzzing with the capability to detect triggers of suspicious behavior based on historical and current software executions. This enables fast, precise backdoor detection suitable for both CI and update validation workflows. Second, it combines code change analysis with fuzzing data to precisely point maintainers to backdoor-revealing code regions, even when release updates modify millions of lines of code. We also outline five strategies attackers could use to evade Lily, and evaluate corresponding defenses. Our experiments across hundreds of benign and backdoored commits and releases show that Lily achieves high detection accuracy with low false alarm rates, reliably identifies malicious code, resists adversarial attempts, and would have prevented real-world backdoor incidents. Article Search Article: ase26main-p379-p doi:10.1145/3832783.3834352
	Kondo, Masanari	ASE '26: "How Well Do LLMs Generate ..." How Well Do LLMs Generate Taxonomies in the SE Domain? A Multi-perspective Evaluation Framework Sota Nakashima, Yuta Ishimoto, Masanari Kondo, Tao Xiao, and Yasutaka Kamei (Kyushu University, Japan) Taxonomies provide a shared conceptual framework for organizing heterogeneous observations in software engineering (SE) research. Manually constructing such taxonomies is labor-intensive and requires annotators with expertise in the SE domain. While advances in Large Language Models (LLMs) have led to the emergence of automated taxonomy generation methods outside the SE domain, their applicability to technically complex SE artifacts remains unclear. In this experience paper, we present the first comprehensive empirical evaluation of how state-of-the-art automated methods perform on SE artifacts through a multi-perspective evaluation framework, including taxonomy quality, alignment with taxonomies defined by human experts, reliability under independent annotation, and efficiency. To support this evaluation, we systematically collect seven SE papers with publicly available artifacts and human-defined taxonomies, and conduct experiments using two automated methods (TnT-LLM and CLIMB) with five state-of-the-art LLMs. Our evaluation reveals a clear trade-off: TnT-LLM constructs high-quality taxonomies comparable to human-defined ones but incurs substantially higher cost and runtime and tends to generate overly complex taxonomies, whereas CLIMB is 15–40× faster and 8–49× cheaper but tends to score lower on quality when technical inference beyond surface-level similarity is required. These findings suggest that TnT-LLM and CLIMB can be used in practical situations in the SE domain, while researchers should first assess the complexity of the generated taxonomies and their cost using a subset of the target data to decide whether to use automated methods or human experts. Our work represents a first step toward a systematic understanding of automated taxonomy generation in SE, offering actionable insights for future research and practice. Article Search Article: ase26main-p3263-p doi:10.1145/3832783.3837551
	Kong, Fanqi	ASE '26: "RegoMender: A Multi-agent ..." RegoMender: A Multi-agent Framework for Automated Rego Policy Repair Ruijie Zhang, Huaxiao Yin, Li Hu, Fanqi Kong, Haozhe Liang, Shaoyin Cheng, Kun Zhang, and Bibo Tu (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Science and Technology of China, China; Peking University, China; University of Chinese Academy of Sciences, China) Policy-as-Code (PaC) has emerged as a foundational paradigm in cloud-native systems. However, repairing Rego policies remains challenging due to their strict syntax, declarative semantics, and specific verification requirements. Existing automated program repair (APR) methods are mainly designed for mainstream languages and struggle to accommodate the unique policy logic and repair workflows of Rego. Thus, Rego policy repair remains a manual process driven by trial and error. To address this, we introduce RegoBench, the first automated Rego policy benchmark comprising 1,159 real-world defects, and propose RegoMender, a feedback-guided multi-agent framework. Collaborating via a shared blackboard and an atomic toolkit, RegoMender dynamically executes patching, rewriting, or rolling back, to resolve complex repair scenarios. Evaluated on RegoBench, RegoMender achieves syntactic and test-based semantic success rates of 82.9% and 77.9%, respectively, outperforming the strongest baseline by 13.4%. Unlike other approaches whose performance drops in complex scenarios, RegoMender maintains effectiveness across single-step and chained repair tasks. Furthermore, it generalizes strongly across HCL and SQL and achieves an 86.4% repair rate on 132 real-world CVE vulnerabilities, proving its robustness and practical utility for security. Article Search Article: ase26main-p1325-p doi:10.1145/3832783.3837490
	Kong, Fanshuang	ASE '26: "ExeCRE: Execution-Consistency ..." ExeCRE: Execution-Consistency Guided Reliability Estimation for Self-Correcting Code Generation Yiru Dong, Richong Zhang, Fanshuang Kong, and Si Chen (Beihang University, China) Large language models (LLMs) have made notable progress in code generation, but they still struggle on challenging tasks that require sophisticated algorithms or complex implementations. Recent methods increasingly use code execution as feedback, especially in self-correction pipelines that construct verification signals from generated code. However, these pipelines often depend on supervision signals whose reliability is unknown, which can introduce misleading feedback, unnecessary revisions, and incorrect final answers. To address this issue, we propose ExeCRE, an Execution-Consistency guided code Reliability Estimation framework. Instead of judging candidate code by tests or LLM feedback, ExeCRE estimates code reliability by statistically analyzing consistency patterns in execution outputs over a large number of randomly generated inputs. It collects execution outputs over generated inputs, projects them into consistency signals, and applies Dawid–Skene model to infer latent code reliability. We integrate ExeCRE into self-correction for code generation. Experiments show that ExeCRE consistently improves both effectiveness and stability, while substantially reducing misleading correction signals. Under GPT-5.2 on LiveCodeBench, the average number of misleading feedback cases on already correct code drops from 113.2 with a representative self-correction baseline to 14.0 with ExeCRE. As an additional study, we apply the same reliability estimation strategy to code-based mathematical reasoning and observe similar benefits. These results suggest that ExeCRE enables more reliable use of generated code in execution-based pipelines. Article Search Article: ase26main-p496-p doi:10.1145/3832783.3837445
	Konstantinides, John	ASE '26: "Why Is This on My Bill? Documentation-Grounded ..." Why Is This on My Bill? Documentation-Grounded Rule Learning for Itemized Bill Explanation John Konstantinides, Jason Titus Lefever, Muhammed Numair Mansur, Martin Schaef, and Willem Visser (Amazon Web Services, USA; Drexel University, USA; Amazon Web Services, Germany) Complex itemized bills from services such as cloud computing, healthcare, or telecommunications can be difficult to understand because the pricing terms that determine what a customer pays are straightforward, but the eligibility rules that determine whether a given line item, a single charge for a product and quantity, qualifies for a given price are scattered across user guides, service terms, and fine print. No single document describes them all, and without them, it is difficult to explain why a specific charge appears on a bill. We present a neuro-symbolic tool that learns these eligibility rules automatically from billing data and documentation. Pricing terms are evaluated against line items to produce labelled data indicating whether each pricing term was eligible for a given line item. An LLM agent then uses this labelled data, a knowledge base of public documentation, and a small set of rule-evaluation tools to generate rules that are accurate: no rule incorrectly labels a line item as ineligible for a pricing term, and explainable: every rule is backed by a passage from the knowledge base. We showcase the tool on the AWS billing system, evaluating millions of line items across hundreds of internal accounts. The tool learns a small set of rules that, together with the pricing terms, explain the majority of observed discrepancies, and we measure documentation coverage, rule stability across sample sizes, and the impact of ML pre-seeding on discovery cost. Article Search Article: ase26ind-p112-p doi:10.1145/3832783.3834490
	Koyejo, Sanmi	ASE '26: "A Few Pages of Markdown: Committed ..." A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, and Sanmi Koyejo (Stanford University, USA; Carnegie Mellon University, USA; Grid Dynamics, USA) Coding agents increase development velocity but also technical debt. Prior work reports only average effects across adopters, hiding wide differences between teams. We introduce RAMP (Repository AI Maturity Profile), a four-level cumulative maturity model grounded in version-controlled artifacts that teams commit to configure AI tools. RAMP runs from behavioral rules and coding standards through named agent definitions to multi-agent orchestration, with observed practice concentrated in the first three levels. Across 441 repositories the levels behave as a cumulative scale, and independent human annotation reproduces RAMP’s repository-level labels on 97 Article Search Article: ase26main-p2970-p doi:10.1145/3832783.3837546
	Koziolek, Anne	ASE '26: "Can Formal Specifications ..." Can Formal Specifications Be Synthesized from Tests Alone? Tianhai Liu, Maximilian Müller, Tobias Hey, Vitus Lüntzel, Muhammad Minhas, Anne Koziolek, and Bernhard Beckert (KIT, Germany) Formal specifications offer strong guarantees, but remain costly to write manually. Recent LLM-based approaches automate this by inferring specifications from source code, yet their reliance on white-box access poses barriers to industrial adoption due to intellectual property risks and deployment costs. Our approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden. Candidate specifications are validated locally using bounded model checking, with feedback guiding iterative refinement. Initial results on the SpecGenBench benchmark suggest that tests can guide LLMs towards meaningful Java Modeling Language specifications, while also highlighting checker compatibility and diagnostic feedback as key challenges for reliable refinement. Article Search Artifacts Available Article: ase26nier-p62-p doi:10.1145/3832783.3834549 ASE '26: "The EVerest Dataset for Secure ..." The EVerest Dataset for Secure Software Engineering Sophie Corallo, Debora Grupp, Dominik Fuchß, Jan Keim, Frederik Reiche, Tobias Hey, and Anne Koziolek (KIT, Germany) End-to-end security verification, from requirements through architecture to code, requires datasets that span all three artifact types with fine-grained security labels. No existing dataset provides this combination. We present the EVerest dataset, a multi-artifact resource based on EVerest, an industry-driven open-source software stack for electric vehicle charging stations. The dataset includes 84 manually elicited security requirements annotated with security objectives, 1,445 fine-grained security elements (components, entities, data, data flows, states, etc.), acceptance windows, coreferences, and architectural trace links, as well as the EVerest software architecture model, source code, and natural language documentation. It enables research on security requirements classification, named entity recognition, architectural trace linking, and design-time or code-level security verification. During dataset creation, a real security weakness (CWE-1295) was identified, disclosed to the project maintainers, and subsequently fixed. The dataset is publicly available [4]. A short video is available at https://youtu.be/pnn1uqpomvQ. Article Search Artifacts Available Article: ase26tool-p56-p doi:10.1145/3832783.3834614
	Kroening, Daniel	ASE '26: "ReCodeAgent: A Multi-agent ..." ReCodeAgent: A Multi-agent Workflow for Language-Agnostic Translation and Validation of Large-Scale Repositories Ali Reza Ibrahimzada, Brandon Paulsen, Daniel Kroening, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; Amazon, USA) Most repository-level code translation and validation techniques have been evaluated on a single source-target programming language (PL) pair, owing to the complex engineering effort required to adapt new PL pairs. Programming agents can enable PL-agnosticism in repository-level code translation and validation: they can synthesize code across many PLs and autonomously use existing tools specific to each PL’s analysis. However, state-of-the-art has yet to offer a fully autonomous agentic approach for repository-level code translation and validation of large-scale programs. This paper proposes ReCodeAgent, an autonomous multi-agent approach for language-agnostic repository-level code translation and validation. Users only need to provide the project in the source PL and specify the target PL for ReCodeAgent to automatically translate and validate the entire repository. ReCodeAgent is the first technique to achieve high translation success rates across many PLs. We compare the effectiveness of ReCodeAgent with four alternative neuro-symbolic and agentic approaches to translate 118 real-world projects, with 1,975 LoC and 43 translation units for each project, on average. The projects cover 6 PLs and 4 PL pairs. Our results demonstrate that ReCodeAgent consistently outperforms prior techniques on translation correctness, improving test pass rate by 60.8% on ground-truth tests, with an average cost of $15.3. We also perform process-centric analysis of ReCodeAgent trajectories to confirm its procedural efficiency. Finally, we investigate how the design choices (a multi-agent vs. single-agent architecture) influence ReCodeAgent performance: on average, the test pass rate drops by 40.4%, and trajectories become 28% longer and persistently inefficient. Article Search Article: ase26main-p1257-p doi:10.1145/3832783.3837486
	Kuang, Hongyu	ASE '26: "We Must Have Missed This Comment: ..." We Must Have Missed This Comment: Detecting and Repairing Stale Function References in Linux Kernel Comments Kexin Sun, Yunbo Lyu, Xutong Ma, Hongyu Kuang, Ratnadira Widyasari, He Zhang, Xiaoxing Ma, Julia Lawall, and David Lo (Nanjing University, China; Singapore Management University, Singapore; Inria, France) As the Linux kernel evolves, code comments may become outdated, as the functions they reference can be refactored or removed independently without corresponding updates to the comments. Such stale function references can mislead maintainers and thus hinder code comprehension. Prior work on detecting code-comment inconsistency mainly focused on addressing semantic misalignment between Javadoc comments and their directly annotated functions, making them inapplicable to this type of externally induced staleness in the Linux kernel. Therefore, we propose ReCite, a three-stage approach to identify and repair such stale references: (1) detecting unresolved function-form symbols—symbols in comments that appear to reference functions but for which no matching function can be found in the current codebase, (2) tracing the evolution history of each unresolved symbol through the Git history, and (3) generating LLM-based repair suggestions grounded in the evolution history and current code context. On Linux kernel v6.18-rc1, ReCite detects 869 stale references with generated repair suggestions. A manual evaluation on 200 sampled repairs shows that 178 (89.0%) provide useful repair guidance, with 85 (42.5%) directly applicable. Of our 75 submitted patches, 50 have been accepted. We also empirically study all unresolved function-form symbols. Article Search Article: ase26main-p908-p doi:10.1145/3832783.3837474
	Kulygin, Oleg	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Kumano, Tatsuo	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Kumar, Neetesh	ASE '26: "DAGGER: Dynamic Agentic Graph-Guided ..." DAGGER: Dynamic Agentic Graph-Guided Efficient Reasoner for Container Image Dependency Optimization Shikhar Vashistha and Neetesh Kumar (IIT Roorkee, India) Container image (CI) bloat degrades cloud deployment efficiency, as structural redundancy and obsolete package buildup over time result in complex dependency graphs that remain largely unaddressed by current CI optimization methods. Traditional visualization techniques rely on user expertise for manual optimization, whereas runtime methods require long execution traces to identify and retain only accessed dependencies. Conversely, static-analysis-based methods lack semantic visibility in dynamic loading or reflection contexts, leading to over- or under-approximations. To address these limitations, we propose Dynamic Agentic Graph-Guided Efficient Reasoner (DAGGER) that dynamically selects from an ensemble of optimization strategies based on CI structures and dependency patterns. DAGGER’s agentic AI module utilizes knowledge retrieval on the graph representation of CI dependencies to analyze and prevent the removal of critical dependencies, ensuring zero-loss operational functionality. DAGGER’s knowledge base is built using curated examples that its agentic AI module uses to generate optimized CI. Based on preliminary experiments on production CIs, DAGGER achieves an average size reduction of 35.7% with a 0.2% breakage rate, compared with state-of-the-art baselines. Article Search Artifacts Available Article: ase26main-p522-p doi:10.1145/3832783.3837446
	Kumar, Rahul	ASE '26: "Kani: A Model Checker for ..." Kani: A Model Checker for Rust Rémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech (Amazon Web Services, USA; Amazon Web Services, UK; Queen Mary University, UK; Brown University, USA; Datadog, USA; Massachusetts Institute of Technology, USA) Rust's ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust's Mid-level Intermediate Representation (MIR) into CBMC's bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign. Article Search Artifacts Available Article: ase26ind-p163-p doi:10.1145/3832783.3834499
	Kurin, Vitaly	ASE '26: "Certified Program Synthesis ..." Certified Program Synthesis with a Multi-modal Verifier Yueyang Feng, Dipesh Kafle, Vladimir Gladshtein, Vitaly Kurin, George Pîrlea, Qiyuan Zhao, Peter Müller, and Ilya Sergey (National University of Singapore, Singapore; Neapolis University Pafos, Cyprus; ETH Zurich, Switzerland) Certified program synthesis (a.k.a. vericoding) is the process of automatically generating a program, its formal specification, and a machine-checkable proof of program/specification alignment from a natural-language task description. Two key challenges make vericoding difficult. First, specifications synthesised from natural language descriptions are often either too weak to be meaningful or too strong to be implementable, yet existing approaches lack systematic means to detect such defects. Second, the program verifiers used to validate results are fragmented: each tool supports a particular reasoning mode—auto-active (e.g., Dafny, Verus) or interactive (e.g., Rocq, Lean)—with its own trade-off between automation and expressivity. This forces each synthesis methodology to target a single paradigm, limiting the tasks it can handle. We overcome both challenges by structuring the synthesis workflow in stages around a multi-modal verifier—a single tool that combines dynamic validation, automated proofs, and interactive proof scripting within one foundational framework. We realise this idea in LeetProof, a new agentic pipeline built on Velvet, a multi-modal program verifier built in the Lean theorem prover. Multi-modality enables LeetProof to validate generated specifications via randomised property-based testing before any code is synthesised, decompose the synthesis task into sub-problems guided by verification conditions, and delegate residual proof obligations to frontier AI provers specialised for Lean. We evaluate LeetProof on an extensive benchmark suite derived from prior work on certified synthesis. Our specification validation uncovers defects in existing reference benchmarks, and LeetProof's staged pipeline achieves a significantly higher rate of fully certified solutions than a single-mode baseline at the same fixed budget—consistently across two different frontier LLM backends. Article Search Artifacts Available Article: ase26main-p4427-p doi:10.1145/3832783.3837559
	Kurra, Dhruva Dixith	ASE '26: "DragonCrawl: A Generative, ..." DragonCrawl: A Generative, Intent-Based Framework for Scalable Mobile End-to-End Testing Sowjanya Puligadda, Mengdie Zhang, Ali Zamani, Dhruva Dixith Kurra, Eric Chen, and Juan Marcano (Uber Technologies, USA) As mobile applications grow in complexity, traditional End-to-End (E2E) testing frameworks struggle with UI volatility, maintenance overhead, and cross-platform scalability. This paper presents DragonCrawl, an AI-driven mobile testing system for continuous regression testing that has evolved from embedding-based similarity matching to generative intent-based reasoning using large language models. Unlike prior LLM-based testing research focused on exploratory testing and crash detection, DragonCrawl validates specific user flows on every code change, blocking commits that break critical functionality. By leveraging GPT-4o’s multimodal capabilities, DragonCrawl achieves 91.6% pass rate on iOS and 92.2% on Android across 1,013 automated tests running continuously in CI/CD pipelines. The system reduces test onboarding time from 96-120 hours to under 4 hours and has saved an estimated 27 developer years in test maintenance effort. We present the architectural evolution from V1 (semantic embedding matching) to V2 (generative intent-based reasoning), discuss implementation challenges including token explosion and memory constraints, and report operational experience from production deployment. The integration of multimodal vision for end-state detection and tool calling for backend state transitions enables comprehensive regression testing that bridges UI interactions with system state. Our results demonstrate that AI-driven testing can maintain stability while eliminating the brittleness of traditional automated tests, enabling continuous quality assurance at scale. Article Search Article: ase26ind-p2-p doi:10.1145/3832783.3834455
	Kurup, Mayur Premkumar	ASE '26: "Deployment Risk Assessment ..." Deployment Risk Assessment using Diff-Aware Features: A Case Study at Prime Video Mayur Premkumar Kurup, Hyunjae Suh, Swathi Vaidyanathan, Pranesh Vyas, Srinidhi Madabhushi, and Yegor Silyutin (Amazon.com, USA; University of California at Irvine, USA) At Amazon Prime Video, we face the critical operational challenge of managing code deployments during live events and rapid feature releases without causing service outages. Current change control approaches use blanket deployment freezes that block all changes regardless of risk, creating significant developer toil. While prior research has explored risky change predictors, these rely on developer-specific metadata or extensive historical data, raising privacy concerns and limiting applicability to new projects. We introduce a framework centered on diff-aware features-characteristics derived directly from code modifications. Our key contribution is the systematic identification of which quantitative metrics (code-level and change-level metrics) and qualitative indicators (coding style violations, change type classification) are necessary for risk prediction. We employ LLMs as multi-language feature extractors, demonstrating their effectiveness for code analysis beyond generation tasks and eliminating the need for language-specific tooling. We evaluated our framework on two datasets: Prime Video’s production environment and the public ApacheJIT dataset. Our best-performing model achieves an average recall of 0.83 and F1 score of 0.81 across both datasets for detecting risky code changes. Notably, ablation analysis reveals that change-level volume metrics (e.g., lines added/deleted) are noisy predictors, while structural code complexity provides a substantially stronger risk signal. These results demonstrate that thoughtful feature curation enables effective change risk assessment across different programming languages and organizational contexts while avoiding privacy concerns. Article Search Article: ase26ind-p261-p doi:10.1145/3832783.3834517
	Kwak, Jiwon	ASE '26: "ThreatCraft: Automated Attack ..." ThreatCraft: Automated Attack Scenario Generation via Hybrid Rule-Based and LLM-Driven Reasoning Dohee Kang, Jiwon Kwak, Geunwoo Baek, and Seungjoo Kim (Korea University, Republic of Korea) Recently, the growing complexity of modern Information Technology (IT) systems has made it increasingly difficult to identify realistic attack scenarios. Although various automated approaches have been proposed, challenges such as dependence on expert knowledge and hallucinations in LLM-based methods remain unresolved. We develop ThreatCraft, an attack-scenario generation tool that combines a rule-based engine with Large Language Models (LLMs). ThreatCraft constructs system-level attack paths using a Unified Kill Chain (UKC) and leverages them to guide LLMs in generating detailed attack scenarios. Experimental results across automotive, Industrial Control Systems (ICS), and enterprise domains show that ThreatCraft achieves an average F1-score of 0.984 and a semantic similarity score of 0.893, improving attack-path reconstruction accuracy and semantic similarity by up to 8.3% and 10.7%, respectively, compared with other tools. These results demonstrate that ThreatCraft can consistently generate realistic and structurally coherent attack scenarios across various domains. GitHub:https://github.com/HackProof/2026_ASE_ThreatCraft.git Demo:https://youtu.be/nrIHEKDLp2E Article Search Artifacts Available Article: ase26tool-p39-p doi:10.1145/3832783.3834608
	Lam, Wing	ASE '26: "TDRepro: A Neurosymbolic Approach ..." TDRepro: A Neurosymbolic Approach to Reproducing Timing-Dependent Flaky Test Failures Shanto Rahman, Talank Baral, August Shi, and Wing Lam (University of Texas at Austin, USA; George Mason University, USA) Tests that nondeterministically pass or fail on the same version of code are known as flaky tests, and their failures substantially hinder regression testing and debugging. Reproducing failures from timing-dependent (TD) flaky tests is particularly challenging because these failures depend on rare thread interleavings that may not occur even after running the test many times. Prior techniques reproduce such failures by searching for locations at which to inject delays during execution, but this search process can be expensive. We present TDRepro, an automated approach that leverages large-language models (LLMs) and program analysis to efficiently reproduce TD test failures. TDRepro first identifies relevant methods by collecting executed methods during the test run and identifying those that execute concurrently with other methods. It then ranks these methods by computing the embedding similarity between each method’s code and the observed failure log. Finally, TDRepro uses an LLM to identify candidate locations for delay injection within the top-ranked methods. TDRepro validates these candidates by injecting delays and rerunning the test, iteratively refining the candidate locations based on unsuccessful attempts until the target failure is reproduced or the maximum number of iterations is reached. We evaluate TDRepro on 82 TD tests across 25 modules from open-source Java Maven projects. TDRepro reproduces 100% more failures than prior state-of-the-art technique, FlakeRake, and achieves more reliable reproduction, with 55 tests reaching a failure reproduction rate of >99%, compared with 30 tests for FlakeRake. Repeatedly reproducing failures with TDRepro requires 1482.11× and 36.5× less time and incurs 1104.2× and 26.9× lower cost than repeatedly rerunning tests and using FlakeRake, respectively. Article Search Article: ase26main-p1337-p doi:10.1145/3832783.3834384
	Lambertenghi, Stefano Carlo	ASE '26: "Cam2Sim: Neural Scenario Reconstruction ..." Cam2Sim: Neural Scenario Reconstruction for Closed-Loop Autonomous Driving Simulation Davide Jannussi, Stefano Carlo Lambertenghi, Constantin Carste, and Andrea Stocco (Politecnico di Torino, Italy; TU Munich, Germany; fortiss, Germany) Simulation-based testing enables safe and repeatable evaluation of autonomous driving systems, but its effectiveness is limited by the gap between synthetic simulator outputs and real-world camera observations. We present Cam2Sim, a tool that transforms real-world driving recordings into executable CARLA scenarios. Starting from camera images and poses, Cam2Sim reconstructs road geometry, ego trajectories, parked vehicles, and simulation assets, and augments the environment with Gaussian Splatting to render camera observations resembling the original recording. The framework supports ROS-based data extraction, parked-vehicle detection, OpenStreetMap-based map generation, CARLA scenario construction, Gaussian Splatting training, trajectory replay, and closed-loop testing. We validate Cam2Sim on a real urban-driving scenario with an end-to-end driving model, evaluating reconstruction quality, image-generation quality, and closed-loop behavior against a simulation-only baseline and the real-world reference. Results show that Gaussian-Splatting-based rendering reduces the visual gap with respect to simulator rendering and improves behavioral similarity to the real-world reference. The artifact is publicly available at https://github.com/ast-fortiss-tum/cam2sim, and a screencast is available at https://youtu.be/KmZ74l1__lI. Article Search Article: ase26tool-p120-p doi:10.1145/3832783.3834639
	Lamothe, Maxime	ASE '26: "Discovering Performance Archetypes: ..." Discovering Performance Archetypes: Critical-Path-Aware Pattern Analysis and Regression Detection Kaveh Shahedi, Heng Li, Maxime Lamothe, and Foutse Khomh (Polytechnique Montréal, Canada) Software performance analysis and prediction requires integrating multiple signals, as code structure alone cannot capture runtime behavior shaped by execution frequency, resource contention, and I/O patterns. We present a critical-path-aware performance analysis methodology that automatically discovers recurring performance patterns by synthesizing static code features, dynamic execution traces, and kernel-level resource data. In a preliminary study across six real-world C/C++ applications (SQLite, OpenSSL, Zstandard, FFmpeg, cURL, and jq), we first empirically confirm that static complexity metrics explain only 10.4% of the variance (ρ2) in critical path execution time, quantifying a gap that, while theoretically expected, had not been measured systematically across applications. Motivated by this finding, we analyze nearly 80,000 critical execution paths and address two research questions. First, we discover 13 distinct performance archetypes: recurring behavioral patterns that appear consistently across different applications, independent of their domain or implementation. Five of these patterns are near-universal and appear in at least five of the six applications studied. Notably, three of these archetypes are present in all six applications, and together, these common patterns account for 56.4% of all observed paths. Each archetype maps to specific resource profiles and optimization strategies that transfer across domains. Second, we leverage these archetypes within a multi-signal regression detection framework that triangulates path structure, resource consumption, and archetype deviations, achieving an F1-score of 0.867 and a 60.4% improvement over resource-only methods. Article Search Article: ase26main-p2896-p doi:10.1145/3832783.3834426 ASE '26: "Baseliner: A Plugin-Oriented, ..." Baseliner: A Plugin-Oriented, Hardware-Agnostic GPU Benchmarking Library Côme Eyraud and Maxime Lamothe (Polytechnique Montréal, Canada) GPU benchmarking underpins performance claims across high-performance computing (HPC), yet the software infrastructure producing these measurements is rarely treated as a first-class research artifact. Existing tools fragment into benchmark suites where measurement logic is coupled to kernels, vendor profilers designed for diagnostic tracing rather than statistical benchmarking, and ecosystem-specific libraries that lack cross-hardware portability. We present Baseliner, a hardware-agnostic GPU benchmarking framework whose plugin-oriented architecture decouples workload definition from measurement orchestration. A formalized Workload Interface and a backend abstraction layer let workloads, timing backends, stopping criteria, and statistics engines be swapped independently of the core engine. An adapter mechanism further enables a single Workload definition to be executed by Baseliner, NVBench, or PrimBench, eliminating redundant implementations across toolchains. We validate the framework through blas-baseliner, a cross-vendor BLAS suite spanning cuBLAS and rocBLAS. Empirical evaluation on NVIDIA V100 and AMD MI210 hardware shows Baseliner reaches measurement parity with vendor libraries within the precision floor of GPU event timing while remaining competitive in wall-clock time. Video: https://youtu.be/LdKUEqewmQw Article Search Article: ase26tool-p156-p doi:10.1145/3832783.3834645
	Lan, Haoxuan	ASE '26: "Free Is More: Empowering Software ..." Free Is More: Empowering Software Agents via Issue-Free Trajectory Learning and Entropy-Aware RLVR Training Xin-Cheng Wen, Binbin Chen, Haoxuan Lan, Hang Yu, Peng Di, and Cuiyun Gao (Harbin Institute of Technology, Shenzhen, China; Ant Group, China; Zhejiang University, China; University of New South Wales, Australia) Large language models (LLMs) have transformed the software engineering landscape. Recently, numerous LLM-based agents have been developed to address real-world software issue fixing tasks. These agents are typically equipped with various coding tools, enabling them to autonomously generate action trajectories for end-to-end problem-solving. Despite their state-of-the-art performance, these agents still face two primary challenges: (1) Lack of sufficiently high-quality issue descriptions: Inconsistencies between issue descriptions and their corresponding solutions introduce noise and ambiguity that can mislead automated agents, restricting their ability to derive effective solutions. Furthermore, high-quality issue-PR pairs are difficult to acquire at scale, and the available datasets remain relatively limited in size. (2) Uncertainty introduced by bash tools prevents stable training and sufficient exploration: Bash tools serve as the primary interface for code execution and file manipulation in SWE agents, making them integral to virtually all agent operations. However, bash tools introduce substantial uncertainty into the agent's decision-making process. In reinforcement learning with verifiable rewards (RLVR), the fixed probability ratio clipping mechanism exhibits limited adaptability to such varying uncertainty states. Specifically, when bash tool invocations trigger high-entropy states, excessively restrictive clipping constraints impede both exploration and stable learning, hindering the training efficiency. To address these challenges, we propose SWE-Fuse, an issue-description-aware training framework that fuses issue-description-guided and issue-free samples for training SWE agents. It consists of two key modules: (1) An issue-free-driven trajectory learning module, which comprises: a multi-step trajectory construction component for generating high-quality multi-turn reasoning-action trajectories, a trajectory data filtering process for ensuring data quality, and issue-free-driven supervised fine-tuning to mitigate potentially misleading issue descriptions while enabling the model to learn step-by-step debugging processes; and (2) An entropy-aware RLVR training module, which adaptively adjusts training dynamics through entropy-driven clipping. It applies relaxed clipping under high entropy to encourage exploration, and stricter clipping under low entropy to ensure training stability. We evaluate SWE-Fuse on the widely studied SWE-bench Verified benchmark shows to demonstrate its effectiveness in solving real-world software problems. Specifically, SWE-Fuse outperforms the best 8B and 32B baselines by 41.9% and 59.3% in solve rate, respectively. Furthermore, integrating SWE-Fuse with test-time scaling (TTS) enables further performance improvements, achieving solve rates of 49.8% and 65.2% under TTS@8 for the 8B and 32B models, respectively. Article Search Article: ase26main-p3466-p doi:10.1145/3832783.3834438
	LaToza, Thomas D.	ASE '26: "DesignFix: Context-Augmented ..." DesignFix: Context-Augmented Repair of Design Rule Violations Mainul Hossain and Thomas D. LaToza (George Mason University, USA) Design rules make project-specific design decisions explicit and checkable, helping teams preserve architectural intent as systems evolve. Although automated checkers can detect violations, developers must still interpret the rule, locate the code that must change, and construct a repair consistent with project conventions. We present DesignFix, an IDE-integrated approach that turns checker-reported violations into project-grounded, reviewable repairs. DesignFix augments each violation with the rule description, a rule-satisfying example from the same project, and focused structural context, while a two-step LLM pipeline separates repair reasoning from structured edit extraction. We report three complementary evaluations. A systematic study of seven prompt configurations across 9,450 repair trials found that the full workflow achieved up to 90% repair success, 89% explanation correctness, and 90% preservation of unrelated code: 26 percentage points above a baseline prompt. We conducted a controlled experiment with 14 developers. Compared to a control condition with browser-based LLMs, developers completed repairs 36% faster with DesignFix, increased correct repairs from 43% to 93%, and reported significantly lower workload on five of six NASA-TLX dimensions. Finally, we ran the autonomous in-IDE agent Cline on six repair task types drawn from our user study. Cline produced a correct repair for only half of them, while averaging 12.1× DesignFix’s token use and substantially higher API cost per run. Together, these results suggest that effective design-rule repair depends on grounding the LLM in checker-derived, project-specific design intent and on keeping repairs under developer review, needs that repository autonomy alone does not meet. Article Search Article: ase26main-p184-p doi:10.1145/3832783.3837422
	Lawall, Julia	ASE '26: "We Must Have Missed This Comment: ..." We Must Have Missed This Comment: Detecting and Repairing Stale Function References in Linux Kernel Comments Kexin Sun, Yunbo Lyu, Xutong Ma, Hongyu Kuang, Ratnadira Widyasari, He Zhang, Xiaoxing Ma, Julia Lawall, and David Lo (Nanjing University, China; Singapore Management University, Singapore; Inria, France) As the Linux kernel evolves, code comments may become outdated, as the functions they reference can be refactored or removed independently without corresponding updates to the comments. Such stale function references can mislead maintainers and thus hinder code comprehension. Prior work on detecting code-comment inconsistency mainly focused on addressing semantic misalignment between Javadoc comments and their directly annotated functions, making them inapplicable to this type of externally induced staleness in the Linux kernel. Therefore, we propose ReCite, a three-stage approach to identify and repair such stale references: (1) detecting unresolved function-form symbols—symbols in comments that appear to reference functions but for which no matching function can be found in the current codebase, (2) tracing the evolution history of each unresolved symbol through the Git history, and (3) generating LLM-based repair suggestions grounded in the evolution history and current code context. On Linux kernel v6.18-rc1, ReCite detects 869 stale references with generated repair suggestions. A manual evaluation on 200 sampled repairs shows that 178 (89.0%) provide useful repair guidance, with 85 (42.5%) directly applicable. Of our 75 submitted patches, 50 have been accepted. We also empirically study all unresolved function-form symbols. Article Search Article: ase26main-p908-p doi:10.1145/3832783.3837474 ASE '26: "Generating Loop Invariants ..." Generating Loop Invariants for Deductive Verification using Iterator Profiles Keisuke Nishimura, Jean-Pierre Lozi, and Julia Lawall (Inria, France) Recent advances in deductive verification have gradually made it practical to verify the functional correctness of real-world software. However, creating loop invariants still requires manual effort. We propose to reduce this burden by automatically generating invariants. In the context of generating invariants for real-world software, the key requirements are to support diverse index iteration patterns and to capture precise information about loop behaviors. In this paper, we introduce the idea of an iterator profile: a loop-invariant template for an iteration pattern. Once a user writes a profile, it can be reused for any iterator-based loop that shares the same iteration pattern. We present LoopAnnotator, a tool that generates loop invariants for iterator-based loops by combining an iterator profile with the result of automatic program analysis of the loop body. LoopAnnotator successfully generates invariants for more than 70 Article Search Article: ase26main-p2432-p doi:10.1145/3832783.3837530
	Le, Chinh T.	ASE '26: "UIBenchKit: A Unified Toolkit ..." UIBenchKit: A Unified Toolkit for Design-to-Code Model Evaluation Chinh T. Le, Trevor Yee Siang Ong, Jingyu Xiao, Yuxuan Wan, and Yintong Huo (Singapore Management University, Singapore; Chinese University of Hong Kong, Hong Kong) Recent years have seen substantial progress in automated design-to-code generation, with many methods proposed for generating HTML and CSS from webpage screenshots. However, the absence of a standardized evaluation platform makes it difficult to compare these methods fairly, limiting both practical adoption and systematic research progress. To bridge this gap, we introduce UIBenchKit, an open-source, integrated toolkit designed to unify the evaluation of design-to-code tasks. UIBenchKit abstracts the complexities of environment setup, model inference, and code rendering, offering researchers a plug-and-play architecture to compare various methods under consistent settings. In addition, it offers an analytical interface for comparison across multiple metrics. Using UIBenchKit, we conduct a benchmarking study of existing tools and derive several findings that highlight directions for future improvement. By providing a streamlined environment for both experimentation and evaluation, UIBenchKit aims to accelerate future benchmarking and innovations in web engineering. The evaluation platform and toolkit are available at the project pages https://www.uibenchkit.com/ and https://github.com/chinh02/UIBenchKit. A video of UIBenchKit is available at https://youtu.be/UyeYyASovuU. Article Search Artifacts Available Article: ase26tool-p53-p doi:10.1145/3832783.3834612
	Le, Thi-Hong-Cuc	ASE '26: "GraphLedger: Repository-Level ..." GraphLedger: Repository-Level Vulnerability Detection via Graph-Based Compression and Assumption Validation Thi-Hong-Cuc Le, Hoang-Quoc-Bao Hua, and Xuan-Bach Le (Ho Chi Minh City University of Technology, Vietnam) Repository-level vulnerability detection requires reasoning across files, procedures, and long-range dependency chains. This is difficult for both dominant families of methods: static analysis often over-approximates and produces many false positives, while LLM-based approaches struggle with large repository context and may generate plausible but unsupported claims. We present GraphLedger, a framework that combines Adaptive Assumption-Corroborating Compression (AACC) with an Assumption Ledger for structured hypothesis verification. AACC reduces repository context while preserving vulnerability-relevant dependency structure. The LLM then proposes explicit vulnerability hypotheses over the compressed context, and the ledger validates their assumptions against repository evidence, producing Verified, Rejected, or Inconclusive outcomes. This makes repository-scale reasoning more auditable and less prone to unsupported conclusions. GraphLedger targets taint-style, source–sink vulnerability hypotheses with bounded inter-procedural evidence, rather than arbitrary vulnerability classes. We conduct a controlled cross-method evaluation on CWE-Bench-Java and a complementary within-system component analysis on CVEfixes. On CWE-Bench-Java, AACC achieves 0.71 token reduction while retaining 0.90 of dependency edges and 0.88 of taint paths. On a documented, repository-disjoint 100-repository CWE-Bench-Java evaluation partition, GraphLedger achieves 0.77 precision, 0.76 recall, and 0.76 F1, and reduces false discovery rate from 0.41 to 0.23 relative to VulAgent under a controlled shared-backend evaluation. These results show that combining structure-aware compression with assumption validation improves the reliability and transparency of repository-level vulnerability detection. Article Search Artifacts Available Article: ase26main-p2655-p doi:10.1145/3832783.3834420
	Le, Xuan-Bach	ASE '26: "GraphLedger: Repository-Level ..." GraphLedger: Repository-Level Vulnerability Detection via Graph-Based Compression and Assumption Validation Thi-Hong-Cuc Le, Hoang-Quoc-Bao Hua, and Xuan-Bach Le (Ho Chi Minh City University of Technology, Vietnam) Repository-level vulnerability detection requires reasoning across files, procedures, and long-range dependency chains. This is difficult for both dominant families of methods: static analysis often over-approximates and produces many false positives, while LLM-based approaches struggle with large repository context and may generate plausible but unsupported claims. We present GraphLedger, a framework that combines Adaptive Assumption-Corroborating Compression (AACC) with an Assumption Ledger for structured hypothesis verification. AACC reduces repository context while preserving vulnerability-relevant dependency structure. The LLM then proposes explicit vulnerability hypotheses over the compressed context, and the ledger validates their assumptions against repository evidence, producing Verified, Rejected, or Inconclusive outcomes. This makes repository-scale reasoning more auditable and less prone to unsupported conclusions. GraphLedger targets taint-style, source–sink vulnerability hypotheses with bounded inter-procedural evidence, rather than arbitrary vulnerability classes. We conduct a controlled cross-method evaluation on CWE-Bench-Java and a complementary within-system component analysis on CVEfixes. On CWE-Bench-Java, AACC achieves 0.71 token reduction while retaining 0.90 of dependency edges and 0.88 of taint paths. On a documented, repository-disjoint 100-repository CWE-Bench-Java evaluation partition, GraphLedger achieves 0.77 precision, 0.76 recall, and 0.76 F1, and reduces false discovery rate from 0.41 to 0.23 relative to VulAgent under a controlled shared-backend evaluation. These results show that combining structure-aware compression with assumption validation improves the reliability and transparency of repository-level vulnerability detection. Article Search Artifacts Available Article: ase26main-p2655-p doi:10.1145/3832783.3834420 ASE '26: "Distributional Program Analysis: ..." Distributional Program Analysis: Treating Large Language Models as Program Samplers Phat T. Tran-Truong and Xuan-Bach Le (Ho Chi Minh City University of Technology, Vietnam) A specification under-determines a program: prompted with one, a large language model (LLM) induces a distribution over candidate programs that respond to it in different ways. Pipelines that generate one program and analyze it discard the key artifact of that distribution: variation across samples. We propose distributional program analysis (DPA): analyze many LLM samples for the same task and aggregate analyzer outputs as cross-sample evidence about candidate program properties. The central statistic is an invariant’s survival rate, the fraction of samples in which the analyzer infers it. Under stated sampling and analyzer assumptions, high-survival invariants mark properties on which independently sampled programs agree; fragile ones may indicate decoding noise, underspecification, or analyzer blind spots. Agreement is not correctness, and we are explicit about when the two come apart. We define survival, release a prototype, and report a HumanEval+ pilot in which high-survival invariants match reference-solution invariants in roughly four of five cases; filtering by survival also improves pass@1 at the same 20-sample budget. Variation is an analysis signal, not noise to hide. Article Search Article: ase26nier-p81-p doi:10.1145/3832783.3834555
	Leach, Matthew	ASE '26: "DT-Drive: A Tool for Deterministic ..." DT-Drive: A Tool for Deterministic Replay-Based Testing and Debugging of Autonomous Driving Systems Sanjeetha Pennada, Matthew Leach, Olek Osikowicz, and Donghwan Shin (University of Sheffield, UK) While simulation is essential for testing autonomous driving systems (ADS), high-fidelity simulators like CARLA often exhibit non-determinism, leading to flaky simulation results. We present DT-Drive, a record-modify-replay framework that ensures deterministic ADS evaluation by decoupling the ego vehicle from the recorded driving scenario. This approach enables “ego-injection” for fair multi-ADS comparisons and “counterfactual replay” via environmental modifications (e.g., weather and traffic), facilitating targeted testing and debugging. Validated on 128 CARLA benchmark scenarios, DT-Drive achieved 100% deterministic evaluation results, effectively eliminating simulator-induced flakiness. We also demonstrate its utility for testing and debugging by conducting a controlled comparison of the TransFuser and TransFuser++ agents under identical and modified environmental conditions. DT-Drive and the sample data are available at https://github.com/SanjeethaPennada/DT-Drive []. The tool demo video is available at https://youtu.be/HB1DIZSF5E0. Article Search Article: ase26tool-p26-p doi:10.1145/3832783.3834601
	Leasure, Jason	ASE '26: "Vulnerability Tracking using ..." Vulnerability Tracking using Normalized Scope+Offset Julian Thome, Hua Yan, Lucas Charles, Craig Smith, and Jason Leasure (GitLab, Luxembourg; GitLab, Australia; GitLab, USA; Independent Researcher, USA) In heterogeneous Static Application Security Testing (SAST) setups, multiple tools continuously monitor code changes to detect security vulnerabilities. Vulnerability Tracking deduplicates and tracks these vulnerabilities throughout a project’s lifetime, reducing futile auditing caused by code volatility and double reporting. In prior work, we introduced the Scope+Offset method which identifies vulnerabilities based on a scope and offset fingerprint, reducing futile auditing by approximately 30%. However, the offset component is sensitive to non-functional code changes such as added comments or whitespace, which can cause spurious duplication. In this paper, we present Scope+OffsetN, an improved method that normalizes the offset computation by excluding non-functional source code lines. We detail the normalization algorithm and demonstrate its correctness on worked examples; on a targeted public benchmark it reduces unique fingerprints by 43%. Scope+OffsetN has been deployed in GitLab since May 2025, providing tracking to thousands of daily security scans. Article Search Article: ase26ind-p239-p doi:10.1145/3832783.3834513
	Lee, Ahcheong	ASE '26: "Top-Down Multi-agent LLM System ..." Top-Down Multi-agent LLM System with Runtime Data for MISRA C Violation Detection Ahcheong Lee, Yeongbin Kang, Sechang Jang, Heechan Yang, and Moonzoo Kim (KAIST, Republic of Korea; VplusLab, Republic of Korea) Ensuring MISRA C compliance is crucial for the safety and reliability of embedded software. For this purpose, industries utilize static rule checkers but suffer high ratios of both missed violations and false alarms. Although companies also try to utilize LLMs for this purpose, existing LLM-based approaches have suboptimal performance for large, complex programs. We introduce LASIK, the world-first top-down multi-agent LLM compliance-checking framework for MISRA C, which combines on-demand repository-level context provision with runtime execution evidence. This design enables LASIK to report more true violations than state-of-the-art static analyzers and a naive vanilla LLM approach, while maintaining a low false positive ratio. Our evaluation on 10 embedded projects shows that LASIK detects 1.3-2.7 times more true violations than the static analyzers and the vanilla LLM approach, while achieving the lowest false alarm ratio (26.7%). Furthermore, on an industrial software developed by VPlusLab Inc., LASIK detects up to 2.1 times more true violations with a low false alarm rate (i.e., 10.8%) than the baseline techniques. Article Search Article: ase26ind-p152-p doi:10.1145/3832783.3834497
	Lee, Heejo	ASE '26: "GANADI: Uncovering C/C++ OSS ..." GANADI: Uncovering C/C++ OSS Reuse Genealogies via Pivotal Function-Based Clustering to Enhance Supply Chain Security Dongyeon Kim, Seunghoon Woo, and Heejo Lee (Korea University, Republic of Korea) We present GANADI, a systematic approach for identifying C/C++ OSS reuse genealogies to enhance software supply chain security. Understanding OSS reuse genealogy is crucial for improving SBOM completeness and prioritizing security remediation across supply chains. Although existing approaches can identify reused components and vulnerabilities within a project, they fail to trace OSS reuse paths through intermediate projects, limiting their effectiveness in securing supply chain ecosystems. To address this limitation, GANADI constructs reuse genealogies by clustering downstream projects based on shared characteristics of origin-derived code (called pivotal functions), and then inferring reuse direction among the projects within each cluster. When applied to 20 widely reused OSS projects with over 1,500 propagation paths, GANADI achieved 84.85% precision and 95.76% recall in identifying reuse genealogies, outperforming existing approaches that achieved at most 23.21% recall. Leveraging OSS reuse genealogy for vulnerability detection, we identified 48 unpatched vulnerabilities in real-world popular C/C++ projects. Among them, 23 were patched following our responsible disclosure (including one CVE ID assigned), demonstrating the practical impact of genealogy-based vulnerability management. Article Search Artifacts Available Article: ase26main-p1485-p doi:10.1145/3832783.3837498
	Lee, Myungho	ASE '26: "EvoLLM: High-Coverage, Readable, ..." EvoLLM: High-Coverage, Readable, and Token-Efficient Unit Test Generation for Industrial Java Codebases Seokhyeon Moon, Myungho Lee, Jihun Kim, Yoon-Chan Jhi, Jihoon Cho, and Hakjoo Oh (Samsung SDS, Republic of Korea; Korea University, Republic of Korea) Adopting automated Java unit-test generation in industrial settings requires high coverage, readability, token efficiency, and modern-Java deployability. No existing technique meets all four: search-based test generators struggle with readability and modern-Java deployability, LLM-centric generators consume tens of millions of tokens, and prior LLM-based test refactoring methods drop baseline coverage by 8–21 percentage points (pp) in our controlled setups. We report on EvoLLM, a hybrid Java unit-test generator we built and deployed to address all four requirements. EvoLLM combines EvoSuiteng—a failure-analysis-driven hardening of EvoSuite that resolves deployability issues and strengthens baseline coverage—with cluster-wise LLM-based refactoring that groups tests by coverage goals and rewrites each cluster in a single LLM call grounded in compact program-under-test context. Across six open-source and three industrial projects, EvoLLM outperforms six state-of-the-art baselines, improving line coverage by 8.2–20.7 pp, branch coverage by 6.2–19.4 pp, and mutation score by 6.8–24.5 pp, while reducing LLM token usage by 47.3%–93.0%. In addition, the test generation stage of EvoLLM demonstrates robust deployability across target projects built with JDKs 8, 11, and 17, while achieving strong effectiveness on a Spring-core release requiring JDK 17. Finally, a 14-participant developer survey further suggests that EvoLLM-generated tests ranked higher in readability than those from prior tools and developer-written tests. Article Search Article: ase26ind-p335-p doi:10.1145/3832783.3834525
	Lee, Seongmin	ASE '26: "Accurate and Low-Cost Residual ..." Accurate and Low-Cost Residual Risk Assessment via Sampled Profiling and Structure-Aware Coverage Amplification Seongmin Lee, Işıl Özgü, Marcel Böhme, and Miryung Kim (University of California at Los Angeles, USA; MPI-SP, Germany) Estimating the residual risk of undiscovered bugs—and thus when to stop fuzzing—is critical for determining testing adequacy. Traditionally, this assessment relies on coverage instrumentation, which records complete coverage of every execution but imposes a 60-70% performance slowdown, reducing fuzzing throughput and delaying bug discovery. This overhead raises a fundamental question: can partial observation provide high-fidelity confidence at a fraction of the coverage instrumentation cost? We propose a risk assessment method in the context of black-box fuzzing that leverages hardware-enabled performance profiling—replacing coverage instrumentation with instruction pointer (IP) sampling—as the core mechanism for low-overhead observation. To recover the accuracy inevitably lost to the sparse nature of sampling, we employ must-execute analysis, a static control-flow analysis that identifies all statements and basic blocks that must have executed to reach, or must execute after, an observed sample, effectively reconstructing missing execution paths from partial observations. Despite the partial coverage inherent to profiler-based sampling, our risk estimation method achieves 4.27× higher throughput than complete-coverage instrumentation, enabling fuzzing campaigns to reach stopping thresholds 2× faster while maintaining high accuracy (1.73 average relative error compared to the ground truth). Ultimately, this efficiency translates into superior bug discovery, triggering more bugs with speedups of up to 10× within the same time budget. Article Search Article: ase26main-p2006-p doi:10.1145/3832783.3837519
	Lee, Yeonjoon	ASE '26: "CLEAR: Causal Context-Based ..." CLEAR: Causal Context-Based Agentic Reasoning for Vulnerability Detection Sungju Yun, Sijune Hwang, Yeonjoon Lee, Kyungtae Kang, and Sungbin Park (Hanyang University, Republic of Korea) Detecting source code vulnerabilities is increasingly difficult as modern security flaws are rooted in complex causal dependencies between execution flows, control conditions, and program states. Despite recent advances in Large Language Models (LLMs) and multi-agent frameworks, existing approaches primarily address superficial similarities between benign and vulnerable functions while failing to capture the complex causal dependencies inherent in security flaws. To address these limitations, we propose Causal Context-based Agentic Reasoning (CLEAR), a novel multi-agent vulnerability detection framework integrated with a causal knowledge graph. CLEAR systematically constructs a Vulnerability Causal Knowledge Graph (VCKG) that models the causal chains between entrypoints, preconditions, root causes, and fix intents across vulnerability instances. Leveraging this structured knowledge, four specialized agents including the Collector, Claim, Critic, and Judge collaboratively verify vulnerability hypotheses through retrieved causal contexts. Experimental results on C/C++ and Java vulnerability benchmarks demonstrate that CLEAR improves Pair-Correct (P-C) performance by 130.7% and 71.56% over state-of-the-art approaches, respectively, demonstrating the effectiveness of causal knowledge graph–guided reasoning for automated vulnerability detection. Article Search Article: ase26main-p2153-p doi:10.1145/3832783.3837523
	Lefever, Jason Titus	ASE '26: "Why Is This on My Bill? Documentation-Grounded ..." Why Is This on My Bill? Documentation-Grounded Rule Learning for Itemized Bill Explanation John Konstantinides, Jason Titus Lefever, Muhammed Numair Mansur, Martin Schaef, and Willem Visser (Amazon Web Services, USA; Drexel University, USA; Amazon Web Services, Germany) Complex itemized bills from services such as cloud computing, healthcare, or telecommunications can be difficult to understand because the pricing terms that determine what a customer pays are straightforward, but the eligibility rules that determine whether a given line item, a single charge for a product and quantity, qualifies for a given price are scattered across user guides, service terms, and fine print. No single document describes them all, and without them, it is difficult to explain why a specific charge appears on a bill. We present a neuro-symbolic tool that learns these eligibility rules automatically from billing data and documentation. Pricing terms are evaluated against line items to produce labelled data indicating whether each pricing term was eligible for a given line item. An LLM agent then uses this labelled data, a knowledge base of public documentation, and a small set of rule-evaluation tools to generate rules that are accurate: no rule incorrectly labels a line item as ineligible for a pricing term, and explainable: every rule is backed by a passage from the knowledge base. We showcase the tool on the AWS billing system, evaluating millions of line items across hundreds of internal accounts. The tool learns a small set of rules that, together with the pricing terms, explain the majority of observed discrepancies, and we measure documentation coverage, rule stability across sample sizes, and the impact of ML pre-seeding on discovery cost. Article Search Article: ase26ind-p112-p doi:10.1145/3832783.3834490
	Leitner, Philipp	ASE '26: "Same Scrutiny, More Time: ..." Same Scrutiny, More Time: Eye Tracking Insights into Reviewing LLM-Labelled Code Ranim Khojah, Francisco Gomes de Oliveira Neto, Mazen Mohamad, Julian Frattini, and Philipp Leitner (Chalmers University of Technology, Sweden; University of Gothenburg, Sweden; RISE Research Institutes of Sweden, Sweden) Modern software development increasingly involves the use of large language models (LLMs) to generate code. Despite their rapid advancement, LLMs remain prone to errors and hallucinations, emphasizing the importance of careful code inspection. However, in practice, developers' trust in LLM-generated code and their willingness to review it thoroughly may not align with these recommendations, which is a gap that remains largely unexplored. In this study, we conduct a Wizard-of-Oz experiment to examine how software engineers behave when code is explicitly labelled as LLM-generated during a code review task. We collect both behavioral data and participant feedback through eye-tracking and exit interviews. Combining Bayesian data analysis with qualitative analysis, we found that while the thoroughness of code review did not change for participants, they spent more time fixating on LLM-labelled code, indicating that the label itself influences attention. Practitioners also adapted their review strategy for LLM-labelled code by assessing the code based on specific criteria (e.g., logical correctness), or using the prompt to guide their review. These findings inform LLM-based tool design on labelling while incorporating the prompt as a software artifact. Our study reveals a gap between reviewers' intentions and actual reviewing behaviour, highlighting the need for software companies to revisit their AI policies (particularly regarding LLM-assisted development) to better support developers in reviewing LLM-generated code. Article Search Artifacts Available Article: ase26main-p2693-p doi:10.1145/3832783.3834423
	Leng, Jianquan	ASE '26: "DBRepro: Automated Database ..." DBRepro: Automated Database Synthesis via a Hybrid Constraint-Solving Approach for Reproducing Slow Queries Zhaoyang Zhang, Shuang Liu, Dengfeng Xu, Wei Lu, Jianquan Leng, Sheng Du, and Xiaoyong Du (Renmin University of China, China; China Electronics Technology Kingbase (Beijing) Technologies, China) Slow queries frequently cause severe performance bottlenecks in Database Management Systems (DBMSs). Due to the severe risk of exacerbating online resource contention, diagnosing their root causes online is usually infeasible; offline diagnosis has thus become the de facto approach. However, strict data privacy regulations prohibit accessing original user data. Therefore, synthesizing a proxy database, one that induces the query optimizer to generate identical physical execution plans as in production, from non-intrusive metadata, is critical for reproducing and diagnosing slow queries offline. Achieving high-fidelity reproduction demands satisfying both global statistical distributions and exact local cardinality constraints. Existing works fundamentally fail to achieve both simultaneously: data-driven approaches cannot enforce strict local cardinalities, whereas workload-aware approaches severely distort the overall data distribution, misleading the optimizer into divergent execution plans. To bridge this gap, we introduce DBRepro, an automated end-to-end database synthesis framework that synergistically integrates data-driven and workload-aware methodologies. DBRepro formulates database generation as a constrained distribution synthesis problem. It initializes a global data distribution from lightweight column statistics, extracts execution constraints from the target queries, and progressively adjusts the distribution to satisfy these constraints, ensuring the global distribution is maximally preserved while exact local cardinalities are strictly enforced. Extensive evaluations on the TPC-H and SSB benchmarks demonstrate that DBRepro outperforms state-of-the-art baselines across comprehensive fidelity metrics. Compared to the data-driven baseline, it reduces cardinality error by up to 20.3% while maintaining identical plan consistency. Against a workload-aware baseline, it reproduces 15% more consistent execution plans and lowers the latency proportion error by 21.5%. Furthermore, we validate its industrial practicality on a nearly 1 TB real-world dataset from a specific industrial sector, managed by KingbaseES, successfully reproducing the execution performance of complex slow queries with high fidelity. Article Search Article: ase26ind-p50-p doi:10.1145/3832783.3834463
	Leng, Jingwen	ASE '26: "AlphaCu: A Transformation-Driven ..." AlphaCu: A Transformation-Driven Synthesis Framework for LLM-Based GPU Kernel Generation Yangjie Zhou, Xing Ma, Zihan Liu, Qing Wang, Weihao Cui, Wu Sun, Hanjing Wang, Binhang Qi, Jingwen Leng, Yun Lin, Minyi Guo, and Jin Song Dong (National University of Singapore, Singapore; Shanghai Jiao Tong University, China; Shanghai Qi Zhi Institute, China; Nanjing University, China; Harvard University, USA) Large language models show promise for code generation, yet their effectiveness in producing high-performance GPU kernels remains insufficiently understood. Recent agentic workflows improve over direct prompting through specialized generation roles and execution feedback, but our characterization of a representative workflow reveals failures in optimization-strategy selection, hardware-specific instruction realization, and shape-dependent parameter selection. We present AlphaCu, a transformation-driven synthesis framework for LLM-based GPU kernel generation. AlphaCu treats kernel generation as structured synthesis over explicit optimization decisions rather than end-to-end code emission. Specifically, AlphaCu represents these decisions as scoped transformation passes maintained across agent-coordinated synthesis stages, enabling compatibility checking and failure attribution. AlphaCu binds selected hardware-sensitive operations to pre-validated microkernels and uses target-device measurements to revise transformation choices and tune runtime configurations. We evaluate AlphaCu on 104 test cases covering single and fused operators across four GPU architectures: NVIDIA H100, A100, V100, and AMD MI210. Under comparable generation budgets, AlphaCu achieves 100% functional correctness on our benchmark suite and delivers an average speedup of 5.64× over prior LLM workflows, while remaining competitive with vendor libraries and tensor compilers. Article Search Article: ase26main-p287-p doi:10.1145/3832783.3837433
	Lévai, Zalán	ASE '26: "Marv: An Interactive Tool ..." Marv: An Interactive Tool for Visualising and Reviewing the Results of Mutation Analysis Daniel Wells, Zalán Lévai, and Phil McMinn (University of Sheffield, UK) Mutation analysis is a useful technique for both practitioners and researchers in examining the strength of a test suite. If the change introduced by a mutant cannot be detected, it may represent a "blind spot" that the test suite failed to consider. However, there are currently no publicly available tools that developers and researchers can use to examine mutants produced by the plethora of existing mutation analysis tools that currently exist for a variety of programming languages (e.g., PIT for Java and Stryker for JavaScript). This is increasingly important given the fact that nowadays, systems are composed of code written in multiple languages. Instead, code editors and diff analysers are used, which are not well optimised for this particular activity. Where tools do exist, they are focused on specific mutation tools/programming languages only. In this paper, we introduce the Marv tool (Mutations Analysis, Review and Visualisation) to specifically address this problem. Marv provides in-code visualisations of mutants and information about them from multiple mutation analysis tools simultaneously. The tool allows users to complete formal textual reviews of each mutant and can export results from all of its supported frameworks in a standardised JSON format. Marv currently includes support for 13 different mutation analysis frameworks that collectively span 12 different programming languages. A screencast demonstrating Marv is available at https://youtu.be/qMjVgXmWrnk. Article Search Article: ase26tool-p144-p doi:10.1145/3832783.3834643
	Li, Chan	ASE '26: "AlarmClaw: Context-Enriched ..." AlarmClaw: Context-Enriched Alarm Management with Category-/Severity-Aware Incident Graphs Siyu Yu, Meizhen Li, Jiacheng Yang, Yifan Wu, Ning Wang, Zhaoxing Chen, Ming Liu, Xinchi Ren, Xincheng Ren, Chan Li, Tong Jia, Xiang Zhang, and Ying Li (Peking University, China; ByteDance, China) Large-scale production systems rely on monitoring rules and anomaly detectors to trigger alarms that notify site reliability engineers (SREs) of potential failures. Before diagnosis and mitigation can begin, alarm management must construct incident state online by deciding whether each arriving alarm is noise, indicates a potential new incident, or should be associated with an existing incident to enrich its evolving state. Existing alarm-management methods remain difficult to deploy because some rely on reusable operational artifacts such as SOPs or historical prototypes to judge alarm relationships, while graph-based methods often apply the same topology-derived propagation patterns across incidents. In production, such artifacts are often missing or service-specific, and valid propagation paths vary with incident type and severity. We present AlarmClaw, a context-enriched alarm-management system built around these two constraints. AlarmClaw uses bounded context clawing to retrieve compact evidence from auditable operational sources and a category- and severity-aware incident graph to constrain a large language model (LLM) decision agent. An evolution mechanism refreshes reusable context and graph evidence from validated outcomes. On a temporally held-out replay from a production corpus of 51,000 alarms and 9,661 incidents, AlarmClaw achieves 86.0% association Precision and 78.5% Recall, improving F1 by 7.4 points over the strongest adapted baseline. During six months of online operation, evolution updates improve F1 by 2.3 points over a matched fixed-knowledge counterfactual. From January to June 2026, AlarmClaw automatically associated more than 4,800 alarms, conservatively saving at least 4,800 engineer-minutes and reducing the per-alarm association operation from approximately 90 s manually to under 10 s. Article Search Article: ase26ind-p313-p doi:10.1145/3832783.3834524
	Li, Chenglin	ASE '26: "Probe to Generate: Program ..." Probe to Generate: Program Variant-Guided Test Augmentation for Repository-Level Repair Benchmarks Chenglin Li, Yisen Xu, Zehao Wang, Shin Hwei Tan, and Tse-Hsun (Peter) Chen (Concordia University, Canada) Test-based benchmarks such as SWE-bench have become a standard basis for evaluating automated issue resolution agents, deeming a patch correct if it passes a provided regression test suite. In practice, weak test suites can admit plausible but semantically incorrect patches, inflating reported agent performance. We present PROBE, a test augmentation framework that uses semantically modified program variants as behavioral probes to identify and close gaps in benchmark test suites. Variants of the reference patch that survive the original tests reveal under-constrained behaviors, which then guide targeted regression test generation. Each generated test is retained only if it passes on the reference patch, fails on at least one surviving variant, and remains robust under behavior-preserving transformations. On SWE-bench Verified, 77% of instances admit at least one surviving variant. PROBE generates 1,014 validated tests across 211 instances, increasing patch-region line and branch coverage by 10.8 and 9.5 percentage points. Re-evaluating the top-10 repair agents with the augmented suites reduces resolved rates by 4.2%-9.0%, showing that many previously accepted patches exploit benchmark test gaps rather than fully satisfying the intended repair semantics. These findings demonstrate that benchmark evaluation is not solely a patch-generation problem but also a test-strength problem. Article Search Article: ase26main-p2532-p doi:10.1145/3832783.3837534
	Li, Chunfang	ASE '26: "InfraAPR: An Agent-Based Repair ..." InfraAPR: An Agent-Based Repair Framework for Cloud Infrastructure-as-Code Programs Quan Chen, Zhao Liu, Chunfang Li, Yifan Zhang, Ning Hu, and Qing Liao (Harbin Institute of Technology, Shenzhen, China; Pengcheng Laboratory, China; Hunan University, China; Nanchang University, China) Infrastructure as Code (IaC) is now a routine part of industrial cloud delivery, and Programming Languages IaC (PL-IaC) frameworks further enable engineers to build infrastructure using familiar programming abstractions. However, repairing buggy PL-IaC programs in practice remains costly and highly challenging. Existing quality assurance efforts for PL-IaC have largely concentrated on defect analysis and static checking, while end-to-end automated repair frameworks for PL-IaC programs remain largely absent. In addition, automated program repair techniques designed for general-purpose software often lack PL-IaC-specific domain knowledge, as well as effective modeling and guidance for topology dependencies, making them ineffective for repairing topology-dependent bugs in PL-IaC settings. This paper presents InfraAPR, an agent-based automated repair framework for PL-IaC programs. To enable end-to-end automated repair, InfraAPR integrates three coordinated modules: (1) an InfraAPR Agent Module for phase-specialized LLM reasoning, (2) a Semantic Mapping Module for reconstructing graph-based PL-IaC semantics, and (3) a Constraint-Guided Repair Module that diagnoses constraint violations and generates repaired programs based on structured diagnostics. We evaluate InfraAPR on an industrial benchmark. Experimental results show that InfraAPR consistently outperforms the baselines, achieving a repair success rate of up to 61.8% and improving the strongest baseline by 15.4% on average. These results demonstrate its substantial practical value and improved reliability for industrial PL-IaC workflows. Article Search Article: ase26ind-p338-p doi:10.1145/3832783.3834526
	Li, Dan	ASE '26: "The CodeInverter Suite: Structure- ..." The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs Peipei Liu, Jian Sun, Rongkang Sun, Li Chen, Zhaoteng Yan, Xiaoling Zhang, Dawei Wang, Dapeng Sun, Peizheng Zhang, and Dan Li (Zhongguancun Laboratory, China; Tsinghua University, China) Binary decompilation plays a vital role in various cybersecurity and software engineering tasks. Recently, end-to-end decompilation methods powered by large language models (LLMs) have attracted increasing attention for their ability to generate highly readable source code with minimal human intervention. However, existing LLM-based methods still struggle with reconstructing program structure and logic, achieving accurate data recovery, ensuring data security and privacy, and maintaining computational efficiency. To address these challenges, we propose the CodeInverter Suite, with three main pieces: (1) the CodeInverter Workflow (CIW) is a novel prompt engineering method that incorporates control flow graphs (CFG) and explicit data mappings to enhance structure reconstruction and data recovery during decompilation; (2) building upon CIW, we construct the CodeInverter Dataset (CID), a large-scale domain-specific dataset containing 8.69 million samples enriched with CFGs and data mapping information; (3) we develop CodeInverter Models (CIMs), two lightweight LLMs with 1.3B and 6.7B parameters, enabling efficient inference in privacy-sensitive and resource-constrained environments. Extensive experiments on two benchmark datasets demonstrate that CIW significantly enhances the decompilation performance of various LLMs, with average improvements of 13.07% in re-executability and 23.94% in re-compilability. For our proposed decompilation model, CIM-6.7B achieves state-of-the-art performance in terms of re-executability and readability, outperforming existing LLMs—even with over 100× more parameters—by an average of 11.03% and 6.27%, respectively. Article Search Article: ase26main-p3581-p doi:10.1145/3832783.3837554
	Li, Ding	ASE '26: "Towards Reliable Alarm Flood ..." Towards Reliable Alarm Flood Reduction in Data Center via Grammar-Guided Verifiable LLM Reasoning Jiacheng Liu, Guocong Lin, Jichao Yan, Huiwen Zheng, Hongli Ma, Changhao Zhou, Zhiyi Yu, Yuanchun Li, Yunxin Liu, Ding Li, Tao Xie, and Yao Guo (Peking University, China; Tsinghua University, China; GDS Holdings, China) Alarm floods pose a critical challenge in system operations, where a single fault can trigger cascaded alarms across interconnected components, overwhelming human operators and obscuring actionable signals. Alarm flood reduction aims to reduce redundant alarms under a safety-oriented objective, because any incorrect reduction may falsely exclude real failures. Existing approaches face a fundamental trade-off: rule-based systems ensure reliability but lack scalability, while solutions based on a large language model (LLM) offer strong generalization but suffer from non-determinism and unverifiable reasoning, limiting their use in safety-critical settings. In this paper, we study the alarm flood reduction problem in data center operations and introduce a solution based on structured reasoning and conservative verification. Our key insight is that expert-level alarm analysis relies on explicit reasoning chains that connect upstream causes to downstream alarms. We design Constrained Reasoning Chain Grammar (CRCG), a lightweight yet expressive grammar that formalizes such reasoning processes as compositional inference chains with logical and numerical constraints. Our method follows two tightly connected steps. First, we use LLM-assisted annotation, checker-guided compilation, and supervised fine-tuning (SFT) to organize expert knowledge in CRCG and train a model to generate explicit reasoning chains. Second, we conservatively reduce alarms only when the reasoning chain can be verified based on CRCG. We evaluate the method on real-world data center HVAC alarms. Results have shown that our method achieves high accuracy while driving false reductions to zero on the evaluated setting, outperforming both rule-based and LLM-only baselines and reducing operational workload substantially. Article Search Artifacts Available Article: ase26ind-p96-p doi:10.1145/3832783.3834481
	Li, Donghui	ASE '26: "BanditFuzz: A Synergistic ..." BanditFuzz: A Synergistic Differential Fuzzing Framework for Compilers Donghui Li, Yingying Li, Jinlong Xu, Bo Zhao, Nan Wang, Jinyang Yao, and Lili Liu (Information Engineering University, China; Henan Normal University, China) Compiler fuzzing is critical for ensuring the reliability of modern optimizing compilers. However, traditional generators and raw Large Language Model (LLM) outputs often yield syntactically invalid or low-value programs, incurring significant computational overhead. In this paper, we present BanditFuzz, an end-to-end synergistic differential fuzzing framework integrating four core mechanisms: (1) a coverage-feedback-driven dynamic prompt scheduler that alternates strategies to generate diverse corpora; (2) a lightweight repair module (CompileFix) that heuristically recovers near-compilable raw LLM outputs; (3) a deterministic AST mutation engine (ASTMutate) that systematically expands high-quality seeds to compensate for inference latency; and (4) a sanitizer-enhanced differential testing oracle utilizing an unoptimized baseline (-O0) to precisely identify miscompilations while filtering Undefined Behavior (UB). Extensive evaluations on GCC and Clang demonstrate that BanditFuzz significantly improves backend coverage over state-of-the-art baselines under identical budgets, successfully identifying 28 realworld compiler bugs. Article Search Article: ase26nier-p61-p doi:10.1145/3832783.3834548
	Li, Ge	ASE '26: "Revisiting LLMs on New Feature ..." Revisiting LLMs on New Feature Implementation in Real-World Software Development Practices Jia Li, Tingxuan Huang, Tiankuo Zhao, Yiming Wang, Yiran Zhang, Anshun Hu, Kechi Zhang, Lecheng Wang, Zinan Sheng, Kui Liu, Ge Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Peking University, China; Huawei Technologies, China) Implementing new features in existing repositories is a key activity in software development. With the rapid advances in large language models (LLMs), benchmarking their capability in this task has attracted growing attention. However, existing benchmarks deviate from real-world practices in two aspects. First, they provide LLMs with unrealistic information such as target code signatures and file paths, which developers do not have access to in practice. Second, they only evaluate the final generated code using functional tests, without examining intermediate steps like requirement understanding and implementation planning. These limitations make it difficult to faithfully assess LLMs’ actual capabilities and diagnose their weaknesses. To address the above limitations, we conduct a systematic evaluation to revisit the capability of large language models (LLMs) in new feature implementation, with a task setup strictly aligned with real-world software development practices. Our evaluation is built on NFEI, a curated benchmark sourced from merged feature pull requests of active GitHub repositories, where each target feature involves cross-snippet multiple code modifications, and LLMs are only provided with the feature description and the target repository throughout the evaluation. Beyond the realistic input settings, we further annotate fine-grained labels for the intermediate steps of the development workflow, including requirement clarification and implementation planning. This enables our evaluation to support a comprehensive stage-wise assessment across three granularities with seven dedicated metrics. We evaluate seven popular LLMs under two development paradigms and three generation strategies. Results show that new feature implementation remains highly challenging, with an overall average Test Pass Rate of only 29.84%. Our stage-wise analysis reveals that intermediate step quality is closely linked to final code performance, and injecting ground-truth intermediate artifacts yields an average absolute gain of about 18%, yet performance remains limited. Qualitative error analysis further identifies three recurrent failure patterns, suggesting that new feature implementation of LLMs adhering to real-world world software development practices remains challenges. Article Search Article: ase26main-p1768-p doi:10.1145/3832783.3837511 ASE '26: "Perception, Reasoning, and ..." Perception, Reasoning, and Action: A ReAct-Based Vulnerability Detection Framework with Repository-Level Reasoning Xin-Cheng Wen, Hanyue Luo, Cuiyun Gao, Hao Zhu, Yang Xiao, and Ge Li (Harbin Institute of Technology, Shenzhen, China; Peking University, China; Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) The exponential growth in software vulnerabilities has created an urgent demand for automated vulnerability detection solutions. Recent research has emphasized the importance of repository-level context for vulnerability detection and has leveraged large language models (LLMs) to address this challenge. Although these methods show state-of-the-art performance, they face the following challenges: (1) Insufficient perception of repository-level contextual information. Current approaches primarily rely on the given input itself or predefined knowledge bases. They cannot adequately account for inter-file dependencies, such as import relationships and class hierarchies, that may be critical to understanding specific vulnerabilities. (2) Relying on manually designed actions in the LLM reasoning process. Specifically, existing methods do not effectively integrate reasoning (i.e., predicting vulnerability existence by LLMs) with action (i.e., dynamically retrieving additional or reduced context by tool). This limitation can lead to factual hallucinations throughout the detection process, leading to limited performance. To address these challenges, we propose to model the repository-level vulnerability detection task from a Reasoning and Action (i.e., ReAct) paradigm and incorporate human workflows into multi agent-based LLMs, termed ReAct-Vul, which consists of two key modules: (1) a repository-scale knowledge slicing, which comprises an intra-procedural slicing process, an inter-procedural slicing process, and a ReAct-based perception component for extracting the vulnerability-related context and knowledge at the repository level. (2) a synergistic reasoning-action-driven detection module, which interleaves a dual-perspective vulnerability analysis (Action phase) and detection-reflection loop (Reasoning phase). This synergistic approach enables the framework to explicitly consider both vulnerability presence and absence, generate reasoning explanations and refine subsequent targeted actions for vulnerability detection. We evaluate ReAct-Vul on the real-world C/C++ dataset PrimeVul and SVEN to demonstrate its effectiveness in vulnerability detection. Specifically, ReAct-Vul outperforms the best baseline by 18.4% on SVEN and 8.7% on PrimeVul in terms of accuracy. Furthermore, we demonstrate that the proposed ReAct paradigm enhances the reasoning capabilities of different models, achieving a 15.9% improvement in the accuracy of SVEN. Article Search Article: ase26main-p3189-p doi:10.1145/3832783.3837547
	Li, Guancheng	ASE '26: "Post-quantum Cryptography ..." Post-quantum Cryptography in the Wild: Assessing the Readiness of Open-Source Ecosystems Tongxin Yuan, Zhanpeng Liu, Jiashuo Liang, Zhuosheng Zhang, Gongshen Liu, Yang Yu, and Guancheng Li (Shanghai Jiao Tong University, China; Tencent Xuanwu Lab, China) The threat of cryptographically relevant quantum computers, compounded by harvest now, decrypt later attacks, has made migration to post-quantum cryptography (PQC) urgent. With PQC standards finalized and transition guidance phasing out quantum-vulnerable algorithms, the readiness of the open-source supply chain, through which cryptographic vulnerabilities propagate, remains unclear. To fill this gap, we present the first cross-ecosystem empirical study of source-level PQC readiness. PQC Scanner is a two-stage pipeline in which (i) crypto detection identifies packages with cryptographic functionality, and (ii) PQC detection produces a binary support label and source-derived structured readiness record at the repository level using commit history, source analysis, and agent post-verification. Applied to 1,117,913 packages, Stage 1 identifies 55,654 crypto-related packages. Stage 2 evaluates their repositories for source-level PQC support. A separate audit of 219 Stage 2-negative repositories gives a Stage 2 recall lower bound of ≥  97.48%. On a 247-repository deployment-validation sample, agent post-verification eliminated all false positives, yielding precision of 1.000. The pipeline scales to million-package scans: at concurrency 10, it analyzes over one million packages in just over two weeks, with a median LLM cost of $0.0010 per package. Across 8 ecosystems, we find a migration gap: only 1.88% of crypto-related packages show source-level PQC support, and the repository-deduplicated rate is 1.72%. Rust leads by both counts, while NuGet/Ruby/PHP remain near zero. Source-derived structured readiness records show partial support: among PQC-supporting repositories, only 19.2% satisfy the full-support criterion, with a mean migration coverage of 36%. Adoption accelerates sharply after FIPS publication (August 2024), but migration remains infrastructure-gated: key libraries such as Python’s cryptography (581M downloads/month) and framework integration layers in Java/npm still lack deployable PQC pathways, blocking downstream packages regardless of developer intent. We characterize adoption timing, bottlenecks, and community response strategies, deriving recommendations for maintainers, registry operators, and policy makers. Article Search Article: ase26main-p758-p doi:10.1145/3832783.3837461
	Li, Haodong	ASE '26: "Harnessing Uncertainty in ..." Harnessing Uncertainty in Code Language Models: Lessons from Vulnerability Detection Haodong Li, Xiao Cheng, Xudong Wang, Zhihao Guo, and Haoyu Wang (Huazhong University of Science and Technology, China; Macquarie University, Australia; Zhongguancun Institute of Artificial Intelligence, China; University of Technology Sydney, Australia) Code Language Models (CLMs) are increasingly adopted for vulnerability detection, yet knowing when to trust their predictions remains an open challenge. Uncertainty estimation has improved reliability in traditional discriminative models, but whether these benefits transfer to the generative paradigm of CLMs is unclear. This experience paper presents a systematic empirical study of uncertainty estimation in CLM-based vulnerability detection, evaluating four calibration methods and two uncertainty-driven enhancement frameworks across eight models (2B--16B parameters) under both in-distribution and out-of-distribution settings on 1,050 real-world projects. Our study reveals that: (1) calibration effectiveness is model-scale dependent: temperature scaling and ensembles deliver consistent gains, while Monte Carlo Dropout and Bayesian Low-Rank Adaptation by Backpropagation only benefit medium-scale models (approximately 6B--7B parameters); (2) uncertainty-based correction requires label-conditional modeling to be effective (up to 12% Macro-F1 improvement on out-of-distribution data), as global strategies show negligible effects; (3) curriculum learning fails to improve upon standard fine-tuning, as uncertainty-based difficulty ordering does not align with the learned decision boundary, causing training instability or negligible gains. These findings challenge assumptions about the universal transferability of uncertainty methods and provide practical guidelines for deploying uncertainty-aware vulnerability detection. Article Search Article: ase26main-p786-p doi:10.1145/3832783.3837465
	Li, Haofeng	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Li, Haokun	ASE '26: "ACSLBench: A Verified C/ACSL ..." ACSLBench: A Verified C/ACSL Corpus and Benchmark with Compositional Call Chains for Formal Specification Synthesis Junjie Hu, Cheng Wen, Bin Yu, Jialun Cao, Dugang Liu, Weidi Sun, Haokun Li, Shengchao Qin, and Cong Tian (Xidian University, China; Hong Kong University of Science and Technology, Hong Kong; Shenzhen University, China; Peking University, China) Formal specification synthesis for C programs is a key step toward scalable deductive verification, yet current learning-based approaches lack large verified C/ACSL data and evaluation tasks that exercise reasoning across function calls. We present ACSLBench, a reusable dataset artifact for training and evaluating C/ACSL specification synthesis models. ACSLBench contains two resources: a corpus of 504,587 formally verified C/ACSL programs, and a curated benchmark of 495 tasks designed around function-call composition. The corpus is built by translating verified Rust/Verus seeds into C/ACSL via an LLM-guided semantic mapping loop, in which Frama-C/WP feedback repairs failed candidates. The benchmark is synthesized from verified components by constructing caller functions whose specifications depend on multiple callee contracts. Experiments with six LLMs show that performance drops as the number of function calls increases. The dataset is available at https://huggingface.co/datasets/noBuggie/AcslBench, and the video is available at https://youtu.be/kgvvTajX2Mk. Article Search Article: ase26tool-p82-p doi:10.1145/3832783.3834628
	Li, Haoran	ASE '26: "When Ambiguity Meets Atypicality: ..." When Ambiguity Meets Atypicality: Dual-Perspective Test Input Prioritization for DNNs Haoran Li, Shihai Wang, Bin Liu, Jialuo Chen, Wenjing Zhu, Yu Liu, Tengfei Shi, and Shudi Guo (Beihang University, China; Zhejiang University, China) While Deep Neural Networks (DNNs) have achieved remarkable progress in cutting-edge domains, their inherent brittleness has become a growing concern. To ensure the reliability and safety of DNN-enabled software, DNN testing has emerged as an indispensable practice. Within this context, test input prioritization is essential for early fault detection and reducing labeling costs. However, it remains challenging to accurately identify failure-inducing inputs. Although decision ambiguity and distributional atypicality are two widely adopted perspectives for characterizing inter-class competition and intra-class typicality respectively, relying on either perspective in isolation inevitably introduces blind spots. In this paper, we propose DuFP (Dual perspective Feature space Prioritization), a KNN density-based test input prioritization approach for DNNs that jointly incorporates both inter-class and intra-class perspectives. The prioritization framework of DuFP is built upon class-conditional density estimation. Based on the estimation results, prediction correctness is characterized by an ambiguity score and an atypicality score, with the former reflecting decision ambiguity and the latter quantifying distributional atypicality. A hybrid uncertainty score is then constructed by integrating both scores to guide the final prioritization. We evaluate DuFP on prioritization and selection tasks across image and text datasets under clean, corrupted, and adversarial scenarios. Experimental results demonstrate that DuFP effectively and efficiently prioritizes fault-inducing inputs and outperforms state-of-the-art approaches. Article Search Artifacts Available Article: ase26main-p367-p doi:10.1145/3832783.3834351
	Li, Heng	ASE '26: "Discovering Performance Archetypes: ..." Discovering Performance Archetypes: Critical-Path-Aware Pattern Analysis and Regression Detection Kaveh Shahedi, Heng Li, Maxime Lamothe, and Foutse Khomh (Polytechnique Montréal, Canada) Software performance analysis and prediction requires integrating multiple signals, as code structure alone cannot capture runtime behavior shaped by execution frequency, resource contention, and I/O patterns. We present a critical-path-aware performance analysis methodology that automatically discovers recurring performance patterns by synthesizing static code features, dynamic execution traces, and kernel-level resource data. In a preliminary study across six real-world C/C++ applications (SQLite, OpenSSL, Zstandard, FFmpeg, cURL, and jq), we first empirically confirm that static complexity metrics explain only 10.4% of the variance (ρ2) in critical path execution time, quantifying a gap that, while theoretically expected, had not been measured systematically across applications. Motivated by this finding, we analyze nearly 80,000 critical execution paths and address two research questions. First, we discover 13 distinct performance archetypes: recurring behavioral patterns that appear consistently across different applications, independent of their domain or implementation. Five of these patterns are near-universal and appear in at least five of the six applications studied. Notably, three of these archetypes are present in all six applications, and together, these common patterns account for 56.4% of all observed paths. Each archetype maps to specific resource profiles and optimization strategies that transfer across domains. Second, we leverage these archetypes within a multi-signal regression detection framework that triangulates path structure, resource consumption, and archetype deviations, achieving an F1-score of 0.867 and a 60.4% improvement over resource-only methods. Article Search Article: ase26main-p2896-p doi:10.1145/3832783.3834426
	Li, Hongyan	ASE '26: "How Reasoning Shapes Social ..." How Reasoning Shapes Social Bias in LLM-Generated Code? Weifeng Sun, Jieke Shi, Zhou Yang, Yuchen Chen, Hongyan Li, Meng Yan, and David Lo (Singapore Management University, Singapore; University of Alberta, Canada; Alberta Machine Intelligence Institute, Canada; Nanjing University, China; Chongqing University, China) Large language models (LLMs) are increasingly used for code generation, but recent studies have shown that generated programs can exhibit code bias, i.e., unfair or differential treatment encoded in code logic with respect to sensitive demographic attributes. Although prior work has investigated this problem in a direct generation setting, it remains unclear how bias behaves in reasoning-based code generation, where models produce intermediate reasoning traces before generating the final code. To bridge this gap, we conduct the first systematic empirical study of social bias in reasoning-based code generation. We evaluate 9 models spanning both standard LLMs and large reasoning models (LRMs) on realistic bias-sensitive coding tasks covering three human-centered decision scenarios. Our results reveal four main findings. First, reasoning generally reduces code bias, lowering the average bias rate from 0.64 to 0.40, but the improvement is highly model-dependent. Second, reasoning-based generation does not consistently preserve code quality, with the average quality dropping from 0.72 to 0.59. We further find that biased reasoning strongly predicts biased code, and that simply adjusting generation configurations is insufficient for robust bias mitigation. Motivated by these findings, we propose ProbeDebias, a reasoning-aware debiasing framework that detects biased reasoning traces and rewrites them before final code generation. Extensive experiments demonstrate that ProbeDebias achieves 87.76 Article Search Article: ase26main-p1394-p doi:10.1145/3832783.3834387
	Li, Huan	ASE '26: "VARIES: Verification Harness ..." VARIES: Verification Harness Synthesis and Efficient Scheduling for Unsoundness Detection in Rust Libraries Huan Li, Xing Hu, Xin Xia, and Xinyu Wang (Zhejiang University, China) Rust provides strong compile-time safety guarantees, but unsafe code in real-world libraries can still introduce unsoundness bugs that may undermine this guarantee. Compared with prior work, bounded model checking (BMC) offers a promising direction by adapting formal verification to unsoundness detection. In practice, however, BMC requires harnesses that are tedious to construct, and many unsoundness bugs arise only under specific program states that a single harness may miss. To this end, we propose Varies, a BMC-based framework that treats unsoundness detection in Rust libraries as a joint problem of harness synthesis and budget-aware verification. During the synthesis stage, Varies builds seed harnesses for each target API and then expands them into derived harnesses through mutator injection. Over the resulting harness derivation tree, Varies applies feedback-driven pruning strategies to schedule verification efficiently. In our benchmark, Varies identifies defects involving target APIs in more evaluated crates than any baseline while maintaining a low false-positive rate. In a broader deployment on popular crates.io libraries, it identifies previously unknown unsoundness in 10 crates, with reports for 6 crates acknowledged by maintainers. The results indicate that stateful harness synthesis and feedback-driven scheduling can make BMC practical for targeted unsoundness detection in Rust libraries. Article Search Article: ase26main-p638-p doi:10.1145/3832783.3837450
	Li, Huaxuan	ASE '26: "WebCQ: Cooperative Multi-agent ..." WebCQ: Cooperative Multi-agent Deep Reinforcement Learning for Scalable Web GUI Testing Yujia Fan, Sinan Wang, Zebang Fei, Yao Qin, Huaxuan Li, and Yepang Liu (Southern University of Science and Technology, China) Multi-agent reinforcement learning (MARL)-based techniques have shown promise for GUI testing. However, as the complexity of modern GUI software increases, existing MARL-based approaches (e.g., MARG and Fastbot) struggle to scale due to the inherent limitations of their underlying tabular reinforcement learning algorithms. This limits their applicability to large-scale commercial GUI software, especially web applications with vast state spaces and many interactive elements. To fill this gap, we propose WebCQ, a novel MARL-based approach for scalable web GUI testing. WebCQ incorporates QTRAN for multi-agent coordination and a lightweight synchronization mechanism, allowing it to work under asynchronous web testing scenarios. It extracts semantic and exploration features for each UI event to form an action vector. This vector is concatenated with the current state vector and fed into the policy network, enabling DQN-based decision making within a dynamic action space. We evaluated WebCQ on eight large-scale commercial websites. Under the same time budget and agent count, WebCQ explored 33.3% more states and executed 42.2% more unique actions than MARG, while triggering more failures on six of the eight websites under test. It also demonstrated strong scalability, maintaining higher action throughput during 20-hour experiments, and achieving greater performance improvements as the number of agents increased. These results show that WebCQ overcomes key limitations of existing MARL-based approaches, providing a scalable and effective solution to enhance modern web GUI testing. Article Search Article: ase26main-p944-p doi:10.1145/3832783.3834374
	Li, Hui	ASE '26: "SpecFSM: Extracting and Repairing ..." SpecFSM: Extracting and Repairing Finite State Machines from Protocol Specification Documents Xiangdong Li, DaWei Huang, Jingjing Guan, and Hui Li (Beijing University of Posts and Telecommunications, Beijing, China) Finite state machines (FSMs) are a fundamental abstraction for modeling dynamic system behavior and are widely used in protocol analysis. However, automatically extracting FSMs from natural-language specifications remains challenging. Protocol documents are often lengthy and structurally complex, with state-transition descriptions scattered across the text. As a result, large language models (LLMs) operating under incomplete context are prone to generating spurious transitions and logically flawed FSMs. In this paper, we propose SpecFSM, a framework for the automatic extraction and repair of protocol FSMs from natural-language specifications. SpecFSM combines state completion, evidence tracing, and formal verification into a unified pipeline that infers missing states, constrains incorrect transitions, and repairs logical defects in the extracted models. Experiments on multiple protocol documents show that SpecFSM improves the average number of correctly extracted state transitions by 54.7% over existing methods, while producing FSMs with stronger logical validity and better interpretability. Article Search Artifacts Available Article: ase26main-p13-p doi:10.1145/3832783.3834331 ASE '26: "Benchmarking Automated Security ..." Benchmarking Automated Security Patch Backporting: How Far Are We? Jincheng Yang, Yulong Fu, Chengwei Liu, Lyuye Zhang, Fangyuan Zhang, Bingyang Ren, Yang Liu, and Hui Li (Xidian University, China; Nankai University, China; Nanyang Technological University, Singapore) Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools have reported high success rates, often exceeding 80% on their respective datasets. However, these evaluations are typically confined to homogeneous environments, such as within the same repository or specific project versions. Consequently, it remains unclear how well these tools generalize beyond their originally targeted scenarios. We present Porting Benchmark, a curated dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework. Using this benchmark, we evaluate five state-of-the-art tools spanning traditional program analysis, LLM-based prompting, and LLM agents under aligned evaluation settings. Our results show that aligned evaluation changes the apparent performance landscape: PortGPT and TSBPort remain comparatively strong on the Replication Dataset, while FixMorph and Mystique degrade substantially under the common protocol. Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design. On a 45-case dynamically validated subset with verified test cases and constructed POCs, we further observe that reference-based benchmark scores do not fully capture real-world remediation: exact match sharply under-credits harder target adaptations, while executable validation reveals residual integration failures in the target that static reference agreement misses. Executable-feedback refinement provides limited but measurable recovery on the hardest executable cases. Article Search Article: ase26main-p2788-p doi:10.1145/3832783.3837542
	Li, Jia	ASE '26: "Aligning User Requirement ..." Aligning User Requirement with Large Language Model in Code Generation Jia Li, Ruiqi Bai, Yangkang Luo, Yiran Zhang, Wentao Yang, Zeyu Sun, Tiankuo Zhao, Dongming Jin, Lei Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Institute of Software at Chinese Academy of Sciences, China; Peking University, China; University of Hong Kong, Hong Kong) Code generation refers to automatically producing executable programs from user requirements. Recently, researchers have explored approaches to enhance the correctness of generated code with advanced large language models. Although achieving improvements, existing approaches focus on designing reasoning strategies or post-refinement methods to enhance code generation performance. Despite their differences, all these methods share a common assumption: the LLM can correctly understand the given requirement. However, this assumption does not always hold. To fill this gap, we propose REA-Coder, a requirement alignment approach to enhance the code generation performance of LLMs. REA-Coder involves first identifying the requirement content that does not align with LLMs and aligning the requirements. Then, based on the aligned requirements, LLMs generate code and further verify whether the generated code aligns with the requirements, iterating this process of requirement alignment and code generation until generating correct code or achieving the maximum number of iterations. Experimental results show that REA-Coder outperforms all advanced baselines on four LLMs across five programming benchmarks. Concretely, REA-Coder achieves average improvements of 7.93%, 30.25%, 26.75%, 8.59%, and 8.15% on the five benchmarks, demonstrating the effectiveness of requirement alignment for improving the code generation performance of LLMs. Article Search Article: ase26main-p1298-p doi:10.1145/3832783.3837487 ASE '26: "Revisiting LLMs on New Feature ..." Revisiting LLMs on New Feature Implementation in Real-World Software Development Practices Jia Li, Tingxuan Huang, Tiankuo Zhao, Yiming Wang, Yiran Zhang, Anshun Hu, Kechi Zhang, Lecheng Wang, Zinan Sheng, Kui Liu, Ge Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Peking University, China; Huawei Technologies, China) Implementing new features in existing repositories is a key activity in software development. With the rapid advances in large language models (LLMs), benchmarking their capability in this task has attracted growing attention. However, existing benchmarks deviate from real-world practices in two aspects. First, they provide LLMs with unrealistic information such as target code signatures and file paths, which developers do not have access to in practice. Second, they only evaluate the final generated code using functional tests, without examining intermediate steps like requirement understanding and implementation planning. These limitations make it difficult to faithfully assess LLMs’ actual capabilities and diagnose their weaknesses. To address the above limitations, we conduct a systematic evaluation to revisit the capability of large language models (LLMs) in new feature implementation, with a task setup strictly aligned with real-world software development practices. Our evaluation is built on NFEI, a curated benchmark sourced from merged feature pull requests of active GitHub repositories, where each target feature involves cross-snippet multiple code modifications, and LLMs are only provided with the feature description and the target repository throughout the evaluation. Beyond the realistic input settings, we further annotate fine-grained labels for the intermediate steps of the development workflow, including requirement clarification and implementation planning. This enables our evaluation to support a comprehensive stage-wise assessment across three granularities with seven dedicated metrics. We evaluate seven popular LLMs under two development paradigms and three generation strategies. Results show that new feature implementation remains highly challenging, with an overall average Test Pass Rate of only 29.84%. Our stage-wise analysis reveals that intermediate step quality is closely linked to final code performance, and injecting ground-truth intermediate artifacts yields an average absolute gain of about 18%, yet performance remains limited. Qualitative error analysis further identifies three recurrent failure patterns, suggesting that new feature implementation of LLMs adhering to real-world world software development practices remains challenges. Article Search Article: ase26main-p1768-p doi:10.1145/3832783.3837511
	Li, Jiale	ASE '26: "ChangeWiki: Repository-Level ..." ChangeWiki: Repository-Level Change Summarization Augmented with Architecture Semantics Zijun Wang, Wuxia Jin, Jiale Li, Zhanhong Mou, and Ting Liu (Xi'an Jiaotong University, China) Understanding software evolution at the repository level is essential for tasks such as release management, code review, and regression testing. However, existing change summarization techniques are largely confined to single commits or functions, failing to capture cross-commit evolutionary context, while recent repository-level understanding tools focus on static documentation of single-version codebases, overlooking evolution over time. To bridge this gap, we propose ChangeWiki, an architecture semantic-augmented approach for repository-level change summarization. ChangeWiki first constructs hierarchical, multi-granularity change entity trees enriched with multi-source contexts to infer change intent and impact. It then recovers modular structures across versions and employs a bidirectional context-guided aggregation mechanism, synthesizing code-level changes from the bottom up while injecting architectural semantics as top-down constraints. ChangeWiki finally generates coherent, traceable summaries that capture both local modifications and system-level evolution. We construct comprehensive benchmarks and evaluate ChangeWiki on real-world projects. Experimental results demonstrate significant improvements in semantic accuracy, completeness, and cross-granularity traceability. A prototype of ChangeWiki has been deployed in an industrial setting for upstream-downstream code evolution, where developers reported that the hierarchical summaries significantly reduced manual effort in issue localization caused by upstream changes and show potential for automating version release notes. Article Search Article: ase26main-p3335-p doi:10.1145/3832783.3834436
	Li, Jianing	ASE '26: "GraphQLer: Enhancing GraphQL ..." GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing Omar Tsai, Jianing Li, Tsz Tung Cheung, Lejing Huang, Hao Zhu, Jianrui Xiao, Iman Sharafaldin, and Mohammad A. Tayebi (Simon Fraser University, Canada; Forward Security, Canada) GraphQL APIs power production systems across financial services, e-commerce, and social platforms, yet their most critical access-control vulnerabilities—Insecure Direct Object Reference (IDOR), Use-After-Free (UAF), and state-dependent injection—routinely escape automated security testing. Industry-standard scanners (ZAP) and the leading research fuzzer (EvoMaster) test operations in isolation and cannot compose the multi-step sequences these flaws require. We present GraphQLer, an open-source automated security testing framework built for production GraphQL APIs. GraphQLer constructs a typed dependency graph from live schema introspection and synthesizes vulnerability chains—ordered operation sequences targeting specific flaw classes. Three strategies cover the critical attack surface: topological SCC-traversal for general reachability, cross-user IDOR replay for broken access control, and CREATE→DELETE→READ synthesis for UAF. On a production financial API (FinServ), GraphQLer identified eight potential vulnerabilities—including denial-of-service vectors that exposed stack traces and sensitive implementation details—without prior documentation or authentication credentials. On a self-hosted Saleor instance pinned to the CVE-2022-39275 commit, GraphQLer reproduced all four broken-access-control mutations cited in the security advisory. On the 11 public APIs of the coverage set, GraphQLer achieves 85.52% mean PositiveCoverage versus 29.29% (EvoMaster) and 21.80% (ZAP); across the 21 evaluated APIs it detects all 5 confirmed IDOR endpoints, UAF behavior on two controlled schemas, and confirms XSS and SQLi on DVGA (an independent third-party oracle)—while all baselines detect zero chain-based vulnerabilities. Article Search Artifacts Available Article: ase26ind-p143-p doi:10.1145/3832783.3834496
	Li, Jingjing	ASE '26: "Smart Brain: Semantic Anomaly ..." Smart Brain: Semantic Anomaly Detection for Operational Time Series in Large Scale Service Systems Hang Cui, Zexin Wang, Jingjing Li, Juncheng Hu, Haotian Si, Cenjie Hu, Quan Zhou, Yongchang Hu, Lei Han, Dan Pei, Changhua Pei, and Gaogang Xie (University of Chinese Academy of Sciences, China; Computer Network Information Center at Chinese Academy of Sciences, China; Jilin University, China; Independent Researcher, China; Shenyang Institute of Automation at Chinese Academy of Sciences, China; Huawei Technologies, China; Tsinghua University, China) Time series anomaly detection is a core component of operational automation in large scale service systems. However, most existing methods model anomalies as numerical deviations in the data space, while real software operations require decisions over whether an observed behavior constitutes an actionable abnormal event. This mismatch often leads to brittle thresholds, excessive false alerts, and outputs that are difficult for operators to interpret and act upon. In this paper, we argue that practical anomaly detection should move from point-centric data anomaly detection to semantic anomaly detection. We present Smart Brain, a two stage framework for semantic anomaly detection in operational time series. Stage I extracts structured temporal evidence by recognizing interpretable anomaly patterns. Stage II combines the extracted evidence with metric semantics and operator authored rules to produce semantic anomaly decisions and human-readable explanations. Through evaluation on benchmark datasets and real industrial monitoring scenarios, we show that Smart Brain improves operationally meaningful anomaly identification while providing stronger interpretability and deployment suitability than score centric pipelines. Beyond the framework itself, our study offers practical lessons for building anomaly detection systems in production software environments, highlighting the importance of semantic grounding, structured evidence, and lightweight adaptation to evolving services. Article Search Article: ase26main-p337-p doi:10.1145/3832783.3837436
	Li, Jinku	ASE '26: "LaMAR: Latent Multi-agent ..." LaMAR: Latent Multi-agent Collaboration via KV-Cache Communication for Automated Program Repair Rui Jiao, Yue Zhang, Zhexuan Feng, and Jinku Li (Xidian University, China; Shandong University, China) Multi-agent systems for automated program repair communicate through text tokens, requiring each agent to decode its internal state into discrete symbols and the next agent to re-encode them. This conversion loses information and incurs token overhead that grows quadratically with the agent count. We develop Latent Agent Communication (LAC), a theoretically grounded framework that formalizes how agents can share KV-cache representations directly in continuous space, and prove it provides a communication channel with strictly higher information capacity while reducing token complexity from O(N^2) to O(N). We instantiate LAC as LaMAR, a dual-chain repair system: Bug Analysis Chain diagnoses the bug through four collaborating latent agents; Repair Chain refines the patch through multi-agent latent collaboration with cross-chain context transfer, and supports optional multi-round iteration for complex defects. Evaluated across three benchmarks spanning Java, Python, and C++ with three model families, LaMAR with Qwen3-8B achieves 24.5% repair success rate on Defects4J and 62.1%--87.5% on DebugBench and QuixBugs, outperforming all baselines in the large majority of settings. Ablation experiments identify the bug analysis chain and latent communication as the most critical components. Article Search Article: ase26main-p198-p doi:10.1145/3832783.3837423
	Li, Junyi	ASE '26: "TELLER: Non-intrusive Cross-Layer ..." TELLER: Non-intrusive Cross-Layer Root-Cause Analysis for LLM Inference Ruilin Xu, Junyi Li, Pengfei Chen, and Zongxuan Xie (Sun Yat-sen University, China) Large language model (LLM) inference has evolved from an offline workload into a continuously operated software service, yet root-cause analysis remains difficult because a single request spans the inference engine, Python/C++ backend, host CUDA APIs, GPU kernels, and distributed communication. Existing profilers expose raw timelines, while log-based diagnosis often misses cross-layer execution semantics and request-level structure. We present TELLER, a non-intrusive trace- and log-aware LLM inference root-cause analysis framework. TELLER first collects NVTX/CUPTI traces and service logs without modifying model binaries, then reconstructs per-request call-chain trees and aligns log lines with the corresponding execution steps. We introduce a dependency-aware causal-context slice that preserves parent-child structure, temporal order, and communication relations, and a Trace Pair Encoding (TPE) tokenizer that compresses such slices into compact structural token sequences with parent, depth, and duration attributes. On top of these representations, TELLER combines numeric candidate localization with a multimodal root-cause model that jointly predicts abnormal steps, localizes suspicious operators, and generates natural-language explanations. Experiments on multi-node GPU inference workloads show a clear compression-accuracy trade-off: a moderate TPE vocabulary reduces per-step trace length by more than 80% while achieving the best overall performance on both horizontal (cross-node communication) and vertical (within-node execution stack) views, whereas more aggressive compression substantially degrades diagnosis quality. Further analyses under low-fault priors, strengthened baselines, modality ablations, explanation-quality checks, and tracing overhead show that TELLER provides a practical triage and evidence-localization substrate for LLM inference RCA. Article Search Artifacts Available Article: ase26main-p423-p doi:10.1145/3832783.3837440
	Li, Kaixuan	ASE '26: "Testing Static Analyzers via ..." Testing Static Analyzers via Semantic-Preserving Mutators Learned from Real-World Refactoring Practice Meilin Li, Kaixuan Li, Zifan Xie, Shiyu Qiu, Ming Wen, Maolin Sun, and Hongyu Zhang (Chongqing University, China; Nanyang Technological University, Singapore; Huazhong University of Science and Technology, China; Nanjing University, China) Static analyzers reason about program behavior without execution and report issues when code violates predefined rules. A key limitation is their production of inaccurate, incomplete results, generating spurious warnings and missing critical issues. Metamorphic testing is the most commonly used method to efficiently detect bugs in static analyzers. It requires designing a set of semantic-preserving mutators. When a mutator is applied to a seed program, any discrepancy in the analyzer's reports for the original and mutated versions indicates a potential bug. Thus, efficiently generating large numbers of semantic-preserving mutators is critical. We observe that during routine software maintenance, developers often restructure code to improve readability or optimize it without changing external program behavior. Our key insight is that mining and generalizing these patterns from real-world refactoring practice enables the automatic construction of numerous mutators that reflect the distribution of real-world code variants. We present SAFuzzer, a framework that mines such refactoring practice and distills these edits into semantic-preserving mutators. We ultimately generate 313 mutators and apply them to detect bugs in five widely used Java static analyzers. SAFuzzer detects 42 previously unknown bugs. Compared with five state-of-the-art baselines, SAFuzzer detects the most bugs, demonstrating the value of learning diverse mutators from real-world refactoring practice. Article Search Article: ase26main-p2906-p doi:10.1145/3832783.3837544
	Li, Kefan	ASE '26: "Escaping the Self-Repair Trap: ..." Escaping the Self-Repair Trap: Improving Test Oracle Generation via Dual-Context Awareness Kefan Li, Hongyue Yu, and Yuan Yuan (Beihang University, China) Large Language Models (LLMs) have shown strong potential for regression-oracle completion, where a test prefix is given and the current program version is treated as expected behavior. Recent approaches increasingly rely on iterative self-repair and execution feedback, but optimizing execution success does not necessarily yield strong fault-revealing oracles. This objective, widely adopted in repair-based methods, serves only as a proxy and may be misaligned with the true goal of oracle generation. Such misalignment biases the repair process, giving rise to a feedback-driven degeneration that we term the Self-Repair Trap, where iterative repair progressively drives models toward assertions that are easier to satisfy but less effective at detecting faults. To address this issue, we propose DCAware, a computationally efficient, non-iterative framework that prioritizes high signal-to-noise contextual grounding over multi-round repair. DCAware integrates structured static context with selectively retrieved dynamic states, enabling precise and robust oracle generation without iterative feedback loops. Extensive experiments based on execution and mutation testing show that DCAware consistently improves fault-revealing effectiveness while maintaining high execution success, outperforming prior methods with substantially lower computational cost. Our results suggest that improving contextual quality is more effective than adding iterative repair complexity in the studied regression-oracle setting. Article Search Artifacts Available Article: ase26main-p2670-p doi:10.1145/3832783.3834421
	Li, Kexin	ASE '26: "RFC2TLA+: Extracting and Verifying ..." RFC2TLA+: Extracting and Verifying Formal Models from RFC Documents using Continuous LLM Feedback Guozhen Ding, Kexin Li, Ilya Grishchenko, and David Lie (University of Toronto, Canada) Extracting natural-language protocol specifications such as Requests for Comments (RFCs) into formally verifiable models is a challenging and labor-intensive process that requires significant expertise. Recent advances in large language models (LLMs) and agents show promise in automating this task. However, existing automated approaches suffer from insufficient structural consistency, hallucinations, and limited scalability. Moreover, the ability to pass such automatically extracted models into formal verification tools such as model checkers has not been demonstrated. We present RFC2TLA+, a three-stage pipeline for automatically extracting RFCs into automatically verifiable models. RFC2TLA+ achieves this by providing fine-grain and continuous feedback to the LLM throughout the extraction process. It decomposes the extraction process into three passes—states, transitions, and invariants—while constraining LLM generation through fine-grained tool calls, lightweight validation, and iterative feedback. This design enables early error detection and correction, mitigating hallucinations and preventing syntactic and semantic inconsistencies. The resulting communicating finite-state machines (CFSMs) are deterministically translated into TLA + and verified using the TLC model checker. We evaluate RFC2TLA+ on a benchmark of 14 RFCs and their accompanying human-crafted FSMs and show that it generates more complete models than the baseline. In addition, our tool extracts invariants, enabling a model checker to detect injected faults. To minimize the effects of LLM memorization, we additionally generate synthetic RFCs and evaluate the tool on them, demonstrating its effectiveness in both model extraction and error detection. Article Search Artifacts Available Article: ase26main-p683-p doi:10.1145/3832783.3837453 ASE '26: "FAiLGen: Calibrating LLM for ..." FAiLGen: Calibrating LLM for Failing Test Generation with Monte Carlo Tree Search Tsz-On Li, Xiaochuan Yan, Dehui Yi, Yuhang Jiang, Kexin Li, Congying Xu, Ying Wang, and Shing-Chi Cheung (Hong Kong University of Science and Technology, Hong Kong; Northeastern University, China) Failing test generation is an important yet challenging task in software engineering. It involves searching a vast space to identify fault-triggering test inputs and the oracles that assert these faulty executions. Several approaches have been proposed for generating failing tests. Specifically, given a program-under-test (PUT) and its requirements, these approaches leverage large language models (LLMs) to generate alternative implementations of the PUT that comply with the requirements, followed by differential testing between the PUT and the alternative implementations. Failing tests can be constructed by adopting the inconsistency-revealing inputs as the test inputs and treating the outputs returned by the alternative implementations as expected outputs. As alternative implementations may also contain faults and thus return incorrect outputs, current methods rely on either output consistency across alternative implementations or pre-constructed test cases for validation. However, the former is susceptible to LLM training biases or stochasticity, while the latter can be impractical due to the scarcity or unavailability of pre-constructed test cases in real-world scenarios. To address existing works’ limitations, we employ LLM as an alternative oracle for output validation, and calibrate its reasoning steps to reduce its susceptibility to LLM training biases or stochasticity. One critical challenge is that the calibration process inherently requires correct input-output pairs for the output validation task as ground-truth for reference when validating/calibrating LLMs’ reasoning, yet correct input-outputs (i.e., passing tests) are often scarce or unavailable in real-world scenarios. To address this challenge, our insight is that outputs consistently returned by both the PUT and all alternative implementations have a high probability of being the correct outputs of the PUT, as the PUT and alternative implementations are generated by independent agents (i.e., human developers and LLMs). Based on this insight, we propose FAiLGen, a novel approach that calibrates LLM’s reasoning for failing tests generation via a representative reasoning calibration paradigm, Monte Carlo Tree Search. We evaluate FAiLGen on 100 subjects from CodeForces and 100 subjects from SWE-Bench-Live. Our evaluation results show that FAiLGen achieves a recall of 58.1%, which is 62.4% higher than that of the best baseline (35.8%). Meanwhile, FAiLGen attains a precision of 75.2%, favorably compared to the best baseline (61.1%). Article Search Artifacts Available Article: ase26main-p1022-p doi:10.1145/3832783.3837478
	Li, Lei	ASE '26: "Aligning User Requirement ..." Aligning User Requirement with Large Language Model in Code Generation Jia Li, Ruiqi Bai, Yangkang Luo, Yiran Zhang, Wentao Yang, Zeyu Sun, Tiankuo Zhao, Dongming Jin, Lei Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Institute of Software at Chinese Academy of Sciences, China; Peking University, China; University of Hong Kong, Hong Kong) Code generation refers to automatically producing executable programs from user requirements. Recently, researchers have explored approaches to enhance the correctness of generated code with advanced large language models. Although achieving improvements, existing approaches focus on designing reasoning strategies or post-refinement methods to enhance code generation performance. Despite their differences, all these methods share a common assumption: the LLM can correctly understand the given requirement. However, this assumption does not always hold. To fill this gap, we propose REA-Coder, a requirement alignment approach to enhance the code generation performance of LLMs. REA-Coder involves first identifying the requirement content that does not align with LLMs and aligning the requirements. Then, based on the aligned requirements, LLMs generate code and further verify whether the generated code aligns with the requirements, iterating this process of requirement alignment and code generation until generating correct code or achieving the maximum number of iterations. Experimental results show that REA-Coder outperforms all advanced baselines on four LLMs across five programming benchmarks. Concretely, REA-Coder achieves average improvements of 7.93%, 30.25%, 26.75%, 8.59%, and 8.15% on the five benchmarks, demonstrating the effectiveness of requirement alignment for improving the code generation performance of LLMs. Article Search Article: ase26main-p1298-p doi:10.1145/3832783.3837487
	Li, Li	ASE '26: "Source-Free Detection and ..." Source-Free Detection and Impact Analysis of Compiler Optimization Problems in Mobile Applications Han Hu, Xiaoheng Xie, Bo Sun, Jian Gu, Gang Fan, and Li Li (Independent Researcher, Hong Kong; Independent Researcher, China; Monash University, Australia; Beihang University, China) Mobile apps frequently suffer from frame drops, overheating, and excessive power consumption. While developers optimize algorithms and debug code, a critical bottleneck often goes unnoticed: native libraries compiled with low optimization levels (O0/O1 instead of O2/O3). Because these libraries execute without functional errors, the resulting performance degradation remains hidden in production apps. We present OptDetect, a source-free framework that detects compiler optimization problems directly from app binaries. OptDetect handles mixed optimization levels through binary disassembly, chunk-level classification, and weighted score aggregation, achieving 93.0% accuracy on controlled datasets and 81.9% on real-world datasets. Applying OptDetect to 21,972 native libraries from 830 top-ranked Google Play apps, we find that 30.5% of libraries use low optimization levels, affecting 91.7% of apps. Through case studies on 12 production apps, fixing detected issues reduces CPU instructions by 10-63% (median: 20.5%) for commercial apps and 15-58% (median: 32%) for open-source apps. Performance complaints decrease in 5 of 6 commercial apps, and ratings increase in 5 of 6. Further investigation reveals that widely-used third-party libraries are themselves distributed at low optimization levels, with 49.7% of 1,073 libraries in a major repository exhibiting this problem. These findings show that compiler optimization problems are common, source-free detectable, and practically consequential in mobile app ecosystems. Article Search Article: ase26main-p135-p doi:10.1145/3832783.3834340
	Li, Lian	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Li, Meilin	ASE '26: "Testing Static Analyzers via ..." Testing Static Analyzers via Semantic-Preserving Mutators Learned from Real-World Refactoring Practice Meilin Li, Kaixuan Li, Zifan Xie, Shiyu Qiu, Ming Wen, Maolin Sun, and Hongyu Zhang (Chongqing University, China; Nanyang Technological University, Singapore; Huazhong University of Science and Technology, China; Nanjing University, China) Static analyzers reason about program behavior without execution and report issues when code violates predefined rules. A key limitation is their production of inaccurate, incomplete results, generating spurious warnings and missing critical issues. Metamorphic testing is the most commonly used method to efficiently detect bugs in static analyzers. It requires designing a set of semantic-preserving mutators. When a mutator is applied to a seed program, any discrepancy in the analyzer's reports for the original and mutated versions indicates a potential bug. Thus, efficiently generating large numbers of semantic-preserving mutators is critical. We observe that during routine software maintenance, developers often restructure code to improve readability or optimize it without changing external program behavior. Our key insight is that mining and generalizing these patterns from real-world refactoring practice enables the automatic construction of numerous mutators that reflect the distribution of real-world code variants. We present SAFuzzer, a framework that mines such refactoring practice and distills these edits into semantic-preserving mutators. We ultimately generate 313 mutators and apply them to detect bugs in five widely used Java static analyzers. SAFuzzer detects 42 previously unknown bugs. Compared with five state-of-the-art baselines, SAFuzzer detects the most bugs, demonstrating the value of learning diverse mutators from real-world refactoring practice. Article Search Article: ase26main-p2906-p doi:10.1145/3832783.3837544
	Li, Meizhen	ASE '26: "AlarmClaw: Context-Enriched ..." AlarmClaw: Context-Enriched Alarm Management with Category-/Severity-Aware Incident Graphs Siyu Yu, Meizhen Li, Jiacheng Yang, Yifan Wu, Ning Wang, Zhaoxing Chen, Ming Liu, Xinchi Ren, Xincheng Ren, Chan Li, Tong Jia, Xiang Zhang, and Ying Li (Peking University, China; ByteDance, China) Large-scale production systems rely on monitoring rules and anomaly detectors to trigger alarms that notify site reliability engineers (SREs) of potential failures. Before diagnosis and mitigation can begin, alarm management must construct incident state online by deciding whether each arriving alarm is noise, indicates a potential new incident, or should be associated with an existing incident to enrich its evolving state. Existing alarm-management methods remain difficult to deploy because some rely on reusable operational artifacts such as SOPs or historical prototypes to judge alarm relationships, while graph-based methods often apply the same topology-derived propagation patterns across incidents. In production, such artifacts are often missing or service-specific, and valid propagation paths vary with incident type and severity. We present AlarmClaw, a context-enriched alarm-management system built around these two constraints. AlarmClaw uses bounded context clawing to retrieve compact evidence from auditable operational sources and a category- and severity-aware incident graph to constrain a large language model (LLM) decision agent. An evolution mechanism refreshes reusable context and graph evidence from validated outcomes. On a temporally held-out replay from a production corpus of 51,000 alarms and 9,661 incidents, AlarmClaw achieves 86.0% association Precision and 78.5% Recall, improving F1 by 7.4 points over the strongest adapted baseline. During six months of online operation, evolution updates improve F1 by 2.3 points over a matched fixed-knowledge counterfactual. From January to June 2026, AlarmClaw automatically associated more than 4,800 alarms, conservatively saving at least 4,800 engineer-minutes and reducing the per-alarm association operation from approximately 90 s manually to under 10 s. Article Search Article: ase26ind-p313-p doi:10.1145/3832783.3834524
	Li, Mengze	ASE '26: "Towards Fully Automated Medical ..." Towards Fully Automated Medical Imaging Code Generation via Validation-Based Context Engineering Zixiao Zhao, Jing Sun, Zhe Hou, Cheng-Hao Cai, Qian Liu, Mengze Li, Zijian Zhang, and Jin Song Dong (University of Auckland, New Zealand; Griffith University, Australia; Monash University, Suzhou, China; Beijing Institute of Technology, China; National University of Singapore, Singapore) Large language models (LLMs) have demonstrated considerable promise in program generation for small-scale and conventional application development; however, they remain limited when applied to complex, domain-specific tasks such as medical image processing. General-purpose models lack explicit domain knowledge and robust validation mechanisms to ensure correctness, often requiring substantial human intervention to produce reliable processing pipelines. To address these limitations, we propose AutoMedImg, a multi-agent framework for fully automated medical image processing code generation. AutoMedImg orchestrates specialised agents across two phases: a Planning Phase that performs dataset analysis and architecture design with semantic and formal verification, and a Coding Phase that generates modules in parallel with static checking, execution testing, and assembly validation. This multi-stage validation mitigates error propagation throughout generation, while comprehensive auto-context engineering combining domain-specific knowledge bases, shared memory, and validation feedback automates context construction without manual prompting. A cross-project adaptive pipeline synthesis mechanism further accumulates validated pipelines and retrieves proven components for new tasks based on project similarity, enhancing generation efficiency through cross-project learning. Extensive evaluation across six diverse and well-established medical imaging datasets with five backbone LLMs demonstrates that AutoMedImg achieves zero human intervention, with Dice scores of up to 0.90 for segmentation tasks and 99% accuracy for classification. Article Search Article: ase26main-p1668-p doi:10.1145/3832783.3834399
	Li, Miqing	ASE '26: "Less Is More: Tuning Configurable ..." Less Is More: Tuning Configurable Systems with Imperfect Fidelity Yulong Ye, Miqing Li, and Tao Chen (University of Birmingham, UK) Configuration tuning is essential for optimizing the performance of highly configurable systems, e.g., throughput or runtime, under a given environment. Yet, this is a challenging process as there can be many options to tune, and configuration measurement is often highly expensive. In this paper, we demonstrate the phenomenon of “less can be more”: system configuration tuning can be greatly improved with much superior budget utilization by partially tuning under the imperfect-fidelity—an environment that is similar, but cheaper to measure, compared with the concerned perfect-fidelity of environment under which the system should be tuned. We codify a conceptual framework of fidelity for configurable systems, drawing on which allows us to propose MFTune, a tuner that proactively explores in the space of >104 possible imperfect-fidelity settings to approximate a useful one, which strikes for the wideness of tuning. This creates high-quality seeds for the perfect-fidelity, which in turn ensures the tuning depth. Experiment results against 10 state-of-the-art tuners, obtained from running diverse real-world systems for 19 months 24 × 7, show that MFTune performs considerably better on 83.33% cases with up to 19.34% improvement while achieving hours of budget saving in general. Article Search Article: ase26main-p988-p doi:10.1145/3832783.3834376
	Li, Qi	ASE '26: "Evidence-Grounded Logic Vulnerability ..." Evidence-Grounded Logic Vulnerability Detection for Smart Contracts via Runtime Context Reasoning Guang Gong, Yucong Jiang, Rong Jian, Xiaotao Feng, Zhihan Wei, Qi Li, and Ke Xu (Tsinghua University, China; 360 Vulnerability Research Institute, China) Smart contracts are foundational to DeFi, yet detecting business-logic vulnerabilities, i.e., execution is syntactically correct but violates a contract’s intended behavior, remains difficult. Most recent LLM-based approaches still follow a largely static, source-code–centric auditing paradigm. In practice, however, smart contracts are inherently stateful: many logic flaws emerge only under specific contract states and across particular state transitions. As a result, code-only auditing can produce false positives and miss true vulnerabilities. To address this gap, we present RcAudit, a system for detecting smart-contract logic vulnerabilities via runtime-context–enhanced LLM reasoning. RcAudit constructs a Contract Logic Knowledge Base that captures contract behavior from multiple perspectives to support LLM analysis. It then applies a state- and intent-aware fuzzing strategy to generate logic-critical runtime contexts, and performs LLM reasoning over selected contexts that exhibit potential intent–behavior inconsistencies to pinpoint vulnerabilities. We evaluate RcAudit on three real-world datasets. RcAudit identifies 74 of 132 known logic vulnerabilities with high precision (96.9%), achieving 117.6% higher detection than the strongest baseline. Importantly, RcAudit further uncovers 22 zero-day vulnerabilities in real-world projects. Article Search Artifacts Available Article: ase26main-p839-p doi:10.1145/3832783.3837471
	Li, Rongchen	ASE '26: "LARA: Static ReDoS Detection ..." LARA: Static ReDoS Detection for Regular Expressions with Lookahead via Matching Automata Mengxi Wang, Chengyao Peng, Weihao Su, Guiyi He, Rongchen Li, Hong Huang, and Haiming Chen (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) with lookahead assertions are widely used in modern software, yet their interaction with backtracking engines can cause Regular expression Denial of Service (ReDoS) vulnerabilities. Existing static methods rely on 𝜀-NFA ambiguity analysis, which cannot capture lookahead evaluation cost, while dynamic and hybrid methods incur high cost or incomplete coverage. We present LARA, a static ReDoS detector for regular expressions with lookahead (REwLA), which subsumes standard regexes. Our core contribution is the matching NFA, which transforms a REwLA into a standard 𝜀-NFA. The matching NFA is not language-equivalent to the original REwLA; however, we prove that its match degree equals the la-match degree of the original REwLA, so the same complexity upper bound is preserved, including lookahead overhead. This reduces lookahead-aware ReDoS detection to standard 𝜀-NFA ambiguity analysis, enabling existing detection techniques to be applied directly to the matching NFA. We evaluate LARA on 42,794 deduplicated real-world REwLA. Among 5,889 vulnerabilities jointly confirmed by multiple tools and validated on real backtracking engines, LARA identifies 5,871, outperforming all baselines. On 400 confirmed vulnerable regexes from 177 real-world ReDoS CVEs, LARA achieves 99.50% recall. LARA successfully exploits 4,468 vulnerabilities on real engines, with a median analysis time of 0.05 s and 7.67 MB memory. Article Search Article: ase26main-p997-p doi:10.1145/3832783.3837475 ASE '26: "ReSEDA: Automatic and Precise ..." ReSEDA: Automatic and Precise Program-Level ReDoS Triage via Interprocedural Taint Analysis and Agentic Exploit Generation Rongchen Li, Weihao Su, Chengyao Peng, Hong Huang, Haiming Chen, and Guiyi He (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Regular expressions (regexes) are widely used in computer science, particularly in web services. However, Regular Expression Denial-of-Service (ReDoS) has become a growing security threat. ReDoS is an asymmetric Denial-of-Service attack that exploits the super-linear runtime behavior of regex engines. However, existing ReDoS detection tools only report whether regexes cause the super-linear matching behavior, instead of considering whether the behavior can be triggered in the program context. As a result, triaging such findings remains expensive for developers in practice. We present ReSEDA, an automatic and precise workflow that triages ReDoS alerts and generates executable proofs of concept (PoCs) for vulnerable JavaScript programs. The workflow employs (i) Interprocedural Finite Distributive Subset (IFDS) taint analysis, (ii) Satisfiability Modulo Theories (SMT) solving for supported path-feasibility and ReDoS constraints, and (iii) Large Language Model (LLM) agents for PoC construction with Model Context Protocol (MCP) tools that provide static evidence. From 86 most starred JavaScript projects in GitHub, we confirm that among 637 regexes reported to be vulnerable, there are only 63 regexes which can be exploited by injection through external interfaces, where ReSEDA is able to identify and generate PoCs for 61 of them automatically. We also discover that the assistance of ReSEDA reduces analyst-hours by 8.78× using $2.01 per vulnerability, or by 7.86× for free in a local-LLM setting. Furthermore, ReSEDA uncovered 27 impactful ReDoS vulnerabilities with assigned CVE IDs, including 8 disclosed fully automatically. Article Search Article: ase26main-p2923-p doi:10.1145/3832783.3837545
	Li, Shanping	ASE '26: "EMERGE: Checking Implementation ..." EMERGE: Checking Implementation Equivalence for LLMs via Rule Synthesis Qi Zhan, Xing Hu, Xin Xia, and Shanping Li (Zhejiang University, China) Verifying whether two implementations of the same large language model are equivalent across frameworks is difficult in practice. Even when they implement the same computation, the graphs may differ in operator decomposition, tensor layout, and the use of fused or opaque kernels, making manual rewrite rules hard to build and maintain. We present Emerge, a framework for checking Implementation Equivalence over computation graphs extracted from model implementations. Instead of writing rules manually, Emerge infers candidate relations from execution values, and synthesizes rewrite rules on demand when existing rules are insufficient. Each synthesized rule is then validated using SMT solving when possible and constraint-aware randomized testing for opaque kernels. As these local equivalences accumulate, Emerge eventually establishes whether the two implementations are equivalent. Our implementation targets inference computation graphs captured from HuggingFace Transformers and vLLM. Our evaluation shows that Emerge establishes equivalence for correct implementation pairs at practical cost. It also detects 10 of 13 known implementation bugs, uncovers 8 previously unknown implementation issues that were later confirmed by developers, and localizes the first mismatch when equivalence cannot be established. Article Search Article: ase26main-p1924-p doi:10.1145/3832783.3834405
	Li, Shanshan	ASE '26: "CTForge: Automatically Generating ..." CTForge: Automatically Generating Test Suites for Software Configuration Yuanliang Zhang, Zhizheng Zheng, Shanshan Li, Zhouyang Jia, Chaopeng Luo, Liqian Chen, Zhenbang Chen, Ji Wang, and Xiangke Liao (National University of Defense Technology, China) Software configuration plays a critical role in modern software systems, yet it also frequently leads to severe failures. Existing approaches, whether static analysis or LLM-based validation, struggle to capture implicit semantic constraints and validate configuration-code interactions. Leveraging existing unit tests is also insufficient due to their lack of configuration-specific focus. Thus, we present CTForge, an LLM-powered framework that automatically generates configuration-specific test suites. Its core innovation is a three-stage configuration-aware optimization pipeline that moves beyond vanilla test generation, specifically using parameter semantics to improve LLM outputs. This optimization pipeline iteratively aligns tests through: (1)enhance configuration-related code coverage to ensure relevance, (2) assertion validation across valid parameter values to eliminate false assertions, and (3) configuration-sensitivity verification to select tests that semantically exercise the intended configuration behavior. Evaluated on five large-scale systems, CTForge detects 63 out of 79 real-world configuration issues and achieves an F1-score of 0.88 in misconfiguration detection. CTForge also uncovers six previously unknown defects. Our work demonstrates that structured configuration-aware refinement is essential for LLM to produce effective test suites. Article Search Article: ase26main-p1197-p doi:10.1145/3832783.3837484 ASE '26: "Beyond Syntactic Differencing: ..." Beyond Syntactic Differencing: Semantic-Aware Scheduling for Cross-Configuration Incremental Builds Xiaolong Dai, Shanshan Li, Jun Lyu, and Xintao Niu (Nanjing University, China) Modern configurable software systems are routinely built and tested across thousands of configuration variants to ensure correctness under diverse settings. Reusing build artifacts across configurations is therefore crucial to reduce redundant effort, yet remains challenging. Existing approaches estimate rebuild cost using syntactic option differences and apply greedy scheduling, which often misestimate true costs and yield suboptimal build orders. We present SIBS, the first semantics-aware scheduling framework for incremental builds across configurations, addressing both inaccurate cost estimation and the limitations of greedy scheduling. The key idea is a semantic distance metric that models the impact of configuration changes on rebuild scope by capturing option-level effects on code generation, accounting for global configuration headers, and propagating changes through dependency graphs. This enables cost-aware global scheduling formulated as an Asymmetric Traveling Salesman Problem (ATSP). Across 21 real-world systems and five independently sampled configuration batches, SIBS reduces observed build time relative to the state-of-the-art build scheduler in 17 systems. On average, it saves 196s (21%), with a median saving of 40s (3%), and achieves a 27.7% geometric-mean reduction in build time across projects. Batch-level reductions range from 25.7% to 29.3%, and the scheduling overhead remains modest (median 3.1s; mean 12.9s). These results demonstrate that semantics-aware cost modeling and global scheduling provide substantial and robust efficiency gains across diverse configurable systems. Article Search Artifacts Available Article: ase26main-p2497-p doi:10.1145/3832783.3837533
	Li, Shijie	ASE '26: "CodeFault: Predicting Fault ..." CodeFault: Predicting Fault Risks from Code Changes via Multi-modal Learning Yifan Xiao, Shijie Li, and Yu Huang (Peking University, China; China Southern Power Grid, China) Just-In-Time defect prediction identifies fault-inducing code changes but relies solely on static code properties, missing runtime fault patterns. Meanwhile, log-based anomaly detection captures runtime behaviors but lacks visibility into causal code modifications. This disconnect delays fault identification and complicates root cause analysis. We present CodeFault, a multi-modal fault prediction framework that fuses code change semantics with runtime log patterns through two novel mechanisms. Hierarchical Fault Spectrum Alignment (HFSA) projects both modalities into a shared, two-level fault taxonomy space—four coarse and eight fine-grained categories—providing a structured information bottleneck that enables principled cross-modal knowledge transfer. Spectrum-Guided Cross-Modal Attention (SGCA) performs token-level fusion conditioned on fault spectrum agreement, avoiding the degeneracy of pooled-vector approaches while focusing attention on fault-relevant token pairs. A dual-granularity contrastive objective further leverages the taxonomy structure to separate fault-inducing from benign embeddings at both instance and fault-type levels. We evaluate CodeFault on two complementary testbeds. On the public benchmark of 31,142 samples from Defects4J, BugsInPy, and ManySStuBs4J, CodeFault reaches 0.891 AUC-ROC and 0.857 F1-score against 15 prior-art baselines and 2 self-constructed strong late-fusion controls, improving over the strongest code-only baseline by 5.1% AUC and over the strongest late-fusion control by 3.1% AUC (Wilcoxon signed-rank test, Cliff's δ ≥ 0.73). On 2,147 real co-occurring CI/CD pairs collected from 55 GitHub Actions repositories with the CI build outcome as ground truth—the largest non-synthetic CI/CD fault test set in JIT defect prediction to date—CodeFault reaches 0.843 AUC, +4.3% over JIT-Smart, retaining 94.6% of the synthetic-set headline. The framework generalizes to unseen projects with 2.5% average AUC improvement and maintains 97.9% AUC under realistic 15% positive rates. A knowledge-distilled code-only variant achieves 0.862/0.831 AUC on synthetic/real test sets without log inputs, enabling pre-commit deployment. Article Search Artifacts Available Article: ase26main-p759-p doi:10.1145/3832783.3837462
	Li, Shuang	ASE '26: "Structure-Guided Semantic ..." Structure-Guided Semantic Deobfuscation of Android Identifiers Mingyang Chen, Zhentao Xie, Yaqi Gao, Shuang Li, and Wenrui Diao (Shandong University, China) Android developers frequently employ identifier renaming to obfuscate code and hinder reverse engineering. This practice effectively conceals program semantics. However, it severely impedes downstream security analysis tasks, particularly manual inspection of malicious and privacy-sensitive behaviors. Existing deobfuscation techniques rely on code similarity, learned naming priors, or local LLM reasoning. These methods often exhibit severe limitations when applied to proprietary, heavily obfuscated, or cross-file context-dependent code. In this paper, we present DeMask, a novel framework that integrates static program analysis with Large Language Models (LLMs) to recover meaningful identifiers from obfuscated Android apps. Guided by program structure, DeMask executes a bottom-up, context-aware inference process for whole-app semantic reconstruction. It incorporates tailored naming constraints and optimization strategies to mitigate LLM hallucinations and ensure scalability for real-world codebases. We implemented a prototype and evaluated it on diverse datasets of benign and malicious Android apps. The results demonstrate that DeMask significantly outperforms prior work in semantic accuracy and naming consistency. Specifically, it achieves an average effective semantic recovery of over 88.6% across all evaluation settings. Article Search Article: ase26main-p2252-p doi:10.1145/3832783.3837525
	Li, Siyuan	ASE '26: "ExcavatorFuzz: LLM-Guided ..." ExcavatorFuzz: LLM-Guided Path-Difficulty-Driven Directed Greybox Fuzzing Kaiyu Xie, Siyuan Li, Jiaqian Peng, Yun Yang, Yaowen Zheng, Kai Cheng, Jiayu Zhang, Shizhao Tian, Yubo Li, and Hongsong Zhu (Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China; Shandong University, China) Directed greybox fuzzing (DGF) is effective at steering mutations toward vulnerable code regions, but its efficiency is often limited by two bottlenecks: misprioritized target-reaching paths and hard-to-satisfy blocking predicates. We present ExcavatorFuzz, an LLM-assisted DGF framework that addresses both challenges in a unified workflow. ExcavatorFuzz first performs CLI-aware feasibility filtering to prune configuration-infeasible paths, and then ranks the remaining candidate paths using a lightweight difficulty metric that approximates their relative tractability based on explicit predicate complexity and implicit data-dependency complexity. During fuzzing, ExcavatorFuzz monitors line-level progress to detect blocked paths and invokes the LLM to synthesize or refine seeds for unsatisfied predicates using structured feedback. We evaluate ExcavatorFuzz on 30 real-world C/C++ benchmarks. ExcavatorFuzz triggers 29 out of 30 known vulnerabilities within 24 hours and achieves an average 4.34x speedup in time-to-exposure over seven state-of-the-art fuzzers. It also discovered three previously unknown vulnerabilities in open-source projects, two of which have been assigned CVE IDs. Article Search Article: ase26main-p1484-p doi:10.1145/3832783.3837497
	Li, Tianlin	ASE '26: "Not as Sweet by Another Name: ..." Not as Sweet by Another Name: An Empirical Study of Format Robustness in LLM Document Workflows Xiaoyu Zhang, Xianyun Cheng, Tianlin Li, Yuwei Zheng, Yue Yang, and Yang Liu (Nanyang Technological University, Singapore; National University of Singapore, Singapore; Beihang University, China; Xi'an University of Architecture and Technology, China) LLM-driven software systems are rapidly evolving from plain-text conversations to document-centric end-to-end workflows, where the same semantic content can be delivered in diverse document formats (e.g., CSV) through file upload interfaces. Yet existing testing work focuses on the robustness and reliability of models and systems whose input is a single prompt string, leaving a critical question unanswered: Can these document workflows maintain robust behaviors when the same content arrives in a different document format? To fill the gap, in this paper, we propose a format-aware metamorphic testing framework with three metamorphic relations to comprehensively evaluate the format robustness of end-to-end LLM document workflows. Based on this framework, we conduct a large-scale empirical study spanning four representative LLM workflows, four real-world tasks, and four document formats, comprising a total of 48,000 workflow executions. Our findings reveal that format variation poses a systematic and serious threat. Merely switching formats can cause accuracy to drop by up to 53.63% and trigger decision drifts in over 41% of instances. We further design lightweight mitigation strategies from the users’ perspective that recover up to 44.21% of format-induced decision drift without model retraining. Our study demonstrates that document format is not a neutral wrapper but a critical factor affecting the reliability of LLM software systems, calling for corresponding testing and safeguards in the deployment in real-world high-stakes scenarios. Article Search Article: ase26main-p718-p doi:10.1145/3832783.3837456
	Li, Toby Jia-Jun	ASE '26: "Programming by Chat: A Large-Scale ..." Programming by Chat: A Large-Scale Behavioral Analysis of 11,579 Real-World AI-Assisted IDE Sessions Ningzhi Tang, Chaoran Chen, Zihan Fang, Gelei Xu, Maria Dhakal, Yiyu Shi, Collin McMillan, Yu Huang, and Toby Jia-Jun Li (University of Notre Dame, USA; Vanderbilt University, USA) IDE-integrated AI coding assistants, which operate conversationally within developers' working codebases with access to project context and multi-file editing, are rapidly reshaping software development. However, empirical investigation of this shift remains limited: existing studies largely rely on small-scale, controlled settings or analyze general-purpose chatbots rather than codebase-aware IDE workflows. We present, to the best of our knowledge, the first large-scale study of real-world conversational programming in IDE-native settings, analyzing 74,998 developer messages from 11,579 chat sessions across 1,300 repositories and 899 developers using Cursor and GitHub Copilot. These chats were committed to public repositories as part of routine development, capturing in-the-wild behavior. Our findings reveal three shifts in how programming work is organized: conversational programming operates as progressive specification, with developers iteratively refining outputs rather than specifying complete tasks upfront; developers redistribute cognitive work to AI, delegating diagnosis, comprehension, and validation rather than engaging with code and outputs directly; and developers actively manage the collaboration, externalizing plans into persistent artifacts, and negotiating AI autonomy through context injection and behavioral constraints. These results provide foundational empirical insights into AI-assisted development and offer implications for the design of future programming environments. Article Search Article: ase26main-p1071-p doi:10.1145/3832783.3834377
	Li, Tsz-On	ASE '26: "FAiLGen: Calibrating LLM for ..." FAiLGen: Calibrating LLM for Failing Test Generation with Monte Carlo Tree Search Tsz-On Li, Xiaochuan Yan, Dehui Yi, Yuhang Jiang, Kexin Li, Congying Xu, Ying Wang, and Shing-Chi Cheung (Hong Kong University of Science and Technology, Hong Kong; Northeastern University, China) Failing test generation is an important yet challenging task in software engineering. It involves searching a vast space to identify fault-triggering test inputs and the oracles that assert these faulty executions. Several approaches have been proposed for generating failing tests. Specifically, given a program-under-test (PUT) and its requirements, these approaches leverage large language models (LLMs) to generate alternative implementations of the PUT that comply with the requirements, followed by differential testing between the PUT and the alternative implementations. Failing tests can be constructed by adopting the inconsistency-revealing inputs as the test inputs and treating the outputs returned by the alternative implementations as expected outputs. As alternative implementations may also contain faults and thus return incorrect outputs, current methods rely on either output consistency across alternative implementations or pre-constructed test cases for validation. However, the former is susceptible to LLM training biases or stochasticity, while the latter can be impractical due to the scarcity or unavailability of pre-constructed test cases in real-world scenarios. To address existing works’ limitations, we employ LLM as an alternative oracle for output validation, and calibrate its reasoning steps to reduce its susceptibility to LLM training biases or stochasticity. One critical challenge is that the calibration process inherently requires correct input-output pairs for the output validation task as ground-truth for reference when validating/calibrating LLMs’ reasoning, yet correct input-outputs (i.e., passing tests) are often scarce or unavailable in real-world scenarios. To address this challenge, our insight is that outputs consistently returned by both the PUT and all alternative implementations have a high probability of being the correct outputs of the PUT, as the PUT and alternative implementations are generated by independent agents (i.e., human developers and LLMs). Based on this insight, we propose FAiLGen, a novel approach that calibrates LLM’s reasoning for failing tests generation via a representative reasoning calibration paradigm, Monte Carlo Tree Search. We evaluate FAiLGen on 100 subjects from CodeForces and 100 subjects from SWE-Bench-Live. Our evaluation results show that FAiLGen achieves a recall of 58.1%, which is 62.4% higher than that of the best baseline (35.8%). Meanwhile, FAiLGen attains a precision of 75.2%, favorably compared to the best baseline (61.1%). Article Search Artifacts Available Article: ase26main-p1022-p doi:10.1145/3832783.3837478
	Li, Tun	ASE '26: "Looks Good, but Does It Run? ..." Looks Good, but Does It Run? A Large-Scale Empirical Study of the Executability of Example Code in Model Cards Simeng Yao, Jialin Zhao, Yang Zhang, Tun Li, Tao Wang, Changrong Xie, Zezhou Tang, and Yiwen Wu (National University of Defense Technology, China) Model cards document how machine learning models should be understood, evaluated, and reused in practice. Many also provide example code to help users access and use models, yet the executability of such code remains understudied. We take Hugging Face as an open model repository and conduct an empirical study of model-card example code. Among 291 model cards, 68.38% of the example-code snippets fail to run, suggesting that execution failures are common and may hinder model reuse. To characterize these failures, we construct a taxonomy comprising fifteen error categories and twenty-four subcategories and distill fifty reusable repair strategies. Based on these findings, we develop CardCodeFixer, a tool for automated repair. Experimental results show that CardCodeFixer increases executability from 29.63% to 56.08% with GPT-4o and from 31.75% to 51.85% with DeepSeek-v3. These results characterize execution problems in model-card example code and show that automated repair can improve executability. Article Search Artifacts Available Article: ase26main-p1672-p doi:10.1145/3832783.3837507
	Li, Wangcai	ASE '26: "UCT: A Versatile Code Translation ..." UCT: A Versatile Code Translation Framework Based on a Unified Intermediate Representation Wangcai Li, Dongyan Wang, Zehong Yu, Yifan Cheng, Ning Ge, Chunming Hu, and Zhuo Su (Beihang University, China; Renmin University of China, China; Tsinghua University, China; University of Electronic Science and Technology of China, China) Model-driven design often requires the same model to support multiple downstream tasks, such as simulation, testing, verification, and deployment. However, existing tools usually build separate translation workflows for different tasks, causing repeated model parsing, redundant semantic reconstruction, and limited reuse across toolchains. In this paper, we present UCT, a versatile code translation framework based on a unified intermediate representation (CIR). UCT translates models into CIR once, preserves executable semantics, structural information, scheduling relations, and model-code mappings, and then generates task-specific code through unified instrumentation and backend translation. We implemented UCT and evaluated it on Simulink benchmark models. The results show that UCT can generate usable customized code for simulation, testing, verification, and deployment. The generated binary artifacts also provide additional benefits, improving model testing coverage by 85.9% on average and accelerating simulation by 19.8× on average over Simulink Rapid Accelerator. The video is presented at https://youtu.be/CCu5iO853p4. The implementation is available at https://github.com/CodeGen123/UCT. Article Search Article: ase26tool-p111-p doi:10.1145/3832783.3834636
	Li, Wei	ASE '26: "IcFuzz: Fuzzing Isaac Sim ..." IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation Zhixiang Chen, Zhuangbin Chen, Ruoxi Jia, Zeqin Liao, Wei Li, Jinyang Liu, and Zibin Zheng (Sun Yat-sen University, China; Nanyang Technological University, Singapore; Chinese University of Hong Kong, Hong Kong) Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190%–205% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers. Article Search Article: ase26main-p3261-p doi:10.1145/3832783.3837550 ASE '26: "SAF: An AI-Agent-Ready and ..." SAF: An AI-Agent-Ready and Browser-Accessible Static Analysis Framework for LLVM IR Yuekang Li, Wei Li, Wei Song, Yi Liu, and Gelei Deng (University of New South Wales, Australia; Griffith University, Australia; Nanyang Technological University, Singapore) Static program analysis finds bugs before software ships, and modern checkers for C/C++ depend on whole-program infrastructure: pointer analysis, value-flow tracking, taint analysis, and IFDS-based data flow on top of LLVM. Today’s LLVM-IR frameworks fall short. SVF, Phasar, and Lotus expose their analyses through C++ APIs that require subclassing, recompilation, and pinned LLVM builds; onboarding takes months. CodeQL replaces the C++ API with a domain-specific query language. None is designed for the AI coding agents that increasingly drive software-engineering work. We present the Static Analyzer Factory (SAF), an LLVM-IR analysis framework that combines a Rust kernel exposed to Python through PyO3 zero-copy bindings, a WebAssembly and Pyodide browser playground that runs the same SDK with no install, a declarative YAML language for function specifications that the built-in checkers consume at runtime, and two shipped coding-agent skills installable in Claude Code and Codex. As an illustrative case, SAF’s bundled memory-safety checkers were themselves authored end-to-end through this workflow using Claude Code on the Opus 4.6 model. On the NIST Juliet C/C++ benchmark, these checkers achieve the best F1 on three of four memory-safety CWEs, each measured against whichever of SVF and Lotus ships a corresponding checker. Code: https://github.com/Static-Analyzer-Factory/static-analyzer-factory. Documentation and browser playground: https://static-analyzer-factory.github.io/static-analyzer-factory/. Demo video: https://youtu.be/Cj58VvNCrlw. Article Search Article: ase26tool-p8-p doi:10.1145/3832783.3834597
	Li, Weiguo	ASE '26: "LLM-Assisted Joint Ticket ..." LLM-Assisted Joint Ticket and Log Analysis for Incident Triage in Intelligent and Connected Vehicles Ruowei Fu, Shenglin Zhang, Wenwei Gu, Weiguo Li, Yongqian Sun, and Dan Pei (Nankai University, China; Huawei, China; Tsinghua University, China) With the rapid development of intelligent and connected vehicles (ICVs), in-vehicle systems have grown increasingly complex, leading to frequent anomalies in real-world usage. To maintain a high-quality user experience, efficient incident triage is essential for timely issue resolution. However, with the growing volume and complexity of incidents, traditional manual triage processes are becoming increasingly insufficient. Recent advances in large language models (LLMs) have demonstrated strong capabilities in reasoning and natural language understanding, offering new opportunities for automation. We propose InsightTriage, an end-to-end automated incident triage system designed and deployed for real-world industrial scenarios, which leverages LLMs to jointly analyze user queries and vehicle logs to generate accurate and explainable triage results. To address the lack of domain-specific knowledge, InsightTriage first constructs a component-level structured knowledge base in an offline phase by leveraging LLMs to automatically extract knowledge from historical vehicle logs. In the online phase, to mitigate the context length limitations of LLMs in log analysis, InsightTriage introduces a log retriever pretrained with contrastive learning, which efficiently identifies query-relevant log entries. Comprehensive experiments conducted on a dataset collected from the production environment of a top-tier global supplier for ICVs, demonstrate that InsightTriage achieves superior performance, reaching a weighted F1-Score of 0.801 (an improvement of 0.137 over the best baseline), while also providing explainable triage reports. Article Search Article: ase26ind-p283-p doi:10.1145/3832783.3834521
	Li, Xiangdong	ASE '26: "SpecFSM: Extracting and Repairing ..." SpecFSM: Extracting and Repairing Finite State Machines from Protocol Specification Documents Xiangdong Li, DaWei Huang, Jingjing Guan, and Hui Li (Beijing University of Posts and Telecommunications, Beijing, China) Finite state machines (FSMs) are a fundamental abstraction for modeling dynamic system behavior and are widely used in protocol analysis. However, automatically extracting FSMs from natural-language specifications remains challenging. Protocol documents are often lengthy and structurally complex, with state-transition descriptions scattered across the text. As a result, large language models (LLMs) operating under incomplete context are prone to generating spurious transitions and logically flawed FSMs. In this paper, we propose SpecFSM, a framework for the automatic extraction and repair of protocol FSMs from natural-language specifications. SpecFSM combines state completion, evidence tracing, and formal verification into a unified pipeline that infers missing states, constrains incorrect transitions, and repairs logical defects in the extracted models. Experiments on multiple protocol documents show that SpecFSM improves the average number of correctly extracted state transitions by 54.7% over existing methods, while producing FSMs with stronger logical validity and better interpretability. Article Search Artifacts Available Article: ase26main-p13-p doi:10.1145/3832783.3834331
	Li, Xiaofeng	ASE '26: "AutoFLC: An LLM-Based Flowchart ..." AutoFLC: An LLM-Based Flowchart Generation Tool for Legacy Code Repository Yixing Luo, Longxing Yang, Xiaofeng Li, Bin Gu, and Zhi Jin (Beijing Institute of Control Engineering, China; Peking University, China) Code comprehension remains a major bottleneck in maintaining large-scale legacy code repositories, particularly due to their complex intra-procedural control flows and lack of up-to-date documentation. While textual summaries generated by large language models (LLMs) provide semantic insights, they fail to intuitively represent non-linear control logic. Visual flowcharts are therefore highly desirable, yet existing automated approaches either produce cluttered diagrams or generate syntactically invalid scripts that cannot be rendered. To address these challenges, we present AutoFLC, a general-purpose tool to transform repository-scale legacy codebases into comprehensive visual flowcharts. AutoFLC combines static analysis for precise function extraction with a renderer-in-the-loop self-correction mechanism. This tool iteratively refines the generated PlantUML script to guarantee syntactic validity, thereby ensuring the successful rendering of the final visual flowchart. Evaluations on three real-world aerospace systems demonstrate that AutoFLC achieves a flowchart generation success rate exceeding 99%. A user study with 10 industrial practitioners further confirms that the generated flowcharts significantly reduce cognitive load and effectively support logic comprehension. The tool is publicly available at https://github.com/dfjdkjkdf/AutoFLC/tree/main under the MIT License, with a demonstration video accessible at https://youtu.be/AeEi9Nbw7xI. Article Search Article: ase26tool-p107-p doi:10.1145/3832783.3834635
	Li, Xiaolei	ASE '26: "GraphDroid: Asynchronous LLM-Based ..." GraphDroid: Asynchronous LLM-Based Mobile App GUI Testing via History-Aware Exploration and Hybrid Intent Fulfillment Xiaolei Li, Jialun Cao, Zhijian Hou, Yuzhi Zhao, Yepang Liu, and Shing-Chi Cheung (Hong Kong University of Science and Technology, China; Southern University of Science and Technology, China; Guangzhou HKUST Fok Ying Tung Research Institute, China; City University of Hong Kong, China) Automated GUI testing is a widely adopted technique for ensuring mobile application quality by simulating user interactions to exercise functionalities. Despite the research breakthroughs in the past decades, covering complex functionalities that require multi-step action sequences still remains challenging. Traditional tools lack semantic understanding capability and can rarely synthesize such action sequences. Recent LLM-based tools can generate test intents describing target functionalities and leverage the LLM to fulfill the intents, but suffer from three key limitations: 1) loss of historical context for identifying uncovered functionalities, 2) synchronous intent generation that blocks exploration, and 3) per-step LLM-driven fulfillment incurring high cost and latency. To address these limitations, we propose GraphDroid, an intent-driven GUI testing framework that integrates a cluster-based memory mechanism to effectively identify uncovered functionalities from historically visited states for comprehensive application testing. For improving testing efficiency, GraphDroid adopts an asynchronous intent generation paradigm that eliminates the latency bottleneck and a hybrid intent fulfillment strategy that reserves the LLM for fulfilling complex intents while delegating simple intents to a lightweight heuristic algorithm. We evaluate GraphDroid on 41 real-world Android apps against six state-of-the-art baselines. Results show that GraphDroid outperforms all baselines, achieving up to 36.4% higher code coverage while incurring less than one eighth of the cost of the best pure LLM-based baseline. GraphDroid also exposes 19 bugs in the 41 apps and detects 13 of 52 crashes in the Themis bug benchmark, surpassing all the six baselines. Seven of the 19 bugs were previously unknown and we reported them to the developers. So far, four bugs have been confirmed and fixed. Article Search Article: ase26main-p609-p doi:10.1145/3832783.3837449
	Li, Xuandong	ASE '26: "S2CAgent: A Self-Learning ..." S2CAgent: A Self-Learning Agent Knowledge Graph Framework for Software Supply Chain Analysis Youfei Huang, Zhong Li, Minxue Pan, and Xuandong Li (Nanjing University, China) The extensive reuse of open-source software (OSS) accelerates development. However, it also creates increasingly complex software supply chains (SSCs) and intensifies the attacker-defender asymmetry, making attacks "low-cost, high-impact, and hard-to-detect." Software Bill of Materials (SBOMs) and Software Composition Analysis (SCA) are widely used for SSC analysis, but both have clear limitations. SBOMs frequently lack vulnerability information, while SCA tools are typically limited to specific ecosystems. To address these limitations, we first construct a multi-source software supply chain knowledge graph (SSCKG) that unifies heterogeneous information and supports continuous evolution through automated updates. Building on this foundation, we propose S2CAgent, a neural-symbolic large language model (LLM) agent framework for SSC analysis. S2CAgent supports natural language questions by inducing symbolic reasoning rules from the SSCKG. These rules align complex questions with underlying graph semantics and multi-hop reasoning patterns. Furthermore, the agent leverages structured evidence from the SSCKG and unstructured web knowledge, thereby mitigating LLM hallucinations and alleviating knowledge incompleteness. In addition, it incorporates a self-learning mechanism that synthesizes and refines tool-augmented trajectories to improve future reasoning. We evaluate S2CAgent on a newly constructed cross-ecosystem benchmark that includes three core tasks: vulnerability impact assessment, software dependency analysis, and license compliance checking. Experimental results show that S2CAgent outperforms baselines across multiple metrics and remains stable under complex multi-hop reasoning. In particular, S2CAgent has been deployed at a leading ICT corporation, where it effectively handles complex real-world analysis cases, further demonstrating its practical utility. Article Search Article: ase26main-p1823-p doi:10.1145/3832783.3837513 ASE '26: "From Vibe to Spec: An Empirical ..." From Vibe to Spec: An Empirical Study to Demystify Specifications in Code Generation Ruirui He, Hanqing Lu, Lezhi Ma, Kai Ye, Qiong Wu, Shangqing Liu, Lei Bu, and Xuandong Li (Nanjing University, China) Recent advances in large language models (LLMs) for code generation have given rise to vibe coding, a programming practice in which developers interact with LLMs through unstructured natural language and primarily validate implementations by inspecting overall execution outputs. However, the inherent ambiguity and inconsistency of natural language present substantial challenges for generating complex and large-scale software systems. To mitigate these limitations, an emerging AI programming paradigm—specification-driven development—advocates providing LLMs with precise and consistent specifications to guide code generation. Despite its promise, fundamental questions regarding the appropriate forms of specifications and the granularity at which they should be supplied to LLMs remain largely unexplored. To address this gap, we present the first empirical study that systematically investigates the impact of two orthogonal dimensions of specifications—form and granularity—on the effectiveness of LLM-based code generation. We construct a dataset comprising five medium-sized software projects, ranging from several hundred to over one thousand lines of code, implemented in multiple programming languages and spanning diverse application domains (e.g., system utilities and games). For each project, we design specifications in three forms—natural language, coarse-grained pseudocode, and fine-grained pseudocode—to capture the form dimension. To examine granularity, we further decompose the fine-grained pseudocode into four levels of input granularity: line-level, function-level, module-level, and project-level. Using this dataset, we evaluate code generated by three representative models, GPT-5, DeepSeek-V3.1, and Qwen-3.7. Evaluation is conducted using a comprehensive set of metrics, including text-similarity-based metrics (e.g., BLEU-4 and CodeBLEU), test-based metrics (e.g., accuracy), and human-centered metrics (e.g., usability and logical consistency). Our results demonstrate that using fine-grained, structured pseudocode specifications significantly enhances generation stability and quality. Regarding granularity, while coarser-grained specifications (project and module level) generally achieve higher code quality, organizing specifications at the module level provides the best overall balance between quality, stability, and token efficiency. Moreover, additional analyses indicate that this module-level granularity yields the most user-friendly outcome for human developers. Article Search Article: ase26main-p1876-p doi:10.1145/3832783.3837515 ASE '26: "LintCFG: DSL-Driven Linter ..." LintCFG: DSL-Driven Linter Configuration Generation for Coding Standards Yi Tang, Zejun Zhang, Zhenchang Xing, Minxue Pan, Tian Zhang, and Xuandong Li (Nanjing University, China; CSIRO's Data61, Australia) Coding standards are essential for code quality, but configuring linters to enforce them remains manual, error-prone, and hard to maintain. We present LintCFG, a tool that automates linter configuration generation from natural language coding standards. It leverages a domain-specific language (DSL) to structurally represent coding rules and an LLM-based compilation pipeline to produce tool-specific configurations. Our evaluation shows that the tool achieves over 70% accuracy and more than double the precision of existing LLM-based baselines for Checkstyle (Java) and ESLint (JavaScript), confirming its effectiveness and generality. Source code is available at https://github.com/crowdedplus/gen-linter-config, SKILL is available at https://github.com/idiomaticrefactoring/LintConfig/, and a video demonstration is available at https://www.youtube.com/watch?v=95wk0jsogAY. Article Search Article: ase26tool-p96-p doi:10.1145/3832783.3834632
	Li, Xutian	ASE '26: "FeatX: Editing Software by ..." FeatX: Editing Software by Editing Features for Repository-Level Code Evolution Xutian Li, Yifeng Zhu, Xianlin Zhao, Yanzhen Zou, Lu Zhang, and Bing Xie (Peking University, China) Large language models (LLMs) are increasingly used for software evolution, yet most interaction paradigms remain code-centric and require manual context management and prompt iteration. We present FeatX, a feature-oriented tool for editing software by editing features. Given an existing repository, FeatX extracts a hierarchical epic-feature structure with explicit feature-to-code mappings, then invokes a three-stage Evolution Agent to translate feature edits into code patches. The workflow is exposed through four coordinated panels. Across a controlled user study and replay experiments on 38 real-world feature-editing commits, FeatX significantly reduces cognitive load and improves usability compared with vanilla ChatGPT. It also achieves a 42.6% relative improvement in function-level modification localization F1 over strong LLM baselines, at substantially lower cost ($0.07 in total). The tool and collected dataset are available at https://github.com/PKU-SoftwareReuse/FeatX, with a demonstration video at https://youtu.be/OZqKZ4Ii-yM. Article Search Artifacts Available Article: ase26tool-p157-p doi:10.1145/3832783.3834646
	Li, Xuyang	ASE '26: "Conflict Extraction in Probabilistic ..." Conflict Extraction in Probabilistic Datalog Analyses Siyu Chen, Chungha Sung, Xuyang Li, and Jingbo Wang (Purdue University, USA; Amazon Web Services, USA) Probabilistic extensions of Datalog enable static analyses such as pointer analysis, data race detection, and side-channel analysis to rank alarms by likelihood, but this added expressiveness also introduces a new challenge absent from deterministic analyses: the final output may contain alarms that are individually plausible yet mutually inconsistent, because marginal probabilities do not guarantee joint satisfiability. As a result, developers may spend effort investigating combinations of alarms that can never co-occur in any possible world. We address this problem by formalizing such inconsistencies as minimal unsatisfiable subsets (MUSes) and introducing PPProbe, a conflict extractor specialized for probabilistic Datalog analyses. Rather than improving MUS enumeration in general, PPProbe exploits the structure of Datalog derivation graphs to guide the search toward likely conflicts and prune the search space through bottom-up UNSAT inference. We evaluate PPProbe on 70 benchmarks from power side-channel analysis, data race detection, semantic diffing, and Bayesian-network inference. The results show that PPProbe achieves 2.5–24× higher throughput than state-of-the-art MUS enumerators, and that the conflicts it identifies yield a conservative estimate of false-positive reduction, filtering out an average of 47.7% of mutually inconsistent alarms. Article Search Article: ase26main-p1888-p doi:10.1145/3832783.3834404
	Li, Yang	ASE '26: "Specification-Guided Synthesis ..." Specification-Guided Synthesis of Deadlock-Free Communication Protocol Refinements with Large Language Models Yang Li, Ping Hou, and Nobuko Yoshida (University of Oxford, UK) Ensuring behavioural correctness in communication protocols is a central challenge in distributed software systems, as subtle inconsistencies can lead to deadlocks. In such settings, protocol refinement – the safe substitution of a protocol that preserves correctness and compatibility with other components – is essential. Large language models (LLMs) have demonstrated strong capabilities in code generation and program synthesis, yet lack mechanisms to reliably produce outputs with correct behaviour. Formal specification approaches, such as multiparty session types (MPST), offer rigorous guarantees, including deadlock freedom, but provide limited support for automatically constructing protocol refinements. In this paper, we present Syntropy, a framework for synthesising protocol refinements guided by MPST specifications and LLMs. It incorporates refinement constraints directly into the generation process, ensuring the generated variants satisfy these guarantees. Our comprehensive evaluation indicates that Syntropy achieves 95.6%–99.5% validity while maintaining high syntactic correctness, and produces diverse, non-trivial refinements across multiple LLMs. Article Search Article: ase26main-p825-p doi:10.1145/3832783.3837469
	Li, Yanliang	ASE '26: "MicroWeaver: A Constraint-Guided ..." MicroWeaver: A Constraint-Guided Structure–Semantic Aware Approach to Automated Microservice Decomposition Huitian Xue, Kairui Zhang, Chenxi Zhang, Zheng Li, Chuan Luo, Yilong Yang, Tianyu Wo, Chunming Hu, Yanliang Li, Yang Zhou, Penghao Zhang, Tiezi Zhang, and Renyu Yang (Beihang University, China; Xidian University, China; Queen's University Belfast, UK; Independent Researcher, China; Kuaishou, China) Microservice architecture is a pivotal paradigm for refactoring monolithic systems to improve maintainability and evolvability. However, automated, explainable decomposition remains a difficult task, especially when balancing structural soundness with semantic consistency in complex legacy systems. We present MicroWeaver, an automated microservice decomposition approach that reconciles both structural and semantic characteristics. MicroWeaver combines static program analysis and dynamic tracing at runtime to construct a high-fidelity, class-level dependency model, and learns numerical embeddings that capture both the structural characteristics and semantic properties embodied in these dependencies. We introduce multiple constraints for representing core design principles (e.g., high cohesion, low coupling, etc.) and formulate the decomposition as a multi-objective optimization problem. MicroWeaver uses an LLM-agent-based optimization strategy to automatically navigate the solver towards a Pareto-optimal region that balances structural dependencies, semantic coherence and inter-service communication cost. We conduct comprehensive experiments on five real-world systems. Results show that MicroWeaver overcomes key limitations of clustering-based methods that ignore semantic context and LLM-based approaches that lack robust structural constraints, and thus attains competitive structural and semantic scores. MicroWeaver is used as a production-ready architectural refactoring framework in industrial settings. Its robust, multidimensional performance and high degree of interpretability furnish practitioners with actionable and comprehensive insights, thereby facilitating more informed and systematic refactoring processes. Article Search Article: ase26ind-p19-p doi:10.1145/3832783.3834457
	Li, Yi	ASE '26: "TasmScan: Continuation-Aware ..." TasmScan: Continuation-Aware Taint Analysis for TVM Bytecode with Savelist Abstraction Yixuan Liu, Yin Wu, and Yi Li (Nanyang Technological University, Singapore; Xi'an Jiaotong University, China) The Open Network, with a peak market capitalization exceeding twenty billion US dollars and more than one hundred seventy five million activated on chain addresses, relies on the TON Virtual Machine to execute smart contracts. The TON Virtual Machine uses first class continuations with savelists to manage control flow and register state across continuation invocations. Because registers captured by savelists allow data to flow across continuation boundaries without passing through the operand stack, bytecode level analyses cannot construct complete data flow tracking without explicitly modeling savelist semantics. We present TasmScan, the first bytecode level static analysis framework for the TON Virtual Machine that enables cross continuation data flow reasoning without requiring source code. TasmScan models savelist semantics through forward register analysis with a formal over approximation guarantee for exactly resolved save sites and locally tracked register definitions. It then lifts bytecode into TASIR, a typed intermediate representation, and performs path sensitive taint analysis with context aware sources to detect defects. We evaluate TasmScan on two thousand nine hundred twenty one contracts from the TON verifier registry and a labeled benchmark of two hundred eight contracts with human confirmed ground truth. On the full corpus, TasmScan resolves two hundred ninety four thousand five hundred forty six dynamic continuation targets with one hundred percent precision. Ablation confirms that savelist propagation is essential for resolving indirect register calls that depend on cross continuation register passing. On the benchmark, TasmScan detects ninety five point three percent of defects across five classes with ninety six point eight percent precision. A stratified sample of three hundred sixty six pairs from the full corpus estimates eighty five point eight percent overall precision. TasmScan offers a seventeen times median speedup over the state of the art symbolic execution baseline and completes one hundred percent of analyses in the path analysis comparison with zero crashes or timeouts. Article Search Article: ase26main-p182-p doi:10.1145/3832783.3834346
	Li, Yichen	ASE '26: "AutoSQL: Extracting SQL Templates ..." AutoSQL: Extracting SQL Templates from Imperative ORM Code in Large-Scale Repositories Junsong Pu, Yichen Li, Zhuangbin Chen, Zhihan Jiang, and Zibin Zheng (Sun Yat-sen University, Zhuhai, China; Chinese University of Hong Kong, Hong Kong) Suboptimal SQL queries can significantly degrade the performance of cloud systems, motivating the extraction and auditing of SQL statements before deployment. However, Go ORM frameworks construct SQL imperatively through scattered method-call sequences, making it difficult to statically recover the resulting SQL templates. We present AutoSQL, a system that reconstructs SQL templates from Go ORM code. AutoSQL constructs a Code Index, a directed graph that captures structural dependencies between functions, types, and global variables as navigable edges. It then traces upstream call chains from ORM invocation sites to identify database-interacting functions as entry points. For each entry point, an LLM agent traverses the Code Index to collect code slices that influence SQL generation, switching to pattern-based search when the graph cannot resolve a retrieval goal. We call this strategy Hybrid Context Retrieval. Once sufficient context is collected, the agent synthesizes SQL templates. Evaluation on a benchmark of 579 test-covered entry points and 1,186 runtime-traced SQL statements from five large-scale Go repositories shows that AutoSQL achieves 68.04% to 72.18% recall, exceeding the static reachability baseline by 11.80% to 15.94% and outperforming existing methods by 8.52% to 48.57%. Article Search Article: ase26main-p169-p doi:10.1145/3832783.3837420 ASE '26: "TypeScript Repository Indexing ..." TypeScript Repository Indexing for Code Agent Retrieval Junsong Pu, Yichen Li, and Zhuangbin Chen (Sun Yat-sen University, Zhuhai, China; Chinese University of Hong Kong, Hong Kong; Sun Yat-sen University, China) Graph-based code indexing can improve context retrieval for LLM-based code agents by preserving call chains and dependency relationships that keyword search and similarity retrieval often miss. ABCoder is an open-source framework that parses codebases into a function-level code index called UniAST. Its existing parsers combine lightweight AST parsers for syntactic analysis with language servers for semantic resolution, but because such resolution requires a JSON-RPC call for each symbol lookup, these per-symbol calls become a bottleneck on large TypeScript repositories. We present abcoder-ts-parser, a TypeScript parser built on the TypeScript Compiler API that works directly with the compiler's AST, semantic information, and module resolution logic. We evaluate the parser on three open-source TypeScript projects with up to 1.2 million lines of code and find that it produces reliable indexes significantly more efficiently than the existing architecture. For a live demonstration, watch: https://youtu.be/ryssr7ouvdE Article Search Article: ase26tool-p59-p doi:10.1145/3832783.3834616
	Li, Yinan	ASE '26: "One Is Not Enough: The Untold ..." One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability Fangyuan Zhang, Lyuye Zhang, Lingling Fan, Chengwei Liu, Yinan Li, Liang Huang, Yang Liu, Zheli Liu, and Sen Chen (Nankai University, China; Nanyang Technological University, Singapore; Qi An Xin Technology Group, China) Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling. Article Search Article: ase26main-p694-p doi:10.1145/3832783.3837455
	Li, Ying	ASE '26: "From Security Findings to ..." From Security Findings to Verified Fixes: Automated Repair of Infrastructure-as-Code Misconfigurations Ying Li, Tamjid Al Rahat, Yingjun Lyu, Omer Tripp, and George Argyros (University of California at Los Angeles, USA; Amazon Web Services, USA) Traditional Infrastructure as Code misconfiguration remediation requires manual analysis, a labor-intensive approach that cannot meet the scale and speed demands of modern cloud deployments. We present IacFix, an agentic tool that combines LLM-based agents with formal methods to enable automated IaC security remediation from security findings to validated patches. IacFix introduces end-to-end remediation capabilities across CDK and CloudFormation packages, leveraging historical fix patterns and iterative refinement to produce validated patches for complex misconfigurations. For example, IacFix achieves 80.9% end-to-end success rate with 97.7% fault localization precision and 7.12 minutes average processing time, demonstrating comparable effectiveness to manual fixes while delivering automated solutions significantly faster. Notably, IacFix outperforms LLM-only baselines by 45 percentage points in real-world scenarios such as dangling hostclass remediation. The system exhibits one-sided error: it either produces a validated patch or safely declines to patch, ensuring that no incorrect patch is surfaced to developers. Our approach shows promising potential for addressing diverse misconfiguration types at scale. Article Search Article: ase26ind-p211-p doi:10.1145/3832783.3834509 ASE '26: "AlarmClaw: Context-Enriched ..." AlarmClaw: Context-Enriched Alarm Management with Category-/Severity-Aware Incident Graphs Siyu Yu, Meizhen Li, Jiacheng Yang, Yifan Wu, Ning Wang, Zhaoxing Chen, Ming Liu, Xinchi Ren, Xincheng Ren, Chan Li, Tong Jia, Xiang Zhang, and Ying Li (Peking University, China; ByteDance, China) Large-scale production systems rely on monitoring rules and anomaly detectors to trigger alarms that notify site reliability engineers (SREs) of potential failures. Before diagnosis and mitigation can begin, alarm management must construct incident state online by deciding whether each arriving alarm is noise, indicates a potential new incident, or should be associated with an existing incident to enrich its evolving state. Existing alarm-management methods remain difficult to deploy because some rely on reusable operational artifacts such as SOPs or historical prototypes to judge alarm relationships, while graph-based methods often apply the same topology-derived propagation patterns across incidents. In production, such artifacts are often missing or service-specific, and valid propagation paths vary with incident type and severity. We present AlarmClaw, a context-enriched alarm-management system built around these two constraints. AlarmClaw uses bounded context clawing to retrieve compact evidence from auditable operational sources and a category- and severity-aware incident graph to constrain a large language model (LLM) decision agent. An evolution mechanism refreshes reusable context and graph evidence from validated outcomes. On a temporally held-out replay from a production corpus of 51,000 alarms and 9,661 incidents, AlarmClaw achieves 86.0% association Precision and 78.5% Recall, improving F1 by 7.4 points over the strongest adapted baseline. During six months of online operation, evolution updates improve F1 by 2.3 points over a matched fixed-knowledge counterfactual. From January to June 2026, AlarmClaw automatically associated more than 4,800 alarms, conservatively saving at least 4,800 engineer-minutes and reducing the per-alarm association operation from approximately 90 s manually to under 10 s. Article Search Article: ase26ind-p313-p doi:10.1145/3832783.3834524 ASE '26: "Bifrost: Empowering Pretrained ..." Bifrost: Empowering Pretrained Language Model with Fallibility Representation for Log-Based Fault Diagnosis Minghua He, Tong Jia, Lingzhe Zhang, Chiming Duan, Xinlong Zhao, Leyi Pan, Cheng Wang, Kangjin Wang, Yinghao Yu, Liping Zhang, Yifan Wu, and Ying Li (Peking University, China; Tsinghua University, China; Alibaba Group, China) Log-based fault diagnosis is crucial for runtime debugging and maintenance. Existing fault diagnosis methods use language models pre-trained on natural language (PLMs) for log representation. However, system faults are reflected in the multi-level structure of system logs. PLMs pre-trained on natural language struggle to comprehensively capture multi-level fault information, failing to meet the requirements of fault diagnosis. We refer to this information as fallibility representations. To address this problem, we propose a novel log representation learning method, Bifrost. It draws inspiration from the log analysis experience of Site Reliability Engineers and meticulously designs strategies based on self-supervised contrastive learning to learn the fallibility representations of logs. Across three public systems and one industrial ML-as-a-Service system, the log representations produced by Bifrost outperform existing PLMs by average margins of 9.83% in F1 for anomaly detection, 18.28% in HR@k for root cause localization, and 20.88% in Macro-F1 for fault identification. Article Search Article: ase26main-p3295-p doi:10.1145/3832783.3834433
	Li, Yingying	ASE '26: "BanditFuzz: A Synergistic ..." BanditFuzz: A Synergistic Differential Fuzzing Framework for Compilers Donghui Li, Yingying Li, Jinlong Xu, Bo Zhao, Nan Wang, Jinyang Yao, and Lili Liu (Information Engineering University, China; Henan Normal University, China) Compiler fuzzing is critical for ensuring the reliability of modern optimizing compilers. However, traditional generators and raw Large Language Model (LLM) outputs often yield syntactically invalid or low-value programs, incurring significant computational overhead. In this paper, we present BanditFuzz, an end-to-end synergistic differential fuzzing framework integrating four core mechanisms: (1) a coverage-feedback-driven dynamic prompt scheduler that alternates strategies to generate diverse corpora; (2) a lightweight repair module (CompileFix) that heuristically recovers near-compilable raw LLM outputs; (3) a deterministic AST mutation engine (ASTMutate) that systematically expands high-quality seeds to compensate for inference latency; and (4) a sanitizer-enhanced differential testing oracle utilizing an unoptimized baseline (-O0) to precisely identify miscompilations while filtering Undefined Behavior (UB). Extensive evaluations on GCC and Clang demonstrate that BanditFuzz significantly improves backend coverage over state-of-the-art baselines under identical budgets, successfully identifying 28 realworld compiler bugs. Article Search Article: ase26nier-p61-p doi:10.1145/3832783.3834548
	Li, Yiran	ASE '26: "GALA: Graph-Augmented LLM ..." GALA: Graph-Augmented LLM Agents for Root Cause Analysis and Incident Response in Microservices Yifang Tian, Yaming Liu, Zichun Chong, Zihang Huang, Yiran Li, and Hans-Arno Jacobsen (University of Toronto, Canada) Microservice root cause analysis (RCA) requires correlating failures across heterogeneous telemetry within complex service dependency graphs. Existing methods often rely on a single telemetry modality; recent LLM-based approaches can suffer from unconstrained exploration and hallucination; and most systems stop at fault ranking without producing actionable incident response. We present GALA+, a graph-augmented LLM agentic framework centered on graph-guided investigation, which uses service dependencies to bound exploration and refine diagnosis through localized multi-modal evidence. For initial hypothesis generation, GALA+ combines complementary telemetry signals with STRIX, a novel trace- and graph-structure-aware scoring module. GALA+ then produces ranked diagnoses, incident summaries, and stratified action recommendations. We further introduce SURE-Score, a human-guided evaluation framework co-developed with industry SRE experts for assessing RCA-specific output quality beyond conventional text similarity metrics. On two microservice benchmarks, GALA+ consistently achieves the strongest overall results, surpassing the best LLM-based baseline by more than 25 percentage points in AC@1, while also receiving the highest ratings from both SURE-Score and independent human SRE evaluation. Article Search Article: ase26main-p46-p doi:10.1145/3832783.3834335
	Li, Yuanchun	ASE '26: "Towards Reliable Alarm Flood ..." Towards Reliable Alarm Flood Reduction in Data Center via Grammar-Guided Verifiable LLM Reasoning Jiacheng Liu, Guocong Lin, Jichao Yan, Huiwen Zheng, Hongli Ma, Changhao Zhou, Zhiyi Yu, Yuanchun Li, Yunxin Liu, Ding Li, Tao Xie, and Yao Guo (Peking University, China; Tsinghua University, China; GDS Holdings, China) Alarm floods pose a critical challenge in system operations, where a single fault can trigger cascaded alarms across interconnected components, overwhelming human operators and obscuring actionable signals. Alarm flood reduction aims to reduce redundant alarms under a safety-oriented objective, because any incorrect reduction may falsely exclude real failures. Existing approaches face a fundamental trade-off: rule-based systems ensure reliability but lack scalability, while solutions based on a large language model (LLM) offer strong generalization but suffer from non-determinism and unverifiable reasoning, limiting their use in safety-critical settings. In this paper, we study the alarm flood reduction problem in data center operations and introduce a solution based on structured reasoning and conservative verification. Our key insight is that expert-level alarm analysis relies on explicit reasoning chains that connect upstream causes to downstream alarms. We design Constrained Reasoning Chain Grammar (CRCG), a lightweight yet expressive grammar that formalizes such reasoning processes as compositional inference chains with logical and numerical constraints. Our method follows two tightly connected steps. First, we use LLM-assisted annotation, checker-guided compilation, and supervised fine-tuning (SFT) to organize expert knowledge in CRCG and train a model to generate explicit reasoning chains. Second, we conservatively reduce alarms only when the reasoning chain can be verified based on CRCG. We evaluate the method on real-world data center HVAC alarms. Results have shown that our method achieves high accuracy while driving false reductions to zero on the evaluated setting, outperforming both rule-based and LLM-only baselines and reducing operational workload substantially. Article Search Artifacts Available Article: ase26ind-p96-p doi:10.1145/3832783.3834481
	Li, Yubo	ASE '26: "ExcavatorFuzz: LLM-Guided ..." ExcavatorFuzz: LLM-Guided Path-Difficulty-Driven Directed Greybox Fuzzing Kaiyu Xie, Siyuan Li, Jiaqian Peng, Yun Yang, Yaowen Zheng, Kai Cheng, Jiayu Zhang, Shizhao Tian, Yubo Li, and Hongsong Zhu (Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China; Shandong University, China) Directed greybox fuzzing (DGF) is effective at steering mutations toward vulnerable code regions, but its efficiency is often limited by two bottlenecks: misprioritized target-reaching paths and hard-to-satisfy blocking predicates. We present ExcavatorFuzz, an LLM-assisted DGF framework that addresses both challenges in a unified workflow. ExcavatorFuzz first performs CLI-aware feasibility filtering to prune configuration-infeasible paths, and then ranks the remaining candidate paths using a lightweight difficulty metric that approximates their relative tractability based on explicit predicate complexity and implicit data-dependency complexity. During fuzzing, ExcavatorFuzz monitors line-level progress to detect blocked paths and invokes the LLM to synthesize or refine seeds for unsatisfied predicates using structured feedback. We evaluate ExcavatorFuzz on 30 real-world C/C++ benchmarks. ExcavatorFuzz triggers 29 out of 30 known vulnerabilities within 24 hours and achieves an average 4.34x speedup in time-to-exposure over seven state-of-the-art fuzzers. It also discovered three previously unknown vulnerabilities in open-source projects, two of which have been assigned CVE IDs. Article Search Article: ase26main-p1484-p doi:10.1145/3832783.3837497
	Li, Yuekang	ASE '26: "RamFuzz: LLM-Guided Greybox ..." RamFuzz: LLM-Guided Greybox Fuzzing for Spatial Memory Corruption via Valid Range Violation Shangzhi Xu, Wei Song, Yuekang Li, Nan Sun, Muhammad Ejaz Ahmed, Willy Susilo, Benjamin Turnbull, Xiao Cheng, and Siqi Ma (University of New South Wales, Australia; CSIRO's Data61, Australia; University of Wollongong, Australia; Macquarie University, Australia) Spatial memory corruptions remain among the most prevalent software vulnerabilities, consistently ranking among the top CWE categories. These vulnerabilities are closely tied to the values processed by the program: when input-derived values fall outside expected ranges, memory operations may be performed beyond their allocated bounds, leading to corruption. Our pilot study on 132 realworld CVEs shows that 72.7% of spatial memory corruptions stem from such valid value violations. Although fuzzing is widely used to expose exploitable memory corruptions, systematically detecting spatial memory corruptions through fuzzing remains challenging, as it requires generating inputs that conform to complex structural formats while violating valid value ranges. Recent work leverages LLMs to generate structured inputs based on format knowledge, yet LLMs exhibit a strong bias toward well-formed outputs, leaving systematic range violations largely unexplored. In this paper, we propose RamFuzz, an approach that exploits rather than mitigates this bias to guide the fuzzing process. RamFuzz prompts LLMs to enumerate valid ranges of target file formats and deliberately assigns invalid values to seeds during fuzzing, systematically triggering spatial memory corruptions. We evaluated RamFuzz on 15 popular real-world projects with more than 1,000 stars on GitHub, RamFuzz discovered 104 previously unknown memory corruptions, of which 39 have been confirmed, and 33 have been fixed by developers. Article Search Article: ase26main-p540-p doi:10.1145/3832783.3837447 ASE '26: "How Your Credentials Are Leaked ..." How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, and Zhiqiang Li (Griffith University, Australia; Wake Forest University, USA; Nanyang Technological University, Singapore; University of New South Wales, Australia; Zhejiang Sci-Tech University, China; University of Tokyo, Japan; University of Alberta, Canada; Independent Researcher, China) Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research. Article Search Article: ase26main-p928-p doi:10.1145/3832783.3834373 ASE '26: "SAF: An AI-Agent-Ready and ..." SAF: An AI-Agent-Ready and Browser-Accessible Static Analysis Framework for LLVM IR Yuekang Li, Wei Li, Wei Song, Yi Liu, and Gelei Deng (University of New South Wales, Australia; Griffith University, Australia; Nanyang Technological University, Singapore) Static program analysis finds bugs before software ships, and modern checkers for C/C++ depend on whole-program infrastructure: pointer analysis, value-flow tracking, taint analysis, and IFDS-based data flow on top of LLVM. Today’s LLVM-IR frameworks fall short. SVF, Phasar, and Lotus expose their analyses through C++ APIs that require subclassing, recompilation, and pinned LLVM builds; onboarding takes months. CodeQL replaces the C++ API with a domain-specific query language. None is designed for the AI coding agents that increasingly drive software-engineering work. We present the Static Analyzer Factory (SAF), an LLVM-IR analysis framework that combines a Rust kernel exposed to Python through PyO3 zero-copy bindings, a WebAssembly and Pyodide browser playground that runs the same SDK with no install, a declarative YAML language for function specifications that the built-in checkers consume at runtime, and two shipped coding-agent skills installable in Claude Code and Codex. As an illustrative case, SAF’s bundled memory-safety checkers were themselves authored end-to-end through this workflow using Claude Code on the Opus 4.6 model. On the NIST Juliet C/C++ benchmark, these checkers achieve the best F1 on three of four memory-safety CWEs, each measured against whichever of SVF and Lotus ships a corresponding checker. Code: https://github.com/Static-Analyzer-Factory/static-analyzer-factory. Documentation and browser playground: https://static-analyzer-factory.github.io/static-analyzer-factory/. Demo video: https://youtu.be/Cj58VvNCrlw. Article Search Article: ase26tool-p8-p doi:10.1145/3832783.3834597
	Li, Ze	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Li, Zheng	ASE '26: "MicroWeaver: A Constraint-Guided ..." MicroWeaver: A Constraint-Guided Structure–Semantic Aware Approach to Automated Microservice Decomposition Huitian Xue, Kairui Zhang, Chenxi Zhang, Zheng Li, Chuan Luo, Yilong Yang, Tianyu Wo, Chunming Hu, Yanliang Li, Yang Zhou, Penghao Zhang, Tiezi Zhang, and Renyu Yang (Beihang University, China; Xidian University, China; Queen's University Belfast, UK; Independent Researcher, China; Kuaishou, China) Microservice architecture is a pivotal paradigm for refactoring monolithic systems to improve maintainability and evolvability. However, automated, explainable decomposition remains a difficult task, especially when balancing structural soundness with semantic consistency in complex legacy systems. We present MicroWeaver, an automated microservice decomposition approach that reconciles both structural and semantic characteristics. MicroWeaver combines static program analysis and dynamic tracing at runtime to construct a high-fidelity, class-level dependency model, and learns numerical embeddings that capture both the structural characteristics and semantic properties embodied in these dependencies. We introduce multiple constraints for representing core design principles (e.g., high cohesion, low coupling, etc.) and formulate the decomposition as a multi-objective optimization problem. MicroWeaver uses an LLM-agent-based optimization strategy to automatically navigate the solver towards a Pareto-optimal region that balances structural dependencies, semantic coherence and inter-service communication cost. We conduct comprehensive experiments on five real-world systems. Results show that MicroWeaver overcomes key limitations of clustering-based methods that ignore semantic context and LLM-based approaches that lack robust structural constraints, and thus attains competitive structural and semantic scores. MicroWeaver is used as a production-ready architectural refactoring framework in industrial settings. Its robust, multidimensional performance and high degree of interpretability furnish practitioners with actionable and comprehensive insights, thereby facilitating more informed and systematic refactoring processes. Article Search Article: ase26ind-p19-p doi:10.1145/3832783.3834457
	Li, Zhenhao	ASE '26: "ReLog: Execution-Aware Logging ..." ReLog: Execution-Aware Logging with Runtime Feedback for LLM-Oriented Debugging Xin Wang, Yang Feng, Xiaoqian Jiao, Yang Zhang, Zhenhao Li, and Zishuo Ding (Hong Kong University of Science and Technology, Guangzhou, China; Hebei University of Science and Technology, China; York University, Canada) Logging statements are essential for software debugging and maintenance. However, existing approaches to automatic logging generation rely on static analysis and produce statements in a single pass without considering runtime behavior. They are also typically evaluated by similarity to developer-written logs, assuming these logs form an adequate gold standard. This assumption is increasingly limiting in the LLM era, where logs are consumed not only by developers but also by LLMs for downstream tasks. As a result, optimizing logs for human similarity does not necessarily reflect their practical utility. To address these limitations, we introduce ReLog, an iterative logging generation framework guided by runtime feedback. ReLog leverages LLMs to generate, execute, evaluate, and refine logging statements so that runtime logs better support downstream tasks. Instead of comparing against developer-written logs, we evaluate ReLog through downstream debugging tasks, including defect localization and repair. We construct a benchmark based on Defects4J under both direct and indirect debugging settings. Results show that ReLog consistently outperforms all baselines, achieving an F1 score of 0.520 and repairing 97 defects in the direct setting, and the best F1 score of 0.408 in the indirect setting where source code is unavailable. Additional experiments across multiple LLMs demonstrate the generality of the framework, while ablations confirm the importance of iterative refinement and compilation repair. Overall, our work reframes logging as a runtime-guided, task-oriented process and advocates evaluating logs by their downstream utility rather than textual similarity. Article Search Article: ase26main-p769-p doi:10.1145/3832783.3837463 ASE '26: "AgentExecutor: Partial Code ..." AgentExecutor: Partial Code Execution via Agentic Context Generation Junkai Chen, Chengran Yang, Xing Hu, Zhenhao Li, Xin Xia, and David Lo (Singapore Management University, Singapore; Zhejiang University, China; York University, Canada) Executing code snippets is essential for dynamic program analysis, but it remains challenging to execute an arbitrary code snippet due to issues like missing context and incomplete dependencies. Existing approaches to partial code execution, such as LExecutor and Treefix, leverage the power of language models to infer missing information and enable execution. However, they suffer from (i) limited action spaces and feedback, and (ii) rigid optimization strategies, which restrict their effectiveness and efficiency. In this paper, we propose AgentExecutor, a novel multi-agent framework for partial code execution. Our approach introduces a three-phase design: execution environment preparation, dynamic exploration with iterative refinement, and prefix evolution via program synthesis. Supported by the power of LLM agents who can think, act, and get feedback iteratively, AgentExecutor is able to autonomously explore a richer action space, enabling diverse operations such as creating resource files and resolving environment configuration. Furthermore, it adopts adaptive optimization strategies, including coverage-guided context pruning and prefix evolution via program synthesis, to systematically improve the execution quality of partial code. We evaluate AgentExecutor on two widely used datasets comprising Stack Overflow snippets and open-source project code. The results show that AgentExecutor achieves up to 94% and 90% code coverage, outperforming the state-of-the-art approach Treefix by 19.9% and 13.8%, respectively. In addition, AgentExecutor significantly reduces execution time (by up to 80.3%) and cost (by up to 56.6%). These findings demonstrate that AgentExecutor provides an effective and efficient solution for partial code execution. Article Search Article: ase26main-p477-p doi:10.1145/3832783.3834355
	Li, Zhilin	ASE '26: "Mind the Gap: Do Widely-Used ..." Mind the Gap: Do Widely-Used SAST Tools Really Cover the Language-Specific Top CWEs? Zhilin Li, Yiran Nie, Xianglong Qi, Jiwei Yan, and Jun Yan (Institute of Software at Chinese Academy of Sciences, China; Hangzhou Institute for Advanced Study at University of Chinese Academy of Sciences, Hangzhou, China; Beijing University of Technology, China) Static Application Security Testing (SAST) tools play a key role in identifying vulnerabilities early in the development cycle. While these tools claim to detect a wide range of CWEs, their actual coverage is often unclear. In particular, due to language-specific characteristics, it is unclear to what extent SAST tools cover the CWEs most relevant to a given programming language, creating a gap between tool capabilities and developers’ security needs. To address these questions, this experience paper presents a large-scale empirical investigation into the gap between SAST Tools and Language-Specific Top CWEs. Using a heuristic labeling approach on 197,016 CVEs reported over the past decade, we construct the TopLan CWE Lists for three widely used programming languages: C/C++, Java, and Python. Based on these datasets, we evaluate nine popular SAST tools to identify coverage gaps and tool-specific performance characteristics. Our study yields several key findings. First, the language-specific TopLan CWE lists differ a lot from the globally ranked CWE list, indicating that SAST tools need to focus on different types of vulnerabilities for different languages. Second, the whole SAST tool set now exhibits low coverage of the TopLan CWE list, highlighting the need for more targeted code checkers. Third, the covered TopLan CWE sets for different SAST tools vary substantially, underscoring the need to select and combine tools based on vulnerability types. Finally, for top CWEs shared across multiple languages, existing multi-language SAST tools may support detection in only one language, suggesting opportunities to enhance coverage by migrating existing checkers. These findings reveal fundamental challenges for static analysis in detecting certain types of vulnerabilities and provide insights for improving future SAST tool design. They offer practical guidance for practitioners in selecting and combining tools to detect language-specific vulnerabilities more effectively. Article Search Artifacts Available Article: ase26main-p316-p doi:10.1145/3832783.3837435
	Li, Zhiqiang	ASE '26: "How Your Credentials Are Leaked ..." How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, and Zhiqiang Li (Griffith University, Australia; Wake Forest University, USA; Nanyang Technological University, Singapore; University of New South Wales, Australia; Zhejiang Sci-Tech University, China; University of Tokyo, Japan; University of Alberta, Canada; Independent Researcher, China) Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research. Article Search Article: ase26main-p928-p doi:10.1145/3832783.3834373
	Li, Zhong	ASE '26: "MultiKernelBench: A Multi-platform ..." MultiKernelBench: A Multi-platform Benchmark for Kernel Generation Zhongzhen Wen, Yinghui Zhang, Zhong Li, Zhongxin Liu, Linna Xie, and Tian Zhang (Nanjing University, China; Zhejiang University, China) The automatic generation of deep learning (DL) kernels using large language models (LLMs) has emerged as a promising approach to reduce the manual effort and hardware-specific expertise required for writing high-performance operator implementations. However, existing benchmarks for evaluating LLMs in this domain suffer from limited hardware support, coarse-grained kernel categorization, and imbalanced task coverage. To address these limitations, we introduce MultiKernelBench, the first comprehensive, multi-platform benchmark for LLM-based DL kernel generation. MultiKernelBench spans 300 tasks across 15 well-defined kernel categories and supports three major hardware platforms: NVIDIA GPUs, Huawei NPUs, and Google TPUs. To enable future extensibility, we design a modular backend abstraction layer that decouples platform-specific logic from the core benchmarking infrastructure, allowing easy integration of new hardware platforms. We further propose a simple yet effective category-aware one-shot prompting method that improves generation quality by providing in-category exemplars. Through systematic evaluations of seven state-of-the-art LLMs, we reveal significant variation in task difficulty, poor generalization to platforms with less training exposure, and the effectiveness of targeted prompting strategies. Article Search Article: ase26main-p755-p doi:10.1145/3832783.3837460 ASE '26: "S2CAgent: A Self-Learning ..." S2CAgent: A Self-Learning Agent Knowledge Graph Framework for Software Supply Chain Analysis Youfei Huang, Zhong Li, Minxue Pan, and Xuandong Li (Nanjing University, China) The extensive reuse of open-source software (OSS) accelerates development. However, it also creates increasingly complex software supply chains (SSCs) and intensifies the attacker-defender asymmetry, making attacks "low-cost, high-impact, and hard-to-detect." Software Bill of Materials (SBOMs) and Software Composition Analysis (SCA) are widely used for SSC analysis, but both have clear limitations. SBOMs frequently lack vulnerability information, while SCA tools are typically limited to specific ecosystems. To address these limitations, we first construct a multi-source software supply chain knowledge graph (SSCKG) that unifies heterogeneous information and supports continuous evolution through automated updates. Building on this foundation, we propose S2CAgent, a neural-symbolic large language model (LLM) agent framework for SSC analysis. S2CAgent supports natural language questions by inducing symbolic reasoning rules from the SSCKG. These rules align complex questions with underlying graph semantics and multi-hop reasoning patterns. Furthermore, the agent leverages structured evidence from the SSCKG and unstructured web knowledge, thereby mitigating LLM hallucinations and alleviating knowledge incompleteness. In addition, it incorporates a self-learning mechanism that synthesizes and refines tool-augmented trajectories to improve future reasoning. We evaluate S2CAgent on a newly constructed cross-ecosystem benchmark that includes three core tasks: vulnerability impact assessment, software dependency analysis, and license compliance checking. Experimental results show that S2CAgent outperforms baselines across multiple metrics and remains stable under complex multi-hop reasoning. In particular, S2CAgent has been deployed at a leading ICT corporation, where it effectively handles complex real-world analysis cases, further demonstrating its practical utility. Article Search Article: ase26main-p1823-p doi:10.1145/3832783.3837513
	Li, Zhuohua	ASE '26: "Understanding the Performance-Effectiveness ..." Understanding the Performance-Effectiveness Trade-Offs of AddressSanitizer in Real-World Programs: An Empirical Study Jiaxin Xi, Cheng Wen, Zhiwei Lin, Yuandao Cai, Jie Su, Bin Yu, Zhuohua Li, and Shengchao Qin (Xidian University, China; Hong Kong University of Science and Technology, China; Chinese University of Hong Kong, China) AddressSanitizer (ASan) is widely deployed in industrial C/C++ development, but its runtime and memory costs can limit routine use in continuous integration and production-like testing. Although many optimized ASan-like sanitizers have been proposed, heterogeneous workloads, configurations, and baselines make their practical trade-offs difficult to compare. We present a unified, deployment-oriented empirical study of ASan and seven representative optimized sanitizers: ASan{-}{-}, SanRazor, GiantSan, RSan, MEDs, ASAP, and LFP. Using 17 SPEC CPU2006 benchmarks, Juliet, MSET, 21 real-world CVEs, and a multi-threaded MySQL case study, we examine component costs, parameter sensitivity, build configurations, detection outcomes, and deployability. In our ordered cumulative ablation, the largest first-step runtime reduction follows removal of memory-access checks, while the largest late-stage RSS reduction occurs at the heap-management step. Parameter tuning identifies lower-memory configurations without additional false negatives relative to default ASan on Juliet, although this result does not establish preservation of delayed-UAF detection. The reported evidence shows distinct efficiency, detection, and deployment outcomes, but unequal completion sets prevent a formal cross-tool ranking. Our results support treating tuned ASan as a necessary, configuration-dependent comparison baseline for sanitizer evaluation and provide bounded evidence for deployment decisions under different resource and risk constraints. Article Search Article: ase26ind-p63-p doi:10.1145/3832783.3834469 ASE '26: "NL2VBench: A Benchmark for ..." NL2VBench: A Benchmark for End-to-End Natural-Language to Verifiable Rust Generation Lianhe Hu, Cheng Wen, Dugang Liu, Zhiwu Xu, Zhuohua Li, Jie Su, Bin Yu, and Shengchao Qin (Xidian University, China; Shenzhen University, China; Chinese University of Hong Kong, Hong Kong) Large language models (LLMs) have shown promise in code generation, but generating formally verifiable Rust programs from natural-language descriptions remains highly challenging. We present a benchmark called NL2VBench for generating verifiable Rust programs from natural-language descriptions using Verus.NL2VBench contains 762 verifier-checked tasks derived from five public sources and curated through filtering, deduplication, canonicalization, LLM-assisted drafting, and human revision. Each task provides a natural-language description, task-defining interface information, and a verifier-checked reference solution. To demonstrate its utility, we evaluate five representative LLMs on a direct NL-to-Verus baseline. The results show that current LLMs achieve low verification success and even lower strict semantic correctness, demonstrating that NL2VBench is a challenging and reusable benchmark for future research on LLM-based verified code generation. A demonstration video of NL2VBench is available at https://youtu.be/CNOXHejni1c. Article Search Artifacts Available Article: ase26tool-p66-p doi:10.1145/3832783.3834619
	Liang, Chenghui	ASE '26: "CADscanner: Automating Malware ..." CADscanner: Automating Malware Analysis for Compiled AutoCAD Scripts in Engineering Environments Luxing Yin, Chang Sun, Chenghui Liang, Chu Wang, Shufu Zhi, Tianshi Zheng, Ziang Liu, Xin Liu, and Qingguo Zhou (Lanzhou University, China; Sangfor Technologies, China) For architecture, engineering, and manufacturing organizations, the inability to inspect AutoCAD's compiled script formats (FAS and VLX) has become a consequential security blind spot: every publicly available analysis tool fails on them, while threat actors have repeatedly used them to weaponize shared drawing files in documented industrial espionage campaigns. Today, when a security analyst encounters a suspicious FAS or VLX file, the manual practice is either to upload it to a cloud service (often prohibited by confidentiality policies), to attempt ad hoc byte-level inspection (ineffective due to per-file encryption), or to simply skip the file. This paper reports on CADscanner, a tool that automates the analysis of compiled AutoCAD scripts by recovering their behavioral content locally, without requiring AutoCAD installation, cloud submission, or manual reverse engineering. We describe the engineering of a recovery pipeline that handles two proprietary formats: the FAS4 binary, which is protected by rolling-XOR encryption, and the VLX (VRTLIB-1) archive container. The pipeline lifts both into a normalized intermediate representation suitable for automated rule matching and analyst review. On a 201-script consistency benchmark, behavioral API recovery reaches 79.3% recall at 97.8% precision, with security-critical indicators (persistence, network, propagation) preserved at 85--94%. A rule-based detector over the recovered surface achieves 95.8% TPR at 2.2% FPR on a family-disjoint held-out set, processing files in under 15,ms each. We report deployment experience integrating CADscanner into a security vendor's OT analysis workflow, discuss the engineering trade-offs encountered, and distill lessons learned for practitioners building format-recovery tooling in industrial contexts. Article Search Article: ase26ind-p134-p doi:10.1145/3832783.3834495
	Liang, Hanzhong	ASE '26: "Trace-Driven Automated PoC ..." Trace-Driven Automated PoC Synthesis for On-Chain Attacks Xing Su, Hao Wu, Hanzhong Liang, Yunlin Jiang, Yuxi Cheng, Yating Liu, Fengyuan Xu, and Sheng Zhong (Nanjing University, Nanjing, China) Blockchain systems are increasingly targeted by on-chain attacks that exploit vulnerabilities in smart contracts, resulting in billions of dollars in losses. Understanding and reproducing these attacks is critical for defense, yet currently relies on manually crafting proofs-of-concept (PoCs), which is labor-intensive, expertise-driven, and difficult to scale. In this work, we take the first step toward automating PoC synthesis directly from transaction traces. Our key insight is that a concrete execution trace provides not only behavioral evidence for recovering exploit logic, but also runtime semantics that enable precise code synthesis and verification. We design TracExp, a trace-driven framework that combines a dual decompiler, which fuses symbolic lifting with concrete runtime values to produce semantically enriched pseudocode, and a sketch-based synthesis and refinement mechanism that grounds LLM generation in execution context and ensures semantic correctness. Evaluated on 321 real-world DeFi attacks collected over 20 months, TracExp achieves 94.70% generation, 83.80% compilable, and 57.01% verifiable rates, at an average cost of ∼$0.1 per case. Moreover, we contributed 33 previously unavailable PoCs within 2 days to DeFiHackLabs, and all were accepted and merged, earning $900 in bounties, demonstrating both the practical effectiveness and real-world impact. Article Search Article: ase26main-p24-p doi:10.1145/3832783.3834332
	Liang, Haozhe	ASE '26: "RegoMender: A Multi-agent ..." RegoMender: A Multi-agent Framework for Automated Rego Policy Repair Ruijie Zhang, Huaxiao Yin, Li Hu, Fanqi Kong, Haozhe Liang, Shaoyin Cheng, Kun Zhang, and Bibo Tu (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Science and Technology of China, China; Peking University, China; University of Chinese Academy of Sciences, China) Policy-as-Code (PaC) has emerged as a foundational paradigm in cloud-native systems. However, repairing Rego policies remains challenging due to their strict syntax, declarative semantics, and specific verification requirements. Existing automated program repair (APR) methods are mainly designed for mainstream languages and struggle to accommodate the unique policy logic and repair workflows of Rego. Thus, Rego policy repair remains a manual process driven by trial and error. To address this, we introduce RegoBench, the first automated Rego policy benchmark comprising 1,159 real-world defects, and propose RegoMender, a feedback-guided multi-agent framework. Collaborating via a shared blackboard and an atomic toolkit, RegoMender dynamically executes patching, rewriting, or rolling back, to resolve complex repair scenarios. Evaluated on RegoBench, RegoMender achieves syntactic and test-based semantic success rates of 82.9% and 77.9%, respectively, outperforming the strongest baseline by 13.4%. Unlike other approaches whose performance drops in complex scenarios, RegoMender maintains effectiveness across single-step and chained repair tasks. Furthermore, it generalizes strongly across HCL and SQL and achieves an 86.4% repair rate on 132 real-world CVE vulnerabilities, proving its robustness and practical utility for security. Article Search Article: ase26main-p1325-p doi:10.1145/3832783.3837490
	Liang, Hongliang	ASE '26: "PELSE: Asymmetric-Evidence-Guided ..." PELSE: Asymmetric-Evidence-Guided MCU Peripheral Model Synthesis Guohao Wu, Chunlin Wang, Rui Yao, Feng Hong, Hongliang Liang, and Qiuping Yi (Beijing University of Posts and Telecommunications, China; Fudan University, China; Beijing Institute of Computer Technology and Applications, China) Faithful executable peripheral modeling remains a major bottleneck in microcontroller unit (MCU) firmware rehosting. Reference manuals provide broad but non-executable semantic descriptions, while binary analysis yields execution-grounded but incomplete observations. We present PELSE, a framework that synthesizes executable peripheral models by jointly leveraging these two asymmetric evidence sources. Our key insight is that manual-derived semantic structures and binary-derived execution witnesses can be unified under a shared register/field abstraction to mutually constrain model construction. Specifically, PELSE uses large language models (LLMs) to extract semantic candidates from vendor manuals and organize them into manual-derived finite-state machine (FSM) scaffolds, and performs memory-mapped I/O (MMIO)-aware symbolic execution to collect register/field-level witness fragments from firmware binaries. It then applies evidence-guided fusion in a unified register/field namespace to cross-validate and concretize compatible manual-derived transitions, recover well-formed trace-extracted transitions absent from the FSM scaffolds, isolate contradictions, and construct evidence-labeled fused FSMs before compiling them into QEMU-compatible peripheral models. We evaluate PELSE using QEMU-referenced MMIO/IRQ conformance and an enhanced 106-test P2IM suite. PELSE achieves 97.0% conformance on a 42-test overlap set, improving over PERRY by 6.4 percentage points, and a 96.2% pass rate across all 106 tests, outperforming FUZZWARE by 5.6 percentage points. As downstream evidence of improved rehosting fidelity, PELSE-enabled rehosting supports security analyses that reproduce known vulnerabilities and uncover 15 previously unknown real-world vulnerabilities. Article Search Artifacts Available Article: ase26main-p2735-p doi:10.1145/3832783.3837541
	Liang, Jiashuo	ASE '26: "Post-quantum Cryptography ..." Post-quantum Cryptography in the Wild: Assessing the Readiness of Open-Source Ecosystems Tongxin Yuan, Zhanpeng Liu, Jiashuo Liang, Zhuosheng Zhang, Gongshen Liu, Yang Yu, and Guancheng Li (Shanghai Jiao Tong University, China; Tencent Xuanwu Lab, China) The threat of cryptographically relevant quantum computers, compounded by harvest now, decrypt later attacks, has made migration to post-quantum cryptography (PQC) urgent. With PQC standards finalized and transition guidance phasing out quantum-vulnerable algorithms, the readiness of the open-source supply chain, through which cryptographic vulnerabilities propagate, remains unclear. To fill this gap, we present the first cross-ecosystem empirical study of source-level PQC readiness. PQC Scanner is a two-stage pipeline in which (i) crypto detection identifies packages with cryptographic functionality, and (ii) PQC detection produces a binary support label and source-derived structured readiness record at the repository level using commit history, source analysis, and agent post-verification. Applied to 1,117,913 packages, Stage 1 identifies 55,654 crypto-related packages. Stage 2 evaluates their repositories for source-level PQC support. A separate audit of 219 Stage 2-negative repositories gives a Stage 2 recall lower bound of ≥  97.48%. On a 247-repository deployment-validation sample, agent post-verification eliminated all false positives, yielding precision of 1.000. The pipeline scales to million-package scans: at concurrency 10, it analyzes over one million packages in just over two weeks, with a median LLM cost of $0.0010 per package. Across 8 ecosystems, we find a migration gap: only 1.88% of crypto-related packages show source-level PQC support, and the repository-deduplicated rate is 1.72%. Rust leads by both counts, while NuGet/Ruby/PHP remain near zero. Source-derived structured readiness records show partial support: among PQC-supporting repositories, only 19.2% satisfy the full-support criterion, with a mean migration coverage of 36%. Adoption accelerates sharply after FIPS publication (August 2024), but migration remains infrastructure-gated: key libraries such as Python’s cryptography (581M downloads/month) and framework integration layers in Java/npm still lack deployable PQC pathways, blocking downstream packages regardless of developer intent. We characterize adoption timing, bottlenecks, and community response strategies, deriving recommendations for maintainers, registry operators, and policy makers. Article Search Article: ase26main-p758-p doi:10.1145/3832783.3837461
	Liang, Jingjing	ASE '26: "Model-Guided Property-Based ..." Model-Guided Property-Based Testing of WeChat Pay at Billion-User Scale Xiangchen Shen, Yiting Wang, Ting Su, Jingjing Liang, Jingling Sun, Xixian Liang, Haiying Sun, Xinjie Xu, Haochuan Lu, Yuetang Deng, Pengcheng Wang, Geguang Pu, Zhendong Su, and John Hughes (East China Normal University, China; University of Electronic Science and Technology of China, China; Tencent, China; ETH Zurich, Switzerland; Chalmers University of Technology, Sweden) Ensuring the correctness of mobile payment applications is critical, as even subtle faults can lead to severe financial losses. To ensure reliability, the WeChat Pay (a popular payment app with over one billion active users worldwide) team developed a User Acceptance Testing (UAT) system based on model-based testing (MBT). It maintains use cases specifying user operation sequences and expected app behaviors under business rules. UAT converts these use cases into formal models and generates test cases to validate the app. Although UAT achieves 100% state coverage by covering all user operations and business rules, it still suffers from two major limitations: insufficient test coverage and predefined test oracles. In this paper, we introduce a model-guided property-based testing approach to improving the existing UAT system. We have two key observations: (1) UAT test cases can effectively reach all app states; and (2) WeChat Pay exhibits some invariant behaviors, which can be used to synthesize generic properties for bug finding. Building on these observations, our approach performs random exploration from UAT-discovered states, and validates app behaviors against the automatically synthesized properties. We also propose a greedy trace shrinking algorithm to reduce failure-inducing traces. We implemented our approach as UAT++, an advanced testing tool built upon the UAT system. Across 20,000 machine hours, UAT++ found 59 previously unknown bugs, including 48 logic bugs and 11 crash bugs (55 confirmed, 45 fixed). These bugs could not be found by the UAT system and classic property-base testing (PBT). UAT++ improved state transition coverage by 82.6% and 600.0% over the UAT system and classic PBT, respectively. The shrinking algorithm attained an average trace reduction rate of 79.9%. To date, UAT++ has been deployed in the continuous testing pipeline of WeChat Pay across Android, iOS, and HarmonyOS platforms. Article Search Article: ase26ind-p569-p doi:10.1145/3832783.3834537 ASE '26: "Property-Based Testing of ..." Property-Based Testing of Wafer Handling Robots via Model-Based Planning and Fuzzing Ruiyang Xu, Jingjing Liang, Guoyue Zheng, Geguang Pu, and Ting Su (East China Normal University, China) Wafer handling robots (WHRs) in semiconductor manufacturing require ultra-precise control software, where bugs can cause severe mechanical damage and costly downtime, making reliability validation critical. Yet no existing work addresses WHR validation. In this experience paper, we introduce a property-based testing approach for WHRs. Our key observation is that the system requirements of WHRs could be used as the properties for bug detection.However, applying property-based testing to WHR systems is challenging due to the input generation challenge. Complex action dependencies make it difficult to generate valid test inputs, while enormous state spaces hinder achieving adequate test coverage. To address this, we propose model-based planning and fuzzing. Our insight is that the WHR can be represented as a state-based model. Based on this model, we systematically generate valid test inputs through backward planning, then explore diverse scenarios through parameter and environment mutation. We implemented our approach as the ArmGo tool and evaluated it on a production WHR deployed in industrial lithography equipment. ArmGo discovered 21 previously unknown bugs (all confirmed, 15 fixed), including axis limit violations, entanglement issues, and missing interlock checks. ArmGo has been deployed in the continuous integration (CI) pipeline of our industrial partner and is actively used for validating WHRs. We also have distilled a number of practical lessons learned based on our investigation. Article Search Article: ase26main-p621-p doi:10.1145/3832783.3834360
	Liang, Qi	ASE '26: "Characterizing the Landscape ..." Characterizing the Landscape of Open-Source Satellite Software Jinfeng Wen, Qi Liang, Yuehan Sun, Federica Sarro, Ao Zhou, Xuanzhe Liu, and Shangguang Wang (Beijing University of Posts and Telecommunications, China; University College London, UK; Peking University, China) Satellites have become fundamental components of modern technological systems, supporting critical infrastructure in communication, navigation, Earth observation, and scientific research. As space exploration advances and demand for satellite-enabled services grows, reliance on complex, heterogeneous satellite software continues to increase. A systematic understanding of the satellite software landscape is therefore increasingly important, yet existing studies still lack a comprehensive empirical examination. To address this gap, we present the first characterization study of open-source satellite software, examining its ecosystem and development practices. We mine and analyze 22,286 satellite-related GitHub projects through three research questions on popularity trends (RQ1), software goals (RQ2), and development practices (RQ3). First, we characterize the temporal evolution of projects and active developers, revealing increasing popularity. Second, through manual inspection of 646 projects, we construct a taxonomy of 43 software-goal categories spanning conceptual design, datasets, system implementation, simulation, testing, and tools. Third, we conduct an in-depth analysis of projects with source code, revealing a highly heterogeneous and task-specialized ecosystem with 66 programming languages and diverse implementation strategies. Finally, we summarize key findings and derive actionable implications for satellite developers and researchers. Article Search Article: ase26main-p161-p doi:10.1145/3832783.3834343
	Liang, Qingyuan	ASE '26: "Maintaining Control States ..." Maintaining Control States for Initialization-Aware GRPO in Industrial LLM Workflows Chen Liu, Zhenzhao Yuan, Fengyuan Fan, Limei Che, Qiao Qian, Qingyuan Liang, Zeyu Sun, and Lu Zhang (Peking University, China; Tencent, China; Institute of Software at Chinese Academy of Sciences, China) Large language models (LLMs) are increasingly used as components in industrial software workflows, where they are expected to support reliable automation. However, newly introduced workflows often provide only limited data and sparse task-level feedback, making post-deployment adaptation difficult. GRPO-based post-training provides a practical adaptation way in this setting, but its effectiveness depends on the state from which adaptation begins. When the initial behavior of an LLM workflow is poorly aligned with the target workflow, early samples may provide weak reward signals, wasting adaptation budget and delaying workflow onboarding. We propose CoSTAR, an industrial post-deployment adaptation framework that maintains the starting state for downstream GRPO through a lightweight workflow-level control component. CoSTAR performs GRPO-style optimization on this control component while keeping the task model fixed, and alternates this maintenance with downstream GRPO, so that the control state can continue adapting across stages rather than remain a one-shot initialization. Experiments on a company-internal industrial workflow automation task show that CoSTAR substantially improves task-specific post-training, achieving 94.00% exact match and raising performance on complex cases to 80.56%. Overall, our results show that maintaining the starting state of downstream GRPO improves adaptation under limited workflow feedback and provides a more effective path for industrial LLM workflow maintenance. Article Search Article: ase26ind-p22-p doi:10.1145/3832783.3834459
	Liang, Ruichao	ASE '26: "Breaking the Isolation: Coordinated ..." Breaking the Isolation: Coordinated Multi-agent Fuzzing for Smart Contracts with Multi-dimensional Objective Learning Ruichao Liang, Ruochen Cao, Jing Chen, Kun He, Yebo Feng, Yue Xue, and Cong Wu (Wuhan University, China; Nanyang Technological University, Singapore; MetaTrust Labs, Singapore) Smart contracts manage critical assets in decentralized systems but are prone to vulnerabilities. While fuzzing has proven effective in software testing, existing contract fuzzers often rely on ad-hoc optimization strategies with limited objective guidance, typically driven by coverage or simple heuristics. This narrow focus leads to high false negative rates, as important perspectives of smart contracts, like semantic, state, and economic effects, are overlooked during transaction sequence generation. Moreover, coordinating these dimensions into fuzzing is challenging because their divergent objectives and complex interactions make ad-hoc adaptations to fitness functions or mutation strategies largely ineffective. To fill the gaps, we propose SynerFuzz, a multi-agent deep reinforcement learning-based fuzzer. We formulate fuzzing as a Decentralized Partially Observable Markov Decision Process, where each agent is assigned a distinct testing objective extracted from the target contract. Through coordinated learning, DRL agents integrate multi-dimensional signals to construct high-quality sequences, enabling SynerFuzz to uncover both subtle semantic flaws and economically profitable behaviors. Compared to 9 SOTA tools, SynerFuzz detects up to 4.2× more vulnerabilities while reducing time and transaction overhead by 70.6% and 86.8%. In real-world scenarios, SynerFuzz reproduces 33 historical DeFi exploits with over $40 million losses and discovers 17 0-day vulnerabilities in 4 projects managing over $179.8 million, earning $3,800 bug bounties. Article Search Article: ase26main-p791-p doi:10.1145/3832783.3837466
	Liang, Shu	ASE '26: "HERO: Hypothesis-Centered ..." HERO: Hypothesis-Centered Root-Cause Analysis for Microservice Incidents Jiewei Lyu, Junquan Yi, Shu Liang, Pengfei Chen, and Long Pan (Sun Yat-sen University, China; Tencent, China) Root-cause analysis (RCA) in cloud-native microservice systems is challenging because it requires integrating heterogeneous observability signals and deciding what to inspect next under limited diagnosis budgets. Existing large language model (LLM)-based RCA agents either rely heavily on predefined workflows, whose effectiveness is constrained by incomplete Standard Operating Procedure (SOP) coverage, or adopt open-ended diagnosis, which remains brittle when multiple plausible root-cause hypotheses are consistent with the observed evidence. We present Hero, a hypothesis-centered RCA framework that formulates diagnosis as controlled discrimination among competing hypotheses via bounded hypothesis-space instantiation, explicit belief-state tracking, and ambiguity-guided evidence acquisition. We evaluate Hero on OpenRCA and a real-world industrial incident dataset against representative workflow-based and open-ended baselines. On OpenRCA with DeepSeek-V3, Hero achieves an SR of 79.77, outperforming the strongest ReAct-style baseline by 23.20 points while using 1.04 fewer actions on average. On the industrial dataset, it reaches an SR of 85.00 and remains the best-performing method. These results suggest that explicitly controlling competing hypotheses is an effective and practically promising abstraction for microservice RCA, especially in real-world, production-style incidents with incomplete workflow coverage and high diagnostic ambiguity. Article Search Article: ase26main-p1707-p doi:10.1145/3832783.3837509
	Liang, Shuai	ASE '26: "AgentChaos: Chaos Engineering ..." AgentChaos: Chaos Engineering for Agent Systems via Programmatic Fault Injection Gou Tan, Zhensu Sun, Jieke Shi, Ting Zhang, Zilong He, Qingfu Wu, Shuai Liang, Weifeng Sun, Junda He, Pengfei Chen, Chuanfu Zhang, Lwin Khin Shar, and David Lo (Sun Yat-sen University, Guangzhou, China; Singapore Management University, Singapore; Monash University, Australia; China Unicom Software Research Institute, Beijing, China) Agent systems rely on LLM APIs for every response, but these APIs can return server errors, truncated responses, or corrupted content that propagates through downstream agents and causes task failure. Evaluating robustness under these faults is crucial for reliable deployment. Existing fault injection methods are offline, require source code modification, or cannot modify specific response fields. A comprehensive evaluation also requires a systematic fault taxonomy because different fault types affect downstream agents differently. We propose AgentChaos, a chaos engineering framework for controlled, runtime, non-intrusive LLM API fault injection. Since all agent systems access LLMs through the same HTTP interface, we inject faults at this shared layer without modifying source code. We define crash, omission, and value faults on content and tool call fields, intercept and modify LLM API responses at runtime, and verify whether each fault is triggered to filter untriggered tasks and avoid underestimating fault impact. Evaluations across agent systems, benchmarks, and backbone LLMs under 65 fault configurations show that all systems degrade under fault injection, with pass@1 dropping by up to 50 percentage points. The ranking is consistent across models, suggesting that robustness depends on system implementation rather than model capability. Existing fault diagnosis methods achieve below 53% accuracy on fault type and below 56% on fault step, leaving room for improvement. We further reveal practical findings for agent system developers. Article Search Artifacts Available Article: ase26main-p355-p doi:10.1145/3832783.3837437
	Liang, Tingshuo	ASE '26: "From Runnable Code to Shippable ..." From Runnable Code to Shippable Applications: Test-Driven Development for Full-Stack Web Application Generation Yuxuan Wan, Tingshuo Liang, Jiakai Xu, Jingyu Xiao, Yintong Huo, and Michael R. Lyu (Chinese University of Hong Kong, Hong Kong; Columbia University in the City of New York, USA; Singapore Management University, Singapore) Coding agents can generate runnable web applications, but their outputs frequently fail to satisfy functional requirements. Although test-driven development (TDD) offers a principled repair loop, applying it to web applications requires deriving executable acceptance tests, validating behavior through dynamic browser interactions, and translating observed failures into actionable feedback. We present TDDev, an experimental instrument that automates these tasks and enables closed-loop TDD with minimal human mediation. Using TDDev, we conduct the first controlled study of TDD for full-stack web application generation across 20 diverse web applications, multiple backbone models, two coding agents, and three TDD implementations. With sufficiently capable backbones, TDD improves accuracy by 15.5-23.7 percentage points and remains effective across both minimal and full-featured coding agents; replacing unreliable feedback with a stronger tester restores positive gains for a lower-capability backbone. Incremental TDD provides bounded control, Whole-Project TDD enables coordinated repair and achieves the highest cost efficiency in most configurations, and Agentic TDD performs best with highly capable models. Based on these findings, we provide a practical decision tree that selects an implementation according to model capability, feedback reliability, and deployment objectives. By automating acceptance testing and failure-guided repair, TDDev also reduces the human testing and intervention required during development. Article Search Article: ase26main-p1397-p doi:10.1145/3832783.3834388
	Liang, Xiao	ASE '26: "TLCrafter: Peeling the Layers ..." TLCrafter: Peeling the Layers of Natural Language to Reveal Temporal Logic Specifications Cheng Wen, Wenjun Ke, Xiao Liang, Zhi Ma, Xiaoyong Xue, Shengchao Qin, and Cong Tian (Xidian University, China; Northwest University, China; Peking University, China) Natural-language (NL) requirements are widely used in industrial systems, but formal verification typically requires precise temporal logic (TL) specifications. This paper presents TLCrafter, an interactive tool for translating NL requirements into TL formulas, including LTL, CTL, and STL. Given an NL requirement, TLCrafter constructs OnionL+, a hierarchical intermediate representation that supports more robust NL-to-TL formalization by combining LLM-based semantic decomposition with deterministic rule-based synthesis. Its visual interface allows engineers to inspect and correct the intermediate structure before formula generation. Experiments on domain datasets across LTL, CTL, and STL show that TLCrafter improves formula accuracy while maintaining full syntactic validity. A video of TLCrafter is available at https://youtu.be/jp-Pp_amjks. The tool and artifacts are available at https://sites.google.com/view/tlcrafter/. Article Search Article: ase26tool-p13-p doi:10.1145/3832783.3834598
	Liang, Xixian	ASE '26: "Model-Guided Property-Based ..." Model-Guided Property-Based Testing of WeChat Pay at Billion-User Scale Xiangchen Shen, Yiting Wang, Ting Su, Jingjing Liang, Jingling Sun, Xixian Liang, Haiying Sun, Xinjie Xu, Haochuan Lu, Yuetang Deng, Pengcheng Wang, Geguang Pu, Zhendong Su, and John Hughes (East China Normal University, China; University of Electronic Science and Technology of China, China; Tencent, China; ETH Zurich, Switzerland; Chalmers University of Technology, Sweden) Ensuring the correctness of mobile payment applications is critical, as even subtle faults can lead to severe financial losses. To ensure reliability, the WeChat Pay (a popular payment app with over one billion active users worldwide) team developed a User Acceptance Testing (UAT) system based on model-based testing (MBT). It maintains use cases specifying user operation sequences and expected app behaviors under business rules. UAT converts these use cases into formal models and generates test cases to validate the app. Although UAT achieves 100% state coverage by covering all user operations and business rules, it still suffers from two major limitations: insufficient test coverage and predefined test oracles. In this paper, we introduce a model-guided property-based testing approach to improving the existing UAT system. We have two key observations: (1) UAT test cases can effectively reach all app states; and (2) WeChat Pay exhibits some invariant behaviors, which can be used to synthesize generic properties for bug finding. Building on these observations, our approach performs random exploration from UAT-discovered states, and validates app behaviors against the automatically synthesized properties. We also propose a greedy trace shrinking algorithm to reduce failure-inducing traces. We implemented our approach as UAT++, an advanced testing tool built upon the UAT system. Across 20,000 machine hours, UAT++ found 59 previously unknown bugs, including 48 logic bugs and 11 crash bugs (55 confirmed, 45 fixed). These bugs could not be found by the UAT system and classic property-base testing (PBT). UAT++ improved state transition coverage by 82.6% and 600.0% over the UAT system and classic PBT, respectively. The shrinking algorithm attained an average trace reduction rate of 79.9%. To date, UAT++ has been deployed in the continuous testing pipeline of WeChat Pay across Android, iOS, and HarmonyOS platforms. Article Search Article: ase26ind-p569-p doi:10.1145/3832783.3834537
	Liang, Yiliang	ASE '26: "Safeguarding LLM Agents from ..." Safeguarding LLM Agents from Misalignment through Provenance Analysis Yining She, Yiliang Liang, and Eunsuk Kang (Carnegie Mellon University, USA) As LLM agents gain increasing access to powerful tools, ensuring that their actions align with the user’s intent becomes critical. When an agent’s proposed action deviates from that intent—a phenomenon called misalignment— it may cause harm that is difficult to undo. Existing runtime guardrails rely on an LLM-as-a-judge paradigm that lacks a systematic framework for reasoning about alignment, often producing inconsistent or difficult-to-audit judgments. Motivated by provenance analysis, we propose a conceptual framework that formalizes misalignment detection as determining whether a proposed tool call is supported by traceable evidence in the agent’s context. Based on this framework, we build ProvenanceGuard, a multi-stage pipeline that analyzes the agent’s action for three types of misalignment before its execution and only allows aligned actions. We evaluated ProvenanceGuard on AgentSafetyBench and WorkBench, across 11 backbone LLMs. Compared to the LLM-as-a-judge baseline, ProvenanceGuard reduces error rate on misaligned traces from 44.3 Article Search Article: ase26main-p2533-p doi:10.1145/3832783.3837535
	Liao, Bin	ASE '26: "Li-WaC: A Lightweight WebAssembly ..." Li-WaC: A Lightweight WebAssembly Container for Independently Upgradable IoT Applications in Xiaomi Vela Bin Liao, Canfeng Zheng, Shiwen Shan, Qi Huang, Junjie Dong, Xiang Xiao, Yaoyao Gu, and Yuxin Su (Beijing Xiaomi Mobile Software, China; Sun Yat-sen University, China) In resource-constrained IoT devices, traditional application runtimes often struggle with limited performance and inflexible update mechanisms. WebAssembly (Wasm) has emerged as a promising technology to overcome these bottlenecks. However, existing Wasm implementations are not yet fully optimized for practical IoT environments, particularly in terms of JavaScript performance and modular over-the-air (OTA) updates on production IoT systems. To fill the gap, we propose Li-WaC, a lightweight, high-performance, and efficiently updatable WebAssembly Container framework for IoT operating systems.Specifically, we integrate a Wasm runtime into the event-driven Context Hub Runtime Environment (CHRE) framework. By treating the Wasm runtime as a standalone dispatch entity, Li-WaC runs Wasm modules as standard nanoapps, similar to native C/C++ applications. Performance-intensive tasks that were previously handled in JavaScript can then be offloaded to Wasm. We implemented and deployed Li-WaC within Vela, a production IoT operating system developed and maintained by Xiaomi, a leading global manufacturer of smartphones and IoT devices. On compute-oriented microbenchmarks, the AOT mode of Li-WaC achieves a 13× average speedup over QuickJS, approaching V8 on these microbenchmarks. In a production deployment study, we also observed smaller update packages, shorter installation times, and higher upgrade adoption rates under modular updates, where the upgrade adoption rate is the share of devices in the target cohort that completed an upgrade within a stated observation window. Article Search Article: ase26ind-p186-p doi:10.1145/3832783.3834502
	Liao, Pingjia	ASE '26: "Manifesting Implicit Dependencies ..." Manifesting Implicit Dependencies in Requirements Task: An Automated Method Integrating Code Awareness and Change Analysis Hui Ma, Jiajun Yang, Yan Chen, Pingjia Liao, Baoyu Zhao, and Daoping Jiang (Shenzhen Poweroak Newener, China) In modern software development, accurately assessing the impact scope of requirement changes is crucial for software quality, yet this task faces two major challenges. First, highly simplified requirement descriptions (one-sentence requirements) tend to conceal complex business logic and extensive system dependencies. Second, commits often intertwine code changes for multiple requirements, leading to impact assessments that are both incomplete and time-consuming. Traditional manual assessment methods are not only inefficient but also prone to cognitive biases, which often result in the omission of critical impact points. To address these problems, this paper proposes AIST (Analysis of the Impact Scope of the Task), an automated impact scope analysis approach based on Large Language Models (LLMs). AIST leverages the semantic understanding and planning capabilities of LLMs to automatically parse requirement descriptions, retrieve relevant code context from the codebase, and integrate code change information, thereby generating a comprehensive impact scope assessment report. We evaluated AIST on 40 historical requirement changes from three real-world industrial projects. The experimental results show that it achieves a precision of $80.19\%$, a recall of $94.95\%$, and an F1-score of $86.35\%$, thereby significantly improving the completeness of impact scope identification and demonstrating high sensitivity in detecting tangled code changes. In a user survey, the novelty score was 6.32 out of 7.00, and the overall satisfaction score was 6.36 out of 7.00, indicating that users perceive that the tool effectively improves efficiency and reduces the risk of omissions. Article Search Article: ase26ind-p257-p doi:10.1145/3832783.3834516
	Liao, Qing	ASE '26: "InfraAPR: An Agent-Based Repair ..." InfraAPR: An Agent-Based Repair Framework for Cloud Infrastructure-as-Code Programs Quan Chen, Zhao Liu, Chunfang Li, Yifan Zhang, Ning Hu, and Qing Liao (Harbin Institute of Technology, Shenzhen, China; Pengcheng Laboratory, China; Hunan University, China; Nanchang University, China) Infrastructure as Code (IaC) is now a routine part of industrial cloud delivery, and Programming Languages IaC (PL-IaC) frameworks further enable engineers to build infrastructure using familiar programming abstractions. However, repairing buggy PL-IaC programs in practice remains costly and highly challenging. Existing quality assurance efforts for PL-IaC have largely concentrated on defect analysis and static checking, while end-to-end automated repair frameworks for PL-IaC programs remain largely absent. In addition, automated program repair techniques designed for general-purpose software often lack PL-IaC-specific domain knowledge, as well as effective modeling and guidance for topology dependencies, making them ineffective for repairing topology-dependent bugs in PL-IaC settings. This paper presents InfraAPR, an agent-based automated repair framework for PL-IaC programs. To enable end-to-end automated repair, InfraAPR integrates three coordinated modules: (1) an InfraAPR Agent Module for phase-specialized LLM reasoning, (2) a Semantic Mapping Module for reconstructing graph-based PL-IaC semantics, and (3) a Constraint-Guided Repair Module that diagnoses constraint violations and generates repaired programs based on structured diagnostics. We evaluate InfraAPR on an industrial benchmark. Experimental results show that InfraAPR consistently outperforms the baselines, achieving a repair success rate of up to 61.8% and improving the strongest baseline by 15.4% on average. These results demonstrate its substantial practical value and improved reliability for industrial PL-IaC workflows. Article Search Article: ase26ind-p338-p doi:10.1145/3832783.3834526
	Liao, Xiangke	ASE '26: "CTForge: Automatically Generating ..." CTForge: Automatically Generating Test Suites for Software Configuration Yuanliang Zhang, Zhizheng Zheng, Shanshan Li, Zhouyang Jia, Chaopeng Luo, Liqian Chen, Zhenbang Chen, Ji Wang, and Xiangke Liao (National University of Defense Technology, China) Software configuration plays a critical role in modern software systems, yet it also frequently leads to severe failures. Existing approaches, whether static analysis or LLM-based validation, struggle to capture implicit semantic constraints and validate configuration-code interactions. Leveraging existing unit tests is also insufficient due to their lack of configuration-specific focus. Thus, we present CTForge, an LLM-powered framework that automatically generates configuration-specific test suites. Its core innovation is a three-stage configuration-aware optimization pipeline that moves beyond vanilla test generation, specifically using parameter semantics to improve LLM outputs. This optimization pipeline iteratively aligns tests through: (1)enhance configuration-related code coverage to ensure relevance, (2) assertion validation across valid parameter values to eliminate false assertions, and (3) configuration-sensitivity verification to select tests that semantically exercise the intended configuration behavior. Evaluated on five large-scale systems, CTForge detects 63 out of 79 real-world configuration issues and achieves an F1-score of 0.88 in misconfiguration detection. CTForge also uncovers six previously unknown defects. Our work demonstrates that structured configuration-aware refinement is essential for LLM to produce effective test suites. Article Search Article: ase26main-p1197-p doi:10.1145/3832783.3837484
	Liao, Zeqin	ASE '26: "IcFuzz: Fuzzing Isaac Sim ..." IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation Zhixiang Chen, Zhuangbin Chen, Ruoxi Jia, Zeqin Liao, Wei Li, Jinyang Liu, and Zibin Zheng (Sun Yat-sen University, China; Nanyang Technological University, Singapore; Chinese University of Hong Kong, Hong Kong) Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190%–205% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers. Article Search Article: ase26main-p3261-p doi:10.1145/3832783.3837550
	Lie, David	ASE '26: "RFC2TLA+: Extracting and Verifying ..." RFC2TLA+: Extracting and Verifying Formal Models from RFC Documents using Continuous LLM Feedback Guozhen Ding, Kexin Li, Ilya Grishchenko, and David Lie (University of Toronto, Canada) Extracting natural-language protocol specifications such as Requests for Comments (RFCs) into formally verifiable models is a challenging and labor-intensive process that requires significant expertise. Recent advances in large language models (LLMs) and agents show promise in automating this task. However, existing automated approaches suffer from insufficient structural consistency, hallucinations, and limited scalability. Moreover, the ability to pass such automatically extracted models into formal verification tools such as model checkers has not been demonstrated. We present RFC2TLA+, a three-stage pipeline for automatically extracting RFCs into automatically verifiable models. RFC2TLA+ achieves this by providing fine-grain and continuous feedback to the LLM throughout the extraction process. It decomposes the extraction process into three passes—states, transitions, and invariants—while constraining LLM generation through fine-grained tool calls, lightweight validation, and iterative feedback. This design enables early error detection and correction, mitigating hallucinations and preventing syntactic and semantic inconsistencies. The resulting communicating finite-state machines (CFSMs) are deterministically translated into TLA + and verified using the TLC model checker. We evaluate RFC2TLA+ on a benchmark of 14 RFCs and their accompanying human-crafted FSMs and show that it generates more complete models than the baseline. In addition, our tool extracts invariants, enabling a model checker to detect injected faults. To minimize the effects of LLM memorization, we additionally generate synthetic RFCs and evaluate the tool on them, demonstrating its effectiveness in both model extraction and error detection. Article Search Artifacts Available Article: ase26main-p683-p doi:10.1145/3832783.3837453
	Lin, Dayi	ASE '26: "When Elo Lies: Hidden Biases ..." When Elo Lies: Hidden Biases in Codeforces-Based Evaluation of Large Language Models in Practice Shenyu Zheng, Ximing Dong, Xiaoshuang Liu, Chun Yong Chong, Gustavo Oliva, Dayi Lin, Boyuan Chen, Shaowei Wang, and Ahmed E. Hassan (Huawei Canada, Canada; Huawei, China; Monash University, Malaysia; Queen's University, Canada; University of Manitoba, Canada) As Large Language Models (LLMs) achieve breakthroughs in complex reasoning, Codeforces-based Elo ratings have emerged as a prominent metric for evaluating competitive programming capabilities in industry. However, these ratings are often reported without critical experimental details, leading to significant discrepancies-illustrated by recent reports where the same model version’s score fluctuated by nearly 500 points (out of 2,029). This paper presents a systematic empirical study on the hidden factors biasing Elo evaluations: (1) the temporal ordering of submissions, (2) contest difficulty selection, and (3) run-to-run stochastic variability of LLMs. Utilizing a controlled benchmark of 37 recent Codeforces contests and 13,691 generated test cases, we demonstrate that Elo scores are highly sensitive to these parameters. Our findings reveal that varying submission orders can shift scores by 394 points, while contest selection can cause differences of up to 1,122 points for the same model. Run-to-run performance exhibits substantial instability, with a maximum difference of 349 points in mean scores observed when evaluating identical contests. We conclude that direct Elo comparisons are unreliable and potentially misleading without strict standardization and transparent reporting of experimental settings. Article Search Article: ase26ind-p20-p doi:10.1145/3832783.3834458
	Lin, Guocong	ASE '26: "Towards Reliable Alarm Flood ..." Towards Reliable Alarm Flood Reduction in Data Center via Grammar-Guided Verifiable LLM Reasoning Jiacheng Liu, Guocong Lin, Jichao Yan, Huiwen Zheng, Hongli Ma, Changhao Zhou, Zhiyi Yu, Yuanchun Li, Yunxin Liu, Ding Li, Tao Xie, and Yao Guo (Peking University, China; Tsinghua University, China; GDS Holdings, China) Alarm floods pose a critical challenge in system operations, where a single fault can trigger cascaded alarms across interconnected components, overwhelming human operators and obscuring actionable signals. Alarm flood reduction aims to reduce redundant alarms under a safety-oriented objective, because any incorrect reduction may falsely exclude real failures. Existing approaches face a fundamental trade-off: rule-based systems ensure reliability but lack scalability, while solutions based on a large language model (LLM) offer strong generalization but suffer from non-determinism and unverifiable reasoning, limiting their use in safety-critical settings. In this paper, we study the alarm flood reduction problem in data center operations and introduce a solution based on structured reasoning and conservative verification. Our key insight is that expert-level alarm analysis relies on explicit reasoning chains that connect upstream causes to downstream alarms. We design Constrained Reasoning Chain Grammar (CRCG), a lightweight yet expressive grammar that formalizes such reasoning processes as compositional inference chains with logical and numerical constraints. Our method follows two tightly connected steps. First, we use LLM-assisted annotation, checker-guided compilation, and supervised fine-tuning (SFT) to organize expert knowledge in CRCG and train a model to generate explicit reasoning chains. Second, we conservatively reduce alarms only when the reasoning chain can be verified based on CRCG. We evaluate the method on real-world data center HVAC alarms. Results have shown that our method achieves high accuracy while driving false reductions to zero on the evaluated setting, outperforming both rule-based and LLM-only baselines and reducing operational workload substantially. Article Search Artifacts Available Article: ase26ind-p96-p doi:10.1145/3832783.3834481
	Lin, Hong Yi	ASE '26: "AgenticSCR: An Autonomous ..." AgenticSCR: An Autonomous Agentic Secure Code Review for Immature Vulnerabilities Detection Wachiraphan Charoenwet, Kla Tantithamthavorn, Patanamon Thongtanunam, Hong Yi Lin, Minwoo Jeong, and Ming Wu (University of Melbourne, Australia; Monash University, Australia; Atlassian, USA) Secure code review is critical during pre-integration, where Atlassian developers rely on lightweight analysis tools, while deep security assessment is deferred to later stages, delaying feedback and increasing remediation costs. Existing static analyzers are often noisy and struggle with context-dependent or partially manifested vulnerabilities, while static large language model (LLM) reviewers are constrained by context windows and lack tool interaction. Agentic AI, which combines LLMs with code navigation, shows promise; however, its effectiveness for early-stage secure code review remains underexplored. We present AgenticSCR, an agentic secure code reviewer augmented with security-focused semantic memory that grounds reasoning in structured security knowledge to detect vulnerabilities before they fully manifest. AgenticSCR achieves at least 153% relative improvement in generating comments with correct localization, vulnerability type, and relevance over static LLM baseline, multi-agent reviewer, and SAST tools. In a shadow deployment, 54% of its comments were validated by security engineers for developer reporting, demonstrating practical utility while underscoring the difficulty of the task. These findings position the security-focused semantic memory as a promising direction for agentic secure code review, enabling early-stage vulnerability identification. Our approach builds an important step toward reliable localization, detection, and explanation in shift-left security practices. Article Search Article: ase26ind-p302-p doi:10.1145/3832783.3834523 ASE '26: "Agentic Code Review in the ..." Agentic Code Review in the Terminal: A Trajectory-Level Analysis of Behavior, Cost, and Human-Alignment Wachiraphan Charoenwet, Kla Tantithamthavorn, Patanamon Thongtanunam, Hong Yi Lin, Minwoo Jeong, and Ming Wu (University of Melbourne, Australia; Monash University, Australia; Atlassian, USA) Agentic code review in terminal-based environments enables early feedback during local development before pull request creation. However, existing evaluations remain performance-centric and fail to capture the dynamic behaviors of repository-grounded agentic reviewers. Understanding these behaviors is critical for identifying how agentic reviewers succeed, fail, and incur hidden operational costs in practice. Then, we analyze the reviewers’ behavior based on their trajectories. Our results show that agentic reviewers achieve higher review precision but incur substantial exploration and validation overhead, while successful reviews are associated with stronger planning and less downstream validation. These findings highlight the potential benefits of trajectory-aware and cost-sensitive evaluation of future agentic code review systems. Article Search Article: ase26nier-p49-p doi:10.1145/3832783.3834546
	Lin, Yihang	ASE '26: "Debugging the Debuggers: Failure-Anchored ..." Debugging the Debuggers: Failure-Anchored Structured Recovery for Software Engineering Agents Chenyu Zhao, Shenglin Zhang, Yihang Lin, Wenwei Gu, Zhimin Chen, Yongqian Sun, Dan Pei, Chetan Bansal, Saravan Rajmohan, and Minghua Ma (Nankai University, China; Tsinghua University, China; Microsoft, USA; Microsoft 365, USA) Software engineering agents are increasingly deployed in evaluable engineering environments, yet post-failure recovery remains costly, manual, and largely ad hoc. Existing systems expose traces for inspection or generate follow-up feedback, but they do not turn heterogeneous runtime evidence into grounded, bounded recovery guidance for a subsequent attempt. We present PROBE, a failure-anchored framework for structured recovery in software engineering agents. PROBE organizes failed-run telemetry into structured evidence, structured diagnosis, and bounded recovery guidance, realized by a Telemetry Layer, a Diagnosis Layer, and a Guidance Gate. The Telemetry Layer preserves fine-grained runtime signals, the Diagnosis Layer fuses cross-signal evidence into a grounded diagnosis, and the Guidance Gate constructs diagnosis-derived recovery guidance only when it is evidence-grounded, actionable, and within the scope of agent-side behavior. We evaluate PROBE across three software engineering settings spanning repository-level software repair, enterprise workflow recovery, and AIOps service mitigation. On 257 initially unresolved cases, PROBE achieves 65.37% Top-1 diagnosis accuracy and a 21.79% recovery rate, outperforming the strongest non-PROBE baseline by 43.58 and 12.45 percentage points, respectively. The results reveal a substantial diagnosis-recovery gap: accurate diagnosis is necessary but not sufficient unless it can be translated into bounded guidance that the subsequent attempt can execute and verify. Beyond controlled evaluation, a Microsoft IcM prototype shows that PROBE can attach as a non-intrusive side channel to existing service-diagnosis agent workflows without changing the agent policy, toolset, or execution budget. These results suggest that telemetry-grounded, failure-anchored recovery is a practical path to improving post-failure recoverability of software engineering agents under realistic engineering constraints. Article Search Article: ase26ind-p114-p doi:10.1145/3832783.3834492
	Lin, Yitong	ASE '26: "AEG-Edit: Bridging API Evolution ..." AEG-Edit: Bridging API Evolution and Code Semantics for Accurate API Usage in Code Generation Yitong Lin, Haoye Tian, Dehai Zhao, Chao Ni, Xiaohu Yang, and Xiaoxue Ren (Zhejiang University, China; Aalto University, Finland) As APIs across standard libraries and software ecosystems evolve, the API knowledge frozen in pre-trained LLMs becomes outdated. Prompt-based methods supply updated documentation at inference time yet suffer from context neglect, often reverting to memorized deprecated usages. Existing parametric approaches, whether fine-tuning or model editing, face two common challenges: they treat API changes as textual fact updates, overlooking the changes in code semantics needed for executable correctness (C1), and lack a mechanism to concentrate updates on positions involved in the API evolution, causing parameter interference beyond the evolution boundary (C2). We propose AEG-Edit, which constructs a heterogeneous API evolution graph, encodes and aligns the graph signal with the LLM hidden space, and concentrates gradient effort on positions involved in the API evolution through API-weighted windowing and optimization. On RustEvo²+ (708 Rust tasks) and PyEvo (622 Python tasks) across two representative open-source LLMs at the 7–8B parameter scale, AEG-Edit achieves statistically significant Pass@1 gains on RustEvo²+, improving over the strongest baseline by up to 6.49% on Qwen2.5-7B-Instruct. Ablation and transferability analyses confirm that the heterogeneous API evolution graph drives the gains and transfers to alternative editing backbones. Article Search Artifacts Available Article: ase26main-p2449-p doi:10.1145/3832783.3834415
	Lin, Yun	ASE '26: "AlphaCu: A Transformation-Driven ..." AlphaCu: A Transformation-Driven Synthesis Framework for LLM-Based GPU Kernel Generation Yangjie Zhou, Xing Ma, Zihan Liu, Qing Wang, Weihao Cui, Wu Sun, Hanjing Wang, Binhang Qi, Jingwen Leng, Yun Lin, Minyi Guo, and Jin Song Dong (National University of Singapore, Singapore; Shanghai Jiao Tong University, China; Shanghai Qi Zhi Institute, China; Nanjing University, China; Harvard University, USA) Large language models show promise for code generation, yet their effectiveness in producing high-performance GPU kernels remains insufficiently understood. Recent agentic workflows improve over direct prompting through specialized generation roles and execution feedback, but our characterization of a representative workflow reveals failures in optimization-strategy selection, hardware-specific instruction realization, and shape-dependent parameter selection. We present AlphaCu, a transformation-driven synthesis framework for LLM-based GPU kernel generation. AlphaCu treats kernel generation as structured synthesis over explicit optimization decisions rather than end-to-end code emission. Specifically, AlphaCu represents these decisions as scoped transformation passes maintained across agent-coordinated synthesis stages, enabling compatibility checking and failure attribution. AlphaCu binds selected hardware-sensitive operations to pre-validated microkernels and uses target-device measurements to revise transformation choices and tune runtime configurations. We evaluate AlphaCu on 104 test cases covering single and fused operators across four GPU architectures: NVIDIA H100, A100, V100, and AMD MI210. Under comparable generation budgets, AlphaCu achieves 100% functional correctness on our benchmark suite and delivers an average speedup of 5.64× over prior LLM workflows, while remaining competitive with vendor libraries and tensor compilers. Article Search Article: ase26main-p287-p doi:10.1145/3832783.3837433
	Lin, Zhenfeng	ASE '26: "ActionNex: A Production-Grade ..." ActionNex: A Production-Grade System for Next-Best-Action Recommendation in Cloud Outage Management Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Yudi He, Oleg Kulygin, Hatay Tuna, Chetan Bansal, Ze Li, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson, and Ryan Zhang (Microsoft, USA; Microsoft, UK) Major cloud outages require responders to make high-stakes decisions from noisy, multimodal, and continuously evolving operational data. While recent AI-assisted approaches help with tasks such as triage, troubleshooting, and root-cause analysis, they provide limited support for lifecycle-wide outage management in production environments. We present ActionNex, a production-grade, memory-augmented system that recommends state-aware next-best-actions throughout the outage lifecycle. ActionNex converts fragmented multimodal signals into structured operational context and grounds recommendation in three complementary memories: long-term operational knowledge encoded as Key–Condition–Action (KCA) units, episodic memory from historical outage cases, and working memory derived from the current outage state. We evaluate ActionNex on eight real production outages totaling approximately 9 million tokens of multimodal operational data. Using two held-out outages and six incremental learning episodes, we find that action-level recall improves consistently as episodic memory accumulates, rising from 73.8% to 79.6% on one outage and from 65.1% to 73.5% on the other, while precision remains broadly stable. Additional analyses show that retrieval strategy provides a practical precision–recall control knob, and that structured memory outperforms prompt-only alternatives while reducing over-generation. A 30-day pilot across 10 services provides early evidence of usefulness under live operational conditions. Together, these results indicate that memory-grounded, human-in-the-loop recommendation is a practical and effective design for production outage management. Article Search Article: ase26ind-p70-p doi:10.1145/3832783.3834472
	Lin, Zhiwei	ASE '26: "Understanding the Performance-Effectiveness ..." Understanding the Performance-Effectiveness Trade-Offs of AddressSanitizer in Real-World Programs: An Empirical Study Jiaxin Xi, Cheng Wen, Zhiwei Lin, Yuandao Cai, Jie Su, Bin Yu, Zhuohua Li, and Shengchao Qin (Xidian University, China; Hong Kong University of Science and Technology, China; Chinese University of Hong Kong, China) AddressSanitizer (ASan) is widely deployed in industrial C/C++ development, but its runtime and memory costs can limit routine use in continuous integration and production-like testing. Although many optimized ASan-like sanitizers have been proposed, heterogeneous workloads, configurations, and baselines make their practical trade-offs difficult to compare. We present a unified, deployment-oriented empirical study of ASan and seven representative optimized sanitizers: ASan{-}{-}, SanRazor, GiantSan, RSan, MEDs, ASAP, and LFP. Using 17 SPEC CPU2006 benchmarks, Juliet, MSET, 21 real-world CVEs, and a multi-threaded MySQL case study, we examine component costs, parameter sensitivity, build configurations, detection outcomes, and deployability. In our ordered cumulative ablation, the largest first-step runtime reduction follows removal of memory-access checks, while the largest late-stage RSS reduction occurs at the heap-management step. Parameter tuning identifies lower-memory configurations without additional false negatives relative to default ASan on Juliet, although this result does not establish preservation of delayed-UAF detection. The reported evidence shows distinct efficiency, detection, and deployment outcomes, but unequal completion sets prevent a formal cross-tool ranking. Our results support treating tuned ASan as a necessary, configuration-dependent comparison baseline for sanitizer evaluation and provide bounded evidence for deployment decisions under different resource and risk constraints. Article Search Article: ase26ind-p63-p doi:10.1145/3832783.3834469
	Ling, Shuyi	ASE '26: "SwiftGram: Dynamic Lexical ..." SwiftGram: Dynamic Lexical Forking for Precise and Efficient Grammar-Constrained Decoding Shuyi Ling, Liangyi Kang, Jie Liu, Shuai Wang, Zhirou Ma, and Dan Ye (Institute of Software at Chinese Academy of Sciences, China) Large Language Models (LLMs) must strictly adhere to grammatical constraints for reliable structured generation in agentic workflows, code synthesis, and domain-specific language (DSL) generation. Grammar-Constrained Decoding (GCD) enforces this by masking out tokens incompatible with the target grammar at each decoding step, and has been adopted as a core module in mainstream inference engines such as vLLM. However, existing GCD methods exhibit precision defects under grammars with overlapping terminal definitions. The misalignment between LLM tokens and grammar terminals induces terminal ambiguity, where a token admits multiple plausible terminal interpretations. Existing methods handle this imprecisely, causing both false acceptance and false rejection, while incurring high computational overhead. We propose SwiftGram, a GCD framework that incorporates dynamic lexical forking for precise token masking. By forking only at detected ambiguity boundaries, SwiftGram preserves all admissible terminal interpretations while suppressing spurious ones. It builds on Generalized LR (GLR) parsing with the Graph-Structured Stack (GSS) for compact multi-branch parsing, together with adjacency pruning and terminal tries to reduce online overhead. Experiments show that SwiftGram achieves near-zero grammar violations and no observed false rejection, whereas strong baselines remain prone to masking errors. SwiftGram improves effective throughput by up to 14.7% over the strongest baseline under rejection sampling, and achieves a 5.9× average speedup in per-step mask construction under mask-before-selection. Article Search Article: ase26main-p2654-p doi:10.1145/3832783.3834419
	Ling, Zhiwei	ASE '26: "ARMOR: A Robust Self-Supervised ..." ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality Wenzhuo Qian, Hailiang Zhao, Ziqi Wang, Zhipeng Gao, Jiayi Chen, Zhiwei Ling, and Shuiguang Deng (Zhejiang University, China) Automated incident management is critical for microservice reliability. While recent unified frameworks leverage multimodal data for joint optimization, they unrealistically assume perfect data completeness. In practice, network fluctuations and agent failures frequently cause missing modalities. Existing approaches relying on static placeholders introduce imputation noise that masks anomalies and degrades performance. To address this, we propose ARMOR, a robust self-supervised framework designed for missing modality scenarios. ARMOR features: (i) a modality-specific asymmetric encoder that isolates distribution disparities among metrics, logs, and traces; and (ii) a missing-aware gated fusion mechanism utilizing learnable placeholders and dynamic bias compensation to prevent cross-modal interference from incomplete inputs. By employing self-supervised auto-regression with mask-guided reconstruction, ARMOR jointly optimizes anomaly detection (AD), failure triage (FT), and root cause localization (RCL). AD and RCL require no fault labels, while FT relies solely on failure-type annotations for the downstream classifier. Extensive experiments demonstrate that ARMOR achieves state-of-the-art performance under complete data conditions and maintains robust diagnostic accuracy even with severe modality loss. Article Search Article: ase26main-p102-p doi:10.1145/3832783.3834338
	Liu, Bin	ASE '26: "When Ambiguity Meets Atypicality: ..." When Ambiguity Meets Atypicality: Dual-Perspective Test Input Prioritization for DNNs Haoran Li, Shihai Wang, Bin Liu, Jialuo Chen, Wenjing Zhu, Yu Liu, Tengfei Shi, and Shudi Guo (Beihang University, China; Zhejiang University, China) While Deep Neural Networks (DNNs) have achieved remarkable progress in cutting-edge domains, their inherent brittleness has become a growing concern. To ensure the reliability and safety of DNN-enabled software, DNN testing has emerged as an indispensable practice. Within this context, test input prioritization is essential for early fault detection and reducing labeling costs. However, it remains challenging to accurately identify failure-inducing inputs. Although decision ambiguity and distributional atypicality are two widely adopted perspectives for characterizing inter-class competition and intra-class typicality respectively, relying on either perspective in isolation inevitably introduces blind spots. In this paper, we propose DuFP (Dual perspective Feature space Prioritization), a KNN density-based test input prioritization approach for DNNs that jointly incorporates both inter-class and intra-class perspectives. The prioritization framework of DuFP is built upon class-conditional density estimation. Based on the estimation results, prediction correctness is characterized by an ambiguity score and an atypicality score, with the former reflecting decision ambiguity and the latter quantifying distributional atypicality. A hybrid uncertainty score is then constructed by integrating both scores to guide the final prioritization. We evaluate DuFP on prioritization and selection tasks across image and text datasets under clean, corrupted, and adversarial scenarios. Experimental results demonstrate that DuFP effectively and efficiently prioritizes fault-inducing inputs and outperforms state-of-the-art approaches. Article Search Artifacts Available Article: ase26main-p367-p doi:10.1145/3832783.3834351
	Liu, Chanjuan	ASE '26: "DynCA: An Effective Algorithm ..." DynCA: An Effective Algorithm for 3-Wise Combinatorial Interaction Testing in Highly Configurable Systems Ruizhi Shi, Shuangyu Lyu, Renyu Yang, Wei Wu, Chanjuan Liu, Chunming Hu, and Chuan Luo (Beihang University, China; Central South University, China; Dalian University of Technology, China) With the increasing demand for software customization, highly configurable systems have become increasingly important. Combinatorial interaction testing (CIT) is widely recognized as an effective technique for testing such systems. The most critical problem in CIT is constrained covering array generation (CCAG), which aims to construct a t-wise covering array (CA) with as small a size as possible, where t denotes the testing strength. Compared with the widely adopted pairwise testing ( 2-wise CIT), 3-wise CIT is capable of detecting more faults and provides greater practical benefits. However, it also introduces significantly higher computational complexity. Although many existing algorithms perform well on 2-wise CCAG, current state-of-the-art CCAG algorithms still suffer from the severe scalability challenge in 3-wise CCAG and have difficulty generating small-sized CAs for large-scale instances. Since the size of a CA directly affects testing efficiency in practice, generating small-sized 3-wise CAs is of great importance. In this work, we propose , a novel 3-wise CCAG algorithm that effectively generates small-sized CAs for large-scale instances. Experimental results on extensive real-world highly configurable systems demonstrate that, compared with existing state-of-the-art algorithms, reduces the size of generated 3-wise CAs by 10.8%. Moreover, is efficient, requiring only half of the running time to generate smaller 3-wise CAs than existing algorithms. Article Search Artifacts Available Article: ase26main-p354-p doi:10.1145/3832783.3834349
	Liu, Chen	ASE '26: "Maintaining Control States ..." Maintaining Control States for Initialization-Aware GRPO in Industrial LLM Workflows Chen Liu, Zhenzhao Yuan, Fengyuan Fan, Limei Che, Qiao Qian, Qingyuan Liang, Zeyu Sun, and Lu Zhang (Peking University, China; Tencent, China; Institute of Software at Chinese Academy of Sciences, China) Large language models (LLMs) are increasingly used as components in industrial software workflows, where they are expected to support reliable automation. However, newly introduced workflows often provide only limited data and sparse task-level feedback, making post-deployment adaptation difficult. GRPO-based post-training provides a practical adaptation way in this setting, but its effectiveness depends on the state from which adaptation begins. When the initial behavior of an LLM workflow is poorly aligned with the target workflow, early samples may provide weak reward signals, wasting adaptation budget and delaying workflow onboarding. We propose CoSTAR, an industrial post-deployment adaptation framework that maintains the starting state for downstream GRPO through a lightweight workflow-level control component. CoSTAR performs GRPO-style optimization on this control component while keeping the task model fixed, and alternates this maintenance with downstream GRPO, so that the control state can continue adapting across stages rather than remain a one-shot initialization. Experiments on a company-internal industrial workflow automation task show that CoSTAR substantially improves task-specific post-training, achieving 94.00% exact match and raising performance on complex cases to 80.56%. Overall, our results show that maintaining the starting state of downstream GRPO improves adaptation under limited workflow feedback and provides a more effective path for industrial LLM workflow maintenance. Article Search Article: ase26ind-p22-p doi:10.1145/3832783.3834459
	Liu, Chengwei	ASE '26: "How Effective Are NPM Malicious ..." How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study Wenbo Guo, Zhongwen Chen, Zhengzi Xu, Chengwei Liu, Ming Kang, Shiwen Song, Chengyue Liu, Yijia Xu, Weisong Sun, and Yang Liu (Nanyang Technological University, Singapore; Sichuan University, China; Imperial Global Singapore, Singapore; Nankai University, China; Singapore Management University, Singapore) The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on disparate datasets with inconsistent settings, making cross-tool comparison unreliable and leaving practitioners without clear guidance. We present the first large-scale empirical study of NPM malicious package detection, evaluating 11 tools with 16 variants on a unified benchmark of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques. Unlike prior work, we inspect each tool’s source code to explain why tools succeed or fail, not merely how often. Our key findings: (1) the precision and recall a tool achieves are structurally determined by how it resolves the ambiguity between code capability and malicious intent, with IntelGuard reaching the best F1 at 95.98% by grounding its judgment in retrieved evidence and GuardDog the best among conventional tools at 93.32%; (2) behavioral coupling amplifies detection signals when behaviors co-occur, raising SAP_DT from 3.2% to 79.3% for the collect-and-exfiltrate chain; (3) 80.3% of malware uses no evasion because the ecosystem lacks mandatory pre-publication scanning; (4) ML degradation is driven by concept convergence rather than concept drift, since malware became simpler and every decision boundary fitted to a corpus ages with it; (5) combination effectiveness equals complementarity minus false-positive introduction, not paradigm diversity. Strategic combinations reach up to 97.21% accuracy and 97.02% F1. We release our benchmark and evaluation framework. Article Search Article: ase26main-p218-p doi:10.1145/3832783.3837427 ASE '26: "One Is Not Enough: The Untold ..." One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability Fangyuan Zhang, Lyuye Zhang, Lingling Fan, Chengwei Liu, Yinan Li, Liang Huang, Yang Liu, Zheli Liu, and Sen Chen (Nankai University, China; Nanyang Technological University, Singapore; Qi An Xin Technology Group, China) Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling. Article Search Article: ase26main-p694-p doi:10.1145/3832783.3837455 ASE '26: "Benchmarking Automated Security ..." Benchmarking Automated Security Patch Backporting: How Far Are We? Jincheng Yang, Yulong Fu, Chengwei Liu, Lyuye Zhang, Fangyuan Zhang, Bingyang Ren, Yang Liu, and Hui Li (Xidian University, China; Nankai University, China; Nanyang Technological University, Singapore) Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools have reported high success rates, often exceeding 80% on their respective datasets. However, these evaluations are typically confined to homogeneous environments, such as within the same repository or specific project versions. Consequently, it remains unclear how well these tools generalize beyond their originally targeted scenarios. We present Porting Benchmark, a curated dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework. Using this benchmark, we evaluate five state-of-the-art tools spanning traditional program analysis, LLM-based prompting, and LLM agents under aligned evaluation settings. Our results show that aligned evaluation changes the apparent performance landscape: PortGPT and TSBPort remain comparatively strong on the Replication Dataset, while FixMorph and Mystique degrade substantially under the common protocol. Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design. On a 45-case dynamically validated subset with verified test cases and constructed POCs, we further observe that reference-based benchmark scores do not fully capture real-world remediation: exact match sharply under-credits harder target adaptations, while executable validation reveals residual integration failures in the target that static reference agreement misses. Executable-feedback refinement provides limited but measurable recovery on the hardest executable cases. Article Search Article: ase26main-p2788-p doi:10.1145/3832783.3837542 ASE '26: "Implicit, Yet Impactful: Understanding ..." Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects Lyuye Zhang, Chengwei Liu, Fangyuan Zhang, Yiran Zhang, Yuan Zhou, and Yang Liu (Nanyang Technological University, Singapore; Nankai University, China; Zhejiang Sci-Tech University, China) As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly declared dependencies, known as direct dependencies, receive significant attention in terms of maintainability and security. However, implicit dependencies, which are not explicitly defined by users but are still directly utilized or referenced in their project code due to oversight, remain largely unnoticed. Unlike ordinary transitive dependencies, which may remain unused and invisible to the root, implicit dependencies are actively used yet undeclared, leaving their versions outside the project’s direct control. This lack of awareness poses substantial challenges related to security and maintainability. In this study, we present the first study to treat implicit dependencies as the focal phenomenon and quantitatively characterize their lifecycle consequences for the Maven ecosystem. We meticulously collected and built a large-scale dataset with 1,157 libraries with 19,812 versions from the Maven Central Repository and 972 modules from GitHub. Our findings reveal that 34.12% of the analyzed dataset contains implicit dependencies, with two primary causes identified as key contributors to the issue. Among these, 48% introduce breaking changes due to version drift, and 36 CVEs have vulnerable methods directly used by root projects; 30.28% of implicit dependencies are affected by known vulnerabilities under the version-range convention SCA tools use for declared dependencies. Finally, we identified and analyzed four major countermeasures, providing actionable insights and practical implications for addressing this overlooked issue for stakeholders within the OSS ecosystem. Article Search Article: ase26main-p3524-p doi:10.1145/3832783.3837552 ASE '26: "ATLAS: Agentic Taxonomy of ..." ATLAS: Agentic Taxonomy of LArge-Scale Software Ecosystems Junyi Lu, Mengyao Lyu, Jiahui Wu, Lei Yu, Chengwei Liu, Fengjun Zhang, Li Yang, Chun Zuo, and Yang Liu (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Nankai University, China; Sinosoft, China) The open-source ecosystem on GitHub lacks a systematic hierarchical taxonomy of software repositories. GitHub Topics, the dominant organizational mechanism, is flat, inconsistent, and covers only 67% of repositories. We present ATLAS, the first framework that automatically constructs a hierarchical taxonomy for software repositories and classifies repositories into it end-to-end. By combining LLM global knowledge with real repository distributions, ATLAS proposes meaningful splitting dimensions and iteratively corrects those that fail to accommodate real repositories. A Designer Agent proposes splitting dimensions while a Classifier Agent assigns repositories; a self-corrective refinement loop uses classification failures to drive dimension revision through escalating strategies. We evaluate ATLAS on 54,387 GitHub repositories against six baselines spanning four paradigm families, two downstream software engineering tasks, and three model families. On a stratified 2,001-repository benchmark, ATLAS achieves a Taxonomy Quality F-score (TQF) of 83.13%, outperforming the best baseline by 15 percentage points (on the full 54k corpus the approximate TQF is 73.0%, a gap driven by Path Granularity's all-or-nothing scoring on longer paths rather than lower classification accuracy; see Section 4.5). It is the only method to simultaneously achieve high structural quality and high practical applicability. On downstream tasks, the ATLAS taxonomy enables software alternative discovery with P@1 = 85.71%, surpassing even human-curated lists (62.34%), and achieves the highest P@1 for repository retrieval. The taxonomy further reveals structural ecosystem trends that are difficult to obtain from flat tags or similarity methods: the shift from libraries to AI/ML applications (now 61% of newly community-adopted projects) becomes visible only through hierarchical, type-based categorization. An interactive taxonomy explorer is available at https://atlas-taxonomy.netlify.app/. Article Search Artifacts Available Article: ase26main-p622-p doi:10.1145/3832783.3834361
	Liu, Chengyue	ASE '26: "How Effective Are NPM Malicious ..." How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study Wenbo Guo, Zhongwen Chen, Zhengzi Xu, Chengwei Liu, Ming Kang, Shiwen Song, Chengyue Liu, Yijia Xu, Weisong Sun, and Yang Liu (Nanyang Technological University, Singapore; Sichuan University, China; Imperial Global Singapore, Singapore; Nankai University, China; Singapore Management University, Singapore) The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on disparate datasets with inconsistent settings, making cross-tool comparison unreliable and leaving practitioners without clear guidance. We present the first large-scale empirical study of NPM malicious package detection, evaluating 11 tools with 16 variants on a unified benchmark of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques. Unlike prior work, we inspect each tool’s source code to explain why tools succeed or fail, not merely how often. Our key findings: (1) the precision and recall a tool achieves are structurally determined by how it resolves the ambiguity between code capability and malicious intent, with IntelGuard reaching the best F1 at 95.98% by grounding its judgment in retrieved evidence and GuardDog the best among conventional tools at 93.32%; (2) behavioral coupling amplifies detection signals when behaviors co-occur, raising SAP_DT from 3.2% to 79.3% for the collect-and-exfiltrate chain; (3) 80.3% of malware uses no evasion because the ecosystem lacks mandatory pre-publication scanning; (4) ML degradation is driven by concept convergence rather than concept drift, since malware became simpler and every decision boundary fitted to a corpus ages with it; (5) combination effectiveness equals complementarity minus false-positive introduction, not paradigm diversity. Strategic combinations reach up to 97.21% accuracy and 97.02% F1. We release our benchmark and evaluation framework. Article Search Article: ase26main-p218-p doi:10.1145/3832783.3837427
	Liu, Dong	ASE '26: "Beyond Single-Level PGO: Understanding ..." Beyond Single-Level PGO: Understanding and Harnessing Cross-Level Optimization Effects in Industrial Systems Dong Liu, Yifan Cheng, Yunfeng Cui, Ting Chen, Jiachi Chen, Zhihong Xue, Chong Hu, and Shengyu Cheng (ZTE Corporation, China; University of Electronic Science and Technology of China, China; Zhejiang University, China) Profile-guided optimization (PGO) is used to improve software performance in applications and operating system kernels. However, prior work applies PGO to a single layer in isolation, overlooking cross-layer interactions in systems, where kernel and application are optimized independently using different workloads. This practice is common in production environments and makes its impact on end-to-end performance important to understand. It introduces a mismatch between training and deployment, where profiling workloads may not reflect the final co-executed system. Despite its prevalence, the implications of such cross-layer mismatch remain poorly understood. In this paper, we present a large-scale industrial study of multi-level PGO across three representative products. We evaluate the combined effects of independently optimized kernel and application under realistic deployment conditions. Our results show that multi-level PGO can yield performance gains of up to 17.04%, but may lead to severe regressions of up to 81.90%. Through performance counter analysis, we attribute these effects to microarchitectural factors such as cache contention and branch misprediction arising from mismatched profiling assumptions. These findings show that PGO benefits are not necessarily compositional across software layers. Based on these insights, we propose Multi-Level PGO (ML-PGO), a practical guideline for applying PGO safely across system layers. Our work highlights the importance of workload representativeness and cross-layer awareness for achieving reliable performance improvements. Article Search Article: ase26ind-p100-p doi:10.1145/3832783.3834484 ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Liu, Dugang	ASE '26: "Beyond Benchmarks: A Case ..." Beyond Benchmarks: A Case Study of LLM-Generated Verus Specification Failures on Asterinas Vostd Dugang Liu, Ding Wang, Chao Jiang, Cheng Wen, Zhiwu Xu, Zhong Ming, Yuwei Liu, Xinyi Wan, and Lin Huang (Shenzhen University, China; Ant Group, China) Large language models (LLMs) have recently shown promise in automating formal specification generation, but their effectiveness has mainly been demonstrated on self-contained benchmark tasks. This paper examines the changes that occur when LLM-generated specifications are applied to an industrial verification project. To answer this question, we conducted experiments on Asterinas OSTD's Vostd repository, a Rust-based OS-kernel verification codebase built around cross-file dependencies and Entity--Model proof abstractions. We analyze six formal verification targets spanning 156 function-level tasks, 50 Rust source files, and 7,149 lines of code; the failure corpus contains 1,587 reviewed failure episodes nested within 270 model-specific repair traces produced by DeepSeek-V4-Flash, GPT-4o, and Qwen-Coder. Our results show that existing methods effective on benchmarks face significant challenges on Vostd, and that framework customization for industrial validation is necessary and has considerable potential. LLM-generated specifications break in systematic rather than random ways: they cluster across four verification stages (i.e., repository integration, Verus legality, semantic modeling, and proof construction), and their distributions vary across models and targets. We further show that verifier diagnostics do not always identify the true source of failure, and that verifier-guided repair can regress or stall rather than converge. These findings indicate that LLM-generated specifications fail not merely because industrial code is harder, but because failures are structured, stage-dependent, and often repaired in the wrong direction. Future evaluation and tooling should therefore move beyond final pass/fail outcomes and account for where specifications break, whether diagnostics identify the real cause, and whether repair makes progress or simply cycles through new errors. Article Search Artifacts Available Article: ase26ind-p194-p doi:10.1145/3832783.3834504 ASE '26: "VerusSeek: Retrieval-Augmented ..." VerusSeek: Retrieval-Augmented LLM-Based Proof Synthesis for Rust Programs Yuchen Zhang, Cheng Wen, Jialun Cao, Dugang Liu, Zhiwu Xu, Yuwei Liu, and Shengchao Qin (Xidian University, China; Hong Kong University of Science and Technology, Hong Kong; Shenzhen University, China; Institute of Software at Chinese Academy of Sciences, China) Formal verification of Rust programs with Verus provides strong correctness guarantees, but developing the auxiliary specifications and proofs still requires considerable manual effort. Existing LLM-based proof-synthesis agents can automate part of this process, yet their effectiveness on non-trivial tasks is often limited by the lack of reusable proof patterns that are directly relevant to verification. This paper presents VerusSeek, a retrieval-augmented tool for LLM-assisted Verus proof synthesis for Rust programs. Instead of retrieving entire files or functions, VerusSeek indexes previously verified Verus code as semantic proof constructs, including contracts, assertions, loop invariants, lemmas, and proof blocks. For each verification task, the tool performs type-aware retrieval to select constructs that match the current proof obligation, expands them with bounded hierarchical context, and synthesizes lightweight structural loop-invariant hints for index bounds, frame conditions, and termination arguments. Verus checks each candidate proof, and the resulting diagnostics guide the next repair attempt. On 150 tasks from VerusBench, VerusSeek verifies 122 tasks, compared with 69 for AutoVerus and 85 for RagVerus. A demonstration video of VerusSeek is available at https://youtu.be/p2mb61gj95A. Article Search Article: ase26tool-p29-p doi:10.1145/3832783.3834603 ASE '26: "NL2VBench: A Benchmark for ..." NL2VBench: A Benchmark for End-to-End Natural-Language to Verifiable Rust Generation Lianhe Hu, Cheng Wen, Dugang Liu, Zhiwu Xu, Zhuohua Li, Jie Su, Bin Yu, and Shengchao Qin (Xidian University, China; Shenzhen University, China; Chinese University of Hong Kong, Hong Kong) Large language models (LLMs) have shown promise in code generation, but generating formally verifiable Rust programs from natural-language descriptions remains highly challenging. We present a benchmark called NL2VBench for generating verifiable Rust programs from natural-language descriptions using Verus.NL2VBench contains 762 verifier-checked tasks derived from five public sources and curated through filtering, deduplication, canonicalization, LLM-assisted drafting, and human revision. Each task provides a natural-language description, task-defining interface information, and a verifier-checked reference solution. To demonstrate its utility, we evaluate five representative LLMs on a direct NL-to-Verus baseline. The results show that current LLMs achieve low verification success and even lower strict semantic correctness, demonstrating that NL2VBench is a challenging and reusable benchmark for future research on LLM-based verified code generation. A demonstration video of NL2VBench is available at https://youtu.be/CNOXHejni1c. Article Search Artifacts Available Article: ase26tool-p66-p doi:10.1145/3832783.3834619 ASE '26: "ACSLBench: A Verified C/ACSL ..." ACSLBench: A Verified C/ACSL Corpus and Benchmark with Compositional Call Chains for Formal Specification Synthesis Junjie Hu, Cheng Wen, Bin Yu, Jialun Cao, Dugang Liu, Weidi Sun, Haokun Li, Shengchao Qin, and Cong Tian (Xidian University, China; Hong Kong University of Science and Technology, Hong Kong; Shenzhen University, China; Peking University, China) Formal specification synthesis for C programs is a key step toward scalable deductive verification, yet current learning-based approaches lack large verified C/ACSL data and evaluation tasks that exercise reasoning across function calls. We present ACSLBench, a reusable dataset artifact for training and evaluating C/ACSL specification synthesis models. ACSLBench contains two resources: a corpus of 504,587 formally verified C/ACSL programs, and a curated benchmark of 495 tasks designed around function-call composition. The corpus is built by translating verified Rust/Verus seeds into C/ACSL via an LLM-guided semantic mapping loop, in which Frama-C/WP feedback repairs failed candidates. The benchmark is synthesized from verified components by constructing caller functions whose specifications depend on multiple callee contracts. Experiments with six LLMs show that performance drops as the number of function calls increases. The dataset is available at https://huggingface.co/datasets/noBuggie/AcslBench, and the video is available at https://youtu.be/kgvvTajX2Mk. Article Search Article: ase26tool-p82-p doi:10.1145/3832783.3834628
	Liu, Gongshen	ASE '26: "Post-quantum Cryptography ..." Post-quantum Cryptography in the Wild: Assessing the Readiness of Open-Source Ecosystems Tongxin Yuan, Zhanpeng Liu, Jiashuo Liang, Zhuosheng Zhang, Gongshen Liu, Yang Yu, and Guancheng Li (Shanghai Jiao Tong University, China; Tencent Xuanwu Lab, China) The threat of cryptographically relevant quantum computers, compounded by harvest now, decrypt later attacks, has made migration to post-quantum cryptography (PQC) urgent. With PQC standards finalized and transition guidance phasing out quantum-vulnerable algorithms, the readiness of the open-source supply chain, through which cryptographic vulnerabilities propagate, remains unclear. To fill this gap, we present the first cross-ecosystem empirical study of source-level PQC readiness. PQC Scanner is a two-stage pipeline in which (i) crypto detection identifies packages with cryptographic functionality, and (ii) PQC detection produces a binary support label and source-derived structured readiness record at the repository level using commit history, source analysis, and agent post-verification. Applied to 1,117,913 packages, Stage 1 identifies 55,654 crypto-related packages. Stage 2 evaluates their repositories for source-level PQC support. A separate audit of 219 Stage 2-negative repositories gives a Stage 2 recall lower bound of ≥  97.48%. On a 247-repository deployment-validation sample, agent post-verification eliminated all false positives, yielding precision of 1.000. The pipeline scales to million-package scans: at concurrency 10, it analyzes over one million packages in just over two weeks, with a median LLM cost of $0.0010 per package. Across 8 ecosystems, we find a migration gap: only 1.88% of crypto-related packages show source-level PQC support, and the repository-deduplicated rate is 1.72%. Rust leads by both counts, while NuGet/Ruby/PHP remain near zero. Source-derived structured readiness records show partial support: among PQC-supporting repositories, only 19.2% satisfy the full-support criterion, with a mean migration coverage of 36%. Adoption accelerates sharply after FIPS publication (August 2024), but migration remains infrastructure-gated: key libraries such as Python’s cryptography (581M downloads/month) and framework integration layers in Java/npm still lack deployable PQC pathways, blocking downstream packages regardless of developer intent. We characterize adoption timing, bottlenecks, and community response strategies, deriving recommendations for maintainers, registry operators, and policy makers. Article Search Article: ase26main-p758-p doi:10.1145/3832783.3837461
	Liu, Hangcheng	ASE '26: "Making Theft Useless: Adulteration-Based ..." Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems Weijie Wang, Peizhuo Lv, Yan Wang, Weiqing Huang, Rujie Dai, Guokun Xu, Qiujian Lv, Hangcheng Liu, Hao Hu, and Jiaheng Zhang (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Henan Key Laboratory of Information Security, China; National University of Singapore, Singapore) Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants. Article Search Article: ase26main-p131-p doi:10.1145/3832783.3837418
	Liu, Jiachen	ASE '26: "Towards Reliable C-to-Rust ..." Towards Reliable C-to-Rust Translation with Rule-Guided Reasoning and Reinforcement Learning Feng Luo, Jiachen Liu, Cuiyun Gao, Jia Feng, and Kui Liu (Harbin Institute of Technology, Shenzhen, China; Huawei Technologies, China) The migration of legacy C programs to Rust has become an important direction for improving software memory safety while alleviating the high cost of manual rewriting. Leveraging large language models (LLMs) for automated C-to-Rust translation has emerged as a promising direction. However, existing LLM-based approaches remain limited. On the one hand, LLMs exhibit limited capability in identifying Rust-specific rules, and inadequate handling of Rust syntax often results in incorrect translations. On the other hand, existing LLMs often struggle to accurately capture the semantics of complex code, resulting in incorrect translations. To address these challenges, we propose a Translation fRAmework Via rule-guided reasoning and rEinforcement Learning, namely TRAVEL, consisting of two modules. The first module employs Monte Carlo Tree Search (MCTS)-based reasoning path construction guided by Rust-specific rules, steering the search toward translation steps that respect the syntactic rules that LLMs frequently violate. The second module introduces reinforcement learning with execution feedback and reasoning-quality signals to improve semantic preservation. We evaluate TRAVEL on three datasets: xCodeEval (a public benchmark), OS-Bench (functions collected from the Linux kernel), and HW-Bench (an industrial dataset from Huawei). On xCodeEval, TRAVEL outperforms all baselines across three backbone LLMs. In particular, compared to the strongest prompting baseline IRENE, TRAVEL improves computational accuracy (CA) by 26.22% and compilation success rate (CSR) by 18.77%. On HW-Bench and OS-Bench, TRAVEL further improves CSR by 18.28% and 16.51%, respectively, while reducing unsafe rate (UR) by 13.06% and 13.08%, respectively. Article Search Article: ase26ind-p459-p doi:10.1145/3832783.3834534
	Liu, Jiacheng	ASE '26: "Towards Reliable Alarm Flood ..." Towards Reliable Alarm Flood Reduction in Data Center via Grammar-Guided Verifiable LLM Reasoning Jiacheng Liu, Guocong Lin, Jichao Yan, Huiwen Zheng, Hongli Ma, Changhao Zhou, Zhiyi Yu, Yuanchun Li, Yunxin Liu, Ding Li, Tao Xie, and Yao Guo (Peking University, China; Tsinghua University, China; GDS Holdings, China) Alarm floods pose a critical challenge in system operations, where a single fault can trigger cascaded alarms across interconnected components, overwhelming human operators and obscuring actionable signals. Alarm flood reduction aims to reduce redundant alarms under a safety-oriented objective, because any incorrect reduction may falsely exclude real failures. Existing approaches face a fundamental trade-off: rule-based systems ensure reliability but lack scalability, while solutions based on a large language model (LLM) offer strong generalization but suffer from non-determinism and unverifiable reasoning, limiting their use in safety-critical settings. In this paper, we study the alarm flood reduction problem in data center operations and introduce a solution based on structured reasoning and conservative verification. Our key insight is that expert-level alarm analysis relies on explicit reasoning chains that connect upstream causes to downstream alarms. We design Constrained Reasoning Chain Grammar (CRCG), a lightweight yet expressive grammar that formalizes such reasoning processes as compositional inference chains with logical and numerical constraints. Our method follows two tightly connected steps. First, we use LLM-assisted annotation, checker-guided compilation, and supervised fine-tuning (SFT) to organize expert knowledge in CRCG and train a model to generate explicit reasoning chains. Second, we conservatively reduce alarms only when the reasoning chain can be verified based on CRCG. We evaluate the method on real-world data center HVAC alarms. Results have shown that our method achieves high accuracy while driving false reductions to zero on the evaluated setting, outperforming both rule-based and LLM-only baselines and reducing operational workload substantially. Article Search Artifacts Available Article: ase26ind-p96-p doi:10.1145/3832783.3834481
	Liu, Jiakun	ASE '26: "Effective and Efficient Context ..." Effective and Efficient Context Retrieval via Partial Dependency Graph for Repository-Level Code Generation Zhongxin Liu, Zhonghao Jiang, Zhifan Ye, Haoye Wang, Jiakun Liu, and Xiaoxue Ren (Zhejiang University, China; Hangzhou City University, China; Harbin Institute of Technology, China) LLM-based repository-level code generation aims to generate code according to the available context within a software repository, requiring LLMs to understand and reason over complex code dependencies. Due to limited context windows and insufficient understanding of repository-specific code, LLMs typically rely on retrieval-augmented generation (RAG) to incorporate relevant contextual code. Early RAG approaches primarily employ similarity-based retrieval, which often fails to retrieve code snippets that the target function actually depends on. Recent work introduces graph-based retrieval to model such dependencies, but typically relies on manually designed rules and static global graphs, leading to limited flexibility and high construction and maintenance costs. In contrast, human developers typically collect helpful context by implicitly constructing a partial dependency graph and iteratively inspecting along it. Inspired by human behavior, we propose DyRetriever, an effective and efficient context retrieval method via partial dependency graphs. DyRetriever leverages an LLM to simulate how human developers collect helpful context by first selecting a set of entry-point functions and then performing multi-hop reasoning along the code dependency graph. During multi-hop reasoning, DyRetriever leverages the LLM’s semantic understanding to explicitly validate whether a function can help to generate the target function, thereby eliminating reliance on manually designed rules and enabling flexibility across application scenarios. Instead of statically constructing a global dependency graph, DyRetriever builds a partial graph on demand and discards it after use, reducing construction overhead and avoiding maintenance costs. We integrate DyRetriever with a similarity-based code retriever to build a new code generation approach, DyCoder, and evaluate it on two widely used repository-level code generation benchmarks, CoderEval and DevEval. Experimental results show that DyCoder achieves relative Pass@1 improvements of 25.63% and 59.73% on CoderEval and DevEval, respectively, compared with existing RAG-based methods, while being 7.4× faster than baselines based on static dependency graph construction. Article Search Article: ase26main-p356-p doi:10.1145/3832783.3834350 ASE '26: "Multi-level Code Optimization ..." Multi-level Code Optimization via Mixture of Prompts Yun Peng, Jun Wan, Jiakun Liu, Shuzheng Gao, David Lo, and Xiaoxue Ren (Fudan University, China; Zhejiang University, China; Harbin Institute of Technology, China; Chinese University of Hong Kong, Hong Kong; Singapore Management University, Singapore; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China) Runtime efficiency is a critical factor that impacts both software quality and user satisfaction. There are many approaches proposed for code optimization to improve runtime efficiency. Traditional code optimization methods operate on intermediate representations (IRs) during compilation for static languages. They are effective but struggle to handle dynamic languages that do not require compilation. Recently, large language models (LLMs) have been leveraged to directly optimize source code in dynamic languages. However, these methods fail to identify suitable optimization targets and usually conduct incomprehensive single-level optimization. To address these challenges, we propose Optimo, a multi-level LLM-based code optimization approach built on a novel Mixture-of-Prompts (MoP) architecture. In the MoP architecture, Optimo identifies time-critical code structures as performance bottlenecks via differential profiling. These structures are then routed to some optimization strategies, akin to expert models in MoE, each tailored to optimize specific code patterns. Unlike traditional approaches that focus only on statement-level optimizations, Optimo operates at four levels of abstraction, ranging from coarse-grained algorithmic improvements to fine-grained optimizations in API usage. We evaluate Optimo on two code efficiency benchmarks, COFFE and Effibench. Our results demonstrate that Optimo achieves an up to 57.48% opt%, i.e., the percentage of optimized programs that are correct and at least 10% faster than the original programs, and an up to 3.97x speedup when optimizing human-written code, and it consistently outperforms the best baseline by up to 96.51% in terms of opt%. Furthermore, Optimo achieves an up to 42.42% opt% and an up to 13.51x speedup when optimizing LLM-generated code. Article Search Article: ase26main-p874-p doi:10.1145/3832783.3834369
	Liu, Jiawei	ASE '26: "MultiFixer: A Coordinator-Proposer ..." MultiFixer: A Coordinator-Proposer Based Multi-agent Framework for Fixing Multi-hunk Bugs Haichuan Hu, Chunrong Fang, Ye Shang, Jiawei Liu, Weifeng Sun, Guoqing Xie, Chenxing Zhong, and Quanjun Zhang (Nanjing University of Science and Technology, China; Nanjing University, China; Singapore Management University, Singapore) Automated Program Repair (APR) has benefited greatly from Large Language Models (LLMs), but existing LLM-based APR methods still struggle with multi-hunk bugs that require coordinated changes across multiple locations. These bugs demand repository-level context understanding, repair-order scheduling, and effective hunk-level patch generation and selection. To address these challenges, we propose MultiFixer, a novel Coordinator-Proposer based multi-agent framework for multi-hunk repair. MultiFixer performs tool-augmented bug analysis, constructs fine-grained repair context, iteratively generates patches through a Coordinator-Proposer architecture, and applies two-stage patch refinement for syntactic and semantic correctness. We evaluate MultiFixer on 835 bugs from Defects4J and three vulnerability benchmarks. On Defects4J, MultiFixer fixes 326 bugs, including 62 multi-method and 27 multi-file bugs, and outperforms prior APR baselines in the reported comparisons with the same base model. Moreover, MultiFixer also fixes 46 multi-hunk bugs among 95 unique fixes. When combined with Claude-3.5-Sonnet, MultiFixer repairs 420 bugs, establishing a new state of the art on Defects4J. On VUL4J, MultiFixer repairs 24 real-world vulnerabilities, including 5 multi-hunk cases. On the multi-hunk subsets of SEC-bench and PatchEval, MultiFixer fixes 11 and 19 vulnerabilities, respectively, outperforming all compared baselines under GPT-3.5. These results demonstrate the effectiveness of MultiFixer for multi-hunk repair. Article Search Article: ase26main-p2372-p doi:10.1145/3832783.3837527
	Liu, Jie	ASE '26: "SwiftGram: Dynamic Lexical ..." SwiftGram: Dynamic Lexical Forking for Precise and Efficient Grammar-Constrained Decoding Shuyi Ling, Liangyi Kang, Jie Liu, Shuai Wang, Zhirou Ma, and Dan Ye (Institute of Software at Chinese Academy of Sciences, China) Large Language Models (LLMs) must strictly adhere to grammatical constraints for reliable structured generation in agentic workflows, code synthesis, and domain-specific language (DSL) generation. Grammar-Constrained Decoding (GCD) enforces this by masking out tokens incompatible with the target grammar at each decoding step, and has been adopted as a core module in mainstream inference engines such as vLLM. However, existing GCD methods exhibit precision defects under grammars with overlapping terminal definitions. The misalignment between LLM tokens and grammar terminals induces terminal ambiguity, where a token admits multiple plausible terminal interpretations. Existing methods handle this imprecisely, causing both false acceptance and false rejection, while incurring high computational overhead. We propose SwiftGram, a GCD framework that incorporates dynamic lexical forking for precise token masking. By forking only at detected ambiguity boundaries, SwiftGram preserves all admissible terminal interpretations while suppressing spurious ones. It builds on Generalized LR (GLR) parsing with the Graph-Structured Stack (GSS) for compact multi-branch parsing, together with adjacency pruning and terminal tries to reduce online overhead. Experiments show that SwiftGram achieves near-zero grammar violations and no observed false rejection, whereas strong baselines remain prone to masking errors. SwiftGram improves effective throughput by up to 14.7% over the strongest baseline under rejection sampling, and achieves a 5.9× average speedup in per-step mask construction under mask-before-selection. Article Search Article: ase26main-p2654-p doi:10.1145/3832783.3834419
	Liu, Jing	ASE '26: "Empirical Computation: Prompting ..." Empirical Computation: Prompting versus Programming Eric Tang, Jing Liu, and Marcel Böhme (Carnegie Mellon University, USA; MPI-SP, Germany; CISPA Helmholtz Center for Information Security, Germany) Large Language Models (LLMs) can solve any computational problem without an algorithm in a runtime independent of the computational complexity of that problem. Instead of specifying precisely how to solve problem instance using programming, we ask an LLM or agent to solve the problem instance using prompting. Outputs are sampled from a distribution rather than generated procedurally. In this vision paper, we explore the challenges and opportunities of this new form of computation and observe that its capabilities and limits cannot be understood within the classic, rationalist framework of computation. Hence, we appeal to the software engineering (SE) community to develop the foundations and techniques required to analyze the properties of this "empirical computation" as it generates solutions to computational problems: How can we analyze and improve the correctness of LLMs solving a computational problem in the general, in the problem-specific, or in the instance-specific? What are the properties and fundamental limits of empirical computation? This paper aims to establish empirical computation as a field in SE that is timely and rich with interesting problems. Article Search Article: ase26nier-p11-p doi:10.1145/3832783.3834540
	Liu, Jinyang	ASE '26: "IcFuzz: Fuzzing Isaac Sim ..." IcFuzz: Fuzzing Isaac Sim with Semantic Stage Guidance and Multi-level Mutation Zhixiang Chen, Zhuangbin Chen, Ruoxi Jia, Zeqin Liao, Wei Li, Jinyang Liu, and Zibin Zheng (Sun Yat-sen University, China; Nanyang Technological University, Singapore; Chinese University of Hong Kong, Hong Kong) Robotics simulators serve as a foundational infrastructure for embodied AI, facilitating safe and scalable robotic system development. NVIDIA Isaac Sim has emerged as one of the most popular simulators, distinguished by its GPU-accelerated physics engine and photorealistic rendering, which enable high-fidelity modeling of complex environments. However, its inherent complexity inevitably introduces software bugs that can compromise simulation reliability. Existing fuzzing approaches struggle to test Isaac Sim effectively due to challenges of context-aware object semantics, hierarchical simulation control, and a vast simulation state space. In this paper, we propose IcFuzz, the first fuzzing approach for Isaac Sim. IcFuzz first performs an LLM-based semantic stage segmentation, decomposing simulation programs into structured stages that capture context-aware object semantics. Guided by this information, IcFuzz designs multi-level mutation operators to systematically exercise the simulator across hierarchical granularities. To efficiently navigate the vast simulation state space, IcFuzz employs a multi-armed bandit algorithm to adaptively schedule mutation operators. Experimental results show that IcFuzz outperforms the baselines in terms of both code coverage and bug detection. Specifically, IcFuzz achieves approximately 190%–205% of the code coverage of the baselines and detects an average of 3.7 unique crashes over three rounds of 12-hour tests, while no crashes are detected by the baselines. Moreover, IcFuzz has uncovered 11 bugs over approximately four months, 9 of which have been confirmed or fixed by the developers. Article Search Article: ase26main-p3261-p doi:10.1145/3832783.3837550
	Liu, Jun	ASE '26: "Every Scenario Matters: Scenario-Guided ..." Every Scenario Matters: Scenario-Guided White-Box Testing for Static Code Checkers Powered by LLMs Jun Liu, Liqiang Ji, Jiwei Yan, Linjie Pan, Jinsong Ren, Jun Yan, and Jian Zhang (Institute of Software at Chinese Academy of Sciences, China; Huawei Technologies, China) In static analysis tools, each detection rule corresponds to a dedicated code checker. The checker's quality directly determines the validity of reported defects. Thus, comprehensive testing of these checkers is crucial. Existing checker testing approaches usually generate test cases from high-level rule descriptions while treating checkers as black boxes. However, these descriptions usually omit implementation-level conditions and checking scenarios. To bridge this gap, our key insight is that the rule description and checker implementation provide complementary information for comprehensive testing. The implementation supplies concrete checking logic, while the rule anchors the intended semantics. Building on this, we propose ScenSCT, a novel scenario-guided white-box checker testing approach powered by LLMs. ScenSCT first translates the checker's source code into a unified logic-based representation (CheckerIR) and applies both logic-decomposition and scenario-validation strategies to extract concrete checking scenarios. It then converts these scenarios into test cases through execution-feedback-guided test alignment to instantiate scenario constraints and scenario-invariant test augmentation to generate variants that preserve the target scenario. We evaluate ScenSCT on real-world Java checkers from five mainstream static analysis tools. In single-tool evaluation, ScenSCT extracts an average of ~9 scenarios and generates ~39 tests per checker, uncovering 270 potential issues (58 false positives and 212 false negatives) with an overall precision of 86.4%. Furthermore, cross-tool evaluation reveals 177 capability differences among shared checkers. Overall, ScenSCT offers a systematic testing method to improve the reliability of static analysis tools. Article Search Article: ase26main-p1253-p doi:10.1145/3832783.3834381
	Liu, Junhong	ASE '26: "Characterizing and Mitigating ..." Characterizing and Mitigating Productivity Loss in Large-Scale Model Training: An Empirical Study Dinghao Xue, Yanxiang Chen, Junhong Liu, Yepeng Zhang, Guangsen Ni, Menghao Zhang, Tianyu Wo, Zheng Zheng, Chunming Hu, Jin Ouyang, and Renyu Yang (Beihang University, China; Kuaishou, China; Unaffiliated, China) Training large-scale foundation models often uses thousands of GPUs for weeks or months. In production clusters, training productivity is reduced not only by explicit failures but also by scheduling delays, repeated recoveries, alive-but-unproductive hangs, and performance degradation during seemingly normal execution. However, existing metrics such as Effective Training Time Ratio (ETTR) mainly account for time lost to failures and restarts, and do not directly capture jobs that remain alive but make slow progress. Prior diagnosis and mitigation efforts typically target specific failure modes, leading to case-by-case fixes and offering limited support for cluster-wide attribution of productivity loss or systematic reliability improvements. In this paper, we present the Effective Training Productivity Ratio (ETPR), a reliability-oriented decomposition of end-to-end training productivity to stabilize the large-scale machine learning (ML) systems. ETPR characterizes productivity loss by accounting for pre-execution loss, unproductive allocated compute time, and reduced execution quality. We conduct an empirical study of thousands of training jobs over three months on Kuaishou's production cluster. Our analysis shows that productivity is mainly degraded by diagnosis and recovery for fail-stop and fail-hang incidents, as well as subtle fail-slow anomalies that delay fault localization and worsen overall efficiency. Based on these findings, we build and deploy an automated stability governance framework that integrates: (i) a multi-stage log-based fail-stop diagnosis pipeline, (ii) temporal stack invariance analysis for fail-hang localization, (iii) an adaptive fail-slow detector with straggler detection, and (iv) hierarchical recovery strategies. Experiments show that this framework accelerates failure diagnosis, accurately localizes anomalous ranks, mitigates silent slowdowns, and improves cluster-wide ETPR in production. Article Search Article: ase26ind-p34-p doi:10.1145/3832783.3834462
	Liu, Kui	ASE '26: "No Isolated Evolution, No ..." No Isolated Evolution, No Blind Search: Memory-Guided Prompt Co-evolution for Industrial Multi-agent Vulnerability Detection Jie Xu, Zihan Wu, Yun Peng, Chun Yong Chong, Linghan Meng, Kui Liu, and Xiaohua Jia (City University of Hong Kong, Hong Kong; Chinese University of Hong Kong, Hong Kong; Monash University, Malaysia; Huawei Technologies, China) Large Language Model (LLM)-based multi-agent systems have shown promise for automated vulnerability detection, but our industrial deployment reveals two limitations: 1) each agent's prompt is typically optimized in isolation, degrading global end-to-end performance; and 2) evolutionary prompt search lacks memory across iterations, wasting computation costs. To address these limitations, we propose MemCo, a memory-guided prompt co-evolution framework applied to industrial vulnerability detection. First, MemCo takes an end-to-end prompt co-evolution strategy, which evaluates prompts based on the system's final output rather than assessing each agent in isolation. In each evolutionary iteration, only the prompts of agents responsible for the misclassification undergo further evolution, thereby enhancing the system's global accuracy. Second, MemCo adopts a memory-guided search mechanism, which edits prompts based on records of successful and failed modifications. This reduces redundant blind exploration and significantly lowers computation costs. Comprehensive experiments show that MemCo improves Macro-F1 by +8.4 to +18.0 points on public benchmarks and up to 36.9% relative improvement on a proprietary industrial benchmark, while reducing per-generation evolution tokens by 48.5% and inference tokens by 63.8%. MemCo is deployed as a vulnerability detection assistant in our production security pipeline. Article Search Article: ase26ind-p297-p doi:10.1145/3832783.3834522 ASE '26: "Towards Reliable C-to-Rust ..." Towards Reliable C-to-Rust Translation with Rule-Guided Reasoning and Reinforcement Learning Feng Luo, Jiachen Liu, Cuiyun Gao, Jia Feng, and Kui Liu (Harbin Institute of Technology, Shenzhen, China; Huawei Technologies, China) The migration of legacy C programs to Rust has become an important direction for improving software memory safety while alleviating the high cost of manual rewriting. Leveraging large language models (LLMs) for automated C-to-Rust translation has emerged as a promising direction. However, existing LLM-based approaches remain limited. On the one hand, LLMs exhibit limited capability in identifying Rust-specific rules, and inadequate handling of Rust syntax often results in incorrect translations. On the other hand, existing LLMs often struggle to accurately capture the semantics of complex code, resulting in incorrect translations. To address these challenges, we propose a Translation fRAmework Via rule-guided reasoning and rEinforcement Learning, namely TRAVEL, consisting of two modules. The first module employs Monte Carlo Tree Search (MCTS)-based reasoning path construction guided by Rust-specific rules, steering the search toward translation steps that respect the syntactic rules that LLMs frequently violate. The second module introduces reinforcement learning with execution feedback and reasoning-quality signals to improve semantic preservation. We evaluate TRAVEL on three datasets: xCodeEval (a public benchmark), OS-Bench (functions collected from the Linux kernel), and HW-Bench (an industrial dataset from Huawei). On xCodeEval, TRAVEL outperforms all baselines across three backbone LLMs. In particular, compared to the strongest prompting baseline IRENE, TRAVEL improves computational accuracy (CA) by 26.22% and compilation success rate (CSR) by 18.77%. On HW-Bench and OS-Bench, TRAVEL further improves CSR by 18.28% and 16.51%, respectively, while reducing unsafe rate (UR) by 13.06% and 13.08%, respectively. Article Search Article: ase26ind-p459-p doi:10.1145/3832783.3834534 ASE '26: "RACE-Bench: A Reasoning-Augmented ..." RACE-Bench: A Reasoning-Augmented Benchmark for Repository-Level Code Agents on Feature Addition Shuhan Liu, Zhiyi Zhao, Xing Hu, Kui Liu, Xiaohu Yang, and Xin Xia (Zhejiang University, China) Repository-level code agents have shown strong promise in real-world feature addition tasks, making reliable evaluation of their capabilities increasingly important. However, existing benchmarks primarily evaluate these agents as black boxes based on final test correctness, providing limited insight into how they reason and where failures arise. To address this limitation, we introduce RACE-Bench, a reasoning-augmented benchmark for evaluating code agents on repository-level feature addition tasks. RACE-Bench contains 528 real-world feature addition instances from 12 open-source repositories. Each instance is paired with executable patch verification and structured intermediate reference reasoning covering issue understanding, file localization, implementation tasks, and step decomposition. Based on this design, we introduce a dual-track evaluation framework that jointly measures patch correctness and intermediate reasoning alignment with developer-accepted reference trajectories. We evaluate three representative repository-level code agents on RACE-Bench. On the full benchmark, Resolved Rate ranges from 29% to 70% across different agents. Our reasoning-level analysis further shows that while current agents perform well at understanding high-level intent, their performance degrades substantially when translating intent into concrete implementation steps. We also find patches that can be applied but still fail the tests cover fewer reference-reasoning elements (35.7% lower recall) and contain more unsupported reasoning elements (94.1% higher over-prediction) than successful patches. These findings highlight the importance of evaluating repository-level code agents beyond final patch correctness by examining the quality of their reasoning processes. Article Search Article: ase26main-p208-p doi:10.1145/3832783.3837426 ASE '26: "Revisiting LLMs on New Feature ..." Revisiting LLMs on New Feature Implementation in Real-World Software Development Practices Jia Li, Tingxuan Huang, Tiankuo Zhao, Yiming Wang, Yiran Zhang, Anshun Hu, Kechi Zhang, Lecheng Wang, Zinan Sheng, Kui Liu, Ge Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Peking University, China; Huawei Technologies, China) Implementing new features in existing repositories is a key activity in software development. With the rapid advances in large language models (LLMs), benchmarking their capability in this task has attracted growing attention. However, existing benchmarks deviate from real-world practices in two aspects. First, they provide LLMs with unrealistic information such as target code signatures and file paths, which developers do not have access to in practice. Second, they only evaluate the final generated code using functional tests, without examining intermediate steps like requirement understanding and implementation planning. These limitations make it difficult to faithfully assess LLMs’ actual capabilities and diagnose their weaknesses. To address the above limitations, we conduct a systematic evaluation to revisit the capability of large language models (LLMs) in new feature implementation, with a task setup strictly aligned with real-world software development practices. Our evaluation is built on NFEI, a curated benchmark sourced from merged feature pull requests of active GitHub repositories, where each target feature involves cross-snippet multiple code modifications, and LLMs are only provided with the feature description and the target repository throughout the evaluation. Beyond the realistic input settings, we further annotate fine-grained labels for the intermediate steps of the development workflow, including requirement clarification and implementation planning. This enables our evaluation to support a comprehensive stage-wise assessment across three granularities with seven dedicated metrics. We evaluate seven popular LLMs under two development paradigms and three generation strategies. Results show that new feature implementation remains highly challenging, with an overall average Test Pass Rate of only 29.84%. Our stage-wise analysis reveals that intermediate step quality is closely linked to final code performance, and injecting ground-truth intermediate artifacts yields an average absolute gain of about 18%, yet performance remains limited. Qualitative error analysis further identifies three recurrent failure patterns, suggesting that new feature implementation of LLMs adhering to real-world world software development practices remains challenges. Article Search Article: ase26main-p1768-p doi:10.1145/3832783.3837511
	Liu, Kunlin	ASE '26: "IncSFS: Incremental Full-Sparse ..." IncSFS: Incremental Full-Sparse Flow-Sensitive Pointer Analysis for C/C++ Kunlin Liu, Zhenbang Chen, Piyi Zu, Yide Du, and Ji Wang (National University of Defense Technology, China) Pointer analysis is the fundamental technique for compiler optimization and program analysis. Flow sensitive pointer analysis provides high precision but hard to scale to large-size projects. Tailored for rapid iteration scenarios where software evolves continuously, we introduce IncSFS, the first incremental full-sparse flow-sensitive pointer analysis algorithm for C/C++ programs. The algorithm contains two main steps. It first transforms the value-flow graph of a program into a constraint graph, on which a strongly-connected component detection is performed to ensure precision. It then propagates increases and decreases in points-to set in an interleaving manner to support both code deletion and insertion within a single analysis pass. IncSFS is guaranteed to terminate and compute the least fixed point when point-to relation during the analysis is object-acyclic. Experimental results on six large-scale real-world projects show that IncSFS is both precise and efficient, achieving average speedups of 9.60 x over full flow-sensitive pointer analysis and of 5.84 x over the traditional reset-recompute incremental approach. Furthermore, IncSFS improves efficiency by 15.8% compared with state-of-the-art incremental pointer analysis algorithms that also propagate changes in points-to sets. Article Search Artifacts Available Article: ase26main-p1456-p doi:10.1145/3832783.3837496
	Liu, Lili	ASE '26: "BanditFuzz: A Synergistic ..." BanditFuzz: A Synergistic Differential Fuzzing Framework for Compilers Donghui Li, Yingying Li, Jinlong Xu, Bo Zhao, Nan Wang, Jinyang Yao, and Lili Liu (Information Engineering University, China; Henan Normal University, China) Compiler fuzzing is critical for ensuring the reliability of modern optimizing compilers. However, traditional generators and raw Large Language Model (LLM) outputs often yield syntactically invalid or low-value programs, incurring significant computational overhead. In this paper, we present BanditFuzz, an end-to-end synergistic differential fuzzing framework integrating four core mechanisms: (1) a coverage-feedback-driven dynamic prompt scheduler that alternates strategies to generate diverse corpora; (2) a lightweight repair module (CompileFix) that heuristically recovers near-compilable raw LLM outputs; (3) a deterministic AST mutation engine (ASTMutate) that systematically expands high-quality seeds to compensate for inference latency; and (4) a sanitizer-enhanced differential testing oracle utilizing an unoptimized baseline (-O0) to precisely identify miscompilations while filtering Undefined Behavior (UB). Extensive evaluations on GCC and Clang demonstrate that BanditFuzz significantly improves backend coverage over state-of-the-art baselines under identical budgets, successfully identifying 28 realworld compiler bugs. Article Search Article: ase26nier-p61-p doi:10.1145/3832783.3834548
	Liu, Meixi	ASE '26: "Large Language Model Enabled ..." Large Language Model Enabled Symbolic Execution for Automated Functional Analysis Meixi Liu, Zhenbang Chen, Xudong Wang, Ziran He, Jiachen Gu, Minghui Chen, Lei Wang, and Wei Dong (National University of Defense Technology, China) Symbolic execution shows promise in automated program analysis by systematically exploring the path space of the program. However, due to the inherent limitations of program analysis techniques, symbolic execution cannot understand the program’s functionality, which hinders its application in functional analysis and defect detection. This paper introduces FuSE, a method that enhances symbolic execution with Large Language Models (LLMs) to automatically annotate program paths with functional specifications. A program path is annotated with a natural language description of its functionality, a precondition, and a postcondition. Our method significantly reduces the effort required for functional testing and defect detection. Based on UnitTestBot, FuSE can successfully annotate functional specifications for C, C++, Java, and Python programs, with success rates of 98.2%, 95.52%, 87%, and 95.37%, respectively. In our user study with professional developers and testers, FuSE helps users identify 21.67% more functional defects and improves functional coverage by 15.83%, demonstrating its practical utility. Article Search Artifacts Available Article: ase26main-p2155-p doi:10.1145/3832783.3837524
	Liu, Ming	ASE '26: "AlarmClaw: Context-Enriched ..." AlarmClaw: Context-Enriched Alarm Management with Category-/Severity-Aware Incident Graphs Siyu Yu, Meizhen Li, Jiacheng Yang, Yifan Wu, Ning Wang, Zhaoxing Chen, Ming Liu, Xinchi Ren, Xincheng Ren, Chan Li, Tong Jia, Xiang Zhang, and Ying Li (Peking University, China; ByteDance, China) Large-scale production systems rely on monitoring rules and anomaly detectors to trigger alarms that notify site reliability engineers (SREs) of potential failures. Before diagnosis and mitigation can begin, alarm management must construct incident state online by deciding whether each arriving alarm is noise, indicates a potential new incident, or should be associated with an existing incident to enrich its evolving state. Existing alarm-management methods remain difficult to deploy because some rely on reusable operational artifacts such as SOPs or historical prototypes to judge alarm relationships, while graph-based methods often apply the same topology-derived propagation patterns across incidents. In production, such artifacts are often missing or service-specific, and valid propagation paths vary with incident type and severity. We present AlarmClaw, a context-enriched alarm-management system built around these two constraints. AlarmClaw uses bounded context clawing to retrieve compact evidence from auditable operational sources and a category- and severity-aware incident graph to constrain a large language model (LLM) decision agent. An evolution mechanism refreshes reusable context and graph evidence from validated outcomes. On a temporally held-out replay from a production corpus of 51,000 alarms and 9,661 incidents, AlarmClaw achieves 86.0% association Precision and 78.5% Recall, improving F1 by 7.4 points over the strongest adapted baseline. During six months of online operation, evolution updates improve F1 by 2.3 points over a matched fixed-knowledge counterfactual. From January to June 2026, AlarmClaw automatically associated more than 4,800 alarms, conservatively saving at least 4,800 engineer-minutes and reducing the per-alarm association operation from approximately 90 s manually to under 10 s. Article Search Article: ase26ind-p313-p doi:10.1145/3832783.3834524
	Liu, Minghao	ASE '26: "CiL-Agent: Compiler-in-the-Loop ..." CiL-Agent: Compiler-in-the-Loop LLM Agent for Memory-Safe C Program Repair Yang Shen, Yating Zhang, Jiaqiang Yao, Minghao Liu, and Wei Dong (National University of Defense Technology, China) Automated Program Repair (APR) has advanced rapidly on managed languages such as Java and Python, yet C—the bedrock of systems software—remains far harder to repair safely. The difficulty is specific to C: as an unmanaged language with manual memory management, a patch can compile and pass every functional test while silently introducing a memory-safety defect (a leak, use-after-free, or double free) that managed-language tests would never expose, making such “fixes” potentially worse than no fix. Existing LLM-based repair offers little defense, as it learns from impoverished feedback—no execution at all (APPATCH), binary pass/fail signals (ChatRepair), or loosely-structured, unscored sanitizer text (VRpilot). We present CiL-Agent (Compiler-in-the-Loop Agent), which tightly integrates GCC, the Clang Static Analyzer, and Valgrind into the LLM generation loop, parsing their diagnostics into structured, three-dimensional feedback: compilation reachability, static provability, and dynamic memory safety. A two-phase strategy first samples and composite-scores candidate patches (Best-of-N), then refines the best under precise tool feedback. On 1,000 real-world C vulnerabilities spanning 11 CWE categories, CiL-Agent attains 88.2% Pass@1 with 87.3% memory-safe patches, outperforming five repair baselines (by 8.3–58.4pp, all p<0.001, McNemar’s test) and five modern coding agents by a wide margin. A full 1,000-task ablation shows toolchain integration and iterative refinement are independently essential (−44.3 and −35.2 percentage points), with toolchain integration the single most critical component, and a post-cutoff benchmark confirms the gains are not due to training-data memorization. Article Search Article: ase26main-p1378-p doi:10.1145/3832783.3837493
	Liu, Peipei	ASE '26: "The CodeInverter Suite: Structure- ..." The CodeInverter Suite: Structure- and Data-Aware Binary Decompilation with Efficient LLMs Peipei Liu, Jian Sun, Rongkang Sun, Li Chen, Zhaoteng Yan, Xiaoling Zhang, Dawei Wang, Dapeng Sun, Peizheng Zhang, and Dan Li (Zhongguancun Laboratory, China; Tsinghua University, China) Binary decompilation plays a vital role in various cybersecurity and software engineering tasks. Recently, end-to-end decompilation methods powered by large language models (LLMs) have attracted increasing attention for their ability to generate highly readable source code with minimal human intervention. However, existing LLM-based methods still struggle with reconstructing program structure and logic, achieving accurate data recovery, ensuring data security and privacy, and maintaining computational efficiency. To address these challenges, we propose the CodeInverter Suite, with three main pieces: (1) the CodeInverter Workflow (CIW) is a novel prompt engineering method that incorporates control flow graphs (CFG) and explicit data mappings to enhance structure reconstruction and data recovery during decompilation; (2) building upon CIW, we construct the CodeInverter Dataset (CID), a large-scale domain-specific dataset containing 8.69 million samples enriched with CFGs and data mapping information; (3) we develop CodeInverter Models (CIMs), two lightweight LLMs with 1.3B and 6.7B parameters, enabling efficient inference in privacy-sensitive and resource-constrained environments. Extensive experiments on two benchmark datasets demonstrate that CIW significantly enhances the decompilation performance of various LLMs, with average improvements of 13.07% in re-executability and 23.94% in re-compilability. For our proposed decompilation model, CIM-6.7B achieves state-of-the-art performance in terms of re-executability and readability, outperforming existing LLMs—even with over 100× more parameters—by an average of 11.03% and 6.27%, respectively. Article Search Article: ase26main-p3581-p doi:10.1145/3832783.3837554
	Liu, Qian	ASE '26: "Towards Fully Automated Medical ..." Towards Fully Automated Medical Imaging Code Generation via Validation-Based Context Engineering Zixiao Zhao, Jing Sun, Zhe Hou, Cheng-Hao Cai, Qian Liu, Mengze Li, Zijian Zhang, and Jin Song Dong (University of Auckland, New Zealand; Griffith University, Australia; Monash University, Suzhou, China; Beijing Institute of Technology, China; National University of Singapore, Singapore) Large language models (LLMs) have demonstrated considerable promise in program generation for small-scale and conventional application development; however, they remain limited when applied to complex, domain-specific tasks such as medical image processing. General-purpose models lack explicit domain knowledge and robust validation mechanisms to ensure correctness, often requiring substantial human intervention to produce reliable processing pipelines. To address these limitations, we propose AutoMedImg, a multi-agent framework for fully automated medical image processing code generation. AutoMedImg orchestrates specialised agents across two phases: a Planning Phase that performs dataset analysis and architecture design with semantic and formal verification, and a Coding Phase that generates modules in parallel with static checking, execution testing, and assembly validation. This multi-stage validation mitigates error propagation throughout generation, while comprehensive auto-context engineering combining domain-specific knowledge bases, shared memory, and validation feedback automates context construction without manual prompting. A cross-project adaptive pipeline synthesis mechanism further accumulates validated pipelines and retrieves proven components for new tasks based on project similarity, enhancing generation efficiency through cross-project learning. Extensive evaluation across six diverse and well-established medical imaging datasets with five backbone LLMs demonstrates that AutoMedImg achieves zero human intervention, with Dice scores of up to 0.90 for segmentation tasks and 99% accuracy for classification. Article Search Article: ase26main-p1668-p doi:10.1145/3832783.3834399
	Liu, Ray	ASE '26: "Catching Developers in the ..." Catching Developers in the Flow: Low-Latency Agentic Program Repair at Google Scale Celal Ziftci, Spencer Greene, Ray Liu, Livio Dalloro, and Lorenzo Dini (Google, USA) Manual repair of program failures is time-consuming and disruptive for software developers, particularly during the pre-submit phase where test failures occur within continuous integration systems. While Automated Program Repair has seen significant advancement through Large Language Models, existing state-of-the-art techniques primarily focus on post-submit workflows, operating offline without the low-latency requirements necessary to assist developers in real-time within their flow before they switch context. In this paper, we introduce FlowAgent, an AI agent deployed at Google to automatically repair test failures in the pre-submit outer-loop workflow inside continuous integration systems. Integrated into Google’s internal developer tools, Critique and Cider, FlowAgent utilizes a ReAct-style generate-and-validate loop, as well as rigorous pre-execution and post-execution abstention filters to ensure high-quality suggestions under strict latency constraints. Based on our case studies, FlowAgent is highly effective. First, a manual evaluation conducted on 195 real-world test failures demonstrated 67.18% accuracy in suggesting correct fixes. Following its Google-wide deployment, FlowAgent suggested fixes on 295,508 changes, of which developers previewed 65,069 and applied 28,554. Developer feedback from interviews indicate that the agent is useful in suggesting correct fixes, integration of autonomous repair agents into industrial software engineering workflows is received well, while interesting challenges and opportunities still remain. Article Search Article: ase26ind-p231-p doi:10.1145/3832783.3834511
	Liu, Shangqing	ASE '26: "From Vibe to Spec: An Empirical ..." From Vibe to Spec: An Empirical Study to Demystify Specifications in Code Generation Ruirui He, Hanqing Lu, Lezhi Ma, Kai Ye, Qiong Wu, Shangqing Liu, Lei Bu, and Xuandong Li (Nanjing University, China) Recent advances in large language models (LLMs) for code generation have given rise to vibe coding, a programming practice in which developers interact with LLMs through unstructured natural language and primarily validate implementations by inspecting overall execution outputs. However, the inherent ambiguity and inconsistency of natural language present substantial challenges for generating complex and large-scale software systems. To mitigate these limitations, an emerging AI programming paradigm—specification-driven development—advocates providing LLMs with precise and consistent specifications to guide code generation. Despite its promise, fundamental questions regarding the appropriate forms of specifications and the granularity at which they should be supplied to LLMs remain largely unexplored. To address this gap, we present the first empirical study that systematically investigates the impact of two orthogonal dimensions of specifications—form and granularity—on the effectiveness of LLM-based code generation. We construct a dataset comprising five medium-sized software projects, ranging from several hundred to over one thousand lines of code, implemented in multiple programming languages and spanning diverse application domains (e.g., system utilities and games). For each project, we design specifications in three forms—natural language, coarse-grained pseudocode, and fine-grained pseudocode—to capture the form dimension. To examine granularity, we further decompose the fine-grained pseudocode into four levels of input granularity: line-level, function-level, module-level, and project-level. Using this dataset, we evaluate code generated by three representative models, GPT-5, DeepSeek-V3.1, and Qwen-3.7. Evaluation is conducted using a comprehensive set of metrics, including text-similarity-based metrics (e.g., BLEU-4 and CodeBLEU), test-based metrics (e.g., accuracy), and human-centered metrics (e.g., usability and logical consistency). Our results demonstrate that using fine-grained, structured pseudocode specifications significantly enhances generation stability and quality. Regarding granularity, while coarser-grained specifications (project and module level) generally achieve higher code quality, organizing specifications at the module level provides the best overall balance between quality, stability, and token efficiency. Moreover, additional analyses indicate that this module-level granularity yields the most user-friendly outcome for human developers. Article Search Article: ase26main-p1876-p doi:10.1145/3832783.3837515
	Liu, Shuang	ASE '26: "DBRepro: Automated Database ..." DBRepro: Automated Database Synthesis via a Hybrid Constraint-Solving Approach for Reproducing Slow Queries Zhaoyang Zhang, Shuang Liu, Dengfeng Xu, Wei Lu, Jianquan Leng, Sheng Du, and Xiaoyong Du (Renmin University of China, China; China Electronics Technology Kingbase (Beijing) Technologies, China) Slow queries frequently cause severe performance bottlenecks in Database Management Systems (DBMSs). Due to the severe risk of exacerbating online resource contention, diagnosing their root causes online is usually infeasible; offline diagnosis has thus become the de facto approach. However, strict data privacy regulations prohibit accessing original user data. Therefore, synthesizing a proxy database, one that induces the query optimizer to generate identical physical execution plans as in production, from non-intrusive metadata, is critical for reproducing and diagnosing slow queries offline. Achieving high-fidelity reproduction demands satisfying both global statistical distributions and exact local cardinality constraints. Existing works fundamentally fail to achieve both simultaneously: data-driven approaches cannot enforce strict local cardinalities, whereas workload-aware approaches severely distort the overall data distribution, misleading the optimizer into divergent execution plans. To bridge this gap, we introduce DBRepro, an automated end-to-end database synthesis framework that synergistically integrates data-driven and workload-aware methodologies. DBRepro formulates database generation as a constrained distribution synthesis problem. It initializes a global data distribution from lightweight column statistics, extracts execution constraints from the target queries, and progressively adjusts the distribution to satisfy these constraints, ensuring the global distribution is maximally preserved while exact local cardinalities are strictly enforced. Extensive evaluations on the TPC-H and SSB benchmarks demonstrate that DBRepro outperforms state-of-the-art baselines across comprehensive fidelity metrics. Compared to the data-driven baseline, it reduces cardinality error by up to 20.3% while maintaining identical plan consistency. Against a workload-aware baseline, it reproduces 15% more consistent execution plans and lowers the latency proportion error by 21.5%. Furthermore, we validate its industrial practicality on a nearly 1 TB real-world dataset from a specific industrial sector, managed by KingbaseES, successfully reproducing the execution performance of complex slow queries with high fidelity. Article Search Article: ase26ind-p50-p doi:10.1145/3832783.3834463
	Liu, Shuhan	ASE '26: "RACE-Bench: A Reasoning-Augmented ..." RACE-Bench: A Reasoning-Augmented Benchmark for Repository-Level Code Agents on Feature Addition Shuhan Liu, Zhiyi Zhao, Xing Hu, Kui Liu, Xiaohu Yang, and Xin Xia (Zhejiang University, China) Repository-level code agents have shown strong promise in real-world feature addition tasks, making reliable evaluation of their capabilities increasingly important. However, existing benchmarks primarily evaluate these agents as black boxes based on final test correctness, providing limited insight into how they reason and where failures arise. To address this limitation, we introduce RACE-Bench, a reasoning-augmented benchmark for evaluating code agents on repository-level feature addition tasks. RACE-Bench contains 528 real-world feature addition instances from 12 open-source repositories. Each instance is paired with executable patch verification and structured intermediate reference reasoning covering issue understanding, file localization, implementation tasks, and step decomposition. Based on this design, we introduce a dual-track evaluation framework that jointly measures patch correctness and intermediate reasoning alignment with developer-accepted reference trajectories. We evaluate three representative repository-level code agents on RACE-Bench. On the full benchmark, Resolved Rate ranges from 29% to 70% across different agents. Our reasoning-level analysis further shows that while current agents perform well at understanding high-level intent, their performance degrades substantially when translating intent into concrete implementation steps. We also find patches that can be applied but still fail the tests cover fewer reference-reasoning elements (35.7% lower recall) and contain more unsupported reasoning elements (94.1% higher over-prediction) than successful patches. These findings highlight the importance of evaluating repository-level code agents beyond final patch correctness by examining the quality of their reasoning processes. Article Search Article: ase26main-p208-p doi:10.1145/3832783.3837426
	Liu, Shuyang	ASE '26: "From Plan to Action: How Well ..." From Plan to Action: How Well Do Agents Follow the Plan? Shuyang Liu, Saman Dehghan, Jatin Ganhotra, Martin Hirzel, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA; IBM, USA) Agents are commonly instructed to follow a task-specific plan for guidance.However, it is unknown to what extent agents actually follow instructed plans. Without such an analysis---determining the extent agents comply with a given plan---it is impossible to assess whether a solution was reached through correct strategic reasoning or through other means, e.g., data contamination or overfitting to a benchmark. This paper presents the first extensive, systematic analysis of plan compliance in programming agents, examining 21,120 trajectories from SWE-agent across four LLMs on SWE-bench Verified and SWE-bench Pro under eight plan variations. Without an explicit plan, agents fall back on internalized workflows during training, which are often incomplete, overfit, or inconsistently applied. Providing the standard plan improves issue resolution, and we observe that periodic plan reminders can mitigate plan violations and improve task success. A subpar plan hurts performance even more than no plan at all. Surprisingly, inserting additional task-relevant phases in the early stage can degrade performance, particularly when these phases do not align with the model’s internal problem-solving strategy. These findings call for fine-tuning paradigms that teach models to follow instructed plans, rather than encoding task-specific plans in them, so that they reason and act adaptively, rather than memorizing workflows. Article Search Article: ase26main-p1675-p doi:10.1145/3832783.3834400 ASE '26: "Graphectory Viewer: A Tool ..." Graphectory Viewer: A Tool for Process-Centric Analysis of Agentic Software Trajectories Charlie Jyu, Shuyang Liu, and Reyhaneh Jabbarvand (University of Illinois at Urbana-Champaign, USA) We present Graphectory Viewer, a web-based tool for interactive, process-centric analysis of software-agent trajectories. Building on the Graphectory representation introduced in our previous work, Graphectory Viewer transforms heterogeneous raw trajectories into phase-aware graphs that connect low-level execution details with higher-level behavioral structures. The tool supports trajectories from multiple agent frameworks and provides interactive graph construction; node-level inspection of thoughts, actions, and observations; search and filtering over large trajectory collections; and Sankey-style summaries of problem-solving phase transitions. These capabilities enable researchers and practitioners to inspect individual executions, identify recurring behavioral patterns, compare successful and failed runs, and analyze large trajectory corpora beyond final task outcomes. To support reproducibility and further research, we release Graphectory Viewer as an open-source artifact together with documentation, precomputed graphs, and the large-scale trajectory corpus. Article Search Article: ase26tool-p2-p doi:10.1145/3832783.3834593
	Liu, Sirui	ASE '26: "Best-Effort GR(1) Synthesis: ..." Best-Effort GR(1) Synthesis: Exploiting Environmental Cooperation under Unrealizability Sirui Liu, Yating Zhang, Chi Hu, and Wei Dong (National University of Defense Technology, China; China Academy of Engineering Physics, China) Reactive synthesis automatically derives correct-by-construction controllers from temporal logic specifications. GR(1) synthesis is widely adopted due to its polynomial-time complexity and practical expressiveness. In practice, however, a significant proportion of GR(1) specifications are unrealizable. Conventional synthesis tools report failure in such cases, yet real-world environments are often governed by their own objectives rather than purely adversarial behavior, presenting opportunities for the system to leverage environmental cooperation toward satisfying its justice guarantees. For unrealizable GR(1) specifications, this paper proposes best-effort GR(1) synthesis. The approach requires the system strategy to satisfy two properties: best-effort extensibility, which preserves at every state reached by the play the possibility of satisfying all system justice guarantees, and persistent satisfiability of environment assumptions, which ensures that environmental cooperation does not preclude the environment from satisfying its own justice assumptions. For unrealizable but well-separated specifications, we construct a 3-nested µ-calculus fixpoint formula that characterizes the best-effort system winning region and prove its soundness and completeness. The resulting algorithm performs O(n|Q|) symbolic next-state computations, compared with O(mn|Q|2) for standard GR(1) synthesis. We further analyze the relationship between the best-effort and standard GR(1) winning regions through finite cooperative reachability, yielding a hierarchical classification of dependence on environmental cooperation at the region and initial-state levels for well-separated but unrealizable specifications, thereby quantifying the degree of unrealizability. We implement best-effort checking, controller construction, and classification in the Spectra GR(1) synthesizer and evaluate the approach on a diversified corpus of SYNTECH, AMBA, and GenBuf specifications. Experimental results demonstrate that best-effort realizability is common among well-separated but unrealizable specifications and that all top-level unrealizability categories occur in the combined benchmark corpus. Article Search Artifacts Available Article: ase26main-p372-p doi:10.1145/3832783.3837439
	Liu, Tianhai	ASE '26: "Can Formal Specifications ..." Can Formal Specifications Be Synthesized from Tests Alone? Tianhai Liu, Maximilian Müller, Tobias Hey, Vitus Lüntzel, Muhammad Minhas, Anne Koziolek, and Bernhard Beckert (KIT, Germany) Formal specifications offer strong guarantees, but remain costly to write manually. Recent LLM-based approaches automate this by inferring specifications from source code, yet their reliance on white-box access poses barriers to industrial adoption due to intellectual property risks and deployment costs. Our approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden. Candidate specifications are validated locally using bounded model checking, with feedback guiding iterative refinement. Initial results on the SpecGenBench benchmark suggest that tests can guide LLMs towards meaningful Java Modeling Language specifications, while also highlighting checker compatibility and diagnostic feedback as key challenges for reliable refinement. Article Search Artifacts Available Article: ase26nier-p62-p doi:10.1145/3832783.3834549
	Liu, Tianming	ASE '26: "An Empirical Study of Security ..." An Empirical Study of Security Risks in the Android Push Notification Ecosystem Shilong Hu, Zikan Dong, Chao Wang, Tianming Liu, and Haoyu Wang (Huazhong University of Science and Technology, China) Push notification services are widely used in mobile apps to deliver time-sensitive content. In the fragmented Android ecosystem, however, no single push service works reliably across all devices and markets, leading developers to integrate multiple push SDKs from device manufacturers and third-party providers. Despite their widespread use, prior studies have focused mainly on Google’s Firebase Cloud Messaging, leaving the security risks of other push services largely unexplored. In this paper, we present a systematic security assessment of the Android push notification ecosystem, covering 11 mainstream push SDKs and 52,748 apps across multiple Android app markets. Our analysis reveals three classes of security risks across the push notification workflow: server secret leakage, notification hijacking, and plaintext exposure of notification payloads. Specifically, we identify 517 apps that leak server secrets, accounting for at least 78.79 billion cumulative installs. These leaks enable attackers to forge notifications with attacker-controlled titles and bodies, redirect users to arbitrary URLs after a click, and, in 9 of the 11 evaluated push services, broadcast such notifications to all users. We further show that four widely used push SDKs are vulnerable to notification hijacking, enabling attackers to reroute victim notifications. In addition, among the 110 communication-oriented apps we evaluated, none protects notification payloads before they enter push service infrastructure, leaving sensitive content exposed in plaintext. These findings show that securing real-world push services requires stronger protections from both app developers and push service providers, highlighting the need for more secure push deployment in industry practice. We responsibly disclosed the issues to push service providers and app developers, and received acknowledgments from affected parties. Article Search Article: ase26ind-p82-p doi:10.1145/3832783.3834475
	Liu, Ting	ASE '26: "ChangeWiki: Repository-Level ..." ChangeWiki: Repository-Level Change Summarization Augmented with Architecture Semantics Zijun Wang, Wuxia Jin, Jiale Li, Zhanhong Mou, and Ting Liu (Xi'an Jiaotong University, China) Understanding software evolution at the repository level is essential for tasks such as release management, code review, and regression testing. However, existing change summarization techniques are largely confined to single commits or functions, failing to capture cross-commit evolutionary context, while recent repository-level understanding tools focus on static documentation of single-version codebases, overlooking evolution over time. To bridge this gap, we propose ChangeWiki, an architecture semantic-augmented approach for repository-level change summarization. ChangeWiki first constructs hierarchical, multi-granularity change entity trees enriched with multi-source contexts to infer change intent and impact. It then recovers modular structures across versions and employs a bidirectional context-guided aggregation mechanism, synthesizing code-level changes from the bottom up while injecting architectural semantics as top-down constraints. ChangeWiki finally generates coherent, traceable summaries that capture both local modifications and system-level evolution. We construct comprehensive benchmarks and evaluate ChangeWiki on real-world projects. Experimental results demonstrate significant improvements in semantic accuracy, completeness, and cross-granularity traceability. A prototype of ChangeWiki has been deployed in an industrial setting for upstream-downstream code evolution, where developers reported that the hierarchical summaries significantly reduced manual effort in issue localization caused by upstream changes and show potential for automating version release notes. Article Search Article: ase26main-p3335-p doi:10.1145/3832783.3834436
	Liu, Tong	ASE '26: "OpsAgent: An Evolving Multi-agent ..." OpsAgent: An Evolving Multi-agent System for Incident Management in Microservices Yu Luo, Jiamin Jiang, Jingfei Feng, Lei Tao, Qingliang Zhang, Xidao Wen, Yongqian Sun, Shenglin Zhang, Tong Liu, Wenjie Zhang, and Dan Pei (Nankai University, China; Alibaba Cloud, China; Lenovo, China; Tsinghua University, China) Incident management (IM) is central to the reliability of large-scale microservice systems. Yet manual IM, where on-call engineers examine metrics, logs, and traces is labor-intensive and error-prone in the face of massive and heterogeneous observability data. Existing automated IM approaches often struggle to generalize across systems, provide limited interpretability, and incur high deployment costs, which hinders adoption in practice. In this paper, we present OpsAgent, a lightweight, self-evolving multi-agent system for IM that employs a training-free data processor to convert heterogeneous observability data into structured textual descriptions, along with a multi-agent collaboration framework that makes diagnostic inference transparent and auditable. To support continual capability growth, OpsAgent also introduces a dual self-evolution mechanism that integrates internal model updates with external experience accumulation, thereby closing the deployment loop. Comprehensive experiments on the OPENRCA benchmark demonstrate state-of-the-art performance and show that OpsAgent is generalizable, interpretable, cost-efficient, and self-evolving, making it a practically deployable and sustainable solution for long-term operation in real-world microservice systems. Notably, its deployment in Lenovo’s production environment further validates its effectiveness in real-world industrial settings. Article Search Article: ase26ind-p92-p doi:10.1145/3832783.3834479
	Liu, Wanwei	ASE '26: "BDiff: Block-Aware and Accurate ..." BDiff: Block-Aware and Accurate Text-Based Code Differencing Yao Lu, Wanwei Liu, Tanghaoran Zhang, Kang Yang, Yang Zhang, Wenyu Xu, Longfei Sun, Xinjun Mao, Shuzheng Gao, and Michael R. Lyu (National University of Defense Technology, China; Chinese University of Hong Kong, China) Code differencing is a fundamental technique in software engineering. Traditional line-level differencing tools (e.g., Git Myers algorithm) cannot accurately identify block-level edit actions (EAs) such as block move and copy, which are common in real development. They split multi-line block edits into fragmented line-wise changes, raising developers’ cognitive overhead during code review. This paper presents BDiff, a text-based differencing algorithm capable of identifying two types of block-level EAs and five types of line-level EAs. Building on traditional differencing algorithms, we first construct a candidate set containing all possible line and block mappings. Leveraging the Kuhn-Munkres algorithm, we then compute the optimal mapping set and derive a minimal edit script (ES) that closely aligns with the original developer intent. To evaluate BDiff, we selected five state-of-the-art tools, including large language models (LLMs), as baselines, and adopted a combined qualitative and quantitative approach to assess their performance in terms of ES size, result quality, and running time. Experimental results show that BDiff produces higher-quality differencing results than baseline tools while maintaining competitive runtime performance. Our experiments also show the unreliability of LLMs in code differencing tasks and their infeasibility in terms of runtime efficiency. Based on the proposed algorithm, we have implemented an open-sourced visual differencing tool. Article Search Artifacts Available Article: ase26main-p251-p doi:10.1145/3832783.3837431
	Liu, Xiaoshuang	ASE '26: "When Elo Lies: Hidden Biases ..." When Elo Lies: Hidden Biases in Codeforces-Based Evaluation of Large Language Models in Practice Shenyu Zheng, Ximing Dong, Xiaoshuang Liu, Chun Yong Chong, Gustavo Oliva, Dayi Lin, Boyuan Chen, Shaowei Wang, and Ahmed E. Hassan (Huawei Canada, Canada; Huawei, China; Monash University, Malaysia; Queen's University, Canada; University of Manitoba, Canada) As Large Language Models (LLMs) achieve breakthroughs in complex reasoning, Codeforces-based Elo ratings have emerged as a prominent metric for evaluating competitive programming capabilities in industry. However, these ratings are often reported without critical experimental details, leading to significant discrepancies-illustrated by recent reports where the same model version’s score fluctuated by nearly 500 points (out of 2,029). This paper presents a systematic empirical study on the hidden factors biasing Elo evaluations: (1) the temporal ordering of submissions, (2) contest difficulty selection, and (3) run-to-run stochastic variability of LLMs. Utilizing a controlled benchmark of 37 recent Codeforces contests and 13,691 generated test cases, we demonstrate that Elo scores are highly sensitive to these parameters. Our findings reveal that varying submission orders can shift scores by 394 points, while contest selection can cause differences of up to 1,122 points for the same model. Run-to-run performance exhibits substantial instability, with a maximum difference of 349 points in mean scores observed when evaluating identical contests. We conclude that direct Elo comparisons are unreliable and potentially misleading without strict standardization and transparent reporting of experimental settings. Article Search Article: ase26ind-p20-p doi:10.1145/3832783.3834458
	Liu, Xiaozhou	ASE '26: "Expanding Guard Reach: Online ..." Expanding Guard Reach: Online Learning-Driven Incremental Kernel Panic Diagnosis Yicheng Sui, Xiaotian Wang, Hailin Zhang, Shenglin Zhang, Binhong Jiang, Heng Zheng, Yongqian Sun, Yuzhi Zhang, Yang Zhang, Xin Wu, Liangyan Peng, Linlin Han, Feng Wang, Xiaozhou Liu, and Yu Zhang (Nankai University, China; ByteDance, China) Kernel panic faults (KPFaults) disrupt large-scale infrastructures. While logs are the primary diagnostic resource, they exhibit continuous semantic drift driven by the evolution of diverse online services and hardware heterogeneity. Existing methods fail to adapt to this drift. However, employing online learning to address this drift encounters two operational bottlenecks: the sparsity of KPFault-indicating logs and the heavy burden of manual intervention. To address this, we propose PanicGuard, an incremental diagnosis framework driven by online learning. PanicGuard integrates Fault-Indicating Representation Extraction (FIRE) to autonomously filter noise from sparse logs and Emergent Drift Guard Engine (EDGE) to verify evolving patterns within known fault categories and escalate genuinely novel types for expert registration using LLM-assisted reasoning. Evaluations on two real-world datasets comprising 6,789 and 6,779 KPFault cases demonstrate that PanicGuard achieves high accuracy (0.996 and 0.993) and Macro-F1 score (0.977 and 0.990) with only 29 and 33 human interventions, respectively. Compared to the strongest baseline, PanicGuard reduces human effort by 69% and 95%, respectively, while maintaining high precision. It has been operating in production for over three months, proving its effectiveness in achieving superior diagnostic performance compared to legacy methods, while significantly reducing manual intervention. The source code is publicly available at https://doi.org/10.5281/zenodo.19826984. Article Search Artifacts Available Article: ase26ind-p78-p doi:10.1145/3832783.3834474
	Liu, Xin	ASE '26: "CADscanner: Automating Malware ..." CADscanner: Automating Malware Analysis for Compiled AutoCAD Scripts in Engineering Environments Luxing Yin, Chang Sun, Chenghui Liang, Chu Wang, Shufu Zhi, Tianshi Zheng, Ziang Liu, Xin Liu, and Qingguo Zhou (Lanzhou University, China; Sangfor Technologies, China) For architecture, engineering, and manufacturing organizations, the inability to inspect AutoCAD's compiled script formats (FAS and VLX) has become a consequential security blind spot: every publicly available analysis tool fails on them, while threat actors have repeatedly used them to weaponize shared drawing files in documented industrial espionage campaigns. Today, when a security analyst encounters a suspicious FAS or VLX file, the manual practice is either to upload it to a cloud service (often prohibited by confidentiality policies), to attempt ad hoc byte-level inspection (ineffective due to per-file encryption), or to simply skip the file. This paper reports on CADscanner, a tool that automates the analysis of compiled AutoCAD scripts by recovering their behavioral content locally, without requiring AutoCAD installation, cloud submission, or manual reverse engineering. We describe the engineering of a recovery pipeline that handles two proprietary formats: the FAS4 binary, which is protected by rolling-XOR encryption, and the VLX (VRTLIB-1) archive container. The pipeline lifts both into a normalized intermediate representation suitable for automated rule matching and analyst review. On a 201-script consistency benchmark, behavioral API recovery reaches 79.3% recall at 97.8% precision, with security-critical indicators (persistence, network, propagation) preserved at 85--94%. A rule-based detector over the recovered surface achieves 95.8% TPR at 2.2% FPR on a family-disjoint held-out set, processing files in under 15,ms each. We report deployment experience integrating CADscanner into a security vendor's OT analysis workflow, discuss the engineering trade-offs encountered, and distill lessons learned for practitioners building format-recovery tooling in industrial contexts. Article Search Article: ase26ind-p134-p doi:10.1145/3832783.3834495
	Liu, Xuanzhe	ASE '26: "Characterizing the Landscape ..." Characterizing the Landscape of Open-Source Satellite Software Jinfeng Wen, Qi Liang, Yuehan Sun, Federica Sarro, Ao Zhou, Xuanzhe Liu, and Shangguang Wang (Beijing University of Posts and Telecommunications, China; University College London, UK; Peking University, China) Satellites have become fundamental components of modern technological systems, supporting critical infrastructure in communication, navigation, Earth observation, and scientific research. As space exploration advances and demand for satellite-enabled services grows, reliance on complex, heterogeneous satellite software continues to increase. A systematic understanding of the satellite software landscape is therefore increasingly important, yet existing studies still lack a comprehensive empirical examination. To address this gap, we present the first characterization study of open-source satellite software, examining its ecosystem and development practices. We mine and analyze 22,286 satellite-related GitHub projects through three research questions on popularity trends (RQ1), software goals (RQ2), and development practices (RQ3). First, we characterize the temporal evolution of projects and active developers, revealing increasing popularity. Second, through manual inspection of 646 projects, we construct a taxonomy of 43 software-goal categories spanning conceptual design, datasets, system implementation, simulation, testing, and tools. Third, we conduct an in-depth analysis of projects with source code, revealing a highly heterogeneous and task-specialized ecosystem with 66 programming languages and diverse implementation strategies. Finally, we summarize key findings and derive actionable implications for satellite developers and researchers. Article Search Article: ase26main-p161-p doi:10.1145/3832783.3834343
	Liu, Xudong	ASE '26: "CAPMix: Robust KPI Anomaly ..." CAPMix: Robust KPI Anomaly Detection for AIOps in Noisy and Dynamic Environments Xudong Mou, Rui Wang, Tiejun Wang, Zexin Wu, Fangda Guo, Jie Sun, Shiru Chen, Penghao Zhang, Tiezi Zhang, Tianyu Wo, Hao Peng, Chunming Hu, Xudong Liu, and Renyu Yang (Beihang University, China; Chinese Academy of Sciences, China; Inspur, China; Kuaishou, China) Time-series anomaly detection is crucial in AIOps for maintaining large-scale service reliability. In production, streams of Key Performance Indicators (KPI) are high-dimensional, non-stationary, and affected by noise, deployment changes, and latent anomalies, making real failures hard to distinguish from benign variation. Most existing methods assume either normality (learning from “normal” history) or rely on injected anomalies for training. Yet injected patterns often misalign with real failure modes, skewing decision boundaries – aka. Anomaly Shift. We propose CAPMix, a controllable anomaly augmentation framework with prior-guided injection for realistic temporal behaviors. CAPMix combines label revision and dual-space mixup to enhance robustness under contaminated and mixed data. CAPMix consistently outperforms state-of-the-art methods on public AIOps and time-series benchmarks. It has been deployed in a large-scale production system, reducing false alarms and improving monitoring reliability. A real-world dataset is also released to enrich the research on robust KPI anomaly detection. Article Search Article: ase26ind-p110-p doi:10.1145/3832783.3834487
	Liu, Xuming	ASE '26: "Spec2V: Planning-Guided Specification-to-Verilog ..." Spec2V: Planning-Guided Specification-to-Verilog Generation Framework with Verification-Driven Debugging Xuming Liu, Chi Zhang, Jinglong Xu, Shan Zhou, and Jinbo Wang (Technology and Engineering Center for Space Utilization at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) Field Programmable Gate Array (FPGA) is essential in mission-critical fields like aerospace. It offers high flexibility and deterministic real-time response. With the increase in development demands and system complexity, the traditional design paradigm that relies on manual expertise has become inefficient. Although large language models (LLMs) provide a potential pathway for automated code generation, a significant semantic gap remains between the linear reasoning patterns of LLMs and the inherent parallelism of FPGA hardware logic. Current methods encounter difficulties in decomposing complex tasks, low-resource code generation, and resolving simulation errors. To address these issues, we present Spec2V, an agent framework for the generation of Verilog code. Spec2V incorporates two key complementary components: (i) we propose a task planning method based on a dual-layer Tree of Thought. It decouples complex specifications into macro-topology and micro-logic structures to mitigate logical drift from linear reasoning and to improve the accuracy of initial solutions. (ii) During validation and debugging, Spec2V reformulates failure analysis as a structured attribution task with an LLM-as-a-Judge paradigm. It utilizes the reasoning capabilities of LLMs and multi-source evidence to localize the sources of simulation errors. Furthermore, the framework introduces a multi-temperature hedged sampling strategy and a waveform mismatch rate filtering mechanism to identify correct implementations efficiently from extensive candidate spaces. On the public VerilogEval Machine and Human benchmarks, Spec2V achieves Pass@1 accuracies of up to 99.8% and 99.4%, respectively. Case studies on representative RTL design tasks further demonstrate that Spec2V significantly reduces the manual effort required for implementation and mitigates the overhead of iterative engineering through closed-loop planning, validation, and debugging. Article Search Artifacts Available Article: ase26main-p157-p doi:10.1145/3832783.3834342
	Liu, Yaming	ASE '26: "GALA: Graph-Augmented LLM ..." GALA: Graph-Augmented LLM Agents for Root Cause Analysis and Incident Response in Microservices Yifang Tian, Yaming Liu, Zichun Chong, Zihang Huang, Yiran Li, and Hans-Arno Jacobsen (University of Toronto, Canada) Microservice root cause analysis (RCA) requires correlating failures across heterogeneous telemetry within complex service dependency graphs. Existing methods often rely on a single telemetry modality; recent LLM-based approaches can suffer from unconstrained exploration and hallucination; and most systems stop at fault ranking without producing actionable incident response. We present GALA+, a graph-augmented LLM agentic framework centered on graph-guided investigation, which uses service dependencies to bound exploration and refine diagnosis through localized multi-modal evidence. For initial hypothesis generation, GALA+ combines complementary telemetry signals with STRIX, a novel trace- and graph-structure-aware scoring module. GALA+ then produces ranked diagnoses, incident summaries, and stratified action recommendations. We further introduce SURE-Score, a human-guided evaluation framework co-developed with industry SRE experts for assessing RCA-specific output quality beyond conventional text similarity metrics. On two microservice benchmarks, GALA+ consistently achieves the strongest overall results, surpassing the best LLM-based baseline by more than 25 percentage points in AC@1, while also receiving the highest ratings from both SURE-Score and independent human SRE evaluation. Article Search Article: ase26main-p46-p doi:10.1145/3832783.3834335
	Liu, Yang	ASE '26: "Breaking Customized LLMs for ..." Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks Yuchen Chen, Wei Cheng, Yuan Xiao, Weisong Sun, Chunrong Fang, Yang Liu, Zhenyu Chen, and Baowen Xu (Nanjing University, China; Nanjing University of Aeronautics and Astronautics, China; Nanyang Technological University, Singapore) LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness. Article Search Article: ase26main-p2706-p doi:10.1145/3832783.3834424 ASE '26: "How Effective Are NPM Malicious ..." How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study Wenbo Guo, Zhongwen Chen, Zhengzi Xu, Chengwei Liu, Ming Kang, Shiwen Song, Chengyue Liu, Yijia Xu, Weisong Sun, and Yang Liu (Nanyang Technological University, Singapore; Sichuan University, China; Imperial Global Singapore, Singapore; Nankai University, China; Singapore Management University, Singapore) The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on disparate datasets with inconsistent settings, making cross-tool comparison unreliable and leaving practitioners without clear guidance. We present the first large-scale empirical study of NPM malicious package detection, evaluating 11 tools with 16 variants on a unified benchmark of 6,420 malicious and 7,288 benign packages annotated with 11 behavior categories and 8 evasion techniques. Unlike prior work, we inspect each tool’s source code to explain why tools succeed or fail, not merely how often. Our key findings: (1) the precision and recall a tool achieves are structurally determined by how it resolves the ambiguity between code capability and malicious intent, with IntelGuard reaching the best F1 at 95.98% by grounding its judgment in retrieved evidence and GuardDog the best among conventional tools at 93.32%; (2) behavioral coupling amplifies detection signals when behaviors co-occur, raising SAP_DT from 3.2% to 79.3% for the collect-and-exfiltrate chain; (3) 80.3% of malware uses no evasion because the ecosystem lacks mandatory pre-publication scanning; (4) ML degradation is driven by concept convergence rather than concept drift, since malware became simpler and every decision boundary fitted to a corpus ages with it; (5) combination effectiveness equals complementarity minus false-positive introduction, not paradigm diversity. Strategic combinations reach up to 97.21% accuracy and 97.02% F1. We release our benchmark and evaluation framework. Article Search Article: ase26main-p218-p doi:10.1145/3832783.3837427 ASE '26: "One Is Not Enough: The Untold ..." One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability Fangyuan Zhang, Lyuye Zhang, Lingling Fan, Chengwei Liu, Yinan Li, Liang Huang, Yang Liu, Zheli Liu, and Sen Chen (Nankai University, China; Nanyang Technological University, Singapore; Qi An Xin Technology Group, China) Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling. Article Search Article: ase26main-p694-p doi:10.1145/3832783.3837455 ASE '26: "Not as Sweet by Another Name: ..." Not as Sweet by Another Name: An Empirical Study of Format Robustness in LLM Document Workflows Xiaoyu Zhang, Xianyun Cheng, Tianlin Li, Yuwei Zheng, Yue Yang, and Yang Liu (Nanyang Technological University, Singapore; National University of Singapore, Singapore; Beihang University, China; Xi'an University of Architecture and Technology, China) LLM-driven software systems are rapidly evolving from plain-text conversations to document-centric end-to-end workflows, where the same semantic content can be delivered in diverse document formats (e.g., CSV) through file upload interfaces. Yet existing testing work focuses on the robustness and reliability of models and systems whose input is a single prompt string, leaving a critical question unanswered: Can these document workflows maintain robust behaviors when the same content arrives in a different document format? To fill the gap, in this paper, we propose a format-aware metamorphic testing framework with three metamorphic relations to comprehensively evaluate the format robustness of end-to-end LLM document workflows. Based on this framework, we conduct a large-scale empirical study spanning four representative LLM workflows, four real-world tasks, and four document formats, comprising a total of 48,000 workflow executions. Our findings reveal that format variation poses a systematic and serious threat. Merely switching formats can cause accuracy to drop by up to 53.63% and trigger decision drifts in over 41% of instances. We further design lightweight mitigation strategies from the users’ perspective that recover up to 44.21% of format-induced decision drift without model retraining. Our study demonstrates that document format is not a neutral wrapper but a critical factor affecting the reliability of LLM software systems, calling for corresponding testing and safeguards in the deployment in real-world high-stakes scenarios. Article Search Article: ase26main-p718-p doi:10.1145/3832783.3837456 ASE '26: "Latent Reuse in Agent Skills: ..." Latent Reuse in Agent Skills: Multi-modal Clone Detection at Ecosystem Scale Jiaying Zhu, Lyuye Zhang, Wenbo Guo, and Yang Liu (Nanyang Technological University, Singapore) An agent skill is a reusable package for extending an LLM agent, typically a SKILL.md file that combines YAML metadata, natural-language instructions, and executable code. Public repositories now host over two million skills, yet existing tools analyze each artifact in isolation, and registries do not track reuse created through copying, renaming, or adaptation. Detecting these links is difficult because reuse may appear in one channel while the others change; conventional single-channel clone detectors can therefore miss such adaptations. We present SkillReuse, a multi-modal clone detector that combines global lexical matching with channel-specific representations for YAML, prose, and code, then uses logistic regression to produce clone scores and interpretable clone-type labels. We also introduce SkillReuse-Bench, an annotated benchmark of 300 skill pairs spanning exact copies, renamed copies, adaptations, and semantic equivalents. On SkillReuse-Bench, SkillReuse reaches an F1 of 0.939 with 0.952 precision, improving over TF-IDF and delivering 4.2× higher recall on Type-4 semantic clones than MinHash. Applied to all 137,470 skills that pass the content filter, SkillReuse identifies 1.06 million clone pairs involving 66.8% of the analyzed skills; 95.3% of these pairs cross author boundaries. Among skills in the analyzed name-based clone families, 67% are superseded by a higher-quality variant. Tracing 938 security-relevant skills through the clone graph surfaces 16,587 clone links spanning 6,376 related skills that per-skill scanners alone would miss. Article Search Article: ase26main-p820-p doi:10.1145/3832783.3837468 ASE '26: "SecChain: Operationalizing ..." SecChain: Operationalizing Security Guidelines for Multi-agent Smart Contract Generation Dianxiang Sun, Liming Nie, and Yang Liu (Nanyang Technological University, Singapore; Shenzhen Technology University, China) Smart contracts generated by large language models (LLMs) can compile yet still violate basic security obligations, and existing generation frameworks largely treat security as post-hoc verification rather than as a constraint that persists throughout generation and repair. We present SecChain, a multi-agent smart-contract generation framework built around a persistent SecuritySpec artifact that makes requirement-level security obligations explicit and preserves them across planning, coding, testing, auditing, and fixing. Five LLM-powered agents collaborate with a fully deterministic Coordinator through stage-specific procedures, deterministic pre-test verification, and nested repair loops, while an Auditor provides complementary semantic review grounded in a three-layer security knowledge base. We evaluate SecChain on 1,000 contracts from the finite-state-machine-guided smart-contract generation (FSM-SCG) dataset against vanilla GPT-4o, GPT-5.4, Claude Sonnet 4.6, and the FSM-SCG framework. SecChain achieves an 89.0% final compilation rate and a Zero Risk Contract Proportion (ZRCP) of 60.3%, compared with 12.7% for vanilla GPT-4o and 23.3% for FSM-SCG. With a GPT-4o backbone, SecChain still outperforms the tested vanilla current-generation models (GPT-5.4, Claude Sonnet 4.6) on the primary security metrics. Article Search Artifacts Available Article: ase26main-p1030-p doi:10.1145/3832783.3837480 ASE '26: "Panorama: Unveiling Latent ..." Panorama: Unveiling Latent Dependencies for Microservice Autoscaling via Meta-learning Zhuangbin Chen, Hongjiang Feng, Yang Liu, Juzheng Zheng, Xiaoyu He, and Zibin Zheng (Sun Yat-sen University, China) Existing autoscaling approaches primarily leverage direct service calls to model the propagation effects of scaling decisions across inter-service dependencies. However, the intricate and implicit service interactions (i.e., latent dependencies) often go beyond such direct invocations, rendering suboptimal scaling actions and poor adaptability. To address these limitations, we propose Panorama, a novel autoscaling framework that explicitly unveils and exploits indirect service interactions. In particular, we formalize two fundamental categories of latent dependencies, i.e., resource interference dependencies (RIDs), which emerge from shared infrastructure resources, and execution blocking dependencies (EBDs), which stem from temporal constraints in the execution logic of business workflows. Panorama employs a hybrid attention mechanism to model these multifaceted service dependencies alongside temporal dynamics. We also design a meta-learning paradigm to enable rapid adaptation to evolving workload patterns and dependency structures without extensive retraining. Evaluation across four representative microservice benchmarks shows that Panorama consistently outperforms state-of-the-art baselines, achieving up to 68% reduction in resource consumption while improving response time by 42%. This highlights the critical importance of explicitly modeling latent dependencies for effective microservice resource management. Article Search Article: ase26main-p1217-p doi:10.1145/3832783.3837485 ASE '26: "Benchmarking Automated Security ..." Benchmarking Automated Security Patch Backporting: How Far Are We? Jincheng Yang, Yulong Fu, Chengwei Liu, Lyuye Zhang, Fangyuan Zhang, Bingyang Ren, Yang Liu, and Hui Li (Xidian University, China; Nankai University, China; Nanyang Technological University, Singapore) Automated security patch backporting is critical for mitigating N-day vulnerabilities. Recent tools have reported high success rates, often exceeding 80% on their respective datasets. However, these evaluations are typically confined to homogeneous environments, such as within the same repository or specific project versions. Consequently, it remains unclear how well these tools generalize beyond their originally targeted scenarios. We present Porting Benchmark, a curated dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework. Using this benchmark, we evaluate five state-of-the-art tools spanning traditional program analysis, LLM-based prompting, and LLM agents under aligned evaluation settings. Our results show that aligned evaluation changes the apparent performance landscape: PortGPT and TSBPort remain comparatively strong on the Replication Dataset, while FixMorph and Mystique degrade substantially under the common protocol. Performance degrades sharply on structurally complex patches: the best commit-level success rate falls from 85.2% on Type-I patches to 24.0% on Type-IV. We identify four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design. On a 45-case dynamically validated subset with verified test cases and constructed POCs, we further observe that reference-based benchmark scores do not fully capture real-world remediation: exact match sharply under-credits harder target adaptations, while executable validation reveals residual integration failures in the target that static reference agreement misses. Executable-feedback refinement provides limited but measurable recovery on the hardest executable cases. Article Search Article: ase26main-p2788-p doi:10.1145/3832783.3837542 ASE '26: "Implicit, Yet Impactful: Understanding ..." Implicit, Yet Impactful: Understanding Hidden Dependencies in Java Projects Lyuye Zhang, Chengwei Liu, Fangyuan Zhang, Yiran Zhang, Yuan Zhou, and Yang Liu (Nanyang Technological University, Singapore; Nankai University, China; Zhejiang Sci-Tech University, China) As software usage continues to expand, package managers automatically resolve dependencies to construct a dependency graph based on user-specified requirements. These explicitly declared dependencies, known as direct dependencies, receive significant attention in terms of maintainability and security. However, implicit dependencies, which are not explicitly defined by users but are still directly utilized or referenced in their project code due to oversight, remain largely unnoticed. Unlike ordinary transitive dependencies, which may remain unused and invisible to the root, implicit dependencies are actively used yet undeclared, leaving their versions outside the project’s direct control. This lack of awareness poses substantial challenges related to security and maintainability. In this study, we present the first study to treat implicit dependencies as the focal phenomenon and quantitatively characterize their lifecycle consequences for the Maven ecosystem. We meticulously collected and built a large-scale dataset with 1,157 libraries with 19,812 versions from the Maven Central Repository and 972 modules from GitHub. Our findings reveal that 34.12% of the analyzed dataset contains implicit dependencies, with two primary causes identified as key contributors to the issue. Among these, 48% introduce breaking changes due to version drift, and 36 CVEs have vulnerable methods directly used by root projects; 30.28% of implicit dependencies are affected by known vulnerabilities under the version-range convention SCA tools use for declared dependencies. Finally, we identified and analyzed four major countermeasures, providing actionable insights and practical implications for addressing this overlooked issue for stakeholders within the OSS ecosystem. Article Search Article: ase26main-p3524-p doi:10.1145/3832783.3837552 ASE '26: "ATLAS: Agentic Taxonomy of ..." ATLAS: Agentic Taxonomy of LArge-Scale Software Ecosystems Junyi Lu, Mengyao Lyu, Jiahui Wu, Lei Yu, Chengwei Liu, Fengjun Zhang, Li Yang, Chun Zuo, and Yang Liu (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Nankai University, China; Sinosoft, China) The open-source ecosystem on GitHub lacks a systematic hierarchical taxonomy of software repositories. GitHub Topics, the dominant organizational mechanism, is flat, inconsistent, and covers only 67% of repositories. We present ATLAS, the first framework that automatically constructs a hierarchical taxonomy for software repositories and classifies repositories into it end-to-end. By combining LLM global knowledge with real repository distributions, ATLAS proposes meaningful splitting dimensions and iteratively corrects those that fail to accommodate real repositories. A Designer Agent proposes splitting dimensions while a Classifier Agent assigns repositories; a self-corrective refinement loop uses classification failures to drive dimension revision through escalating strategies. We evaluate ATLAS on 54,387 GitHub repositories against six baselines spanning four paradigm families, two downstream software engineering tasks, and three model families. On a stratified 2,001-repository benchmark, ATLAS achieves a Taxonomy Quality F-score (TQF) of 83.13%, outperforming the best baseline by 15 percentage points (on the full 54k corpus the approximate TQF is 73.0%, a gap driven by Path Granularity's all-or-nothing scoring on longer paths rather than lower classification accuracy; see Section 4.5). It is the only method to simultaneously achieve high structural quality and high practical applicability. On downstream tasks, the ATLAS taxonomy enables software alternative discovery with P@1 = 85.71%, surpassing even human-curated lists (62.34%), and achieves the highest P@1 for repository retrieval. The taxonomy further reveals structural ecosystem trends that are difficult to obtain from flat tags or similarity methods: the shift from libraries to AI/ML applications (now 61% of newly community-adopted projects) becomes visible only through hierarchical, type-based categorization. An interactive taxonomy explorer is available at https://atlas-taxonomy.netlify.app/. Article Search Artifacts Available Article: ase26main-p622-p doi:10.1145/3832783.3834361
	Liu, Yanzhen	ASE '26: "DafnyRAG: A Retrieval-Augmented ..." DafnyRAG: A Retrieval-Augmented and Verification-Driven Tool for Automated Repair of Dafny Code Yanzhen Liu, Xu Lu, Bin Yu, Haoxiang Zhang, Chu Chen, and Meng Wang (Xidian University, China; Qufu Normal University, China; Hebei University, China) Dafny is a verification-aware language whose adoption is hindered by the heavy manual effort of writing formal specifications and proof artefacts—a critical bottleneck for safety-critical software development. While Large Language Models (LLMs) can synthesise Dafny code, they routinely hallucinate domain-specific constructs and stagnate in repetitive generate–verify–fail cycles, because Dafny is severely under-represented in pre-training corpora. We present DafnyRAG, an open-source tool that turns any general-purpose LLM into a verification-aware Dafny repair agent. DafnyRAG ships with (i) a heterogeneous Dafny knowledge base—a static Syntax Rule Library, a static Error Theory Library, and a dynamic Repair Case Library; (ii) an error-aware retrieval router that selects the appropriate library based on the verifier diagnostic; and (iii) a verification-driven iterative repair loop that backfills every successful repair into the case library, growing the tool’s expertise over time. Across three production LLM backends (GPT-4, DeepSeek-V3, Claude-4.5-Sonnet) on the MBPP-DFY-178 benchmark, DafnyRAG consistently outperforms a strong few-shot baseline on verify@5, peaking at 83.71% with Claude-4.5-Sonnet. The tool source code, knowledge base, and evaluation scripts are available at https://doi.org/10.5281/zenodo.21372059. A screencast demo is available at https://youtu.be/s-QBaGj8tK8. Article Search Artifacts Available Article: ase26tool-p44-p doi:10.1145/3832783.3834610
	Liu, Yating	ASE '26: "Trace-Driven Automated PoC ..." Trace-Driven Automated PoC Synthesis for On-Chain Attacks Xing Su, Hao Wu, Hanzhong Liang, Yunlin Jiang, Yuxi Cheng, Yating Liu, Fengyuan Xu, and Sheng Zhong (Nanjing University, Nanjing, China) Blockchain systems are increasingly targeted by on-chain attacks that exploit vulnerabilities in smart contracts, resulting in billions of dollars in losses. Understanding and reproducing these attacks is critical for defense, yet currently relies on manually crafting proofs-of-concept (PoCs), which is labor-intensive, expertise-driven, and difficult to scale. In this work, we take the first step toward automating PoC synthesis directly from transaction traces. Our key insight is that a concrete execution trace provides not only behavioral evidence for recovering exploit logic, but also runtime semantics that enable precise code synthesis and verification. We design TracExp, a trace-driven framework that combines a dual decompiler, which fuses symbolic lifting with concrete runtime values to produce semantically enriched pseudocode, and a sketch-based synthesis and refinement mechanism that grounds LLM generation in execution context and ensures semantic correctness. Evaluated on 321 real-world DeFi attacks collected over 20 months, TracExp achieves 94.70% generation, 83.80% compilable, and 57.01% verifiable rates, at an average cost of ∼$0.1 per case. Moreover, we contributed 33 previously unavailable PoCs within 2 days to DeFiHackLabs, and all were accepted and merged, earning $900 in bounties, demonstrating both the practical effectiveness and real-world impact. Article Search Article: ase26main-p24-p doi:10.1145/3832783.3834332
	Liu, Yepang	ASE '26: "GraphDroid: Asynchronous LLM-Based ..." GraphDroid: Asynchronous LLM-Based Mobile App GUI Testing via History-Aware Exploration and Hybrid Intent Fulfillment Xiaolei Li, Jialun Cao, Zhijian Hou, Yuzhi Zhao, Yepang Liu, and Shing-Chi Cheung (Hong Kong University of Science and Technology, China; Southern University of Science and Technology, China; Guangzhou HKUST Fok Ying Tung Research Institute, China; City University of Hong Kong, China) Automated GUI testing is a widely adopted technique for ensuring mobile application quality by simulating user interactions to exercise functionalities. Despite the research breakthroughs in the past decades, covering complex functionalities that require multi-step action sequences still remains challenging. Traditional tools lack semantic understanding capability and can rarely synthesize such action sequences. Recent LLM-based tools can generate test intents describing target functionalities and leverage the LLM to fulfill the intents, but suffer from three key limitations: 1) loss of historical context for identifying uncovered functionalities, 2) synchronous intent generation that blocks exploration, and 3) per-step LLM-driven fulfillment incurring high cost and latency. To address these limitations, we propose GraphDroid, an intent-driven GUI testing framework that integrates a cluster-based memory mechanism to effectively identify uncovered functionalities from historically visited states for comprehensive application testing. For improving testing efficiency, GraphDroid adopts an asynchronous intent generation paradigm that eliminates the latency bottleneck and a hybrid intent fulfillment strategy that reserves the LLM for fulfilling complex intents while delegating simple intents to a lightweight heuristic algorithm. We evaluate GraphDroid on 41 real-world Android apps against six state-of-the-art baselines. Results show that GraphDroid outperforms all baselines, achieving up to 36.4% higher code coverage while incurring less than one eighth of the cost of the best pure LLM-based baseline. GraphDroid also exposes 19 bugs in the 41 apps and detects 13 of 52 crashes in the Themis bug benchmark, surpassing all the six baselines. Seven of the 19 bugs were previously unknown and we reported them to the developers. So far, four bugs have been confirmed and fixed. Article Search Article: ase26main-p609-p doi:10.1145/3832783.3837449 ASE '26: "WebCQ: Cooperative Multi-agent ..." WebCQ: Cooperative Multi-agent Deep Reinforcement Learning for Scalable Web GUI Testing Yujia Fan, Sinan Wang, Zebang Fei, Yao Qin, Huaxuan Li, and Yepang Liu (Southern University of Science and Technology, China) Multi-agent reinforcement learning (MARL)-based techniques have shown promise for GUI testing. However, as the complexity of modern GUI software increases, existing MARL-based approaches (e.g., MARG and Fastbot) struggle to scale due to the inherent limitations of their underlying tabular reinforcement learning algorithms. This limits their applicability to large-scale commercial GUI software, especially web applications with vast state spaces and many interactive elements. To fill this gap, we propose WebCQ, a novel MARL-based approach for scalable web GUI testing. WebCQ incorporates QTRAN for multi-agent coordination and a lightweight synchronization mechanism, allowing it to work under asynchronous web testing scenarios. It extracts semantic and exploration features for each UI event to form an action vector. This vector is concatenated with the current state vector and fed into the policy network, enabling DQN-based decision making within a dynamic action space. We evaluated WebCQ on eight large-scale commercial websites. Under the same time budget and agent count, WebCQ explored 33.3% more states and executed 42.2% more unique actions than MARG, while triggering more failures on six of the eight websites under test. It also demonstrated strong scalability, maintaining higher action throughput during 20-hour experiments, and achieving greater performance improvements as the number of agents increased. These results show that WebCQ overcomes key limitations of existing MARL-based approaches, providing a scalable and effective solution to enhance modern web GUI testing. Article Search Article: ase26main-p944-p doi:10.1145/3832783.3834374
	Liu, Yi	ASE '26: "How Your Credentials Are Leaked ..." How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, and Zhiqiang Li (Griffith University, Australia; Wake Forest University, USA; Nanyang Technological University, Singapore; University of New South Wales, Australia; Zhejiang Sci-Tech University, China; University of Tokyo, Japan; University of Alberta, Canada; Independent Researcher, China) Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research. Article Search Article: ase26main-p928-p doi:10.1145/3832783.3834373 ASE '26: "SAF: An AI-Agent-Ready and ..." SAF: An AI-Agent-Ready and Browser-Accessible Static Analysis Framework for LLVM IR Yuekang Li, Wei Li, Wei Song, Yi Liu, and Gelei Deng (University of New South Wales, Australia; Griffith University, Australia; Nanyang Technological University, Singapore) Static program analysis finds bugs before software ships, and modern checkers for C/C++ depend on whole-program infrastructure: pointer analysis, value-flow tracking, taint analysis, and IFDS-based data flow on top of LLVM. Today’s LLVM-IR frameworks fall short. SVF, Phasar, and Lotus expose their analyses through C++ APIs that require subclassing, recompilation, and pinned LLVM builds; onboarding takes months. CodeQL replaces the C++ API with a domain-specific query language. None is designed for the AI coding agents that increasingly drive software-engineering work. We present the Static Analyzer Factory (SAF), an LLVM-IR analysis framework that combines a Rust kernel exposed to Python through PyO3 zero-copy bindings, a WebAssembly and Pyodide browser playground that runs the same SDK with no install, a declarative YAML language for function specifications that the built-in checkers consume at runtime, and two shipped coding-agent skills installable in Claude Code and Codex. As an illustrative case, SAF’s bundled memory-safety checkers were themselves authored end-to-end through this workflow using Claude Code on the Opus 4.6 model. On the NIST Juliet C/C++ benchmark, these checkers achieve the best F1 on three of four memory-safety CWEs, each measured against whichever of SVF and Lotus ships a corresponding checker. Code: https://github.com/Static-Analyzer-Factory/static-analyzer-factory. Documentation and browser playground: https://static-analyzer-factory.github.io/static-analyzer-factory/. Demo video: https://youtu.be/Cj58VvNCrlw. Article Search Article: ase26tool-p8-p doi:10.1145/3832783.3834597
	Liu, Yinxi	ASE '26: "Decompiling the Web: Automated ..." Decompiling the Web: Automated Semantic Recovery of Post-compilation Abstraction Leaks Shriyans Sudhi and Yinxi Liu (Rochester Institute of Technology, USA) Modern web applications rely on advanced compilation pipelines to transform high-level source code into heavily optimized execution bundles. This structural transformation introduces a systemic security gap that we formalize as Post-Compilation Semantic Collapse. During the build process, the application state is fractured into disjointed execution fragments, and dependencies are subsequently orchestrated via dynamic runtime engines. While developers operate under the assumption of server-client isolation, modern bundlers can weaken this boundary to optimize performance, silently migrating sensitive backend context and internal routing logic into public client-side artifacts. Traditional security scanners are poorly matched to these architectural exposures. By evaluating compiled JavaScript as a flat, static resource, existing tools fail to reconstruct dynamic dependency graphs or interpret the proprietary streaming protocols required to map the modern attack surface. To overcome this structural gap, we introduce JS Recon, an automated semantic recovery framework that performs decompiler-like analysis for modern JavaScript bundles. Because bundlers obscure execution paths using cryptographic hashes and functionally transformed arrays, pure static parsing is insufficient. JS Recon defeats this obfuscation by coupling static structural analysis with targeted dynamic execution. Specifically, it statically lifts heavily minified payloads into an Abstract Syntax Tree (AST) to isolate obfuscated routing logic, and subsequently evaluates these localized runtime dictionaries within a dynamic native sandbox. Furthermore, to resolve decentralized server-side dependencies, the pipeline actively manipulates proprietary React Server Component (RSC) streaming protocols, forcing the backend to dynamically serialize and expose routing state not present in static artifacts. We deployed JS Recon against the Tranco Top 1M domains to execute a large-scale measurement study. Our pipeline extracted over 2.5 million orphaned sourcemaps, achieving a 97.04% extraction rate in controlled environments compared to 0% for baseline tools. Furthermore, JS Recon recovered 6,210 verified secret instances, establishing a 6.6x discovery multiplier over the leading reconnaissance spider. Our measurement identifies a widespread ecosystem issue, finding 447 globally unique verified secrets distributed across 379 root domains. This study shows that automated semantic recovery is needed to audit build artifacts and map the obscured attack surfaces of modern web deployments. Article Search Artifacts Available Article: ase26main-p145-p doi:10.1145/3832783.3837419
	Liu, Yisi	ASE '26: "Lost in Translation, Found ..." Lost in Translation, Found in Summary: Summary-Driven Supervision for Cross-Language Code Retrieval Zhijie Liu, Yisi Liu, Linxi Jiang, Yutian Tang, Lili Xiao, and Zhipeng Xue (Independent Researcher, China; Donghua University, China; University of Glasgow, UK; Zhejiang University, China) Cross-language code retrieval (CLCR) is critical to modern software development, and recent studies have shown that contrastive learning is an effective way to learn cross-language code semantics. However, these methods are still limited by two fundamental challenges. First, they rely on online judge platforms or multilingual NL-to-code datasets, which either lack diversity or fail to ensure semantic alignment between code snippets, thereby limiting the effectiveness of cross-language semantic learning. Second, during training, code snippets from different languages are often encoded into heterogeneous representation distributions. This distribution inconsistency introduces similarity bias and weakens the model's ability to capture accurate cross-language semantics. To address these challenges, we propose SemSIR, an end-to-end framework for CLCR. The key insight is to use Summary IR, a natural-language intermediate representation, to bridge semantic gaps across languages. Built on this insight, SemSIR automatically constructs scalable cross-language supervision from real-world repositories, and further combines distribution alignment with CLIP-style contrastive training to learn more discriminative language-independent code semantics. In our evaluation, we collect 24 million real-world code snippets across 9 languages and automatically construct 7 million semantic groups. Manual inspection of 1,000 sampled groups shows that 92.7% are fully semantically coherent, with an average Group Purity of 96.8%. On CLCR, SemSIR consistently outperforms all baselines on two benchmarks, surpassing the state-of-the-art method by up to 24.7% in MRR and 50.1% in MAP on average. In addition, experimental results on a security case study of tracing rewritten malware across languages show that SemSIR achieves 92.20 MRR and 88.40 MAP, highlighting its potential for security-oriented CLCR. Article Search Article: ase26main-p479-p doi:10.1145/3832783.3837444
	Liu, Yixuan	ASE '26: "TasmScan: Continuation-Aware ..." TasmScan: Continuation-Aware Taint Analysis for TVM Bytecode with Savelist Abstraction Yixuan Liu, Yin Wu, and Yi Li (Nanyang Technological University, Singapore; Xi'an Jiaotong University, China) The Open Network, with a peak market capitalization exceeding twenty billion US dollars and more than one hundred seventy five million activated on chain addresses, relies on the TON Virtual Machine to execute smart contracts. The TON Virtual Machine uses first class continuations with savelists to manage control flow and register state across continuation invocations. Because registers captured by savelists allow data to flow across continuation boundaries without passing through the operand stack, bytecode level analyses cannot construct complete data flow tracking without explicitly modeling savelist semantics. We present TasmScan, the first bytecode level static analysis framework for the TON Virtual Machine that enables cross continuation data flow reasoning without requiring source code. TasmScan models savelist semantics through forward register analysis with a formal over approximation guarantee for exactly resolved save sites and locally tracked register definitions. It then lifts bytecode into TASIR, a typed intermediate representation, and performs path sensitive taint analysis with context aware sources to detect defects. We evaluate TasmScan on two thousand nine hundred twenty one contracts from the TON verifier registry and a labeled benchmark of two hundred eight contracts with human confirmed ground truth. On the full corpus, TasmScan resolves two hundred ninety four thousand five hundred forty six dynamic continuation targets with one hundred percent precision. Ablation confirms that savelist propagation is essential for resolving indirect register calls that depend on cross continuation register passing. On the benchmark, TasmScan detects ninety five point three percent of defects across five classes with ninety six point eight percent precision. A stratified sample of three hundred sixty six pairs from the full corpus estimates eighty five point eight percent overall precision. TasmScan offers a seventeen times median speedup over the state of the art symbolic execution baseline and completes one hundred percent of analyses in the path analysis comparison with zero crashes or timeouts. Article Search Article: ase26main-p182-p doi:10.1145/3832783.3834346
	Liu, Yong	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Liu, Yonghui	ASE '26: "Requirements-Augmented Generation ..." Requirements-Augmented Generation for Trustworthy Acceptance Testing of LLM-Based Software Fanyu Wang, Chetan Arora, Zhenping Xie, Yonghui Liu, Kla Tantithamthavorn, Aldeida Aleti, and Siwei Jiang (Monash University, Australia; Jiangnan University, China; Australian National University, Australia; Yiwuyishi Intelligent Technology (Nantong), China; Tianjin University, China) LLM-based software (LBS) integrates large language models as core components to deliver flexible and personalised responses. Unlike traditional software with deterministic outputs, LBSs exhibit context-dependent, stochastic behaviour that renders classical acceptance testing and test oracles insufficient: the same query may require fundamentally different responses depending on users' personas and software context. This gap creates an urgent need for automated acceptance testing frameworks that can autonomously interpret users' instructions, while also raising the challenge of how we can reliably interpret users' intentions in a changing environment. In this paper, we present an automated acceptance testing framework for LBS with calibrated verdict reliability through two technical contributions. First, we introduce REquirements-Augmented Generation (REAG), which interprets user intentions by retrieving relevant software requirements, domain knowledge, and personas via adaptive RAG and self-reasoning to generate context-aware test oracles. Second, recognising that oracle generation may retrieve irrelevant constraints, misinterpret intent, or hallucinate requirements, we introduce a confidence-calibrated cascade judgment that quantifies verdict reliability via simulated expert agreement, accepting high-confidence verdicts, escalating ambiguous cases, or abstaining when uncertain, with empirical reliability guarantees backed by conformal risk control. An industrial case study on a production nutrition advisory application demonstrates that REAG achieves a 3.91/5 oracle quality score, successfully achieving qualified or marginal oracle quality in 82% of cases. The confidence-calibrated cascade achieves 98.8% accuracy, improves oracle quality from 3.91 to 4.30 by filtering unqualified outputs, and delivers a 31.7% cost-efficiency improvement over single-judge baselines, validating industrial viability. Article Search Article: ase26ind-p113-p doi:10.1145/3832783.3834491
	Liu, Yu	ASE '26: "When Ambiguity Meets Atypicality: ..." When Ambiguity Meets Atypicality: Dual-Perspective Test Input Prioritization for DNNs Haoran Li, Shihai Wang, Bin Liu, Jialuo Chen, Wenjing Zhu, Yu Liu, Tengfei Shi, and Shudi Guo (Beihang University, China; Zhejiang University, China) While Deep Neural Networks (DNNs) have achieved remarkable progress in cutting-edge domains, their inherent brittleness has become a growing concern. To ensure the reliability and safety of DNN-enabled software, DNN testing has emerged as an indispensable practice. Within this context, test input prioritization is essential for early fault detection and reducing labeling costs. However, it remains challenging to accurately identify failure-inducing inputs. Although decision ambiguity and distributional atypicality are two widely adopted perspectives for characterizing inter-class competition and intra-class typicality respectively, relying on either perspective in isolation inevitably introduces blind spots. In this paper, we propose DuFP (Dual perspective Feature space Prioritization), a KNN density-based test input prioritization approach for DNNs that jointly incorporates both inter-class and intra-class perspectives. The prioritization framework of DuFP is built upon class-conditional density estimation. Based on the estimation results, prediction correctness is characterized by an ambiguity score and an atypicality score, with the former reflecting decision ambiguity and the latter quantifying distributional atypicality. A hybrid uncertainty score is then constructed by integrating both scores to guide the final prioritization. We evaluate DuFP on prioritization and selection tasks across image and text datasets under clean, corrupted, and adversarial scenarios. Experimental results demonstrate that DuFP effectively and efficiently prioritizes fault-inducing inputs and outperforms state-of-the-art approaches. Article Search Artifacts Available Article: ase26main-p367-p doi:10.1145/3832783.3834351
	Liu, Yuhong	ASE '26: "RepoProbe: Benchmarking Architecture-Aware ..." RepoProbe: Benchmarking Architecture-Aware Repository Comprehension with Checklists Yuexi Yang, Alyssa Wu, Ji Luo, Richeng Xuan, Zhichao Hu, Yuhong Liu, and Zhen Qin (Zhejiang University, China; Tencent, China) The integration of Large Language Models (LLMs) into software engineering has shifted the focus from function-level generation to repository-scale assistance. However, existing benchmarks largely rely on bug reports from GitHub Issues, which often allow models to bypass genuine understanding via pattern matching on error logs. This misalignment under-measures Edit Bias, which refers to premature generation, where models prematurely propose code modifications instead of understanding the existing repository architecture. Furthermore, current LLM-as-a-Judge scalar scoring suffers from high variance and low interpretability. This work introduces RepoProbe, a novel benchmark for evaluating repository-level code understanding through open-ended Q&A using GitHub Discussions, which focuses on open-ended architectural inquiries rather than defect reporting. To ensure rigorous evaluation, we propose a Checklist-Based Verification Protocol that decomposes answers into atomic, verifiable facts, thereby replacing subjective ratings with objective verification. Our evaluation of state-of-the-art (SOTA) LLMs reveals a persistent gap between high clarity and evidence-grounded technical correctness. It also quantitatively confirms the prevalence of edit bias, in which models prioritize code generation instead of architectural analysis. Finally, we demonstrate that our verification protocol significantly improves evaluation reliability compared to traditional evaluations with scalar scoring. Article Search Artifacts Available Article: ase26main-p676-p doi:10.1145/3832783.3837452
	Liu, Yunxin	ASE '26: "Towards Reliable Alarm Flood ..." Towards Reliable Alarm Flood Reduction in Data Center via Grammar-Guided Verifiable LLM Reasoning Jiacheng Liu, Guocong Lin, Jichao Yan, Huiwen Zheng, Hongli Ma, Changhao Zhou, Zhiyi Yu, Yuanchun Li, Yunxin Liu, Ding Li, Tao Xie, and Yao Guo (Peking University, China; Tsinghua University, China; GDS Holdings, China) Alarm floods pose a critical challenge in system operations, where a single fault can trigger cascaded alarms across interconnected components, overwhelming human operators and obscuring actionable signals. Alarm flood reduction aims to reduce redundant alarms under a safety-oriented objective, because any incorrect reduction may falsely exclude real failures. Existing approaches face a fundamental trade-off: rule-based systems ensure reliability but lack scalability, while solutions based on a large language model (LLM) offer strong generalization but suffer from non-determinism and unverifiable reasoning, limiting their use in safety-critical settings. In this paper, we study the alarm flood reduction problem in data center operations and introduce a solution based on structured reasoning and conservative verification. Our key insight is that expert-level alarm analysis relies on explicit reasoning chains that connect upstream causes to downstream alarms. We design Constrained Reasoning Chain Grammar (CRCG), a lightweight yet expressive grammar that formalizes such reasoning processes as compositional inference chains with logical and numerical constraints. Our method follows two tightly connected steps. First, we use LLM-assisted annotation, checker-guided compilation, and supervised fine-tuning (SFT) to organize expert knowledge in CRCG and train a model to generate explicit reasoning chains. Second, we conservatively reduce alarms only when the reasoning chain can be verified based on CRCG. We evaluate the method on real-world data center HVAC alarms. Results have shown that our method achieves high accuracy while driving false reductions to zero on the evaluated setting, outperforming both rule-based and LLM-only baselines and reducing operational workload substantially. Article Search Artifacts Available Article: ase26ind-p96-p doi:10.1145/3832783.3834481
	Liu, Yuwei	ASE '26: "KVerus: Scalable and Resilient ..." KVerus: Scalable and Resilient Formal Verification Proof Generation for Rust Code Yuwei Liu, Xinyi Wan, Yanhao Wang, Minghua Wang, Lin Huang, and Tao Wei (Ant Group, China; Independent Researcher, China) Repository-scale formal verification is becoming practical for Rust systems, but maintaining and extending proofs remains expensive in real projects. In the Asterinas Rust OS kernel, the CortenMM memory-management module requires Verus proofs that cross file and module boundaries, reuse project-specific lemmas with limited documentation, and survive frequent Verus/toolchain evolution. Existing LLM-based proof-generation methods are mostly designed for small or single-file tasks, and they do not provide the structural project knowledge or verifier-aware repair needed in such a repository-scale verification workflow. This paper presents KVerus, a practical LLM-assisted workflow for Verus proof generation in evolving Rust repositories. KVerus builds a dynamic knowledge base over code metadata, lemma semantics, and Verus/toolchain knowledge. It combines dependency-aware context extraction, semantic lemma retrieval, and error-driven refinement to generate Verus proof code that is checked by the verifier and then reviewed by engineers. In CortenMM, KVerus generated verifier-passing proof patches that verified 23 previously unverified functions, introduced 6 reusable lemmas, and accounted for 21.0% of the proof code in the module; these patches were accepted upstream by Asterinas developers. The CortenMM experience also exposed practical boundary cases, including incorrect specifications that required human repair and generated proofs that benefited from human cleanup. Across benchmarks, KVerus achieves a 51.0% success rate on three repository-level benchmarks with cross-file dependencies, compared with 4.5% for a multi-round prompting baseline, and verifies 80.2% of tasks on three single-file benchmarks. These experiences and results show that LLM-assisted proof generation can move beyond benchmark-oriented synthesis and become a maintainable workflow for repository-scale Rust verification. Article Search Artifacts Available Article: ase26ind-p190-p doi:10.1145/3832783.3834503 ASE '26: "Beyond Benchmarks: A Case ..." Beyond Benchmarks: A Case Study of LLM-Generated Verus Specification Failures on Asterinas Vostd Dugang Liu, Ding Wang, Chao Jiang, Cheng Wen, Zhiwu Xu, Zhong Ming, Yuwei Liu, Xinyi Wan, and Lin Huang (Shenzhen University, China; Ant Group, China) Large language models (LLMs) have recently shown promise in automating formal specification generation, but their effectiveness has mainly been demonstrated on self-contained benchmark tasks. This paper examines the changes that occur when LLM-generated specifications are applied to an industrial verification project. To answer this question, we conducted experiments on Asterinas OSTD's Vostd repository, a Rust-based OS-kernel verification codebase built around cross-file dependencies and Entity--Model proof abstractions. We analyze six formal verification targets spanning 156 function-level tasks, 50 Rust source files, and 7,149 lines of code; the failure corpus contains 1,587 reviewed failure episodes nested within 270 model-specific repair traces produced by DeepSeek-V4-Flash, GPT-4o, and Qwen-Coder. Our results show that existing methods effective on benchmarks face significant challenges on Vostd, and that framework customization for industrial validation is necessary and has considerable potential. LLM-generated specifications break in systematic rather than random ways: they cluster across four verification stages (i.e., repository integration, Verus legality, semantic modeling, and proof construction), and their distributions vary across models and targets. We further show that verifier diagnostics do not always identify the true source of failure, and that verifier-guided repair can regress or stall rather than converge. These findings indicate that LLM-generated specifications fail not merely because industrial code is harder, but because failures are structured, stage-dependent, and often repaired in the wrong direction. Future evaluation and tooling should therefore move beyond final pass/fail outcomes and account for where specifications break, whether diagnostics identify the real cause, and whether repair makes progress or simply cycles through new errors. Article Search Artifacts Available Article: ase26ind-p194-p doi:10.1145/3832783.3834504 ASE '26: "VerusSeek: Retrieval-Augmented ..." VerusSeek: Retrieval-Augmented LLM-Based Proof Synthesis for Rust Programs Yuchen Zhang, Cheng Wen, Jialun Cao, Dugang Liu, Zhiwu Xu, Yuwei Liu, and Shengchao Qin (Xidian University, China; Hong Kong University of Science and Technology, Hong Kong; Shenzhen University, China; Institute of Software at Chinese Academy of Sciences, China) Formal verification of Rust programs with Verus provides strong correctness guarantees, but developing the auxiliary specifications and proofs still requires considerable manual effort. Existing LLM-based proof-synthesis agents can automate part of this process, yet their effectiveness on non-trivial tasks is often limited by the lack of reusable proof patterns that are directly relevant to verification. This paper presents VerusSeek, a retrieval-augmented tool for LLM-assisted Verus proof synthesis for Rust programs. Instead of retrieving entire files or functions, VerusSeek indexes previously verified Verus code as semantic proof constructs, including contracts, assertions, loop invariants, lemmas, and proof blocks. For each verification task, the tool performs type-aware retrieval to select constructs that match the current proof obligation, expands them with bounded hierarchical context, and synthesizes lightweight structural loop-invariant hints for index bounds, frame conditions, and termination arguments. Verus checks each candidate proof, and the resulting diagnostics guide the next repair attempt. On 150 tasks from VerusBench, VerusSeek verifies 122 tasks, compared with 69 for AutoVerus and 85 for RagVerus. A demonstration video of VerusSeek is available at https://youtu.be/p2mb61gj95A. Article Search Article: ase26tool-p29-p doi:10.1145/3832783.3834603
	Liu, Zesen	ASE '26: "When Compression Becomes an ..." When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents Zesen Liu, Zhixiang Zhang, Yuchong Xie, and Dongdong She (Hong Kong University of Science and Technology, China; Fudan University, China) Prompt compression is increasingly deployed in LLM agents to reduce latency and cost. It determines what the backend LLM ultimately sees, thereby unexpectedly changing the security boundary of the agent pipeline. We show that, when trusted and untrusted inputs are compressed under a shared budget, this lossy transformation exposes a new attack surface in the LLM agents. By perturbing only untrusted inputs before compression, an adversary can cause the compressor to discard task-critical evidence or safety guardrails before LLM inference. Unlike prompt injection, jailbreaks, or RAG poisoning, our attack target is the compressor rather than the backend LLM. The perturbation need not encode a meaningful instruction or even survive compression. We formalize this vulnerability as adversarial information loss (AIL), the excess downstream behavioral distortion caused by adversarially steering a lossy compressor beyond benign compression alone. To exploit AIL, we present COMA, a transfer-based black-box attack that uses attacker-side surrogate compressors and backend LLMs to optimize pre-compression perturbations. COMA first selects a misbehavior-inducing target in compressed space, then searches for a perturbation whose surrogate compression matches that target. Across three tasks (agent tool selection, question answering, and system prompt corruption) and six widely used compressors, COMA achieves an average attack success rate of 0.71, versus 0.21 for the strongest non-compression-based baseline. COMA further generalizes across compression budgets, backend LLMs, and surrogate compressors, transfers to two case studies of real-world agents. We also show that isolating trusted inputs from untrusted inputs during compression improves robustness, especially for system prompt corruption. Article Search Artifacts Available Article: ase26main-p1531-p doi:10.1145/3832783.3834394
	Liu, Zhanpeng	ASE '26: "Post-quantum Cryptography ..." Post-quantum Cryptography in the Wild: Assessing the Readiness of Open-Source Ecosystems Tongxin Yuan, Zhanpeng Liu, Jiashuo Liang, Zhuosheng Zhang, Gongshen Liu, Yang Yu, and Guancheng Li (Shanghai Jiao Tong University, China; Tencent Xuanwu Lab, China) The threat of cryptographically relevant quantum computers, compounded by harvest now, decrypt later attacks, has made migration to post-quantum cryptography (PQC) urgent. With PQC standards finalized and transition guidance phasing out quantum-vulnerable algorithms, the readiness of the open-source supply chain, through which cryptographic vulnerabilities propagate, remains unclear. To fill this gap, we present the first cross-ecosystem empirical study of source-level PQC readiness. PQC Scanner is a two-stage pipeline in which (i) crypto detection identifies packages with cryptographic functionality, and (ii) PQC detection produces a binary support label and source-derived structured readiness record at the repository level using commit history, source analysis, and agent post-verification. Applied to 1,117,913 packages, Stage 1 identifies 55,654 crypto-related packages. Stage 2 evaluates their repositories for source-level PQC support. A separate audit of 219 Stage 2-negative repositories gives a Stage 2 recall lower bound of ≥  97.48%. On a 247-repository deployment-validation sample, agent post-verification eliminated all false positives, yielding precision of 1.000. The pipeline scales to million-package scans: at concurrency 10, it analyzes over one million packages in just over two weeks, with a median LLM cost of $0.0010 per package. Across 8 ecosystems, we find a migration gap: only 1.88% of crypto-related packages show source-level PQC support, and the repository-deduplicated rate is 1.72%. Rust leads by both counts, while NuGet/Ruby/PHP remain near zero. Source-derived structured readiness records show partial support: among PQC-supporting repositories, only 19.2% satisfy the full-support criterion, with a mean migration coverage of 36%. Adoption accelerates sharply after FIPS publication (August 2024), but migration remains infrastructure-gated: key libraries such as Python’s cryptography (581M downloads/month) and framework integration layers in Java/npm still lack deployable PQC pathways, blocking downstream packages regardless of developer intent. We characterize adoption timing, bottlenecks, and community response strategies, deriving recommendations for maintainers, registry operators, and policy makers. Article Search Article: ase26main-p758-p doi:10.1145/3832783.3837461
	Liu, Zhao	ASE '26: "InfraAPR: An Agent-Based Repair ..." InfraAPR: An Agent-Based Repair Framework for Cloud Infrastructure-as-Code Programs Quan Chen, Zhao Liu, Chunfang Li, Yifan Zhang, Ning Hu, and Qing Liao (Harbin Institute of Technology, Shenzhen, China; Pengcheng Laboratory, China; Hunan University, China; Nanchang University, China) Infrastructure as Code (IaC) is now a routine part of industrial cloud delivery, and Programming Languages IaC (PL-IaC) frameworks further enable engineers to build infrastructure using familiar programming abstractions. However, repairing buggy PL-IaC programs in practice remains costly and highly challenging. Existing quality assurance efforts for PL-IaC have largely concentrated on defect analysis and static checking, while end-to-end automated repair frameworks for PL-IaC programs remain largely absent. In addition, automated program repair techniques designed for general-purpose software often lack PL-IaC-specific domain knowledge, as well as effective modeling and guidance for topology dependencies, making them ineffective for repairing topology-dependent bugs in PL-IaC settings. This paper presents InfraAPR, an agent-based automated repair framework for PL-IaC programs. To enable end-to-end automated repair, InfraAPR integrates three coordinated modules: (1) an InfraAPR Agent Module for phase-specialized LLM reasoning, (2) a Semantic Mapping Module for reconstructing graph-based PL-IaC semantics, and (3) a Constraint-Guided Repair Module that diagnoses constraint violations and generates repaired programs based on structured diagnostics. We evaluate InfraAPR on an industrial benchmark. Experimental results show that InfraAPR consistently outperforms the baselines, achieving a repair success rate of up to 61.8% and improving the strongest baseline by 15.4% on average. These results demonstrate its substantial practical value and improved reliability for industrial PL-IaC workflows. Article Search Article: ase26ind-p338-p doi:10.1145/3832783.3834526
	Liu, Zhe	ASE '26: "Piece by Piece: Automating ..." Piece by Piece: Automating Combination Interaction GUI Testing via Planning and Dual Memory Zhe Liu, Oujin Wang, Junjie Wang, Chunyang Chen, Mengzhuo Chen, Boyu Wu, Yuekai Huang, and Qing Wang (Institute of Software at Chinese Academy of Sciences, China; Tsinghua University, China; TU Munich, Germany; University of Chinese Academy of Sciences, Beijing, China) Combination interactions require coordinated operations across multiple GUI widgets within a page to complete a functional task, which are common in modern mobile apps. However, due to widget dependencies, dynamic interface transitions, and context-sensitive execution, existing automated GUI testing approaches based on predefined models or state exploration struggle to reliably complete such interactions. LLM-based GUI testing methods improve semantic understanding but often generate inconsistent actions due to the lack of coordination modeling and interaction context. To address these challenges, this paper proposes COMBDroid, an automated GUI testing approach that enables reliable completion of combination interactions through structured planning and dual memory. COMBDroid first detects combination interaction patterns from GUI structure, then generates page-level interaction plans and grounds them into widget-level executable actions. Inspired by Sudoku solving, COMBDroid maintains a dual-memory mechanism, where context memory preserves execution states within a functionality and experience memory captures reusable interaction patterns. COMBDroid is designed as an integrable module that activates when combination interactions are detected and allows existing testing tools to resume exploration after completion. We evaluate COMBDroid on 100 combination interaction functionalities collected from 100 mobile apps, comparing it with 15 state-of-the-art GUI testing baselines. COMBDroid achieves 103% higher passing rate than the best baseline and improves activity coverage by 65%-100% when integrated with existing testing tools. Furthermore, GUI testing tools integrated with COMBDroid detect 37 new crash bugs in real-world apps, with 26 fixed and the remaining confirmed by developers, demonstrating its effectiveness in improving GUI testing. Article Search Article: ase26main-p3565-p doi:10.1145/3832783.3837553
	Liu, Zheli	ASE '26: "One Is Not Enough: The Untold ..." One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability Fangyuan Zhang, Lyuye Zhang, Lingling Fan, Chengwei Liu, Yinan Li, Liang Huang, Yang Liu, Zheli Liu, and Sen Chen (Nankai University, China; Nanyang Technological University, Singapore; Qi An Xin Technology Group, China) Security patches (SPs) are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are incomplete, downstream users may observe only part of the required fix set and therefore apply only partial patching. However, comprehensive patch discovery remains difficult because the prevalence and causes of the multi-SP phenomenon are still poorly understood. In this paper, we present the first large-scale empirical study of multi-SP vulnerabilities. By merging four major vulnerability databases, we construct a dataset of 6,053 multi-SP CVEs with 16,260 SPs, showing that 20.6% of CVEs with patches involve multiple SPs and that merging databases increases recognized multi-SP CVE counts by 36-55% over any single source. We further analyze why a vulnerability is associated with multiple SPs and derive a two-level taxonomy with 6 categories and 16 sub-categories. Based on these findings, we develop SPectre, a taxonomy-driven prototype for comprehensive patch discovery. On 300 multi-SP CVEs, after manually verifying ground-truth SPs, SPectre improves multi-SP patch coverage over representative patch-localization baselines, achieving 0.927 recall on same-repository cases and 0.873 recall on cross-repository cases after manual ground-truth verification. On 100 recent CVEs recorded as single-patch by all public databases, SPectre further discovers 28 previously unreported SPs across 20 CVEs. Our results show that multi-SP vulnerabilities are both prevalent and systematically underreported, motivating stronger patch-completeness awareness, improved vulnerability database curation, and relation-aware security tooling. Article Search Article: ase26main-p694-p doi:10.1145/3832783.3837455
	Liu, Zhengyao	ASE '26: "Automated Lemma Discovery ..." Automated Lemma Discovery in Agentic Program Verification Huan Zhao, Haoxin Tu, Zhengyao Liu, Martin C. Rinard, and Abhik Roychoudhury (National University of Singapore, Singapore; Massachusetts Institute of Technology, USA) Deductive verification provides strong correctness guarantees for code by extracting verification conditions (VCs) and writing formal proofs for them. The expertise-intensive task of VC proving is the main bottleneck in this process, and has been partly automated owing to recent advances in Large Language Model (LLM) agents. However, existing proof agents are not able to discover helper lemmas – auxiliary lemmas that aid in proving – and thus fall short as programs grow in size and complexity. In this paper, we argue that VC proving for program verification is more than a purely mathematical task, and benefits considerably from program comprehension. Our key insight is that human proof engineers often discover and apply helper lemmas based on their understanding of the program semantics, which are not directly reflected in the VCs produced by VC generators. Inspired by this insight, we propose an LLM agent, LemmaNet, that discovers helper lemmas in two ways. Specifically, the agent first synthesizes lemmas offline by directly analyzing the source code and specifications and then relating this semantic understanding to the mechanical, verbose encoding produced by VC generators. As the proof unfolds, LemmaNet then adapts existing helper lemmas online to accommodate evolving proof states, enabling the agent to effectively discharge complex VCs on-the-fly. We implement LemmaNet on top of an existing proof agent AutoRocq for Rocq and the Frama-C ecosystem, and evaluate it on SV-COMP and established real-world subjects, including modules of the Linux kernel, Contiki OS, standard C++ library, and X.509 parser. Our experimental results demonstrate that LemmaNet significantly outperforms state-of-the-art approaches, highlighting the importance of program comprehension-aided lemma discovery in agentic program verification. Article Search Article: ase26main-p529-p doi:10.1145/3832783.3834356
	Liu, Zhijie	ASE '26: "Lost in Translation, Found ..." Lost in Translation, Found in Summary: Summary-Driven Supervision for Cross-Language Code Retrieval Zhijie Liu, Yisi Liu, Linxi Jiang, Yutian Tang, Lili Xiao, and Zhipeng Xue (Independent Researcher, China; Donghua University, China; University of Glasgow, UK; Zhejiang University, China) Cross-language code retrieval (CLCR) is critical to modern software development, and recent studies have shown that contrastive learning is an effective way to learn cross-language code semantics. However, these methods are still limited by two fundamental challenges. First, they rely on online judge platforms or multilingual NL-to-code datasets, which either lack diversity or fail to ensure semantic alignment between code snippets, thereby limiting the effectiveness of cross-language semantic learning. Second, during training, code snippets from different languages are often encoded into heterogeneous representation distributions. This distribution inconsistency introduces similarity bias and weakens the model's ability to capture accurate cross-language semantics. To address these challenges, we propose SemSIR, an end-to-end framework for CLCR. The key insight is to use Summary IR, a natural-language intermediate representation, to bridge semantic gaps across languages. Built on this insight, SemSIR automatically constructs scalable cross-language supervision from real-world repositories, and further combines distribution alignment with CLIP-style contrastive training to learn more discriminative language-independent code semantics. In our evaluation, we collect 24 million real-world code snippets across 9 languages and automatically construct 7 million semantic groups. Manual inspection of 1,000 sampled groups shows that 92.7% are fully semantically coherent, with an average Group Purity of 96.8%. On CLCR, SemSIR consistently outperforms all baselines on two benchmarks, surpassing the state-of-the-art method by up to 24.7% in MRR and 50.1% in MAP on average. In addition, experimental results on a security case study of tracing rewritten malware across languages show that SemSIR achieves 92.20 MRR and 88.40 MAP, highlighting its potential for security-oriented CLCR. Article Search Article: ase26main-p479-p doi:10.1145/3832783.3837444
	Liu, Zhongxin	ASE '26: "RealisticTritonBench: A Benchmark ..." RealisticTritonBench: A Benchmark for Triton-Kernel Generation in Real-World AI Frameworks Jinjun Huang, Zhongzhen Wen, Tongtong Xu, Meng Yan, Xin Xia, and Zhongxin Liu (Zhejiang University, China; Nanjing University, China; Huawei, China; Chongqing University, China) In modern AI frameworks, the GPU kernel is a key determinant of overall system performance. By combining usability, portability, and near-handwritten CUDA performance, Triton has been widely adopted for implementing GPU kernels. Recent advances have shown the potential of using large language models (LLMs) to automatically generate Triton kernels, helping reduce the manual effort required by expert kernel developers. To evaluate the quality of LLM-generated Triton kernels, several benchmarks have been proposed. However, existing benchmarks primarily target isolated kernel generation tasks and suffer from three key limitations: (1) they restrict the task to only PyTorch-to-Triton translation, thus failing to reflect the diversity and complexity of real-world Triton tasks; (2) they evaluate only the performance of individual kernels, limiting the evaluation of real-world performance of generated kernels in AI frameworks, where end-to-end performance is the core criterion for real deployment; (3) they rely on manually written evaluation scripts for single kernel, which may introduce vulnerabilities and allow models to exploit evaluation flaws to bypass correctness checks and obtain inflated scores. To address these limitations, we introduce RealisticTritonBench, the first benchmark that derives Triton kernel generation tasks from real-world pull requests in popular AI frameworks, enabling evaluation under realistic, production-like settings. RealisticTritonBench systematically extracts real-world PRs with Triton kernel modified from popular open-source AI frameworks and transforms them into kernel generation tasks with concrete engineering contexts. Each task takes a natural language requirement as input and requires to generate a corresponding Triton kernel implementation. RealisticTritonBench also provides a complete and reproducible evaluation environment for each task. In contrast to prior benchmarks that focus on isolated kernel performance, RealisticTritonBench integrates generated kernels into their original frameworks and evaluates them under end-to-end test, enabling a more faithful assessment. We conduct a systematic evaluation of the state-of-the-art LLMs on RealisticTritonBench, revealing that they still struggle to handle the challenges in real-world Triton generation tasks. Article Search Article: ase26main-p721-p doi:10.1145/3832783.3837457 ASE '26: "MultiKernelBench: A Multi-platform ..." MultiKernelBench: A Multi-platform Benchmark for Kernel Generation Zhongzhen Wen, Yinghui Zhang, Zhong Li, Zhongxin Liu, Linna Xie, and Tian Zhang (Nanjing University, China; Zhejiang University, China) The automatic generation of deep learning (DL) kernels using large language models (LLMs) has emerged as a promising approach to reduce the manual effort and hardware-specific expertise required for writing high-performance operator implementations. However, existing benchmarks for evaluating LLMs in this domain suffer from limited hardware support, coarse-grained kernel categorization, and imbalanced task coverage. To address these limitations, we introduce MultiKernelBench, the first comprehensive, multi-platform benchmark for LLM-based DL kernel generation. MultiKernelBench spans 300 tasks across 15 well-defined kernel categories and supports three major hardware platforms: NVIDIA GPUs, Huawei NPUs, and Google TPUs. To enable future extensibility, we design a modular backend abstraction layer that decouples platform-specific logic from the core benchmarking infrastructure, allowing easy integration of new hardware platforms. We further propose a simple yet effective category-aware one-shot prompting method that improves generation quality by providing in-category exemplars. Through systematic evaluations of seven state-of-the-art LLMs, we reveal significant variation in task difficulty, poor generalization to platforms with less training exposure, and the effectiveness of targeted prompting strategies. Article Search Article: ase26main-p755-p doi:10.1145/3832783.3837460 ASE '26: "Effective and Efficient Context ..." Effective and Efficient Context Retrieval via Partial Dependency Graph for Repository-Level Code Generation Zhongxin Liu, Zhonghao Jiang, Zhifan Ye, Haoye Wang, Jiakun Liu, and Xiaoxue Ren (Zhejiang University, China; Hangzhou City University, China; Harbin Institute of Technology, China) LLM-based repository-level code generation aims to generate code according to the available context within a software repository, requiring LLMs to understand and reason over complex code dependencies. Due to limited context windows and insufficient understanding of repository-specific code, LLMs typically rely on retrieval-augmented generation (RAG) to incorporate relevant contextual code. Early RAG approaches primarily employ similarity-based retrieval, which often fails to retrieve code snippets that the target function actually depends on. Recent work introduces graph-based retrieval to model such dependencies, but typically relies on manually designed rules and static global graphs, leading to limited flexibility and high construction and maintenance costs. In contrast, human developers typically collect helpful context by implicitly constructing a partial dependency graph and iteratively inspecting along it. Inspired by human behavior, we propose DyRetriever, an effective and efficient context retrieval method via partial dependency graphs. DyRetriever leverages an LLM to simulate how human developers collect helpful context by first selecting a set of entry-point functions and then performing multi-hop reasoning along the code dependency graph. During multi-hop reasoning, DyRetriever leverages the LLM’s semantic understanding to explicitly validate whether a function can help to generate the target function, thereby eliminating reliance on manually designed rules and enabling flexibility across application scenarios. Instead of statically constructing a global dependency graph, DyRetriever builds a partial graph on demand and discards it after use, reducing construction overhead and avoiding maintenance costs. We integrate DyRetriever with a similarity-based code retriever to build a new code generation approach, DyCoder, and evaluate it on two widely used repository-level code generation benchmarks, CoderEval and DevEval. Experimental results show that DyCoder achieves relative Pass@1 improvements of 25.63% and 59.73% on CoderEval and DevEval, respectively, compared with existing RAG-based methods, while being 7.4× faster than baselines based on static dependency graph construction. Article Search Article: ase26main-p356-p doi:10.1145/3832783.3834350 ASE '26: "Doc2Feat-Bench: Evaluating ..." Doc2Feat-Bench: Evaluating Documentation-Driven Feature Addition Zhonghao Jiang, Le Deng, Jialun Cao, Michael Pradel, and Zhongxin Liu (Zhejiang University, China; Hong Kong University of Science and Technology, Hong Kong; CISPA Helmholtz Center for Information Security, Germany) Documentation changes in mature software projects often describe newly introduced or modified behavior. This makes them a natural basis for documentation-driven feature addition, where software engineering agents implement features from public-facing documentation updates. However, existing benchmarks for agentic software development primarily rely on issue reports written for maintainer coordination and often contain implementation-level details. Motivated by this observation, this work introduces Doc2Feat-bench, a benchmark for documentation-driven feature addition. Doc2Feat-bench consists of 634 tasks across 10 mature open-source software projects, involving about 114k code changes in total. Each task pairs a documentation change with the corresponding implementation and developer-written tests, enabling evaluation of whether a software engineering agent can implement the feature described by the documentation diff. The benchmark is constructed through a five-phase pipeline, starting from release notes, and offers broad coverage across libraries, developer tools, and frameworks while preserving real-world development settings. To facilitate lightweight and reliable evaluation under limited resources, we further curate a human-validated subset named Doc2Feat-bench Verified. It contains 114 high-quality instances whose task clarity and evaluation validity are manually verified. We use Doc2Feat-bench to assess a range of state-of-the-art software engineering agents with two widely used scaffolds. Experimental results show that despite significant token consumption, the best task success rate remains as low as 37.72% (OpenHands with Qwen3-Coder-480B). Our analysis reveals that software engineering agents face key challenges in performing cross-file edits, understanding existing code modules, and correctly interpreting documentation semantics. Article Search Article: ase26main-p1306-p doi:10.1145/3832783.3837489
	Liu, Ziang	ASE '26: "CADscanner: Automating Malware ..." CADscanner: Automating Malware Analysis for Compiled AutoCAD Scripts in Engineering Environments Luxing Yin, Chang Sun, Chenghui Liang, Chu Wang, Shufu Zhi, Tianshi Zheng, Ziang Liu, Xin Liu, and Qingguo Zhou (Lanzhou University, China; Sangfor Technologies, China) For architecture, engineering, and manufacturing organizations, the inability to inspect AutoCAD's compiled script formats (FAS and VLX) has become a consequential security blind spot: every publicly available analysis tool fails on them, while threat actors have repeatedly used them to weaponize shared drawing files in documented industrial espionage campaigns. Today, when a security analyst encounters a suspicious FAS or VLX file, the manual practice is either to upload it to a cloud service (often prohibited by confidentiality policies), to attempt ad hoc byte-level inspection (ineffective due to per-file encryption), or to simply skip the file. This paper reports on CADscanner, a tool that automates the analysis of compiled AutoCAD scripts by recovering their behavioral content locally, without requiring AutoCAD installation, cloud submission, or manual reverse engineering. We describe the engineering of a recovery pipeline that handles two proprietary formats: the FAS4 binary, which is protected by rolling-XOR encryption, and the VLX (VRTLIB-1) archive container. The pipeline lifts both into a normalized intermediate representation suitable for automated rule matching and analyst review. On a 201-script consistency benchmark, behavioral API recovery reaches 79.3% recall at 97.8% precision, with security-critical indicators (persistence, network, propagation) preserved at 85--94%. A rule-based detector over the recovered surface achieves 95.8% TPR at 2.2% FPR on a family-disjoint held-out set, processing files in under 15,ms each. We report deployment experience integrating CADscanner into a security vendor's OT analysis workflow, discuss the engineering trade-offs encountered, and distill lessons learned for practitioners building format-recovery tooling in industrial contexts. Article Search Article: ase26ind-p134-p doi:10.1145/3832783.3834495
	Liu, Zihan	ASE '26: "AlphaCu: A Transformation-Driven ..." AlphaCu: A Transformation-Driven Synthesis Framework for LLM-Based GPU Kernel Generation Yangjie Zhou, Xing Ma, Zihan Liu, Qing Wang, Weihao Cui, Wu Sun, Hanjing Wang, Binhang Qi, Jingwen Leng, Yun Lin, Minyi Guo, and Jin Song Dong (National University of Singapore, Singapore; Shanghai Jiao Tong University, China; Shanghai Qi Zhi Institute, China; Nanjing University, China; Harvard University, USA) Large language models show promise for code generation, yet their effectiveness in producing high-performance GPU kernels remains insufficiently understood. Recent agentic workflows improve over direct prompting through specialized generation roles and execution feedback, but our characterization of a representative workflow reveals failures in optimization-strategy selection, hardware-specific instruction realization, and shape-dependent parameter selection. We present AlphaCu, a transformation-driven synthesis framework for LLM-based GPU kernel generation. AlphaCu treats kernel generation as structured synthesis over explicit optimization decisions rather than end-to-end code emission. Specifically, AlphaCu represents these decisions as scoped transformation passes maintained across agent-coordinated synthesis stages, enabling compatibility checking and failure attribution. AlphaCu binds selected hardware-sensitive operations to pre-validated microkernels and uses target-device measurements to revise transformation choices and tune runtime configurations. We evaluate AlphaCu on 104 test cases covering single and fused operators across four GPU architectures: NVIDIA H100, A100, V100, and AMD MI210. Under comparable generation budgets, AlphaCu achieves 100% functional correctness on our benchmark suite and delivers an average speedup of 5.64× over prior LLM workflows, while remaining competitive with vendor libraries and tensor compilers. Article Search Article: ase26main-p287-p doi:10.1145/3832783.3837433
	Lo, David	ASE '26: "Beyond Text Matching: Towards ..." Beyond Text Matching: Towards Reference-Free Evaluation for Human-Oriented Binary Reverse Engineering Xiuwei Shang, Li Hu, Xiao Jiang, Jieke Shi, Junda He, Zhou Yang, Shaoyin Cheng, Guoqiang Chen, Weiming Zhang, and David Lo (University of Science and Technology of China, China; Singapore Management University, Singapore; University of Alberta, Canada) Human-Oriented Binary Reverse Engineering (HOBRE) aims to transform decompiled pseudocode into a more human-friendly representation, thereby reducing the cognitive burden of reverse analysis and improving efficiency. However, reliably evaluating HOBRE outputs remains a fundamental challenge. On one hand, human evaluation is costly, time-consuming, as well as difficult to scale. On the other hand, existing automated metrics either rely on executable test cases and runtime environments, which are often unavailable for real-world binaries, or depend on high-quality source code references that are typically inaccessible and fail to capture semantically equivalent but lexically diverse outputs. Although the emerging LLM-as-a-Judge paradigm is naturally well-suited to HOBRE evaluation, its effectiveness has not yet been fully studied. This paper presents the first systematic investigation of the LLM-as-a-Judge paradigm for HOBRE, covering three representative tasks: function name recovery, binary code summarization, and decompilation optimization. We introduce BinJudgeBench, the first expert-annotated, reference-free evaluation benchmark based on multi-dimensional human judgment. Our empirical study reveals that LLM-as-a-Judge achieves an average correlation of 63.20% with human judgment, significantly outperforming traditional automated metrics at 35.04%. By analyzing the impact of various judge configurations, including backbone LLMs, prompting strategies, and decoding temperatures, on both correlation and cost, we find that no “one-size-fits-all” configuration exists, as the optimal setup varies across tasks and individual samples. To address this, we propose BinJudge, which employs a lightweight routing mechanism to adaptively select the optimal judge configuration for each specific task and sample. BinJudge improves correlation with human experts by 4.5%–24.7% and reduces API cost to 0.06×–0.84× of that of static best configurations, providing a scalable, cost-effective, and high-fidelity automated evaluation scheme for HOBRE. Article Search Article: ase26main-p130-p doi:10.1145/3832783.3834339 ASE '26: "AgentChaos: Chaos Engineering ..." AgentChaos: Chaos Engineering for Agent Systems via Programmatic Fault Injection Gou Tan, Zhensu Sun, Jieke Shi, Ting Zhang, Zilong He, Qingfu Wu, Shuai Liang, Weifeng Sun, Junda He, Pengfei Chen, Chuanfu Zhang, Lwin Khin Shar, and David Lo (Sun Yat-sen University, Guangzhou, China; Singapore Management University, Singapore; Monash University, Australia; China Unicom Software Research Institute, Beijing, China) Agent systems rely on LLM APIs for every response, but these APIs can return server errors, truncated responses, or corrupted content that propagates through downstream agents and causes task failure. Evaluating robustness under these faults is crucial for reliable deployment. Existing fault injection methods are offline, require source code modification, or cannot modify specific response fields. A comprehensive evaluation also requires a systematic fault taxonomy because different fault types affect downstream agents differently. We propose AgentChaos, a chaos engineering framework for controlled, runtime, non-intrusive LLM API fault injection. Since all agent systems access LLMs through the same HTTP interface, we inject faults at this shared layer without modifying source code. We define crash, omission, and value faults on content and tool call fields, intercept and modify LLM API responses at runtime, and verify whether each fault is triggered to filter untriggered tasks and avoid underestimating fault impact. Evaluations across agent systems, benchmarks, and backbone LLMs under 65 fault configurations show that all systems degrade under fault injection, with pass@1 dropping by up to 50 percentage points. The ranking is consistent across models, suggesting that robustness depends on system implementation rather than model capability. Existing fault diagnosis methods achieve below 53% accuracy on fault type and below 56% on fault step, leaving room for improvement. We further reveal practical findings for agent system developers. Article Search Artifacts Available Article: ase26main-p355-p doi:10.1145/3832783.3837437 ASE '26: "We Must Have Missed This Comment: ..." We Must Have Missed This Comment: Detecting and Repairing Stale Function References in Linux Kernel Comments Kexin Sun, Yunbo Lyu, Xutong Ma, Hongyu Kuang, Ratnadira Widyasari, He Zhang, Xiaoxing Ma, Julia Lawall, and David Lo (Nanjing University, China; Singapore Management University, Singapore; Inria, France) As the Linux kernel evolves, code comments may become outdated, as the functions they reference can be refactored or removed independently without corresponding updates to the comments. Such stale function references can mislead maintainers and thus hinder code comprehension. Prior work on detecting code-comment inconsistency mainly focused on addressing semantic misalignment between Javadoc comments and their directly annotated functions, making them inapplicable to this type of externally induced staleness in the Linux kernel. Therefore, we propose ReCite, a three-stage approach to identify and repair such stale references: (1) detecting unresolved function-form symbols—symbols in comments that appear to reference functions but for which no matching function can be found in the current codebase, (2) tracing the evolution history of each unresolved symbol through the Git history, and (3) generating LLM-based repair suggestions grounded in the evolution history and current code context. On Linux kernel v6.18-rc1, ReCite detects 869 stale references with generated repair suggestions. A manual evaluation on 200 sampled repairs shows that 178 (89.0%) provide useful repair guidance, with 85 (42.5%) directly applicable. Of our 75 submitted patches, 50 have been accepted. We also empirically study all unresolved function-form symbols. Article Search Article: ase26main-p908-p doi:10.1145/3832783.3837474 ASE '26: "Demystifying Solana Bots: ..." Demystifying Solana Bots: From GitHub Blueprints to On-Chain Fingerprints Xiaoye Zheng, Yujing Chen, Minghao Wu, David Lo, Difan Xie, Daoyuan Wu, Xiaohu Yang, and Zhiyuan Wan (Zhejiang University, China; Singapore Management University, Singapore; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China; Lingnan University, Hong Kong) Solana is an emerging blockchain platform designed for high throughput and low transaction fees, making it inexpensive to submit transactions at scale and, consequently, increasing exposure to bot spamming and related financial exploitation. Solana bots are typically off-chain software systems that operate in a competitive on-chain execution environment by constructing and submitting transactions, and the bot-related transactions on the decentralized exchanges exceed 250 million dollars in daily trading volume in January 2026. Prior studies on Solana have examined system performance, smart-contract security, and specific on-chain phenomena. However, we still lack a systematic understanding of what Solana bots implement in practice and how these implementations manifest as observable on-chain execution fingerprints. To address this gap, we performed a large-scale empirical study of Solana bots from two complementary views: (i) 586 bot repositories collected from GitHub, and (ii) 200 bot addresses on Solana, with over 44 million on-chain transactions. Our study derives an implementation-grounded taxonomy of Solana bots comprising 15 categories grouped into five domains (e.g., Trading Operations, MEV, and On-chain Analytics), identifies a largely shared five-stage operational pipeline manifested in bot implementations, and uncovers systematic variation in on-chain trading behaviors of Solana bots across diverse trading platforms and assets. Based on our findings, we highlight future research directions, and provide recommendations for building and operating bots on the Solana blockchain. Article Search Article: ase26main-p2100-p doi:10.1145/3832783.3837522 ASE '26: "AgentExecutor: Partial Code ..." AgentExecutor: Partial Code Execution via Agentic Context Generation Junkai Chen, Chengran Yang, Xing Hu, Zhenhao Li, Xin Xia, and David Lo (Singapore Management University, Singapore; Zhejiang University, China; York University, Canada) Executing code snippets is essential for dynamic program analysis, but it remains challenging to execute an arbitrary code snippet due to issues like missing context and incomplete dependencies. Existing approaches to partial code execution, such as LExecutor and Treefix, leverage the power of language models to infer missing information and enable execution. However, they suffer from (i) limited action spaces and feedback, and (ii) rigid optimization strategies, which restrict their effectiveness and efficiency. In this paper, we propose AgentExecutor, a novel multi-agent framework for partial code execution. Our approach introduces a three-phase design: execution environment preparation, dynamic exploration with iterative refinement, and prefix evolution via program synthesis. Supported by the power of LLM agents who can think, act, and get feedback iteratively, AgentExecutor is able to autonomously explore a richer action space, enabling diverse operations such as creating resource files and resolving environment configuration. Furthermore, it adopts adaptive optimization strategies, including coverage-guided context pruning and prefix evolution via program synthesis, to systematically improve the execution quality of partial code. We evaluate AgentExecutor on two widely used datasets comprising Stack Overflow snippets and open-source project code. The results show that AgentExecutor achieves up to 94% and 90% code coverage, outperforming the state-of-the-art approach Treefix by 19.9% and 13.8%, respectively. In addition, AgentExecutor significantly reduces execution time (by up to 80.3%) and cost (by up to 56.6%). These findings demonstrate that AgentExecutor provides an effective and efficient solution for partial code execution. Article Search Article: ase26main-p477-p doi:10.1145/3832783.3834355 ASE '26: "Multi-level Code Optimization ..." Multi-level Code Optimization via Mixture of Prompts Yun Peng, Jun Wan, Jiakun Liu, Shuzheng Gao, David Lo, and Xiaoxue Ren (Fudan University, China; Zhejiang University, China; Harbin Institute of Technology, China; Chinese University of Hong Kong, Hong Kong; Singapore Management University, Singapore; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China) Runtime efficiency is a critical factor that impacts both software quality and user satisfaction. There are many approaches proposed for code optimization to improve runtime efficiency. Traditional code optimization methods operate on intermediate representations (IRs) during compilation for static languages. They are effective but struggle to handle dynamic languages that do not require compilation. Recently, large language models (LLMs) have been leveraged to directly optimize source code in dynamic languages. However, these methods fail to identify suitable optimization targets and usually conduct incomprehensive single-level optimization. To address these challenges, we propose Optimo, a multi-level LLM-based code optimization approach built on a novel Mixture-of-Prompts (MoP) architecture. In the MoP architecture, Optimo identifies time-critical code structures as performance bottlenecks via differential profiling. These structures are then routed to some optimization strategies, akin to expert models in MoE, each tailored to optimize specific code patterns. Unlike traditional approaches that focus only on statement-level optimizations, Optimo operates at four levels of abstraction, ranging from coarse-grained algorithmic improvements to fine-grained optimizations in API usage. We evaluate Optimo on two code efficiency benchmarks, COFFE and Effibench. Our results demonstrate that Optimo achieves an up to 57.48% opt%, i.e., the percentage of optimized programs that are correct and at least 10% faster than the original programs, and an up to 3.97x speedup when optimizing human-written code, and it consistently outperforms the best baseline by up to 96.51% in terms of opt%. Furthermore, Optimo achieves an up to 42.42% opt% and an up to 13.51x speedup when optimizing LLM-generated code. Article Search Article: ase26main-p874-p doi:10.1145/3832783.3834369 ASE '26: "How Reasoning Shapes Social ..." How Reasoning Shapes Social Bias in LLM-Generated Code? Weifeng Sun, Jieke Shi, Zhou Yang, Yuchen Chen, Hongyan Li, Meng Yan, and David Lo (Singapore Management University, Singapore; University of Alberta, Canada; Alberta Machine Intelligence Institute, Canada; Nanjing University, China; Chongqing University, China) Large language models (LLMs) are increasingly used for code generation, but recent studies have shown that generated programs can exhibit code bias, i.e., unfair or differential treatment encoded in code logic with respect to sensitive demographic attributes. Although prior work has investigated this problem in a direct generation setting, it remains unclear how bias behaves in reasoning-based code generation, where models produce intermediate reasoning traces before generating the final code. To bridge this gap, we conduct the first systematic empirical study of social bias in reasoning-based code generation. We evaluate 9 models spanning both standard LLMs and large reasoning models (LRMs) on realistic bias-sensitive coding tasks covering three human-centered decision scenarios. Our results reveal four main findings. First, reasoning generally reduces code bias, lowering the average bias rate from 0.64 to 0.40, but the improvement is highly model-dependent. Second, reasoning-based generation does not consistently preserve code quality, with the average quality dropping from 0.72 to 0.59. We further find that biased reasoning strongly predicts biased code, and that simply adjusting generation configurations is insufficient for robust bias mitigation. Motivated by these findings, we propose ProbeDebias, a reasoning-aware debiasing framework that detects biased reasoning traces and rewrites them before final code generation. Extensive experiments demonstrate that ProbeDebias achieves 87.76 Article Search Article: ase26main-p1394-p doi:10.1145/3832783.3834387
	Long, Teng	ASE '26: "Localizing Data Annotation ..." Localizing Data Annotation Faults in Semantic Segmentation Systems Pengyi Yang, Teng Long, Zhiwu Xu, and Linhai Jing (China University of Geosciences (Beijing), China; Shenzhen University, China) Data annotation fault localization is a critical software quality assurance task in deep learning pipelines, as annotation faults can severely compromise model reliability and system dependability in safety-critical applications. Semantic segmentation requires assigning a class label to every pixel in the image, making it one of the most fault-prone annotation tasks, with faults ranging from incorrect class labels to imprecise boundaries. However, existing annotation fault localization methods target simpler annotation types such as classification and object detection, and rely on models trained on potentially noisy data, making them inadequate for dense annotations such as semantic segmentation. We adapt spectrum-based fault localization from program elements to annotation components in semantic segmentation, and propose SegFaultLoc, an annotation fault localization framework that identifies and ranks faulty annotation components by suspiciousness without segmentation model training. SegFaultLoc decomposes annotation masks into connected components and extracts noise-independent features from frozen pretrained encoders to construct dual fault spectra: a semantic spectrum for classification and missing faults, and a geometric spectrum for localization and fragmentation faults. Learning-based suspiciousness aggregation integrates these signals into unified suspiciousness scores for prioritized inspection. Systematic experiments on three benchmarks against seven data-quality baselines demonstrate that SegFaultLoc achieves up to 9.2% improvement in APFD, 21.9% in Precision@10%, and 22.4% in nDCG@10% over the best baseline. Validation on naturally occurring annotation faults in the real-world COCO-Stuff dataset further confirms that correcting detected faults consistently improves segmentation performance. Article Search Article: ase26main-p227-p doi:10.1145/3832783.3837428
	Longfils, Gerry	ASE '26: "UltraInstinctVR: A Model-Based ..." UltraInstinctVR: A Model-Based Tool for Automated System Testing of VR Applications Gerry Longfils, Maxime Cauz, Arnaud Blouin, and Xavier Devroey (University of Namur, Belgium; INSA Rennes, France) Virtual Reality (VR) applications are increasingly used in domains such as surgical training and industrial marketing, yet their longterm adoption remains limited by the lack of effective, systematic, and reproducible testing approaches tailored to VR. To address this gap, we present UltraInstinctVR, a novel tool that automates the generation and execution of concrete system-level tests for VR applications, helping developers efficiently validate interactions and behaviors. We evaluated UltraInstinctVR against state-of-the-art automated VR testing tools across 10 open-source VR applications, where it outperformed existing approaches in detecting unique failures and uncovering real-world bugs. In this paper, we further extended this evaluation through an empirical user study with ten VR developers. Results highlight strong dependability and efficiency while identifying opportunities for improvement in other user experience dimensions. Overall, these findings position UltraInstinctVR as a promising step toward more practical, effective, and scalable VR testing. The tool is publicly available at https://github.com/snailunamur/UltraInstinctVR, with a demonstration video available at https://youtu.be/U8DWTmXmeh4. Article Search Article: ase26tool-p141-p doi:10.1145/3832783.3834642
	Loose, Nils	ASE '26: "A Comprehensive Evaluation ..." A Comprehensive Evaluation of Code Language Models for Security Patch Detection Nils Loose, Joseph Bienhüls, Kristoffer Hempel, Felix Mächtle, and Thomas Eisenbarth (University of Lübeck, Germany) Automated detection of vulnerability-fixing commits (VFCs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and many fixes never receive advisories. Code language models are increasingly adopted for identifying , yet whether they can recognize a security fix from the code change itself remains unclear, as reported performance is shaped by commit messages, project-level data leakage, and uncertain data quality. We present a rigorous re-evaluation that jointly controls these factors through a unified framework consolidating 20 fragmented datasets spanning more than 180000 commits. Training 270 models from 125M to 80B parameters, we isolate the code signal under group-stratified code-only evaluation and assess the impact of model capacity and additional code context, ranging from intra-procedural enrichment to inter-procedural repository context. Model capacity yields clear but insufficient gains, and the evaluated context signals provide no reliable improvement under strict false positive budgets. At a false positive rate of 0.5 Article Search Article: ase26main-p2677-p doi:10.1145/3832783.3837538
	Lops, Andrea	ASE '26: "Doc2Test: An Industrial Multi-agent ..." Doc2Test: An Industrial Multi-agent Framework for Document-Driven End-to-End Selenium Test Generation Andrea Lops, Antonio Ferrara, Fedelucio Narducci, Azzurra Ragone, and Michelantonio Trizio (Polytechnic University of Bari, Italy; Wideverse, Italy; University of Bari, Italy) End-to-end (E2E) testing is a persistent industrial bottleneck: Selenium, a widely used open-source framework for automating web browsers via scripted interactions that emulate user behaviour, relies on brittle scripts, while off-the-shelf Large Language Models (LLMs) hallucinate selectors and saturate the context window when asked to synthesise complete user journeys over production DOMs. We present Doc2Test, a Multi-Agent System (MAS) deployed inside Wideverse (a software engineering and digital transformation ICT company) that translates unstructured requirement documents into executable Selenium suites through three specialised phases: requirements analysis, dynamic DOM/visual context perception, and adaptive code generation with a self-healing loop. Across 90 independent runs on a production Angular cruise-booking platform (~145k LoC, under NDA), four open-sourced internal Wideverse applications, and one independently-developed external application (RealWorld), Doc2Test achieves a 94.4% generation success rate (95% CI: [87.5%, 98.2%]), detects 98.9% of 180 injected UI regressions, and reduces token usage by 86% against a zero-shot single-prompt baseline. Over three months of nightly Jenkins operation, it reduced maintenance effort by ~2.6 person-days / sprint and the flaky-test rate from 11.4% to 4.6%. We further report cost breakdowns and deployment lessons from integrating Doc2Test into our industrial partner's CI/CD pipeline. Article Search Article: ase26ind-p201-p doi:10.1145/3832783.3834507
	Lozi, Jean-Pierre	ASE '26: "Generating Loop Invariants ..." Generating Loop Invariants for Deductive Verification using Iterator Profiles Keisuke Nishimura, Jean-Pierre Lozi, and Julia Lawall (Inria, France) Recent advances in deductive verification have gradually made it practical to verify the functional correctness of real-world software. However, creating loop invariants still requires manual effort. We propose to reduce this burden by automatically generating invariants. In the context of generating invariants for real-world software, the key requirements are to support diverse index iteration patterns and to capture precise information about loop behaviors. In this paper, we introduce the idea of an iterator profile: a loop-invariant template for an iteration pattern. Once a user writes a profile, it can be reused for any iterator-based loop that shares the same iteration pattern. We present LoopAnnotator, a tool that generates loop invariants for iterator-based loops by combining an iterator profile with the result of automatic program analysis of the loop body. LoopAnnotator successfully generates invariants for more than 70 Article Search Article: ase26main-p2432-p doi:10.1145/3832783.3837530
	Lu, Hanqing	ASE '26: "From Vibe to Spec: An Empirical ..." From Vibe to Spec: An Empirical Study to Demystify Specifications in Code Generation Ruirui He, Hanqing Lu, Lezhi Ma, Kai Ye, Qiong Wu, Shangqing Liu, Lei Bu, and Xuandong Li (Nanjing University, China) Recent advances in large language models (LLMs) for code generation have given rise to vibe coding, a programming practice in which developers interact with LLMs through unstructured natural language and primarily validate implementations by inspecting overall execution outputs. However, the inherent ambiguity and inconsistency of natural language present substantial challenges for generating complex and large-scale software systems. To mitigate these limitations, an emerging AI programming paradigm—specification-driven development—advocates providing LLMs with precise and consistent specifications to guide code generation. Despite its promise, fundamental questions regarding the appropriate forms of specifications and the granularity at which they should be supplied to LLMs remain largely unexplored. To address this gap, we present the first empirical study that systematically investigates the impact of two orthogonal dimensions of specifications—form and granularity—on the effectiveness of LLM-based code generation. We construct a dataset comprising five medium-sized software projects, ranging from several hundred to over one thousand lines of code, implemented in multiple programming languages and spanning diverse application domains (e.g., system utilities and games). For each project, we design specifications in three forms—natural language, coarse-grained pseudocode, and fine-grained pseudocode—to capture the form dimension. To examine granularity, we further decompose the fine-grained pseudocode into four levels of input granularity: line-level, function-level, module-level, and project-level. Using this dataset, we evaluate code generated by three representative models, GPT-5, DeepSeek-V3.1, and Qwen-3.7. Evaluation is conducted using a comprehensive set of metrics, including text-similarity-based metrics (e.g., BLEU-4 and CodeBLEU), test-based metrics (e.g., accuracy), and human-centered metrics (e.g., usability and logical consistency). Our results demonstrate that using fine-grained, structured pseudocode specifications significantly enhances generation stability and quality. Regarding granularity, while coarser-grained specifications (project and module level) generally achieve higher code quality, organizing specifications at the module level provides the best overall balance between quality, stability, and token efficiency. Moreover, additional analyses indicate that this module-level granularity yields the most user-friendly outcome for human developers. Article Search Article: ase26main-p1876-p doi:10.1145/3832783.3837515
	Lu, Haochuan	ASE '26: "Model-Guided Property-Based ..." Model-Guided Property-Based Testing of WeChat Pay at Billion-User Scale Xiangchen Shen, Yiting Wang, Ting Su, Jingjing Liang, Jingling Sun, Xixian Liang, Haiying Sun, Xinjie Xu, Haochuan Lu, Yuetang Deng, Pengcheng Wang, Geguang Pu, Zhendong Su, and John Hughes (East China Normal University, China; University of Electronic Science and Technology of China, China; Tencent, China; ETH Zurich, Switzerland; Chalmers University of Technology, Sweden) Ensuring the correctness of mobile payment applications is critical, as even subtle faults can lead to severe financial losses. To ensure reliability, the WeChat Pay (a popular payment app with over one billion active users worldwide) team developed a User Acceptance Testing (UAT) system based on model-based testing (MBT). It maintains use cases specifying user operation sequences and expected app behaviors under business rules. UAT converts these use cases into formal models and generates test cases to validate the app. Although UAT achieves 100% state coverage by covering all user operations and business rules, it still suffers from two major limitations: insufficient test coverage and predefined test oracles. In this paper, we introduce a model-guided property-based testing approach to improving the existing UAT system. We have two key observations: (1) UAT test cases can effectively reach all app states; and (2) WeChat Pay exhibits some invariant behaviors, which can be used to synthesize generic properties for bug finding. Building on these observations, our approach performs random exploration from UAT-discovered states, and validates app behaviors against the automatically synthesized properties. We also propose a greedy trace shrinking algorithm to reduce failure-inducing traces. We implemented our approach as UAT++, an advanced testing tool built upon the UAT system. Across 20,000 machine hours, UAT++ found 59 previously unknown bugs, including 48 logic bugs and 11 crash bugs (55 confirmed, 45 fixed). These bugs could not be found by the UAT system and classic property-base testing (PBT). UAT++ improved state transition coverage by 82.6% and 600.0% over the UAT system and classic PBT, respectively. The shrinking algorithm attained an average trace reduction rate of 79.9%. To date, UAT++ has been deployed in the continuous testing pipeline of WeChat Pay across Android, iOS, and HarmonyOS platforms. Article Search Article: ase26ind-p569-p doi:10.1145/3832783.3834537
	Lu, Jie	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Lu, Juncheng	ASE '26: "Are Reasoning Traces Faithful ..." Are Reasoning Traces Faithful in LLM-Based Code Vulnerability Detection? Jialai Wang, Juncheng Lu, Songtao Yang, Bingyi He, Zeyu Gao, Chao Zhang, and Shuai Wang (National University of Singapore, Singapore; Tsinghua University, China; Zhongguancun Laboratory, China; Huazhong University of Science and Technology, China; Hong Kong University of Science and Technology, Hong Kong) Reasoning traces generated by large language models (LLMs) provide interpretability by exposing the factors that purportedly support their predictions. Such interpretability is important because model decisions may rely on spurious factors, and it can help practitioners identify such reliance and respond appropriately. However, the usefulness of reasoning traces hinges on their faithfulness, namely whether they reflect the factors that the model actually relies on when producing its prediction. Unfaithful traces may instead serve as plausible narratives that do not correspond to the true decision process. Despite its importance, reasoning-trace faithfulness has not been systematically studied in LLM-based vulnerability detection. We present VulFaith, the first framework for evaluating reasoning-trace faithfulness in this domain. We formalize two complementary criteria: completeness, which requires that all decision-relevant factors sustaining an insecure prediction are exposed, and per-factor faithfulness, which requires that each cited factor is genuinely relied upon by the model. To operationalize these criteria, we design an automated repair-based evaluation scheme that removes cited insecurity factors through code repairs and re-queries the model to test whether the prediction remains sustained. We implement VulFaith and conduct experiments on both repository-level and function-level vulnerability datasets, evaluating ten state-of-the-art open-source models and four commercial LLMs. Our results show that unfaithfulness is widespread, with completeness unfaithfulness reaching up to 66.14% and per-factor unfaithfulness up to 94.00%. We further validate that the unfaithfulness cases identified by VulFaith can support data augmentation for supervised fine-tuning, reducing completeness unfaithfulness by up to 47.89% and per-factor unfaithfulness by up to 59.18%. Article Search Article: ase26main-p776-p doi:10.1145/3832783.3834364
	Lu, Junyi	ASE '26: "ATLAS: Agentic Taxonomy of ..." ATLAS: Agentic Taxonomy of LArge-Scale Software Ecosystems Junyi Lu, Mengyao Lyu, Jiahui Wu, Lei Yu, Chengwei Liu, Fengjun Zhang, Li Yang, Chun Zuo, and Yang Liu (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Nankai University, China; Sinosoft, China) The open-source ecosystem on GitHub lacks a systematic hierarchical taxonomy of software repositories. GitHub Topics, the dominant organizational mechanism, is flat, inconsistent, and covers only 67% of repositories. We present ATLAS, the first framework that automatically constructs a hierarchical taxonomy for software repositories and classifies repositories into it end-to-end. By combining LLM global knowledge with real repository distributions, ATLAS proposes meaningful splitting dimensions and iteratively corrects those that fail to accommodate real repositories. A Designer Agent proposes splitting dimensions while a Classifier Agent assigns repositories; a self-corrective refinement loop uses classification failures to drive dimension revision through escalating strategies. We evaluate ATLAS on 54,387 GitHub repositories against six baselines spanning four paradigm families, two downstream software engineering tasks, and three model families. On a stratified 2,001-repository benchmark, ATLAS achieves a Taxonomy Quality F-score (TQF) of 83.13%, outperforming the best baseline by 15 percentage points (on the full 54k corpus the approximate TQF is 73.0%, a gap driven by Path Granularity's all-or-nothing scoring on longer paths rather than lower classification accuracy; see Section 4.5). It is the only method to simultaneously achieve high structural quality and high practical applicability. On downstream tasks, the ATLAS taxonomy enables software alternative discovery with P@1 = 85.71%, surpassing even human-curated lists (62.34%), and achieves the highest P@1 for repository retrieval. The taxonomy further reveals structural ecosystem trends that are difficult to obtain from flat tags or similarity methods: the shift from libraries to AI/ML applications (now 61% of newly community-adopted projects) becomes visible only through hierarchical, type-based categorization. An interactive taxonomy explorer is available at https://atlas-taxonomy.netlify.app/. Article Search Artifacts Available Article: ase26main-p622-p doi:10.1145/3832783.3834361
	Lu, Minghai	ASE '26: "Adaptive Proof Refinement ..." Adaptive Proof Refinement with LLM-Guided Strategy Selection Minghai Lu, Zhe Zhou, Danning Xie, Songlin Jia, Benjamin Delaware, and Tianyi Zhang (Purdue University, USA; Meta, USA) Formal verification via theorem proving enables rigorous proofs of software correctness, but it is difficult to scale due to the significant manual effort and expertise required. While Large Language Models (LLMs) have shown potential in automating proof generation, they frequently produce incorrect proofs on the first attempt that require iterative refinement to fix. However, most existing approaches employ fixed refinement strategies and cannot dynamically choose an effective strategy, which limits their performance. To overcome this limitation, we introduce Adapt, a novel proof refinement framework that leverages an LLM-guided decision-maker to dynamically select a suitable refinement strategy according to the state of the proof assistant and available context of an incorrect proof. We evaluate Adapt on two benchmark suites against five existing methods and find that it significantly outperforms the best baseline on both by proving 11.26% and 18.58% more theorems, respectively. Furthermore, we demonstrate Adapt’s generalizability by evaluating it across six different LLMs. We also conduct ablation studies to measure the contribution of each component and compare the trade-offs of alternative decision-maker designs. Article Search Article: ase26main-p1291-p doi:10.1145/3832783.3834382
	Lu, Shuai	ASE '26: "Synthesizing File-Level Data ..." Synthesizing File-Level Data for Unit Test Generation with Chain-of-Thoughts via Self-Debugging Ziyue Hua, Tianyu Chen, Yeyun Gong, Shuai Lu, Peng Cheng, Qinglin Zhu, Yibo He, Yingjie Fu, Wenpin Jiao, Wei Yang, and Tao Xie (Peking University, China; Microsoft Research, China; King's College London, UK; Fudan University, China) Automatic unit test (UT) generation is essential for software quality assurance, but existing approaches—including symbolic execution, search-based testing, and recent LLM-based generators—struggle to produce human-quality tests with correct, meaningful assertions and reliable chain-of-thought (CoT) explanations. We identify a gap in UT training data: repository-mined tests lack developer CoTs, while LLM-distilled CoTs are often incorrect or incomplete. To address this issue, we propose a novel data-distillation approach that uses self-debugging to produce high-quality UT training examples paired with faithful CoTs. Our approach combines (1) guided test repair, a heuristic loop (error-, failure-, coverage-, and mutation-focused steps) that prompts the same model to diagnose and iteratively fix generated tests, and (2) CoT compression, which compacts original and debugging CoTs into concise explanations that directly justify correct tests. We apply this pipeline to a large corpus of open-source projects to construct a dataset of 74,518 high-quality <focal method, test, CoT> examples, and then use it for supervised fine-tuning of a base model. An empirical evaluation shows that the fine-tuned model achieves high UT generation effectiveness: it attains a pass rate of 36.17% on test assertions, a branch coverage of 43.90%, and a mutation score of 88.66%, substantially higher than those of state-of-the-art commercial models such as o4-mini. Article Search Article: ase26main-p1002-p doi:10.1145/3832783.3837477
	Lu, Wei	ASE '26: "DBRepro: Automated Database ..." DBRepro: Automated Database Synthesis via a Hybrid Constraint-Solving Approach for Reproducing Slow Queries Zhaoyang Zhang, Shuang Liu, Dengfeng Xu, Wei Lu, Jianquan Leng, Sheng Du, and Xiaoyong Du (Renmin University of China, China; China Electronics Technology Kingbase (Beijing) Technologies, China) Slow queries frequently cause severe performance bottlenecks in Database Management Systems (DBMSs). Due to the severe risk of exacerbating online resource contention, diagnosing their root causes online is usually infeasible; offline diagnosis has thus become the de facto approach. However, strict data privacy regulations prohibit accessing original user data. Therefore, synthesizing a proxy database, one that induces the query optimizer to generate identical physical execution plans as in production, from non-intrusive metadata, is critical for reproducing and diagnosing slow queries offline. Achieving high-fidelity reproduction demands satisfying both global statistical distributions and exact local cardinality constraints. Existing works fundamentally fail to achieve both simultaneously: data-driven approaches cannot enforce strict local cardinalities, whereas workload-aware approaches severely distort the overall data distribution, misleading the optimizer into divergent execution plans. To bridge this gap, we introduce DBRepro, an automated end-to-end database synthesis framework that synergistically integrates data-driven and workload-aware methodologies. DBRepro formulates database generation as a constrained distribution synthesis problem. It initializes a global data distribution from lightweight column statistics, extracts execution constraints from the target queries, and progressively adjusts the distribution to satisfy these constraints, ensuring the global distribution is maximally preserved while exact local cardinalities are strictly enforced. Extensive evaluations on the TPC-H and SSB benchmarks demonstrate that DBRepro outperforms state-of-the-art baselines across comprehensive fidelity metrics. Compared to the data-driven baseline, it reduces cardinality error by up to 20.3% while maintaining identical plan consistency. Against a workload-aware baseline, it reproduces 15% more consistent execution plans and lowers the latency proportion error by 21.5%. Furthermore, we validate its industrial practicality on a nearly 1 TB real-world dataset from a specific industrial sector, managed by KingbaseES, successfully reproducing the execution performance of complex slow queries with high fidelity. Article Search Article: ase26ind-p50-p doi:10.1145/3832783.3834463
	Lu, Weirao	ASE '26: "A Longitudinal Study of Android ..." A Longitudinal Study of Android Apps Signing Key Protection Mark Huasong Meng, Qing Zhang, Weirao Lu, and Chunyang Chen (University College Dublin, Ireland; JD Group, China; TU Munich, Germany) Android app signing relies on developer-managed credentials, making secure key protection essential for the integrity of the software supply chain. A recent platform key leakage incident involving two major OEM manufacturers demonstrates that even robustly designed signing mechanisms can be compromised due to developers' oversight. In this work, we conduct a longitudinal ecosystem study to characterize this threat by mining public repositories for Android signing credentials, recovering compromised keys via exposed passwords, and matching them against signatures from over 4,000 apps collected from major stores and OEM system images. Our analysis identifies 5,673 compromised keystores on GitHub and 26 unique certificates linked to 278 real-world apps. These include 26 third-party apps in public app stores and 252 preinstalled apps from seven manufacturers, collectively affecting over 10 billion users. We demonstrate the practical exploitability of these leaks through a proof-of-concept app replacement attack and identify spillover risks in non-smartphone platforms, including a popular automotive head-unit platform installed in over 1,100 vehicle models. Our results reveal that signing-key mismanagement is a systemic risk, underscoring the need for more rigorous key-management support in Android release engineering and distribution infrastructures. Article Search Article: ase26main-p3058-p doi:10.1145/3832783.3834428
	Lu, Xu	ASE '26: "DafnyRAG: A Retrieval-Augmented ..." DafnyRAG: A Retrieval-Augmented and Verification-Driven Tool for Automated Repair of Dafny Code Yanzhen Liu, Xu Lu, Bin Yu, Haoxiang Zhang, Chu Chen, and Meng Wang (Xidian University, China; Qufu Normal University, China; Hebei University, China) Dafny is a verification-aware language whose adoption is hindered by the heavy manual effort of writing formal specifications and proof artefacts—a critical bottleneck for safety-critical software development. While Large Language Models (LLMs) can synthesise Dafny code, they routinely hallucinate domain-specific constructs and stagnate in repetitive generate–verify–fail cycles, because Dafny is severely under-represented in pre-training corpora. We present DafnyRAG, an open-source tool that turns any general-purpose LLM into a verification-aware Dafny repair agent. DafnyRAG ships with (i) a heterogeneous Dafny knowledge base—a static Syntax Rule Library, a static Error Theory Library, and a dynamic Repair Case Library; (ii) an error-aware retrieval router that selects the appropriate library based on the verifier diagnostic; and (iii) a verification-driven iterative repair loop that backfills every successful repair into the case library, growing the tool’s expertise over time. Across three production LLM backends (GPT-4, DeepSeek-V3, Claude-4.5-Sonnet) on the MBPP-DFY-178 benchmark, DafnyRAG consistently outperforms a strong few-shot baseline on verify@5, peaking at 83.71% with Claude-4.5-Sonnet. The tool source code, knowledge base, and evaluation scripts are available at https://doi.org/10.5281/zenodo.21372059. A screencast demo is available at https://youtu.be/s-QBaGj8tK8. Article Search Artifacts Available Article: ase26tool-p44-p doi:10.1145/3832783.3834610
	Lu, Yanzhou	ASE '26: "Finding Typing-Related Bugs ..." Finding Typing-Related Bugs in JVM Implementations Yanzhou Lu, Junjie Chen, Yingquan Zhao, Tianchang Gao, and Zan Wang (Tianjin University, China) As an object-oriented language, Java relies heavily on its type system. Existing testing efforts mainly target type-related implementations in the Java compiler, while the substantially different type-related implementations in the Java Virtual Machine (JVM) remain insufficiently tested. Although many techniques have been proposed for direct JVM testing, they mostly focus on specific components such as the JIT compiler or garbage collector, leaving type-related implementations underexplored. In this paper, we present Caster, the first technique for testing JVM type-related implementations by directly generating bytecode test programs guided by type specifications in the Java Language Specification (JLS). Specifically, Caster designs a set of feature primitives to encapsulate the operations needed for type-related testing, and leverages a Large Language Model (LLM) to identify type-related test scenarios from the JLS and guide primitive composition. Based on these scenarios, Caster organizes the selected primitive combinations into a multi-unit test-program generator, whose Cartesian-product expansion produces a large number of concrete test programs. To support large-scale execution, Caster dynamically loads these generated programs from memory and invokes them via reflection across different JVM implementations, collects their result lists, and compares them to identify inconsistencies and detect potential JVM bugs. Extensive experiments on four Long-Term Support OpenJDK versions of three popular JVM implementations (i.e., HotSpot, OpenJ9, and Dragonwell) demonstrate that Caster outperforms the state-of-the-art techniques in detecting more JVM inconsistencies. Moreover, Caster has uncovered a total of 21 previously unknown defects in the latest JVM releases, among which 18 have been confirmed or fixed by developers. Article Search Article: ase26main-p1588-p doi:10.1145/3832783.3834396
	Lu, Yao	ASE '26: "BDiff: Block-Aware and Accurate ..." BDiff: Block-Aware and Accurate Text-Based Code Differencing Yao Lu, Wanwei Liu, Tanghaoran Zhang, Kang Yang, Yang Zhang, Wenyu Xu, Longfei Sun, Xinjun Mao, Shuzheng Gao, and Michael R. Lyu (National University of Defense Technology, China; Chinese University of Hong Kong, China) Code differencing is a fundamental technique in software engineering. Traditional line-level differencing tools (e.g., Git Myers algorithm) cannot accurately identify block-level edit actions (EAs) such as block move and copy, which are common in real development. They split multi-line block edits into fragmented line-wise changes, raising developers’ cognitive overhead during code review. This paper presents BDiff, a text-based differencing algorithm capable of identifying two types of block-level EAs and five types of line-level EAs. Building on traditional differencing algorithms, we first construct a candidate set containing all possible line and block mappings. Leveraging the Kuhn-Munkres algorithm, we then compute the optimal mapping set and derive a minimal edit script (ES) that closely aligns with the original developer intent. To evaluate BDiff, we selected five state-of-the-art tools, including large language models (LLMs), as baselines, and adopted a combined qualitative and quantitative approach to assess their performance in terms of ES size, result quality, and running time. Experimental results show that BDiff produces higher-quality differencing results than baseline tools while maintaining competitive runtime performance. Our experiments also show the unreliability of LLMs in code differencing tasks and their infeasibility in terms of runtime efficiency. Based on the proposed algorithm, we have implemented an open-sourced visual differencing tool. Article Search Artifacts Available Article: ase26main-p251-p doi:10.1145/3832783.3837431
	Lu, Yifei	ASE '26: "PL4SA: Optimized Partial Library ..." PL4SA: Optimized Partial Library Selection for Efficient Static Analysis Guohao Feng, Yifei Lu, and Minxue Pan (Nanjing University, China) With the rapid advancements in modern software engineering practices, software applications have become increasingly dependent on external libraries, making the choice between whole-program and application-only analysis more critical: the former often leads to timeouts due to high computational overhead, while the latter risks missing library-induced bugs. Recent research has explored a compromise path, i.e., partial inclusion of libraries to balance analysis efficiency and recall. However, achieving a more precise relevance analysis that enables a more balanced and accurate library selection while minimizing the associated overhead remains a significant challenge. This paper proposes PL4SA, a novel partial library selection approach that establishes precise relevance between client analyses and library methods using fine-grained whole-program points-to information. The key point of PL4SA lies in integrating points-to analysis with the partial library selection process in a progressively expanding manner. During this process, pointers are ranked according to their relevance to the client analysis; in each iteration, the most relevant pointer as well as its corresponding library is selected, while pointers dependent on the selected pointer are further expanded to reveal their points-to information. To support this analysis, extended pointers, a pointer-based abstraction that summarizes additional information flows into/out of method invocations and array accesses, serve as anchors for the progressive expansion of points-to information. Furthermore, PL4SA organizes this analysis in three steps, leveraging summarization techniques to enable the reuse of time-critical intra-procedural points-to analysis results within libraries across different projects, due to the inherent stability of library code. Collectively, these design choices contribute to PL4SA’s high efficiency. Our experimental results demonstrate that by including only 12% and 17% library methods, PL4SA achieves 24.6x, 9.0x speedup, and 99.0% recall, and both 100% precision for variable-type analysis and null-pointer analysis compared to whole-program analysis, significantly outperforming existing baselines. Article Search Article: ase26main-p3256-p doi:10.1145/3832783.3834431
	Luan, Jiaqi	ASE '26: "MERA: A Multi-expert LLM Framework ..." MERA: A Multi-expert LLM Framework for Severity Assessment of User Tickets in Mobile OS Beta Testing Yongqian Sun, Yimin Zuo, Qingliang Zhang, Bowen Hao, Wenwei Gu, Jiaqi Luan, Sixu Zhou, Shenglin Zhang, and Dan Pei (Nankai University, China; Tsinghua University, China) Large-scale mobile OS beta testing generates massive ticket vol- umes, creating a triage bottleneck in which assigning severity dic- tates engineering priority. Automating this is difficult: unlike server logs with rich telemetry, beta tickets rely on vague, symptom-driven user descriptions, which confound standard AIOps tools. Tradi- tional classifiers based on deep learning or pre-trained language models (PLMs) further struggle to adapt to the rapid concept drift triggered by frequent feature updates, and their black-box nature fails to provide the reasoning transparency that engineers require for trust. We observe that experienced triage engineers resolve these challenges by triangulating across user intent, system context, and historical precedent—a discipline that no single monolithic model captures. We present MERA (Multi-expert Evidence Reasoning and Arbitration), the first production-deployed multi-expert LLM framework for severity assessment in telemetry-void mobile OS beta testing. MERA operationalizes this discipline by decoupling severity assessment into three expert perspectives and fusing their evidence into an auditable decision. To meet strict online latency budgets, MERA distills the reasoning capability of a large teacher model into three lightweight experts, and a dynamic fusion layer weighs their evidence to produce a severity decision with human- reviewable rationales. In the mobile OS beta-testing pipeline of a leading global information and communications technology (ICT) provider, MERA serves as the default severity grader for all incom- ing beta tickets, with engineers performing spot-checks. Over five months it processed more than 370,000 tickets at 85% accuracy, sub- stantially outperforming baselines under concept drift and reducing manual triage effort by 60%. Article Search Article: ase26ind-p263-p doi:10.1145/3832783.3834518
	Lüntzel, Vitus	ASE '26: "Can Formal Specifications ..." Can Formal Specifications Be Synthesized from Tests Alone? Tianhai Liu, Maximilian Müller, Tobias Hey, Vitus Lüntzel, Muhammad Minhas, Anne Koziolek, and Bernhard Beckert (KIT, Germany) Formal specifications offer strong guarantees, but remain costly to write manually. Recent LLM-based approaches automate this by inferring specifications from source code, yet their reliance on white-box access poses barriers to industrial adoption due to intellectual property risks and deployment costs. Our approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden. Candidate specifications are validated locally using bounded model checking, with feedback guiding iterative refinement. Initial results on the SpecGenBench benchmark suggest that tests can guide LLMs towards meaningful Java Modeling Language specifications, while also highlighting checker compatibility and diagnostic feedback as key challenges for reliable refinement. Article Search Artifacts Available Article: ase26nier-p62-p doi:10.1145/3832783.3834549
	Luo, Chaopeng	ASE '26: "CTForge: Automatically Generating ..." CTForge: Automatically Generating Test Suites for Software Configuration Yuanliang Zhang, Zhizheng Zheng, Shanshan Li, Zhouyang Jia, Chaopeng Luo, Liqian Chen, Zhenbang Chen, Ji Wang, and Xiangke Liao (National University of Defense Technology, China) Software configuration plays a critical role in modern software systems, yet it also frequently leads to severe failures. Existing approaches, whether static analysis or LLM-based validation, struggle to capture implicit semantic constraints and validate configuration-code interactions. Leveraging existing unit tests is also insufficient due to their lack of configuration-specific focus. Thus, we present CTForge, an LLM-powered framework that automatically generates configuration-specific test suites. Its core innovation is a three-stage configuration-aware optimization pipeline that moves beyond vanilla test generation, specifically using parameter semantics to improve LLM outputs. This optimization pipeline iteratively aligns tests through: (1)enhance configuration-related code coverage to ensure relevance, (2) assertion validation across valid parameter values to eliminate false assertions, and (3) configuration-sensitivity verification to select tests that semantically exercise the intended configuration behavior. Evaluated on five large-scale systems, CTForge detects 63 out of 79 real-world configuration issues and achieves an F1-score of 0.88 in misconfiguration detection. CTForge also uncovers six previously unknown defects. Our work demonstrates that structured configuration-aware refinement is essential for LLM to produce effective test suites. Article Search Article: ase26main-p1197-p doi:10.1145/3832783.3837484
	Luo, Chuan	ASE '26: "MicroWeaver: A Constraint-Guided ..." MicroWeaver: A Constraint-Guided Structure–Semantic Aware Approach to Automated Microservice Decomposition Huitian Xue, Kairui Zhang, Chenxi Zhang, Zheng Li, Chuan Luo, Yilong Yang, Tianyu Wo, Chunming Hu, Yanliang Li, Yang Zhou, Penghao Zhang, Tiezi Zhang, and Renyu Yang (Beihang University, China; Xidian University, China; Queen's University Belfast, UK; Independent Researcher, China; Kuaishou, China) Microservice architecture is a pivotal paradigm for refactoring monolithic systems to improve maintainability and evolvability. However, automated, explainable decomposition remains a difficult task, especially when balancing structural soundness with semantic consistency in complex legacy systems. We present MicroWeaver, an automated microservice decomposition approach that reconciles both structural and semantic characteristics. MicroWeaver combines static program analysis and dynamic tracing at runtime to construct a high-fidelity, class-level dependency model, and learns numerical embeddings that capture both the structural characteristics and semantic properties embodied in these dependencies. We introduce multiple constraints for representing core design principles (e.g., high cohesion, low coupling, etc.) and formulate the decomposition as a multi-objective optimization problem. MicroWeaver uses an LLM-agent-based optimization strategy to automatically navigate the solver towards a Pareto-optimal region that balances structural dependencies, semantic coherence and inter-service communication cost. We conduct comprehensive experiments on five real-world systems. Results show that MicroWeaver overcomes key limitations of clustering-based methods that ignore semantic context and LLM-based approaches that lack robust structural constraints, and thus attains competitive structural and semantic scores. MicroWeaver is used as a production-ready architectural refactoring framework in industrial settings. Its robust, multidimensional performance and high degree of interpretability furnish practitioners with actionable and comprehensive insights, thereby facilitating more informed and systematic refactoring processes. Article Search Article: ase26ind-p19-p doi:10.1145/3832783.3834457 ASE '26: "DynCA: An Effective Algorithm ..." DynCA: An Effective Algorithm for 3-Wise Combinatorial Interaction Testing in Highly Configurable Systems Ruizhi Shi, Shuangyu Lyu, Renyu Yang, Wei Wu, Chanjuan Liu, Chunming Hu, and Chuan Luo (Beihang University, China; Central South University, China; Dalian University of Technology, China) With the increasing demand for software customization, highly configurable systems have become increasingly important. Combinatorial interaction testing (CIT) is widely recognized as an effective technique for testing such systems. The most critical problem in CIT is constrained covering array generation (CCAG), which aims to construct a t-wise covering array (CA) with as small a size as possible, where t denotes the testing strength. Compared with the widely adopted pairwise testing ( 2-wise CIT), 3-wise CIT is capable of detecting more faults and provides greater practical benefits. However, it also introduces significantly higher computational complexity. Although many existing algorithms perform well on 2-wise CCAG, current state-of-the-art CCAG algorithms still suffer from the severe scalability challenge in 3-wise CCAG and have difficulty generating small-sized CAs for large-scale instances. Since the size of a CA directly affects testing efficiency in practice, generating small-sized 3-wise CAs is of great importance. In this work, we propose , a novel 3-wise CCAG algorithm that effectively generates small-sized CAs for large-scale instances. Experimental results on extensive real-world highly configurable systems demonstrate that, compared with existing state-of-the-art algorithms, reduces the size of generated 3-wise CAs by 10.8%. Moreover, is efficient, requiring only half of the running time to generate smaller 3-wise CAs than existing algorithms. Article Search Artifacts Available Article: ase26main-p354-p doi:10.1145/3832783.3834349 ASE '26: "SplitCA: An Effective Tool ..." SplitCA: An Effective Tool for Generating 4-wise Covering Arrays for Large-Scale Highly Configurable Systems Shuangyu Lyu, Ruizhi Shi, Yuechen Duan, Chunming Hu, and Chuan Luo (Beihang University, China) Highly configurable software systems are difficult to test exhaustively because their configuration spaces grow exponentially with the number of options. Combinatorial interaction testing (CIT) addresses this problem by generating t-wise covering arrays (CAs), and prior studies show that 4-wise CIT can detect important faults missed by lower-strength testing. However, existing constrained covering array generation (CCAG) tools still struggle to generate 4-wise CAs for large-scale systems with more than one thousand options. To address this limitation, we propose , an effective tool for large-scale 4-wise CA generation. We evaluate on 118 public real-world large-scale highly configurable software instances, each with more than one thousand options. Under reasonable time and memory limits, existing 4-wise CCAG tools fail to generate a 4-wise CA for any of these instances. In contrast, successfully generates 4-wise CAs for 117 instances, substantially improving the scalability of 4-wise CCAG. Video: https://youtu.be/9uM1Vl2ph-o Repository: https://github.com/chuan-luo-group/SplitCA or https://doi.org/10.5281/zenodo.21360896 Article Search Artifacts Available Article: ase26tool-p76-p doi:10.1145/3832783.3834623
	Luo, Fanjing	ASE '26: "Bridging the Gap between Intent ..." Bridging the Gap between Intent and Impact: An Empirical Study of GPU Optimizations in Deep Learning Frameworks Siqi Wang, Fanjing Luo, Xing Hu, Xinyu Wang, and Xin Xia (Zhejiang University, China) Performance optimization is a critical concern in the evolution of deep learning frameworks, as GPU execution dominates training and inference costs. While hundreds of optimizations are proposed to accelerate training and inference, it is unclear how often these changes deliver meaningful gains in practice, and why they sometimes fail. To bridge this gap, we conduct an empirical study of GPU performance optimizations in deep learning frameworks. We analyze 202 performance-related pull requests from the major deep learning frameworks, and categorize them into 22 distinct optimization strategies (e.g., kernel fusion, auto-tuning, and vectorization). This taxonomy reveals a rich set of developer-intended performance improvements spanning logic, execution, and infrastructure levels. Our evaluation reveals that optimization benefits are far from guaranteed. While some strategies achieve substantial speedups, a significant portion exhibit limited gains or even performance regressions when deployed in realistic workloads. To understand these discrepancies, we conduct multi-level benchmarking and microarchitectural profiling, uncovering three recurring root causes of performance degradation: (1) increased register pressure from aggressive fusion, (2) synchronization overhead migration in small kernels, and (3) memory arbitration under high-load kernels. These findings highlight a fundamental challenge in performance engineering: optimizations interact with hardware resources in complex and often counterintuitive ways, making their outcomes difficult to predict. Our study provides the first systematic characterization of these effects, offering insights to guide more reliable and performance-aware optimization in deep learning frameworks. Article Search Article: ase26main-p162-p doi:10.1145/3832783.3834344
	Luo, Feng	ASE '26: "Towards Reliable C-to-Rust ..." Towards Reliable C-to-Rust Translation with Rule-Guided Reasoning and Reinforcement Learning Feng Luo, Jiachen Liu, Cuiyun Gao, Jia Feng, and Kui Liu (Harbin Institute of Technology, Shenzhen, China; Huawei Technologies, China) The migration of legacy C programs to Rust has become an important direction for improving software memory safety while alleviating the high cost of manual rewriting. Leveraging large language models (LLMs) for automated C-to-Rust translation has emerged as a promising direction. However, existing LLM-based approaches remain limited. On the one hand, LLMs exhibit limited capability in identifying Rust-specific rules, and inadequate handling of Rust syntax often results in incorrect translations. On the other hand, existing LLMs often struggle to accurately capture the semantics of complex code, resulting in incorrect translations. To address these challenges, we propose a Translation fRAmework Via rule-guided reasoning and rEinforcement Learning, namely TRAVEL, consisting of two modules. The first module employs Monte Carlo Tree Search (MCTS)-based reasoning path construction guided by Rust-specific rules, steering the search toward translation steps that respect the syntactic rules that LLMs frequently violate. The second module introduces reinforcement learning with execution feedback and reasoning-quality signals to improve semantic preservation. We evaluate TRAVEL on three datasets: xCodeEval (a public benchmark), OS-Bench (functions collected from the Linux kernel), and HW-Bench (an industrial dataset from Huawei). On xCodeEval, TRAVEL outperforms all baselines across three backbone LLMs. In particular, compared to the strongest prompting baseline IRENE, TRAVEL improves computational accuracy (CA) by 26.22% and compilation success rate (CSR) by 18.77%. On HW-Bench and OS-Bench, TRAVEL further improves CSR by 18.28% and 16.51%, respectively, while reducing unsafe rate (UR) by 13.06% and 13.08%, respectively. Article Search Article: ase26ind-p459-p doi:10.1145/3832783.3834534
	Luo, Hanyue	ASE '26: "Perception, Reasoning, and ..." Perception, Reasoning, and Action: A ReAct-Based Vulnerability Detection Framework with Repository-Level Reasoning Xin-Cheng Wen, Hanyue Luo, Cuiyun Gao, Hao Zhu, Yang Xiao, and Ge Li (Harbin Institute of Technology, Shenzhen, China; Peking University, China; Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China) The exponential growth in software vulnerabilities has created an urgent demand for automated vulnerability detection solutions. Recent research has emphasized the importance of repository-level context for vulnerability detection and has leveraged large language models (LLMs) to address this challenge. Although these methods show state-of-the-art performance, they face the following challenges: (1) Insufficient perception of repository-level contextual information. Current approaches primarily rely on the given input itself or predefined knowledge bases. They cannot adequately account for inter-file dependencies, such as import relationships and class hierarchies, that may be critical to understanding specific vulnerabilities. (2) Relying on manually designed actions in the LLM reasoning process. Specifically, existing methods do not effectively integrate reasoning (i.e., predicting vulnerability existence by LLMs) with action (i.e., dynamically retrieving additional or reduced context by tool). This limitation can lead to factual hallucinations throughout the detection process, leading to limited performance. To address these challenges, we propose to model the repository-level vulnerability detection task from a Reasoning and Action (i.e., ReAct) paradigm and incorporate human workflows into multi agent-based LLMs, termed ReAct-Vul, which consists of two key modules: (1) a repository-scale knowledge slicing, which comprises an intra-procedural slicing process, an inter-procedural slicing process, and a ReAct-based perception component for extracting the vulnerability-related context and knowledge at the repository level. (2) a synergistic reasoning-action-driven detection module, which interleaves a dual-perspective vulnerability analysis (Action phase) and detection-reflection loop (Reasoning phase). This synergistic approach enables the framework to explicitly consider both vulnerability presence and absence, generate reasoning explanations and refine subsequent targeted actions for vulnerability detection. We evaluate ReAct-Vul on the real-world C/C++ dataset PrimeVul and SVEN to demonstrate its effectiveness in vulnerability detection. Specifically, ReAct-Vul outperforms the best baseline by 18.4% on SVEN and 8.7% on PrimeVul in terms of accuracy. Furthermore, we demonstrate that the proposed ReAct paradigm enhances the reasoning capabilities of different models, achieving a 15.9% improvement in the accuracy of SVEN. Article Search Article: ase26main-p3189-p doi:10.1145/3832783.3837547
	Luo, Ji	ASE '26: "RepoProbe: Benchmarking Architecture-Aware ..." RepoProbe: Benchmarking Architecture-Aware Repository Comprehension with Checklists Yuexi Yang, Alyssa Wu, Ji Luo, Richeng Xuan, Zhichao Hu, Yuhong Liu, and Zhen Qin (Zhejiang University, China; Tencent, China) The integration of Large Language Models (LLMs) into software engineering has shifted the focus from function-level generation to repository-scale assistance. However, existing benchmarks largely rely on bug reports from GitHub Issues, which often allow models to bypass genuine understanding via pattern matching on error logs. This misalignment under-measures Edit Bias, which refers to premature generation, where models prematurely propose code modifications instead of understanding the existing repository architecture. Furthermore, current LLM-as-a-Judge scalar scoring suffers from high variance and low interpretability. This work introduces RepoProbe, a novel benchmark for evaluating repository-level code understanding through open-ended Q&A using GitHub Discussions, which focuses on open-ended architectural inquiries rather than defect reporting. To ensure rigorous evaluation, we propose a Checklist-Based Verification Protocol that decomposes answers into atomic, verifiable facts, thereby replacing subjective ratings with objective verification. Our evaluation of state-of-the-art (SOTA) LLMs reveals a persistent gap between high clarity and evidence-grounded technical correctness. It also quantitatively confirms the prevalence of edit bias, in which models prioritize code generation instead of architectural analysis. Finally, we demonstrate that our verification protocol significantly improves evaluation reliability compared to traditional evaluations with scalar scoring. Article Search Artifacts Available Article: ase26main-p676-p doi:10.1145/3832783.3837452
	Luo, Kevin	ASE '26: "IAM Policy Autopilot: Static ..." IAM Policy Autopilot: Static Analysis for Policy Generation from Application Code Antonio Filieri, Luke Kennedy, Kevin Luo, Matt Luttrell, Adrián Palacios, Akash Panda, Neha Rungta, Matthias Schlaipfer, Karan Jit Singh, Anvesh Tanuku, Nick Winans, Diana Yin, and Weiben Zhang (Amazon Web Services, USA; Amazon Web Services, Germany) Every application deployed on Amazon Web Services (AWS) requires Identity and Access Management (IAM) policies that specify which API actions the application is authorized to perform. AWS offers managed policies as a convenience to simplify policy authoring. However, these policies are designed to cover common scenarios which can lead to unnecessarily broad permissions beyond what a specific use case requires. AI coding assistants offer an alternative, but can be unreliable: they hallucinate invalid policy content, and lag behind newly launched services and APIs. Moreover, some organizations distrust nondeterministic processes for security-critical artifacts such as access policies. We present IAM Policy Autopilot (IPA), a deterministic static-analysis tool that generates IAM policies by examining API usage in Python, Java, Go, and TypeScript/JavaScript code. The tool occupies a middle ground between hand-crafted least-privilege policies, which require deep IAM expertise, and potentially overpermissive managed policy selection. It implements a three-phase pipeline that parses source files to identify AWS SDK calls via AST pattern matching; maps SDK operations to the required permissions by consulting authoritative, up-to-date service metadata; and synthesizes policy documents with provenance, tracing each permission to its origin in the source code. We evaluate IPA in two settings: (1) on 10 synthetic benchmark applications across four languages, comparing generated policies against minimal baseline policies, AI-generated policies, and an optimal selection of managed policies. IPA-generated policies prove sufficient to run 9 of the 10 applications; and (2) on a production-style multi-service chatbot application in Python, where IPA-generated policies prove sufficient for executing 11 of 12 handlers. Our findings show that policies generated by our tool are sufficient to run applications on a level similar to, or outperforming, AI-generated policies, while being generated deterministically. On average, the policies permit about an order of magnitude fewer permissions than the optimal selection of managed policies and about 60% fewer permissions than an expert developer-authored set of policies, indicating that IAM Policy Autopilot provides a good starting point when writing application policies. Article Search Article: ase26ind-p234-p doi:10.1145/3832783.3834512
	Luo, Xiapu	ASE '26: "Zero-Knowledge VMs: Security ..." Zero-Knowledge VMs: Security and Usability in Practice Jinan Jiang, Jinzhao Chu, Pengyu Xue, Xinghao Peng, Haoran Qin, and Xiapu Luo (Hong Kong Polytechnic University, Hong Kong) Zero-knowledge Virtual Machines (zkVMs) are emerging critical infrastructure for blockchain Layer 2 scaling solutions, enabling execution of arbitrary programs while generating succinct proofs of correct computation. Despite hundreds of millions of investment, the rapidly evolving zkVM ecosystem lacks comprehensive empirical analysis of its security and usability challenges. We present the first systematic study of zkVM vulnerability and usability issues, analyzing production zkVMs through three perspectives covering 314 security vulnerabilities (professional audits), 11,854 commits (developer practices), and 1,150 user issues (user experiences). We identify prevalent, severe, and non-traditional vulnerability categories and their root causes, reveal high-value attack surfaces that consistently emerge across zkVMs, and identify major usability issues that users struggle with. Comparing our findings against existing research reveals four gaps representing research and tool development opportunities for the testing and analysis of zkVMs. Article Search Article: ase26main-p1549-p doi:10.1145/3832783.3837500
	Luo, Xize	ASE '26: "PCodeTrans: Translate Decompiled ..." PCodeTrans: Translate Decompiled Pseudocode to Trace-Level Equivalent Source Code Yuxin Cui, Zeyu Gao, Siliang Qin, Yuanda Wang, Jiaming Wang, Xize Luo, Peng Zhou, and Chao Zhang (Tsinghua University, China; Institute of Information Engineering at Chinese Academy of Sciences, China; Peking University, China; Hunan University, China) Decompilation remains foundational for binary analysis, yet conventional tools prioritize human readability over compilation success and test-validated runtime consistency. While recent large language model approaches attempt refining decompiled pseudocode, they often introduce semantic hallucinations. Operating statically without dynamic feedback or attempting whole binary repairs lacking scalability, these existing methods struggle to resolve genuine runtime divergences. We present PCodeTrans, a dynamic feedback driven framework that implements a loop of recompilation, validation, and alignment for the recovery of functional source code. Extracting a minimal yet globally consistent context, PCodeTrans employs an in situ substitutable engine. This mechanism injects isolated compiled functions directly into the original binary, natively preserving authentic execution environments. Utilizing trace-level alignment as a diagnostic objective, PCodeTrans leverages breakpoint matched differential tracing, generating precise runtime causal diagnostics that guide the model through iterative refinement resolving behavioral discrepancies. Evaluated across a comprehensive Linux and Windows Benchmark suite including Coreutils, Binutils, PuTTY, and SQLite3, PCodeTrans achieves substantial translation performance refining raw Hex-Rays outputs. Empirical results confirm PCodeTrans achieves 100% function-level compilation success and 99.5% test-validated consistency on unstripped binaries, resolving up to 85.6% of logic errors. Even for stripped executables, the framework maintains over 97% test-validated consistency, narrowing the gap between raw decompilation and functional source code. Surpassing existing baselines, PCodeTrans paves a practical path toward recovered source that can be recompiled, validated to pass test harnesses, and consumed by source-level security analysis and fuzzing tools. Article Search Article: ase26main-p256-p doi:10.1145/3832783.3837432
	Luo, Yangkang	ASE '26: "Aligning User Requirement ..." Aligning User Requirement with Large Language Model in Code Generation Jia Li, Ruiqi Bai, Yangkang Luo, Yiran Zhang, Wentao Yang, Zeyu Sun, Tiankuo Zhao, Dongming Jin, Lei Li, and Zhi Jin (Wuhan University, China; Nanyang Technological University, Singapore; Institute of Software at Chinese Academy of Sciences, China; Peking University, China; University of Hong Kong, Hong Kong) Code generation refers to automatically producing executable programs from user requirements. Recently, researchers have explored approaches to enhance the correctness of generated code with advanced large language models. Although achieving improvements, existing approaches focus on designing reasoning strategies or post-refinement methods to enhance code generation performance. Despite their differences, all these methods share a common assumption: the LLM can correctly understand the given requirement. However, this assumption does not always hold. To fill this gap, we propose REA-Coder, a requirement alignment approach to enhance the code generation performance of LLMs. REA-Coder involves first identifying the requirement content that does not align with LLMs and aligning the requirements. Then, based on the aligned requirements, LLMs generate code and further verify whether the generated code aligns with the requirements, iterating this process of requirement alignment and code generation until generating correct code or achieving the maximum number of iterations. Experimental results show that REA-Coder outperforms all advanced baselines on four LLMs across five programming benchmarks. Concretely, REA-Coder achieves average improvements of 7.93%, 30.25%, 26.75%, 8.59%, and 8.15% on the five benchmarks, demonstrating the effectiveness of requirement alignment for improving the code generation performance of LLMs. Article Search Article: ase26main-p1298-p doi:10.1145/3832783.3837487
	Luo, Yixing	ASE '26: "AutoFLC: An LLM-Based Flowchart ..." AutoFLC: An LLM-Based Flowchart Generation Tool for Legacy Code Repository Yixing Luo, Longxing Yang, Xiaofeng Li, Bin Gu, and Zhi Jin (Beijing Institute of Control Engineering, China; Peking University, China) Code comprehension remains a major bottleneck in maintaining large-scale legacy code repositories, particularly due to their complex intra-procedural control flows and lack of up-to-date documentation. While textual summaries generated by large language models (LLMs) provide semantic insights, they fail to intuitively represent non-linear control logic. Visual flowcharts are therefore highly desirable, yet existing automated approaches either produce cluttered diagrams or generate syntactically invalid scripts that cannot be rendered. To address these challenges, we present AutoFLC, a general-purpose tool to transform repository-scale legacy codebases into comprehensive visual flowcharts. AutoFLC combines static analysis for precise function extraction with a renderer-in-the-loop self-correction mechanism. This tool iteratively refines the generated PlantUML script to guarantee syntactic validity, thereby ensuring the successful rendering of the final visual flowchart. Evaluations on three real-world aerospace systems demonstrate that AutoFLC achieves a flowchart generation success rate exceeding 99%. A user study with 10 industrial practitioners further confirms that the generated flowcharts significantly reduce cognitive load and effectively support logic comprehension. The tool is publicly available at https://github.com/dfjdkjkdf/AutoFLC/tree/main under the MIT License, with a demonstration video accessible at https://youtu.be/AeEi9Nbw7xI. Article Search Article: ase26tool-p107-p doi:10.1145/3832783.3834635
	Luo, Yu	ASE '26: "KRCA: An Efficient Root Cause ..." KRCA: An Efficient Root Cause Analysis System in Hyper-scale Microservice Systems via Agentic AI Jiamin Jiang, Jingfei Feng, Yu Luo, Qingliang Zhang, Yongqian Sun, Wenwei Gu, Shenglin Zhang, Tianyu Cui, Yao Wu, Jielong Huang, Nan Qi, and Dan Pei (Nankai University, China; Kuaishou Technology, China; Tsinghua University, China) Hyper-scale microservice systems have become the standard infrastructure for large-scale Internet companies. These systems consist of numerous loosely coupled microservices that evolve independently through continuous development and deployment. Such complexity makes failures unavoidable, necessitating efficient Root Cause Analysis (RCA) to help Site Reliability Engineers (SREs) quickly localize root cause services and classify failure types. However, existing RCA methods often struggle to adapt to the extreme dynamism and massive scale of these systems. In this paper, we present KRCA, an end-to-end RCA system designed for hyper-scale microservice systems. To manage the vast search space, KRCA employs a multi-stage pipeline that begins with an API-level drilldown to isolate suspicious services. It then instantiates a skeleton-based causal graph from anomalous metrics to serve as a high-recall structural prior, before utilizing a memory-augmented multi-agent framework to verify causality and generate the final failure report. By combining structured causal constraints with multi-agent reasoning, KRCA balances diagnostic accuracy with the efficiency requirements of real-time production use. Experimental results show that KRCA achieves AC@1 scores of 0.88 and 0.79 for root cause service localization and failure type classification, outperforming the strongest baseline by at least 31% in absolute gains. KRCA has been deployed in Kuaishou's production environment for over six months, reducing the average diagnosis time by 77.3%. Article Search Article: ase26ind-p61-p doi:10.1145/3832783.3834468 ASE '26: "OpsAgent: An Evolving Multi-agent ..." OpsAgent: An Evolving Multi-agent System for Incident Management in Microservices Yu Luo, Jiamin Jiang, Jingfei Feng, Lei Tao, Qingliang Zhang, Xidao Wen, Yongqian Sun, Shenglin Zhang, Tong Liu, Wenjie Zhang, and Dan Pei (Nankai University, China; Alibaba Cloud, China; Lenovo, China; Tsinghua University, China) Incident management (IM) is central to the reliability of large-scale microservice systems. Yet manual IM, where on-call engineers examine metrics, logs, and traces is labor-intensive and error-prone in the face of massive and heterogeneous observability data. Existing automated IM approaches often struggle to generalize across systems, provide limited interpretability, and incur high deployment costs, which hinders adoption in practice. In this paper, we present OpsAgent, a lightweight, self-evolving multi-agent system for IM that employs a training-free data processor to convert heterogeneous observability data into structured textual descriptions, along with a multi-agent collaboration framework that makes diagnostic inference transparent and auditable. To support continual capability growth, OpsAgent also introduces a dual self-evolution mechanism that integrates internal model updates with external experience accumulation, thereby closing the deployment loop. Comprehensive experiments on the OPENRCA benchmark demonstrate state-of-the-art performance and show that OpsAgent is generalizable, interpretable, cost-efficient, and self-evolving, making it a practically deployable and sustainable solution for long-term operation in real-world microservice systems. Notably, its deployment in Lenovo’s production environment further validates its effectiveness in real-world industrial settings. Article Search Article: ase26ind-p92-p doi:10.1145/3832783.3834479
	Luo, Yuan	ASE '26: "ArkEval: Benchmarking and ..." ArkEval: Benchmarking and Evaluating Automated Code Repair for ArkTS Bang Xie, Senjian Zhang, Zhiyuan Peng, Wei Chen, Xin Yin, Chenhao Ying, and Yuan Luo (Shanghai Jiao Tong University, China; Zhejiang University, China) Automated program repair benchmarks largely cover mature languages such as Python and Java, leaving limited support for ArkTS and OpenHarmony. We present ArkEval, an executable repository-level benchmark for evaluating repair on real ArkTS/OpenHarmony issue-resolution tasks. To the best of our knowledge, it is the first benchmark with this scope. We mined more than 6,000 pull-request and merge-request records available through July 3, 2025, from nine public repositories. Automated profiling and unanimous screening by three ArkTS/OpenHarmony developers produced 502 instances. Their reproduction tests were constructed through a six-round benchmark-wide refinement process, followed by targeted closure for the remaining six instances. We evaluated eight current models with the same localization-guided, RAG-off repair protocol. The best model compiled 54.38% of its patches, whereas the highest behavioral Pass@1 was 19.32%. ArkEval therefore separates build validity from behavioral repair and supplies traceable tests for studying both. Article Search Article: ase26main-p1862-p doi:10.1145/3832783.3837514 ASE '26: "KQFuzz: Knowledge-Guided Fuzzing ..." KQFuzz: Knowledge-Guided Fuzzing for Quantum Libraries via Large Language Models Fuyuan Xia, Qixin Zhang, Chenhao Ying, Haojin Zhu, Shuai Wang, Yuan Luo, Pingchuan Ma, and Yuxuan Du (Shanghai Jiao Tong University, China; Nanyang Technological University, Singapore; Hong Kong University of Science and Technology, Hong Kong; Zhejiang University of Technology, China) As quantum computing continually improves, ensuring the reliability and correctness of quantum libraries has become increasingly critical. To this end, many LLM-based fuzzing approaches towards quantum libraries have been proposed to uncover potential bugs. However, these methods still suffer from limitations such as insufficient flexibility and low efficiency, which hinder the progress of the quantum computing field. To address these challenges, we propose KQFuzz, a novel knowledge-guided fuzzer for quantum libraries. It leverages comprehensive codebase knowledge to ground LLM-based test generation, synergizing this with fitness-guided evaluation and two-level mutations to explore complex execution paths and trigger potential bugs. Firstly, KQFuzz introduces a novel prompting scheme tailored to quantum programs, which strategically incorporates knowledge of the codebase to efficiently generate high-quality quantum seed programs. Moreover, we develop evaluation and mutation strategies to handle the generated seed programs, facilitating efficient fuzzing execution while further enriching the diversity of the resulting test cases. We implement KQFuzz and conduct fuzzing on three popular quantum libraries, including Qiskit, PennyLane, and Cirq. Experimental results demonstrate that our approach significantly outperforms other state-of-the-art methods, with coverage improved by up to 18.44%. During the development of KQFuzz, we discovered 13 bugs, all of which have been confirmed and 12 have already been fixed by the developers. Article Search Article: ase26main-p1509-p doi:10.1145/3832783.3834392
	Luo, Zijian	ASE '26: "Maximal Format-Free Data Repair ..." Maximal Format-Free Data Repair Zijian Luo, Xi Wu, Hong Jin Kang, Alan Fekete, and Rahul Gopinath (University of Sydney, Australia) ERROR in abstract. Article Search Artifacts Available Article: ase26main-p428-p doi:10.1145/3832783.3834354
	Luttrell, Matt	ASE '26: "IAM Policy Autopilot: Static ..." IAM Policy Autopilot: Static Analysis for Policy Generation from Application Code Antonio Filieri, Luke Kennedy, Kevin Luo, Matt Luttrell, Adrián Palacios, Akash Panda, Neha Rungta, Matthias Schlaipfer, Karan Jit Singh, Anvesh Tanuku, Nick Winans, Diana Yin, and Weiben Zhang (Amazon Web Services, USA; Amazon Web Services, Germany) Every application deployed on Amazon Web Services (AWS) requires Identity and Access Management (IAM) policies that specify which API actions the application is authorized to perform. AWS offers managed policies as a convenience to simplify policy authoring. However, these policies are designed to cover common scenarios which can lead to unnecessarily broad permissions beyond what a specific use case requires. AI coding assistants offer an alternative, but can be unreliable: they hallucinate invalid policy content, and lag behind newly launched services and APIs. Moreover, some organizations distrust nondeterministic processes for security-critical artifacts such as access policies. We present IAM Policy Autopilot (IPA), a deterministic static-analysis tool that generates IAM policies by examining API usage in Python, Java, Go, and TypeScript/JavaScript code. The tool occupies a middle ground between hand-crafted least-privilege policies, which require deep IAM expertise, and potentially overpermissive managed policy selection. It implements a three-phase pipeline that parses source files to identify AWS SDK calls via AST pattern matching; maps SDK operations to the required permissions by consulting authoritative, up-to-date service metadata; and synthesizes policy documents with provenance, tracing each permission to its origin in the source code. We evaluate IPA in two settings: (1) on 10 synthetic benchmark applications across four languages, comparing generated policies against minimal baseline policies, AI-generated policies, and an optimal selection of managed policies. IPA-generated policies prove sufficient to run 9 of the 10 applications; and (2) on a production-style multi-service chatbot application in Python, where IPA-generated policies prove sufficient for executing 11 of 12 handlers. Our findings show that policies generated by our tool are sufficient to run applications on a level similar to, or outperforming, AI-generated policies, while being generated deterministically. On average, the policies permit about an order of magnitude fewer permissions than the optimal selection of managed policies and about 60% fewer permissions than an expert developer-authored set of policies, indicating that IAM Policy Autopilot provides a good starting point when writing application policies. Article Search Article: ase26ind-p234-p doi:10.1145/3832783.3834512
	Lv, Peizhuo	ASE '26: "Making Theft Useless: Adulteration-Based ..." Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems Weijie Wang, Peizhuo Lv, Yan Wang, Weiqing Huang, Rujie Dai, Guokun Xu, Qiujian Lv, Hangcheng Liu, Hao Hu, and Jiaheng Zhang (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Henan Key Laboratory of Information Security, China; National University of Singapore, Singapore) Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants. Article Search Article: ase26main-p131-p doi:10.1145/3832783.3837418
	Lv, Qiujian	ASE '26: "Making Theft Useless: Adulteration-Based ..." Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems Weijie Wang, Peizhuo Lv, Yan Wang, Weiqing Huang, Rujie Dai, Guokun Xu, Qiujian Lv, Hangcheng Liu, Hao Hu, and Jiaheng Zhang (Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Henan Key Laboratory of Information Security, China; National University of Singapore, Singapore) Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants. Article Search Article: ase26main-p131-p doi:10.1145/3832783.3837418
	Ly, Delina	ASE '26: "Can Large Language Models ..." Can Large Language Models Decompose User Stories into Tasks? Exploring the Role of Prompting Strategies and Models Delina Ly, Fatma Başak Aydemir, and Fabiano Dalpiaz (VX Company, Netherlands; Utrecht University, Netherlands) Refining user stories (USs) into tasks is an important step in agile software development, as it translates software requirements into project management artifacts that are assigned to team members. This story-to-task decomposition can be tedious. In this paper, we propose and evaluate DELTA, a Large Language Model (LLM)-based approach that automatically generates tasks from USs and assesses the quality of the resulting decompositions. We conduct a two-phase empirical study to evaluate DELTA. In the first phase, we identify the best-performing DELTA configuration by comparing different prompting strategies, LLM families, and sizes using text similarity metrics on human-created and LLM-generated decompositions. The comparison based on these metrics did not identify a single consistently best-performing configuration. Therefore, in the second phase, we conducted an expert evaluation to determine whether the observed differences in text similarity are reflected in expert judgments and whether DELTA’s criteria-based evaluation module, which uses LLM judges, aligns with expert judgments. Our results show that DELTA’s evaluation module produces rankings that align more closely with expert judgments than text similarity metrics. Moreover, experts generally prefer the top three LLM-generated decompositions, as ranked by LLM judges, over those created by humans, and they express a willingness to adopt DELTA. Article Search Artifacts Available Article: ase26main-p4215-p doi:10.1145/3832783.3837558
	Lyu, Jiewei	ASE '26: "OpsLens: Runbook-Free Root ..." OpsLens: Runbook-Free Root Cause Analysis via Multi-agent Collaboration and Tool Management Haiyu Huang, Jiewei Lyu, Gou Tan, Pengfei Chen, Zhihan Jiang, Guangba Yu, Penghui Mi, Fuqiang Wang, Jian Han, Chongkang Tan, and Michael R. Lyu (Sun Yat-sen University, China; Chinese University of Hong Kong, China; Huawei, China; Independent Researcher, China) Root Cause Analysis (RCA) is critical for cloud service reliability, requiring correlation of multi-modal observability data (i.e., traces, logs, and metrics) to identify failure causes. Current LLM-based RCA approaches face two key limitations: over-reliance on system-specific artifacts (e.g., runbooks), limiting transferability; and difficulty ensuring the quality and reuse of LLM-generated diagnostic tools across modalities. To address these issues, we propose OpsLens, an RCA framework that combines modality-specialized multi-agent collaboration with quality-focused tool management , including feedback-driven refinement and a tool graph with scoreboard. On OpenRCA (335 real-world incidents from three production systems), OpsLens achieves a score rate of 0.80, outperforming baselines by 1.79–4.75×. More importantly, OpsLens has been tested on Platform A in Huawei since June 2025, achieving over 80% RCA accuracy across two industrial datasets and reducing diagnosis time from over 1 hour to under 5 minutes. Article Search Artifacts Available Article: ase26ind-p181-p doi:10.1145/3832783.3834501 ASE '26: "HERO: Hypothesis-Centered ..." HERO: Hypothesis-Centered Root-Cause Analysis for Microservice Incidents Jiewei Lyu, Junquan Yi, Shu Liang, Pengfei Chen, and Long Pan (Sun Yat-sen University, China; Tencent, China) Root-cause analysis (RCA) in cloud-native microservice systems is challenging because it requires integrating heterogeneous observability signals and deciding what to inspect next under limited diagnosis budgets. Existing large language model (LLM)-based RCA agents either rely heavily on predefined workflows, whose effectiveness is constrained by incomplete Standard Operating Procedure (SOP) coverage, or adopt open-ended diagnosis, which remains brittle when multiple plausible root-cause hypotheses are consistent with the observed evidence. We present Hero, a hypothesis-centered RCA framework that formulates diagnosis as controlled discrimination among competing hypotheses via bounded hypothesis-space instantiation, explicit belief-state tracking, and ambiguity-guided evidence acquisition. We evaluate Hero on OpenRCA and a real-world industrial incident dataset against representative workflow-based and open-ended baselines. On OpenRCA with DeepSeek-V3, Hero achieves an SR of 79.77, outperforming the strongest ReAct-style baseline by 23.20 points while using 1.04 fewer actions on average. On the industrial dataset, it reaches an SR of 85.00 and remains the best-performing method. These results suggest that explicitly controlling competing hypotheses is an effective and practically promising abstraction for microservice RCA, especially in real-world, production-style incidents with incomplete workflow coverage and high diagnostic ambiguity. Article Search Article: ase26main-p1707-p doi:10.1145/3832783.3837509
	Lyu, Jun	ASE '26: "Beyond Syntactic Differencing: ..." Beyond Syntactic Differencing: Semantic-Aware Scheduling for Cross-Configuration Incremental Builds Xiaolong Dai, Shanshan Li, Jun Lyu, and Xintao Niu (Nanjing University, China) Modern configurable software systems are routinely built and tested across thousands of configuration variants to ensure correctness under diverse settings. Reusing build artifacts across configurations is therefore crucial to reduce redundant effort, yet remains challenging. Existing approaches estimate rebuild cost using syntactic option differences and apply greedy scheduling, which often misestimate true costs and yield suboptimal build orders. We present SIBS, the first semantics-aware scheduling framework for incremental builds across configurations, addressing both inaccurate cost estimation and the limitations of greedy scheduling. The key idea is a semantic distance metric that models the impact of configuration changes on rebuild scope by capturing option-level effects on code generation, accounting for global configuration headers, and propagating changes through dependency graphs. This enables cost-aware global scheduling formulated as an Asymmetric Traveling Salesman Problem (ATSP). Across 21 real-world systems and five independently sampled configuration batches, SIBS reduces observed build time relative to the state-of-the-art build scheduler in 17 systems. On average, it saves 196s (21%), with a median saving of 40s (3%), and achieves a 27.7% geometric-mean reduction in build time across projects. Batch-level reductions range from 25.7% to 29.3%, and the scheduling overhead remains modest (median 3.1s; mean 12.9s). These results demonstrate that semantics-aware cost modeling and global scheduling provide substantial and robust efficiency gains across diverse configurable systems. Article Search Artifacts Available Article: ase26main-p2497-p doi:10.1145/3832783.3837533
	Lyu, Mengyao	ASE '26: "ATLAS: Agentic Taxonomy of ..." ATLAS: Agentic Taxonomy of LArge-Scale Software Ecosystems Junyi Lu, Mengyao Lyu, Jiahui Wu, Lei Yu, Chengwei Liu, Fengjun Zhang, Li Yang, Chun Zuo, and Yang Liu (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Nanyang Technological University, Singapore; Nankai University, China; Sinosoft, China) The open-source ecosystem on GitHub lacks a systematic hierarchical taxonomy of software repositories. GitHub Topics, the dominant organizational mechanism, is flat, inconsistent, and covers only 67% of repositories. We present ATLAS, the first framework that automatically constructs a hierarchical taxonomy for software repositories and classifies repositories into it end-to-end. By combining LLM global knowledge with real repository distributions, ATLAS proposes meaningful splitting dimensions and iteratively corrects those that fail to accommodate real repositories. A Designer Agent proposes splitting dimensions while a Classifier Agent assigns repositories; a self-corrective refinement loop uses classification failures to drive dimension revision through escalating strategies. We evaluate ATLAS on 54,387 GitHub repositories against six baselines spanning four paradigm families, two downstream software engineering tasks, and three model families. On a stratified 2,001-repository benchmark, ATLAS achieves a Taxonomy Quality F-score (TQF) of 83.13%, outperforming the best baseline by 15 percentage points (on the full 54k corpus the approximate TQF is 73.0%, a gap driven by Path Granularity's all-or-nothing scoring on longer paths rather than lower classification accuracy; see Section 4.5). It is the only method to simultaneously achieve high structural quality and high practical applicability. On downstream tasks, the ATLAS taxonomy enables software alternative discovery with P@1 = 85.71%, surpassing even human-curated lists (62.34%), and achieves the highest P@1 for repository retrieval. The taxonomy further reveals structural ecosystem trends that are difficult to obtain from flat tags or similarity methods: the shift from libraries to AI/ML applications (now 61% of newly community-adopted projects) becomes visible only through hierarchical, type-based categorization. An interactive taxonomy explorer is available at https://atlas-taxonomy.netlify.app/. Article Search Artifacts Available Article: ase26main-p622-p doi:10.1145/3832783.3834361
	Lyu, Michael R.	ASE '26: "OpsLens: Runbook-Free Root ..." OpsLens: Runbook-Free Root Cause Analysis via Multi-agent Collaboration and Tool Management Haiyu Huang, Jiewei Lyu, Gou Tan, Pengfei Chen, Zhihan Jiang, Guangba Yu, Penghui Mi, Fuqiang Wang, Jian Han, Chongkang Tan, and Michael R. Lyu (Sun Yat-sen University, China; Chinese University of Hong Kong, China; Huawei, China; Independent Researcher, China) Root Cause Analysis (RCA) is critical for cloud service reliability, requiring correlation of multi-modal observability data (i.e., traces, logs, and metrics) to identify failure causes. Current LLM-based RCA approaches face two key limitations: over-reliance on system-specific artifacts (e.g., runbooks), limiting transferability; and difficulty ensuring the quality and reuse of LLM-generated diagnostic tools across modalities. To address these issues, we propose OpsLens, an RCA framework that combines modality-specialized multi-agent collaboration with quality-focused tool management , including feedback-driven refinement and a tool graph with scoreboard. On OpenRCA (335 real-world incidents from three production systems), OpsLens achieves a score rate of 0.80, outperforming baselines by 1.79–4.75×. More importantly, OpsLens has been tested on Platform A in Huawei since June 2025, achieving over 80% RCA accuracy across two industrial datasets and reducing diagnosis time from over 1 hour to under 5 minutes. Article Search Artifacts Available Article: ase26ind-p181-p doi:10.1145/3832783.3834501 ASE '26: "MicroAgent: Context-Augmented ..." MicroAgent: Context-Augmented Multi-agent Framework for Automatic Microservice Decomposition Zishan Su, Junjie Huang, Shiwen Shan, Xingyan Chen, Hui Zeng, Yuxin Su, Yanlin Wang, and Michael R. Lyu (Chinese University of Hong Kong, China; Sun Yat-sen University, China) The adoption of Microservice Architecture (MSA) has revolutionized software engineering by enhancing scalability, agility, and maintainability over traditional monolithic applications. As more developers transition their legacy systems to microservice-based architectures, effective microservice decomposition—partitioning monolithic applications into highly cohesive services—becomes vital. However, this decomposition task presents significant challenges. Manual approaches are time-consuming and labor-intensive. Existing automated methods often fail to capture the necessary semantic insights from complex applications, while naive applications of Large Language Models tend to overlook crucial contextual information and design principles, leading to suboptimal results. To address these challenges, we propose MicroAgent, a Context-Augmented Multi-Agent Framework for Microservice Decomposition. Our framework divides the decomposition process into five distinct subtasks and assigns each to a specialized agent. To enhance the effectiveness of each agent, we provide tailored, multi-granularity context that keeps its analysis focused and mitigates information overload. Furthermore, to ensure the decomposition adheres to established design principles, we integrate analytical tools that guide the agents’ decision-making. Experimental evaluations on 10 Java Web applications demonstrate that MicroAgent achieves an average decomposition accuracy of 89.2%, outperforming the state-of-the-art method by 24.6%. We also conduct a case study to highlight the practical benefits of our design. Article Search Artifacts Available Article: ase26main-p3640-p doi:10.1145/3832783.3834441 ASE '26: "BDiff: Block-Aware and Accurate ..." BDiff: Block-Aware and Accurate Text-Based Code Differencing Yao Lu, Wanwei Liu, Tanghaoran Zhang, Kang Yang, Yang Zhang, Wenyu Xu, Longfei Sun, Xinjun Mao, Shuzheng Gao, and Michael R. Lyu (National University of Defense Technology, China; Chinese University of Hong Kong, China) Code differencing is a fundamental technique in software engineering. Traditional line-level differencing tools (e.g., Git Myers algorithm) cannot accurately identify block-level edit actions (EAs) such as block move and copy, which are common in real development. They split multi-line block edits into fragmented line-wise changes, raising developers’ cognitive overhead during code review. This paper presents BDiff, a text-based differencing algorithm capable of identifying two types of block-level EAs and five types of line-level EAs. Building on traditional differencing algorithms, we first construct a candidate set containing all possible line and block mappings. Leveraging the Kuhn-Munkres algorithm, we then compute the optimal mapping set and derive a minimal edit script (ES) that closely aligns with the original developer intent. To evaluate BDiff, we selected five state-of-the-art tools, including large language models (LLMs), as baselines, and adopted a combined qualitative and quantitative approach to assess their performance in terms of ES size, result quality, and running time. Experimental results show that BDiff produces higher-quality differencing results than baseline tools while maintaining competitive runtime performance. Our experiments also show the unreliability of LLMs in code differencing tasks and their infeasibility in terms of runtime efficiency. Based on the proposed algorithm, we have implemented an open-sourced visual differencing tool. Article Search Artifacts Available Article: ase26main-p251-p doi:10.1145/3832783.3837431 ASE '26: "When Extensions Lie: Large-Scale ..." When Extensions Lie: Large-Scale Study of Privacy Policy Compliance in Browser Extensions Zilun Wang, Zeyang Zhuang, Mingxue Zhang, Wei Meng, and Michael R. Lyu (Chinese University of Hong Kong, China; Zhejiang University, China; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China) Browser extensions can pose significant privacy risks to end users due to their complex permission mechanisms and high privilege levels. Modern websites increasingly embed sensitive personal data within HTML elements, making such threats even more insidious. Although prior studies have examined browser extension privacy risks from different perspectives, they are typically constrained to specific sensitive data sources or a set of extensions tested on a few popular websites. To enable a comprehensive compliance check of browser extensions' privacy practices at scale, we develop an automated dynamic analysis framework, ExtPolice. It applies LLM-based techniques to identify sensitive web content embedded in web pages, performs a multi-type taint analysis in the browser to comprehensively track sensitive data flows across browser components, and checks the compliance of such flows against the extension's privacy policy disclosures. We apply ExtPolice to evaluate 149,216 Chrome extensions across 7,200 unique web pages and identify 2,246 extensions with policy violations, enabling scalable analysis of policy compliance for browser extensions. Our study uncovers thousands of policy violations potentially affecting up to tens of millions of users, highlighting major gaps in current extension-store review processes. Article Search Article: ase26main-p741-p doi:10.1145/3832783.3837459 ASE '26: "SimServing: Native-Execution ..." SimServing: Native-Execution Simulation for Evolution-Resilient LLM Serving Configuration Tuning Yujie Huang, Jiazhen Gu, Zhihan Jiang, and Michael R. Lyu (Chinese University of Hong Kong, Hong Kong) Large Language Model (LLM) services expose a large configuration space that critically affects performance, yet tuning these configurations on hardware (e.g., NVIDIA GPUs) is prohibitively expensive. Simulation offers a scalable alternative, but state-of-the-art simulators suffer from a fundamental software engineering pitfall: they re-implement the serving framework's complex control logic (e.g., request scheduling and memory management), creating a semantic copy that inevitably diverges from the rapidly evolving upstream software. Our empirical study across eight consecutive vLLM versions confirms this fidelity drift, with prediction errors widening as the framework evolves. We observe that the serving management software dominates performance fidelity yet accounts for less than 10% of total execution time, with GPU computation consuming over 90%. This asymmetry motivates SimServing, a hybrid simulation framework that executes the native, unmodified serving software while replacing GPU computation with a pluggable latency estimator. This design preserves the serving management software's control flow by executing it rather than modeling it, thereby automatically inheriting upstream updates and substantially reducing the maintenance burden associated with re-implementation. Integrating SimServing with Particle Swarm Optimization for configuration tuning, our evaluation shows that it reduces throughput prediction error from 13.8% to 4.9%, achieves up to 21.18× simulation speedup, and discovers configurations that improve throughput by up to 10.2% over existing baselines. Article Search Article: ase26main-p625-p doi:10.1145/3832783.3834362 ASE '26: "From Runnable Code to Shippable ..." From Runnable Code to Shippable Applications: Test-Driven Development for Full-Stack Web Application Generation Yuxuan Wan, Tingshuo Liang, Jiakai Xu, Jingyu Xiao, Yintong Huo, and Michael R. Lyu (Chinese University of Hong Kong, Hong Kong; Columbia University in the City of New York, USA; Singapore Management University, Singapore) Coding agents can generate runnable web applications, but their outputs frequently fail to satisfy functional requirements. Although test-driven development (TDD) offers a principled repair loop, applying it to web applications requires deriving executable acceptance tests, validating behavior through dynamic browser interactions, and translating observed failures into actionable feedback. We present TDDev, an experimental instrument that automates these tasks and enables closed-loop TDD with minimal human mediation. Using TDDev, we conduct the first controlled study of TDD for full-stack web application generation across 20 diverse web applications, multiple backbone models, two coding agents, and three TDD implementations. With sufficiently capable backbones, TDD improves accuracy by 15.5-23.7 percentage points and remains effective across both minimal and full-featured coding agents; replacing unreliable feedback with a stronger tester restores positive gains for a lower-capability backbone. Incremental TDD provides bounded control, Whole-Project TDD enables coordinated repair and achieves the highest cost efficiency in most configurations, and Agentic TDD performs best with highly capable models. Based on these findings, we provide a practical decision tree that selects an implementation according to model capability, feedback reliability, and deployment objectives. By automating acceptance testing and failure-guided repair, TDDev also reduces the human testing and intervention required during development. Article Search Article: ase26main-p1397-p doi:10.1145/3832783.3834388
	Lyu, Shuangyu	ASE '26: "DynCA: An Effective Algorithm ..." DynCA: An Effective Algorithm for 3-Wise Combinatorial Interaction Testing in Highly Configurable Systems Ruizhi Shi, Shuangyu Lyu, Renyu Yang, Wei Wu, Chanjuan Liu, Chunming Hu, and Chuan Luo (Beihang University, China; Central South University, China; Dalian University of Technology, China) With the increasing demand for software customization, highly configurable systems have become increasingly important. Combinatorial interaction testing (CIT) is widely recognized as an effective technique for testing such systems. The most critical problem in CIT is constrained covering array generation (CCAG), which aims to construct a t-wise covering array (CA) with as small a size as possible, where t denotes the testing strength. Compared with the widely adopted pairwise testing ( 2-wise CIT), 3-wise CIT is capable of detecting more faults and provides greater practical benefits. However, it also introduces significantly higher computational complexity. Although many existing algorithms perform well on 2-wise CCAG, current state-of-the-art CCAG algorithms still suffer from the severe scalability challenge in 3-wise CCAG and have difficulty generating small-sized CAs for large-scale instances. Since the size of a CA directly affects testing efficiency in practice, generating small-sized 3-wise CAs is of great importance. In this work, we propose , a novel 3-wise CCAG algorithm that effectively generates small-sized CAs for large-scale instances. Experimental results on extensive real-world highly configurable systems demonstrate that, compared with existing state-of-the-art algorithms, reduces the size of generated 3-wise CAs by 10.8%. Moreover, is efficient, requiring only half of the running time to generate smaller 3-wise CAs than existing algorithms. Article Search Artifacts Available Article: ase26main-p354-p doi:10.1145/3832783.3834349 ASE '26: "SplitCA: An Effective Tool ..." SplitCA: An Effective Tool for Generating 4-wise Covering Arrays for Large-Scale Highly Configurable Systems Shuangyu Lyu, Ruizhi Shi, Yuechen Duan, Chunming Hu, and Chuan Luo (Beihang University, China) Highly configurable software systems are difficult to test exhaustively because their configuration spaces grow exponentially with the number of options. Combinatorial interaction testing (CIT) addresses this problem by generating t-wise covering arrays (CAs), and prior studies show that 4-wise CIT can detect important faults missed by lower-strength testing. However, existing constrained covering array generation (CCAG) tools still struggle to generate 4-wise CAs for large-scale systems with more than one thousand options. To address this limitation, we propose , an effective tool for large-scale 4-wise CA generation. We evaluate on 118 public real-world large-scale highly configurable software instances, each with more than one thousand options. Under reasonable time and memory limits, existing 4-wise CCAG tools fail to generate a 4-wise CA for any of these instances. In contrast, successfully generates 4-wise CAs for 117 instances, substantially improving the scalability of 4-wise CCAG. Video: https://youtu.be/9uM1Vl2ph-o Repository: https://github.com/chuan-luo-group/SplitCA or https://doi.org/10.5281/zenodo.21360896 Article Search Artifacts Available Article: ase26tool-p76-p doi:10.1145/3832783.3834623
	Lyu, Wenhan	ASE '26: "TheBotCompany: Self-Organizing ..." TheBotCompany: Self-Organizing Multi-agent Systems for Continuous Software Development Wenhan Lyu, Yue Xiao, Yixuan Zhang, and Yifan Sun (William & Mary, USA) Large language model (LLM)-based multi-agent systems have shown promise in automating software development tasks. However, most vibe-coding systems focus on completing small tasks and incremental code changes, leaving persistent, continuous software development largely unexplored. We present TheBotCompany, an open-source orchestration framework for continuous multi-agent software development. TheBotCompany introduces three key innovations: (1) a three-phase state machine (Strategy to Execution to Verification) for milestone-driven development, (2) self-organizing agent teams where manager agents dynamically hire, assign, and retire worker agents based on project needs, and (3) asynchronous human oversight. We evaluate TheBotCompany on real-world software projects over multiple days of continuous development, measuring team adaptation patterns, milestone completion rates, cost efficiency, and code quality. Our results demonstrate that the self-organizing approach enables effective long-term software development with measurable progress, while the verification phase catches defects that would otherwise persist. Article Search Artifacts Available Article: ase26main-p597-p doi:10.1145/3832783.3834358
	Lyu, Yingjun	ASE '26: "From Security Findings to ..." From Security Findings to Verified Fixes: Automated Repair of Infrastructure-as-Code Misconfigurations Ying Li, Tamjid Al Rahat, Yingjun Lyu, Omer Tripp, and George Argyros (University of California at Los Angeles, USA; Amazon Web Services, USA) Traditional Infrastructure as Code misconfiguration remediation requires manual analysis, a labor-intensive approach that cannot meet the scale and speed demands of modern cloud deployments. We present IacFix, an agentic tool that combines LLM-based agents with formal methods to enable automated IaC security remediation from security findings to validated patches. IacFix introduces end-to-end remediation capabilities across CDK and CloudFormation packages, leveraging historical fix patterns and iterative refinement to produce validated patches for complex misconfigurations. For example, IacFix achieves 80.9% end-to-end success rate with 97.7% fault localization precision and 7.12 minutes average processing time, demonstrating comparable effectiveness to manual fixes while delivering automated solutions significantly faster. Notably, IacFix outperforms LLM-only baselines by 45 percentage points in real-world scenarios such as dangling hostclass remediation. The system exhibits one-sided error: it either produces a validated patch or safely declines to patch, ensuring that no incorrect patch is surfaced to developers. Our approach shows promising potential for addressing diverse misconfiguration types at scale. Article Search Article: ase26ind-p211-p doi:10.1145/3832783.3834509
	Lyu, Yunbo	ASE '26: "We Must Have Missed This Comment: ..." We Must Have Missed This Comment: Detecting and Repairing Stale Function References in Linux Kernel Comments Kexin Sun, Yunbo Lyu, Xutong Ma, Hongyu Kuang, Ratnadira Widyasari, He Zhang, Xiaoxing Ma, Julia Lawall, and David Lo (Nanjing University, China; Singapore Management University, Singapore; Inria, France) As the Linux kernel evolves, code comments may become outdated, as the functions they reference can be refactored or removed independently without corresponding updates to the comments. Such stale function references can mislead maintainers and thus hinder code comprehension. Prior work on detecting code-comment inconsistency mainly focused on addressing semantic misalignment between Javadoc comments and their directly annotated functions, making them inapplicable to this type of externally induced staleness in the Linux kernel. Therefore, we propose ReCite, a three-stage approach to identify and repair such stale references: (1) detecting unresolved function-form symbols—symbols in comments that appear to reference functions but for which no matching function can be found in the current codebase, (2) tracing the evolution history of each unresolved symbol through the Git history, and (3) generating LLM-based repair suggestions grounded in the evolution history and current code context. On Linux kernel v6.18-rc1, ReCite detects 869 stale references with generated repair suggestions. A manual evaluation on 200 sampled repairs shows that 178 (89.0%) provide useful repair guidance, with 85 (42.5%) directly applicable. Of our 75 submitted patches, 50 have been accepted. We also empirically study all unresolved function-form symbols. Article Search Article: ase26main-p908-p doi:10.1145/3832783.3837474
	Ma, Bo	ASE '26: "PropGen: Automated Property ..." PropGen: Automated Property Generation for Property-Based Testing of Mobile Apps Yiheng Xiong, Shiwen Song, Bo Ma, Ting Su, and Xiaofei Xie (Singapore Management University, Singapore; East China Normal University, China) Mobile apps often suffer from functional bugs that do not cause crashes but instead manifest as incorrect behaviors under specific user interactions. Such bugs are difficult to detect by conventional automatic testing techniques because they often lack explicit test oracles. Property-based testing can effectively expose them by specifying intended behavior as properties and checking them under diverse interactions. However, its practical use is limited by the reliance on manually written properties, which are difficult and expensive to construct. To address this limitation, this paper explores the use of large language models (LLMs) to automate property construction for property-based testing of mobile apps. This is challenging in two ways. First, it is difficult to systematically uncover and execute diverse app functionalities. Second, it is difficult to derive valid properties from functionality execution results. To address these challenges, we introduce PropGen, which infers candidate app functionalities as hypotheses from GUI states, validates each hypothesis by executing it to collect behavioral evidence, synthesizes properties from the collected evidence, and refines imprecise properties based on testing feedback. We implemented PropGen and evaluated it on 12 real-world Android apps. The results show that PropGen can effectively identify and execute app functionalities, generate valid properties, and refine most imprecise ones. Across all apps, PropGen inferred 1,210 valid functionalities and correctly executed 977 of them, compared with 491 and 187 for the baseline. It generated 985 properties, 912 of which were valid, and successfully refined 118 of 127 imprecise ones exposed during testing. Using the resulting properties, we found 25 previously unknown functional bugs, many of which were missed by existing testing techniques. Article Search Article: ase26main-p2547-p doi:10.1145/3832783.3837536
	Ma, Dongjian	ASE '26: "LLM Agents Can See Code Repositories ..." LLM Agents Can See Code Repositories Dongjian Ma, Silin Chen, Yufei Yang, Yuling Shi, Yanfu Yan, and Xiaodong Gu (Shanghai Jiao Tong University, China; Xi'an Jiaotong University, China; Zhejiang University, China) Coding agents powered by large language models (LLMs) have demonstrated remarkable proficiency in software engineering tasks. Yet modern coding agents rely almost entirely on text, leaving a major gap between how human developers and agents comprehend software repositories. Human developers leverage visual repository cues such as folder hierarchies and dependencies, raising the question of whether multimodal models can similarly improve repository understanding. In this paper, we conduct the first systematic empirical study on multimodal foundation models for repository-level tasks. Our experiments across four modern multimodal models reveal that while a vision-only context representation degrades performance and inflates token costs, integrating visualized context graphs as a supplementary modality can help agents grasp the repository more efficiently. Specifically, providing agents with visual structural context alongside standard text interfaces reduces input token consumption by up to 26% while maintaining or improving issue-resolution accuracy. Furthermore, we demonstrate that visual tools are most effective when utilized during the fault localization stage and when agents autonomously dictate their exploration depth. Our findings highlight a promising hybrid-modality pathway for the design of next-generation coding agents. Article Search Article: ase26main-p734-p doi:10.1145/3832783.3834363
	Ma, Fuchen	ASE '26: "WiDepFuzz: Finding Wi-Fi Protocol ..." WiDepFuzz: Finding Wi-Fi Protocol Bugs in Mobile Hotspot via Field Dependency Model Yuanliang Chen, Fuchen Ma, Taotao Gu, and Yu Jiang (Tsinghua University, China) Wi-Fi is a widely used wireless protocol, and mobile hotspot functionality has become essential for on-the-go connectivity. Bugs in the hotspot protocol stack can cause crashes, performance degradation, and semantic inconsistencies. Fuzzing is a promising technique for detecting such vulnerabilities. However, existing fuzzers typically test by modeling protocol inputs but ignore some critical dependencies among Wi-Fi fields, leading to inefficient testing. In this work, we present WiDepFuzz, a fuzzing framework designed to detect bugs in Mobile Hotspot implementations by modeling field dependencies in the Wi-Fi protocol. First, WiDepFuzz automatically identifies the semantic dependencies among Wi-Fi fields based on the IEEE 802.11 standard and constructs a Field Dependency Model (FDModel) to characterize various direct and indirect dependencies. Second, leveraging the FDModel, WiDepFuzz utilizes dependency-combination guided fuzzing to constantly generate Wi-Fi test frames that efficiently explore deep paths and trigger hidden bugs. Finally, we propose liveness and dependency detectors that enable real-time monitoring to identify abnormal states and uncover potential bugs in mobile hotspots. We implemented WiDepFuzz and evaluated it in six widely used mobile hotspots, covering major smartphone manufacturers, including Samsung, Xiaomi, OPPO, Honor, Huawei, and Nokia. Compared to SOTA Wi-Fi fuzzers like Peach, OwFuzz, wpaspy, and Greyhound, WiDepFuzz detects 15 more bugs and improves bug detection speed by 37% on average. In total, it uncovered 20 new bugs. Article Search Article: ase26main-p1165-p doi:10.1145/3832783.3837483
	Ma, Hongli	ASE '26: "Towards Reliable Alarm Flood ..." Towards Reliable Alarm Flood Reduction in Data Center via Grammar-Guided Verifiable LLM Reasoning Jiacheng Liu, Guocong Lin, Jichao Yan, Huiwen Zheng, Hongli Ma, Changhao Zhou, Zhiyi Yu, Yuanchun Li, Yunxin Liu, Ding Li, Tao Xie, and Yao Guo (Peking University, China; Tsinghua University, China; GDS Holdings, China) Alarm floods pose a critical challenge in system operations, where a single fault can trigger cascaded alarms across interconnected components, overwhelming human operators and obscuring actionable signals. Alarm flood reduction aims to reduce redundant alarms under a safety-oriented objective, because any incorrect reduction may falsely exclude real failures. Existing approaches face a fundamental trade-off: rule-based systems ensure reliability but lack scalability, while solutions based on a large language model (LLM) offer strong generalization but suffer from non-determinism and unverifiable reasoning, limiting their use in safety-critical settings. In this paper, we study the alarm flood reduction problem in data center operations and introduce a solution based on structured reasoning and conservative verification. Our key insight is that expert-level alarm analysis relies on explicit reasoning chains that connect upstream causes to downstream alarms. We design Constrained Reasoning Chain Grammar (CRCG), a lightweight yet expressive grammar that formalizes such reasoning processes as compositional inference chains with logical and numerical constraints. Our method follows two tightly connected steps. First, we use LLM-assisted annotation, checker-guided compilation, and supervised fine-tuning (SFT) to organize expert knowledge in CRCG and train a model to generate explicit reasoning chains. Second, we conservatively reduce alarms only when the reasoning chain can be verified based on CRCG. We evaluate the method on real-world data center HVAC alarms. Results have shown that our method achieves high accuracy while driving false reductions to zero on the evaluated setting, outperforming both rule-based and LLM-only baselines and reducing operational workload substantially. Article Search Artifacts Available Article: ase26ind-p96-p doi:10.1145/3832783.3834481
	Ma, Hui	ASE '26: "Manifesting Implicit Dependencies ..." Manifesting Implicit Dependencies in Requirements Task: An Automated Method Integrating Code Awareness and Change Analysis Hui Ma, Jiajun Yang, Yan Chen, Pingjia Liao, Baoyu Zhao, and Daoping Jiang (Shenzhen Poweroak Newener, China) In modern software development, accurately assessing the impact scope of requirement changes is crucial for software quality, yet this task faces two major challenges. First, highly simplified requirement descriptions (one-sentence requirements) tend to conceal complex business logic and extensive system dependencies. Second, commits often intertwine code changes for multiple requirements, leading to impact assessments that are both incomplete and time-consuming. Traditional manual assessment methods are not only inefficient but also prone to cognitive biases, which often result in the omission of critical impact points. To address these problems, this paper proposes AIST (Analysis of the Impact Scope of the Task), an automated impact scope analysis approach based on Large Language Models (LLMs). AIST leverages the semantic understanding and planning capabilities of LLMs to automatically parse requirement descriptions, retrieve relevant code context from the codebase, and integrate code change information, thereby generating a comprehensive impact scope assessment report. We evaluated AIST on 40 historical requirement changes from three real-world industrial projects. The experimental results show that it achieves a precision of $80.19\%$, a recall of $94.95\%$, and an F1-score of $86.35\%$, thereby significantly improving the completeness of impact scope identification and demonstrating high sensitivity in detecting tangled code changes. In a user survey, the novelty score was 6.32 out of 7.00, and the overall satisfaction score was 6.36 out of 7.00, indicating that users perceive that the tool effectively improves efficiency and reduces the risk of omissions. Article Search Article: ase26ind-p257-p doi:10.1145/3832783.3834516
	Ma, Lei	ASE '26: "How Your Credentials Are Leaked ..." How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, and Zhiqiang Li (Griffith University, Australia; Wake Forest University, USA; Nanyang Technological University, Singapore; University of New South Wales, Australia; Zhejiang Sci-Tech University, China; University of Tokyo, Japan; University of Alberta, Canada; Independent Researcher, China) Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research. Article Search Article: ase26main-p928-p doi:10.1145/3832783.3834373
	Ma, Lezhi	ASE '26: "From Vibe to Spec: An Empirical ..." From Vibe to Spec: An Empirical Study to Demystify Specifications in Code Generation Ruirui He, Hanqing Lu, Lezhi Ma, Kai Ye, Qiong Wu, Shangqing Liu, Lei Bu, and Xuandong Li (Nanjing University, China) Recent advances in large language models (LLMs) for code generation have given rise to vibe coding, a programming practice in which developers interact with LLMs through unstructured natural language and primarily validate implementations by inspecting overall execution outputs. However, the inherent ambiguity and inconsistency of natural language present substantial challenges for generating complex and large-scale software systems. To mitigate these limitations, an emerging AI programming paradigm—specification-driven development—advocates providing LLMs with precise and consistent specifications to guide code generation. Despite its promise, fundamental questions regarding the appropriate forms of specifications and the granularity at which they should be supplied to LLMs remain largely unexplored. To address this gap, we present the first empirical study that systematically investigates the impact of two orthogonal dimensions of specifications—form and granularity—on the effectiveness of LLM-based code generation. We construct a dataset comprising five medium-sized software projects, ranging from several hundred to over one thousand lines of code, implemented in multiple programming languages and spanning diverse application domains (e.g., system utilities and games). For each project, we design specifications in three forms—natural language, coarse-grained pseudocode, and fine-grained pseudocode—to capture the form dimension. To examine granularity, we further decompose the fine-grained pseudocode into four levels of input granularity: line-level, function-level, module-level, and project-level. Using this dataset, we evaluate code generated by three representative models, GPT-5, DeepSeek-V3.1, and Qwen-3.7. Evaluation is conducted using a comprehensive set of metrics, including text-similarity-based metrics (e.g., BLEU-4 and CodeBLEU), test-based metrics (e.g., accuracy), and human-centered metrics (e.g., usability and logical consistency). Our results demonstrate that using fine-grained, structured pseudocode specifications significantly enhances generation stability and quality. Regarding granularity, while coarser-grained specifications (project and module level) generally achieve higher code quality, organizing specifications at the module level provides the best overall balance between quality, stability, and token efficiency. Moreover, additional analyses indicate that this module-level granularity yields the most user-friendly outcome for human developers. Article Search Article: ase26main-p1876-p doi:10.1145/3832783.3837515
	Ma, Lin	ASE '26: "Regression Accumulation in ..." Regression Accumulation in Multi-turn LLM Programming Conversations Yonghui (Andie) Huang, Lin Ma, Amjed Tahir, Qian Zhang, Liwen Xiao, and Lysa Xiao (Massey University, New Zealand; Alibaba Research Center for Complexity Sciences, China; Hangzhou Normal University, China; University of Otago, New Zealand) In LLM-assisted software development, coding is often iterative. In this paper, single-turn refers to settings where the LLM responds in one request with one code suggestion, whereas multi-turn refers to settings where the LLM responds across multiple sequential requests within the same conversation. Regression accumulation refers to a later code suggestion breaking requirements introduced in earlier turns. Reliability depends not only on satisfying the current turn, but also on preserving requirements in earlier turns. Yet, there are limited evaluations of the accumulation of regression in multi-turn coding conversations. To address this gap, we conduct an empirical study of multi-turn regression in LLM programming. We construct 542 tasks from the HumanEval+ and MBPP+ benchmarks, and instantiate each task as an 8-turn requirement-evolution chain. We evaluate six LLM models on 26,016 turn instances (542×6×8). At each turn, we check if the current code suggestion still passes earlier benchmark tests, and we analyze 384 failure cases drawn from the failure population in our 26,016 turn instances to derive and validate a taxonomy of multi-turn regression bugs through independent four-annotator labeling. Our results show that regression accumulation appears across all six models, with 43% to 73% of tasks losing previously correct behavior over the full conversation. Final-turn quality is lower than initial-turn quality across models, and especially in turns adding input validation or broader input types. Manual analysis shows that Cross-Turn Conflict, where later code conflicts with earlier requirements, is the main failure class. We further find that Verification Gate, which checks new code against prior tests and triggers rollback and retry, is the only strategy that consistently improves all models, raising final-turn quality from 75.8% to 87.9% on DeepSeek-V3 and from 31.6% to 47.3% on Llama-3.1-8B. These findings suggest that strong performance on single-turn tasks can overestimate reliability in multi-turn coding conversations. Future evaluation and tool design should test whether later code suggestions preserve requirements from earlier turns and should include Verification Gate mechanisms. Article Search Artifacts Available Article: ase26main-p579-p doi:10.1145/3832783.3834357
	Ma, Mengna	ASE '26: "Tracing the Invisible: Semantic ..." Tracing the Invisible: Semantic Message Flow Discovery via Data Contracts in Real-World Distributed Systems Youlong Chen, Jie Lu, Mingtao Huang, Chenghang Shi, Yongheng Huang, Haofeng Li, Dong Liu, Mengna Ma, Yong Liu, Qinfen Hao, and Lian Li (Institute of Computing Technology at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; Zhongguancun Laboratory, China; Qi An Xin Technology Group, China) Distributed systems rely on complex messaging middleware, posing significant challenges for static analysis tools. Existing approaches often require manually specifying communication patterns between message senders and handlers—a process that is tedious, error-prone, and ill-suited to capture the semantic complexity of real-world systems with diverse routing logic. This paper introduces Hermes, an automated framework that leverages Large Language Models (LLMs) to bridge the semantic gap in distributed tracing. Key to our approach is the insight that "message types" serve as semantic contracts. Hermes leverages these types to synthesize latent routing logic into high-level communication patterns, which subsequently guide the precise discovery of concrete message flows from sender APIs to handlers. Evaluation on 10 real-world systems demonstrates that Hermes significantly outperforms existing approaches, achieving 88.6% precision and 99.6% recall in flow discovery. Applying Hermes to security auditing revealed 121 verified taint paths spanning 57 distinct sinks. These findings led to 56 confirmed zero-day vulnerabilities, of which 53 have been fixed and 7 assigned CVE IDs. Article Search Article: ase26main-p924-p doi:10.1145/3832783.3834372
	Ma, Minghua	ASE '26: "Debugging the Debuggers: Failure-Anchored ..." Debugging the Debuggers: Failure-Anchored Structured Recovery for Software Engineering Agents Chenyu Zhao, Shenglin Zhang, Yihang Lin, Wenwei Gu, Zhimin Chen, Yongqian Sun, Dan Pei, Chetan Bansal, Saravan Rajmohan, and Minghua Ma (Nankai University, China; Tsinghua University, China; Microsoft, USA; Microsoft 365, USA) Software engineering agents are increasingly deployed in evaluable engineering environments, yet post-failure recovery remains costly, manual, and largely ad hoc. Existing systems expose traces for inspection or generate follow-up feedback, but they do not turn heterogeneous runtime evidence into grounded, bounded recovery guidance for a subsequent attempt. We present PROBE, a failure-anchored framework for structured recovery in software engineering agents. PROBE organizes failed-run telemetry into structured evidence, structured diagnosis, and bounded recovery guidance, realized by a Telemetry Layer, a Diagnosis Layer, and a Guidance Gate. The Telemetry Layer preserves fine-grained runtime signals, the Diagnosis Layer fuses cross-signal evidence into a grounded diagnosis, and the Guidance Gate constructs diagnosis-derived recovery guidance only when it is evidence-grounded, actionable, and within the scope of agent-side behavior. We evaluate PROBE across three software engineering settings spanning repository-level software repair, enterprise workflow recovery, and AIOps service mitigation. On 257 initially unresolved cases, PROBE achieves 65.37% Top-1 diagnosis accuracy and a 21.79% recovery rate, outperforming the strongest non-PROBE baseline by 43.58 and 12.45 percentage points, respectively. The results reveal a substantial diagnosis-recovery gap: accurate diagnosis is necessary but not sufficient unless it can be translated into bounded guidance that the subsequent attempt can execute and verify. Beyond controlled evaluation, a Microsoft IcM prototype shows that PROBE can attach as a non-intrusive side channel to existing service-diagnosis agent workflows without changing the agent policy, toolset, or execution budget. These results suggest that telemetry-grounded, failure-anchored recovery is a practical path to improving post-failure recoverability of software engineering agents under realistic engineering constraints. Article Search Article: ase26ind-p114-p doi:10.1145/3832783.3834492 ASE '26: "When Does AI Actually Help ..." When Does AI Actually Help in Incident Response? Identifying Good First Messages in Cloud Service Incidents Minghua Ma, Rujia Wang, Chetan Bansal, Saravan Rajmohan, Yingnong Dang, and Hongyu Zhang (Microsoft, USA; Chongqing University, China) Modern cloud services increasingly rely on agentic software operations, where AI agents, rule-based automation (monitoring alerts, health checks, template runbooks), and human engineers coordinate incident response through shared discussion threads. As these systems mature, the on-call engineer faces a growing volume of machine-generated messages and must quickly identify which ones actually help, under minutes-level time pressure where every moment spent reading noise delays mitigation. We study this problem across thousands of production incidents from 5 cloud services over four years (2022 to 2026). We define a good first message (GFM): the first machine-generated message in an incident discussion thread whose specific content demonstrably influences the on-call engineer’s next investigation action. Three findings emerge. First, incident threads grew 7× longer (from a median of 4 to 30 messages) as AI agents were introduced, yet noise (messages lacking substantive technical content) decreased: among the three actor types, AI agents, rule-based automation, and humans, AI produces the lowest noise rate. Second, AI agents and automation are complementary, covering different workflow roles (e.g., diagnosis vs. monitoring) rather than duplicating each other. Third, only about one in five incidents contains a GFM; influence varies dramatically by functional role but far less by actor type: what a message says matters more than who posted it. We further show that GFMs can be surfaced automatically: σ-rank, an LLM ranker whose prompt encodes domain knowledge from the empirical study, places the GFM in the top 3 of ∼20 machine messages 89% of the time, reducing the engineer’s noise-reading burden by 7×. These results provide the first empirical evidence of how deployed AI output is actually consumed during live incidents and offer a practical mechanism to cut through information overload in time-critical incident response. Article Search Article: ase26main-p860-p doi:10.1145/3832783.3837473
	Ma, Pingchuan	ASE '26: "KQFuzz: Knowledge-Guided Fuzzing ..." KQFuzz: Knowledge-Guided Fuzzing for Quantum Libraries via Large Language Models Fuyuan Xia, Qixin Zhang, Chenhao Ying, Haojin Zhu, Shuai Wang, Yuan Luo, Pingchuan Ma, and Yuxuan Du (Shanghai Jiao Tong University, China; Nanyang Technological University, Singapore; Hong Kong University of Science and Technology, Hong Kong; Zhejiang University of Technology, China) As quantum computing continually improves, ensuring the reliability and correctness of quantum libraries has become increasingly critical. To this end, many LLM-based fuzzing approaches towards quantum libraries have been proposed to uncover potential bugs. However, these methods still suffer from limitations such as insufficient flexibility and low efficiency, which hinder the progress of the quantum computing field. To address these challenges, we propose KQFuzz, a novel knowledge-guided fuzzer for quantum libraries. It leverages comprehensive codebase knowledge to ground LLM-based test generation, synergizing this with fitness-guided evaluation and two-level mutations to explore complex execution paths and trigger potential bugs. Firstly, KQFuzz introduces a novel prompting scheme tailored to quantum programs, which strategically incorporates knowledge of the codebase to efficiently generate high-quality quantum seed programs. Moreover, we develop evaluation and mutation strategies to handle the generated seed programs, facilitating efficient fuzzing execution while further enriching the diversity of the resulting test cases. We implement KQFuzz and conduct fuzzing on three popular quantum libraries, including Qiskit, PennyLane, and Cirq. Experimental results demonstrate that our approach significantly outperforms other state-of-the-art methods, with coverage improved by up to 18.44%. During the development of KQFuzz, we discovered 13 bugs, all of which have been confirmed and 12 have already been fixed by the developers. Article Search Article: ase26main-p1509-p doi:10.1145/3832783.3834392
	Ma, Siqi	ASE '26: "RamFuzz: LLM-Guided Greybox ..." RamFuzz: LLM-Guided Greybox Fuzzing for Spatial Memory Corruption via Valid Range Violation Shangzhi Xu, Wei Song, Yuekang Li, Nan Sun, Muhammad Ejaz Ahmed, Willy Susilo, Benjamin Turnbull, Xiao Cheng, and Siqi Ma (University of New South Wales, Australia; CSIRO's Data61, Australia; University of Wollongong, Australia; Macquarie University, Australia) Spatial memory corruptions remain among the most prevalent software vulnerabilities, consistently ranking among the top CWE categories. These vulnerabilities are closely tied to the values processed by the program: when input-derived values fall outside expected ranges, memory operations may be performed beyond their allocated bounds, leading to corruption. Our pilot study on 132 realworld CVEs shows that 72.7% of spatial memory corruptions stem from such valid value violations. Although fuzzing is widely used to expose exploitable memory corruptions, systematically detecting spatial memory corruptions through fuzzing remains challenging, as it requires generating inputs that conform to complex structural formats while violating valid value ranges. Recent work leverages LLMs to generate structured inputs based on format knowledge, yet LLMs exhibit a strong bias toward well-formed outputs, leaving systematic range violations largely unexplored. In this paper, we propose RamFuzz, an approach that exploits rather than mitigates this bias to guide the fuzzing process. RamFuzz prompts LLMs to enumerate valid ranges of target file formats and deliberately assigns invalid values to seeds during fuzzing, systematically triggering spatial memory corruptions. We evaluated RamFuzz on 15 popular real-world projects with more than 1,000 stars on GitHub, RamFuzz discovered 104 previously unknown memory corruptions, of which 39 have been confirmed, and 33 have been fixed by developers. Article Search Article: ase26main-p540-p doi:10.1145/3832783.3837447
	Ma, Tao	ASE '26: "ABACI: Automated Downstream ..." ABACI: Automated Downstream Bug Resolution via Semantic-Aware Bisection and Convergent Backporting Runzhe Wang, Yuanhang Zhou, Qingming Su, Yong Yang, Xiaohai Shi, and Tao Ma (Alibaba Cloud Computing, China) Downstream Linux kernel distributions, such as AnolisOS, continuously resolve defects inherited from the upstream codebase. This process requires two labor-intensive tasks: identifying the corresponding upstream fix patches, and adapting them for successful integration into downstream. Existing approaches address these tasks in isolation and suffer from fundamental limitations. Cross-version behavioral inconsistency makes it difficult to reliably verify defect existence and localize the correct fix patch across kernel versions. Besides, even when a fix patch is identified, unresolved prerequisite dependencies and structural divergence between upstream and downstream codebases render direct application infeasible. In this work, we present ABACI, an automated tool for resolving bugs discovered in downstream kernels. ABACI performs a four-phase fix patch localization process, employing semantic-aware bisection to correctly identify the target fix patch across kernel versions despite varying crash manifestations. Then ABACI performs convergent backporting, leveraging state-convergence-based dependency discovery to find prerequisite patches and collecting associated Fixes patches to form a self-consistent patch closure, followed by LLM-based adaptation to handle residual code-level conflicts. We evaluate ABACI on 26 real-world bugs from the Anolis community. ABACI achieves a fix patch localization success rate of 88.5% and a backporting success rate of 91.3%, ourperforming state-of-the-art works. Overall, ABACI has been deployed in the Anolis community, successfully resolving 21 real-world downstream kernel bugs and demonstrating its practical effectiveness. Article Search Article: ase26ind-p55-p doi:10.1145/3832783.3834466
	Ma, Xiangxi	ASE '26: "DepUpgrade: Automating Dependency ..." DepUpgrade: Automating Dependency Upgrade through State-Path Exploration Xiangxi Ma, Yifan An, Wentong Tian, Xuanqi Wang, Qingao Dong, Xiang Gao, and Hailong Sun (Beihang University, China) Third-party dependencies frequently introduce API breaking changes, and upgrading them causes compilation or runtime failures in client applications. Existing approaches have explored automating dependency upgrades, but struggle with fixing complex issues. This is mainly because traditional methods lack semantic adaptability, while recent prompt-only LLM-based migration approaches often suffer from hallucinations and fail to navigate multi-step, cascading repairs. To solve this problem, in this paper, we propose DepUpgrade, a framework that models dependency upgrade as a state-path exploration problem. A state is a snapshot of the client codebase at a particular point during migration. Transitions between states are validated via compiler feedback and rolled back if regressions occur. Instead of performing a single-pass generation, DepUpgrade systematically explores a search space of intermediate states with the goal of reaching a successful state. DepUpgrade achieves this goal in three steps: API migration knowledge extraction, repair task formulation and state-path exploration. We evaluate DepUpgrade on a benchmark of 123 migration tasks and 18 real-world projects. Experimental results demonstrate that our framework achieves an unprecedented 96.7% full repair rate on the benchmark, outperforming other baselines. On the real-world projects, DepUpgrade fully repairs 15 of the 18 projects and leaves 31 of the 1,085 initial compilation errors unresolved. Article Search Article: ase26main-p442-p doi:10.1145/3832783.3837442
	Ma, Xiaoxing	ASE '26: "We Must Have Missed This Comment: ..." We Must Have Missed This Comment: Detecting and Repairing Stale Function References in Linux Kernel Comments Kexin Sun, Yunbo Lyu, Xutong Ma, Hongyu Kuang, Ratnadira Widyasari, He Zhang, Xiaoxing Ma, Julia Lawall, and David Lo (Nanjing University, China; Singapore Management University, Singapore; Inria, France) As the Linux kernel evolves, code comments may become outdated, as the functions they reference can be refactored or removed independently without corresponding updates to the comments. Such stale function references can mislead maintainers and thus hinder code comprehension. Prior work on detecting code-comment inconsistency mainly focused on addressing semantic misalignment between Javadoc comments and their directly annotated functions, making them inapplicable to this type of externally induced staleness in the Linux kernel. Therefore, we propose ReCite, a three-stage approach to identify and repair such stale references: (1) detecting unresolved function-form symbols—symbols in comments that appear to reference functions but for which no matching function can be found in the current codebase, (2) tracing the evolution history of each unresolved symbol through the Git history, and (3) generating LLM-based repair suggestions grounded in the evolution history and current code context. On Linux kernel v6.18-rc1, ReCite detects 869 stale references with generated repair suggestions. A manual evaluation on 200 sampled repairs shows that 178 (89.0%) provide useful repair guidance, with 85 (42.5%) directly applicable. Of our 75 submitted patches, 50 have been accepted. We also empirically study all unresolved function-form symbols. Article Search Article: ase26main-p908-p doi:10.1145/3832783.3837474
	Ma, Xiaoxue	ASE '26: "Understanding Real-World Ordering-Related ..." Understanding Real-World Ordering-Related Concurrency Bugs under Weak-Memory and Cross-Architecture Settings Shaohao Wang, Cheng Wen, Yuandao Cai, Shengchao Qin, Jie Su, Mengda He, Xiaoxue Ma, and Cong Tian (Xidian University, China; Hong Kong University of Science and Technology, China; Fermat Labs, China) Modern systems software is increasingly deployed across heterogeneous architectures such as x86, ARM, and RISC‑V, which provide substantially different memory-ordering guarantees. Under weak memory models, hardware and compilers may reorder memory operations or delay their visibility, causing concurrent code that appears correct on x86 to fail in subtle and security-critical ways. In real systems, however, such failures are not limited to instruction-level reorderings: cross-architecture execution can also expose higher-level ordering assumptions about object lifecycle and protocol state. To study this gap, we curate a dataset of 58 manually confirmed real-world concurrency bugs from the Linux Kernel and open-source projects (e.g., MySQL, MariaDB, DPDK, and sofa-pbrpc). We propose Multi-Granularity Ordering (MGO), a taxonomy that organizes these bugs into three layers: micro-instruction, resource lifecycle, and semantic-logic ordering violations. Our analysis shows that micro‑instruction bugs form the largest category in the dataset (32/58, 55.2%) and typically manifest as stale reads or missed signals, whereas resource lifecycle bugs (24/58, 41.4%) are frequently associated with severe memory-safety failures such as use‑after‑free. We further show that these layers differ in architectural exposure and repair strategies: micro-instruction bugs directly capture weak-memory anomalies, while lifecycle and semantic bugs reflect macro-level failures whose manifestation can be amplified in cross-architecture execution. Finally, we identify common mismatches between root causes and repair strategies, and summarize practical implications for future concurrency analysis tools for cross-architecture safety and reliability. Article Search Article: ase26ind-p129-p doi:10.1145/3832783.3834494
	Ma, Xing	ASE '26: "AlphaCu: A Transformation-Driven ..." AlphaCu: A Transformation-Driven Synthesis Framework for LLM-Based GPU Kernel Generation Yangjie Zhou, Xing Ma, Zihan Liu, Qing Wang, Weihao Cui, Wu Sun, Hanjing Wang, Binhang Qi, Jingwen Leng, Yun Lin, Minyi Guo, and Jin Song Dong (National University of Singapore, Singapore; Shanghai Jiao Tong University, China; Shanghai Qi Zhi Institute, China; Nanjing University, China; Harvard University, USA) Large language models show promise for code generation, yet their effectiveness in producing high-performance GPU kernels remains insufficiently understood. Recent agentic workflows improve over direct prompting through specialized generation roles and execution feedback, but our characterization of a representative workflow reveals failures in optimization-strategy selection, hardware-specific instruction realization, and shape-dependent parameter selection. We present AlphaCu, a transformation-driven synthesis framework for LLM-based GPU kernel generation. AlphaCu treats kernel generation as structured synthesis over explicit optimization decisions rather than end-to-end code emission. Specifically, AlphaCu represents these decisions as scoped transformation passes maintained across agent-coordinated synthesis stages, enabling compatibility checking and failure attribution. AlphaCu binds selected hardware-sensitive operations to pre-validated microkernels and uses target-device measurements to revise transformation choices and tune runtime configurations. We evaluate AlphaCu on 104 test cases covering single and fused operators across four GPU architectures: NVIDIA H100, A100, V100, and AMD MI210. Under comparable generation budgets, AlphaCu achieves 100% functional correctness on our benchmark suite and delivers an average speedup of 5.64× over prior LLM workflows, while remaining competitive with vendor libraries and tensor compilers. Article Search Article: ase26main-p287-p doi:10.1145/3832783.3837433
	Ma, Xutong	ASE '26: "We Must Have Missed This Comment: ..." We Must Have Missed This Comment: Detecting and Repairing Stale Function References in Linux Kernel Comments Kexin Sun, Yunbo Lyu, Xutong Ma, Hongyu Kuang, Ratnadira Widyasari, He Zhang, Xiaoxing Ma, Julia Lawall, and David Lo (Nanjing University, China; Singapore Management University, Singapore; Inria, France) As the Linux kernel evolves, code comments may become outdated, as the functions they reference can be refactored or removed independently without corresponding updates to the comments. Such stale function references can mislead maintainers and thus hinder code comprehension. Prior work on detecting code-comment inconsistency mainly focused on addressing semantic misalignment between Javadoc comments and their directly annotated functions, making them inapplicable to this type of externally induced staleness in the Linux kernel. Therefore, we propose ReCite, a three-stage approach to identify and repair such stale references: (1) detecting unresolved function-form symbols—symbols in comments that appear to reference functions but for which no matching function can be found in the current codebase, (2) tracing the evolution history of each unresolved symbol through the Git history, and (3) generating LLM-based repair suggestions grounded in the evolution history and current code context. On Linux kernel v6.18-rc1, ReCite detects 869 stale references with generated repair suggestions. A manual evaluation on 200 sampled repairs shows that 178 (89.0%) provide useful repair guidance, with 85 (42.5%) directly applicable. Of our 75 submitted patches, 50 have been accepted. We also empirically study all unresolved function-form symbols. Article Search Article: ase26main-p908-p doi:10.1145/3832783.3837474
	Ma, Zhi	ASE '26: "TLCrafter: Peeling the Layers ..." TLCrafter: Peeling the Layers of Natural Language to Reveal Temporal Logic Specifications Cheng Wen, Wenjun Ke, Xiao Liang, Zhi Ma, Xiaoyong Xue, Shengchao Qin, and Cong Tian (Xidian University, China; Northwest University, China; Peking University, China) Natural-language (NL) requirements are widely used in industrial systems, but formal verification typically requires precise temporal logic (TL) specifications. This paper presents TLCrafter, an interactive tool for translating NL requirements into TL formulas, including LTL, CTL, and STL. Given an NL requirement, TLCrafter constructs OnionL+, a hierarchical intermediate representation that supports more robust NL-to-TL formalization by combining LLM-based semantic decomposition with deterministic rule-based synthesis. Its visual interface allows engineers to inspect and correct the intermediate structure before formula generation. Experiments on domain datasets across LTL, CTL, and STL show that TLCrafter improves formula accuracy while maintaining full syntactic validity. A video of TLCrafter is available at https://youtu.be/jp-Pp_amjks. The tool and artifacts are available at https://sites.google.com/view/tlcrafter/. Article Search Article: ase26tool-p13-p doi:10.1145/3832783.3834598
	Ma, Zhirou	ASE '26: "SwiftGram: Dynamic Lexical ..." SwiftGram: Dynamic Lexical Forking for Precise and Efficient Grammar-Constrained Decoding Shuyi Ling, Liangyi Kang, Jie Liu, Shuai Wang, Zhirou Ma, and Dan Ye (Institute of Software at Chinese Academy of Sciences, China) Large Language Models (LLMs) must strictly adhere to grammatical constraints for reliable structured generation in agentic workflows, code synthesis, and domain-specific language (DSL) generation. Grammar-Constrained Decoding (GCD) enforces this by masking out tokens incompatible with the target grammar at each decoding step, and has been adopted as a core module in mainstream inference engines such as vLLM. However, existing GCD methods exhibit precision defects under grammars with overlapping terminal definitions. The misalignment between LLM tokens and grammar terminals induces terminal ambiguity, where a token admits multiple plausible terminal interpretations. Existing methods handle this imprecisely, causing both false acceptance and false rejection, while incurring high computational overhead. We propose SwiftGram, a GCD framework that incorporates dynamic lexical forking for precise token masking. By forking only at detected ambiguity boundaries, SwiftGram preserves all admissible terminal interpretations while suppressing spurious ones. It builds on Generalized LR (GLR) parsing with the Graph-Structured Stack (GSS) for compact multi-branch parsing, together with adjacency pruning and terminal tries to reduce online overhead. Experiments show that SwiftGram achieves near-zero grammar violations and no observed false rejection, whereas strong baselines remain prone to masking errors. SwiftGram improves effective throughput by up to 14.7% over the strongest baseline under rejection sampling, and achieves a 5.9× average speedup in per-step mask construction under mask-before-selection. Article Search Article: ase26main-p2654-p doi:10.1145/3832783.3834419
	Mächtle, Felix	ASE '26: "A Comprehensive Evaluation ..." A Comprehensive Evaluation of Code Language Models for Security Patch Detection Nils Loose, Joseph Bienhüls, Kristoffer Hempel, Felix Mächtle, and Thomas Eisenbarth (University of Lübeck, Germany) Automated detection of vulnerability-fixing commits (VFCs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and many fixes never receive advisories. Code language models are increasingly adopted for identifying , yet whether they can recognize a security fix from the code change itself remains unclear, as reported performance is shaped by commit messages, project-level data leakage, and uncertain data quality. We present a rigorous re-evaluation that jointly controls these factors through a unified framework consolidating 20 fragmented datasets spanning more than 180000 commits. Training 270 models from 125M to 80B parameters, we isolate the code signal under group-stratified code-only evaluation and assess the impact of model capacity and additional code context, ranging from intra-procedural enrichment to inter-procedural repository context. Model capacity yields clear but insufficient gains, and the evaluated context signals provide no reliable improvement under strict false positive budgets. At a false positive rate of 0.5 Article Search Article: ase26main-p2677-p doi:10.1145/3832783.3837538
	Madabhushi, Srinidhi	ASE '26: "Deployment Risk Assessment ..." Deployment Risk Assessment using Diff-Aware Features: A Case Study at Prime Video Mayur Premkumar Kurup, Hyunjae Suh, Swathi Vaidyanathan, Pranesh Vyas, Srinidhi Madabhushi, and Yegor Silyutin (Amazon.com, USA; University of California at Irvine, USA) At Amazon Prime Video, we face the critical operational challenge of managing code deployments during live events and rapid feature releases without causing service outages. Current change control approaches use blanket deployment freezes that block all changes regardless of risk, creating significant developer toil. While prior research has explored risky change predictors, these rely on developer-specific metadata or extensive historical data, raising privacy concerns and limiting applicability to new projects. We introduce a framework centered on diff-aware features-characteristics derived directly from code modifications. Our key contribution is the systematic identification of which quantitative metrics (code-level and change-level metrics) and qualitative indicators (coding style violations, change type classification) are necessary for risk prediction. We employ LLMs as multi-language feature extractors, demonstrating their effectiveness for code analysis beyond generation tasks and eliminating the need for language-specific tooling. We evaluated our framework on two datasets: Prime Video’s production environment and the public ApacheJIT dataset. Our best-performing model achieves an average recall of 0.83 and F1 score of 0.81 across both datasets for detecting risky code changes. Notably, ablation analysis reveals that change-level volume metrics (e.g., lines added/deleted) are noisy predictors, while structural code complexity provides a substantially stronger risk signal. These results demonstrate that thoughtful feature curation enables effective change risk assessment across different programming languages and organizational contexts while avoiding privacy concerns. Article Search Article: ase26ind-p261-p doi:10.1145/3832783.3834517
	Maddila, Chandra	ASE '26: "REAP: Automatic Curation of ..." REAP: Automatic Curation of Coding Agent Benchmarks from Interactive Production Usage Smriti Jha, Matteo Paltenghi, Chandra Maddila, Vijayaraghavan Murali, Shubham Ugare, and Satish Chandra (Meta Platforms, USA) Production deployment of AI coding agents requires fast, reproducible evaluation signals. Existing industrial practices trade off speed and fidelity: online A/B testing takes weeks and risks user experience, shadow deployment yields signals that are not reproducible across runs, and public benchmarks diverge from production workloads in language distribution, prompt style, and codebase structure. This paper presents REAP (Relevance and Execution-Audited Pipeline), an automated curation pipeline that constructs production-derived benchmarks from real developer-agent sessions without manual labeling. Such curation, while in-distribution to production usage, runs into several challenges. Untestable prompts, misaligned tests, and test flakiness all compromise evaluation reliability. While tasks can be manually audited to ensure only high-quality tasks remain in the benchmark, this approach is infeasible in the monorepo setting: the build infrastructure state is often ephemeral in large monorepos and requires the benchmark to be continuously re-curated against the current codebase. As manual verification cannot be sustained at this cadence, REAP adds an automated verification layer using LLM-based task classification, agentic test-relevance validation, and multi-run stability checks to ensure the executable benchmark yields trustworthy signals. We use REAP to curate Harvest, a benchmark where each task feeds the coding agent a real developer prompt and verifies the resulting code change against fail-to-pass tests retrieved from production. Harvest’s distribution spans more than four programming languages with a majority of tasks drawn from Hack, a meaningful divergence from public benchmarks which are skewed towards Python. Model and harness evaluations reveal that solve rates range from 42.9% to 58.2% across five frontier models, surfacing capability differences that inform concrete deployment decisions. The underlying corpus contains proprietary source code and cannot be released publicly; we share our automated curation methodology and case studies to enable other organizations to construct similar production-derived benchmarks at scale. Article Search Artifacts Available Article: ase26ind-p266-p doi:10.1145/3832783.3834519
	Maeda, Kosuke	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Magazine, Raghav	ASE '26: "eARCO: Efficient Automated ..." eARCO: Efficient Automated Root Cause Analysis with Prompt Optimization Drishti Goel, Raghav Magazine, Supriyo Ghosh, Akshay Nambi, Prathamesh Deshpande, Xuchao Zhang, Chetan Bansal, and Saravan Rajmohan (University of Illinois at Urbana-Champaign, USA; Microsoft Research, India; Inception, United Arab Emirates; Microsoft, India; Microsoft Research, USA; Microsoft, USA; Microsoft 365, USA) Root cause analysis (RCA) for incidents in large-scale cloud systems is a complex, knowledge-intensive task that often requires significant manual effort from on-call engineers (OCEs). Improving RCA is vital for accelerating the incident resolution process and reducing service downtime and manual efforts. Recent advancements in Large-Language Models (LLMs) have proven to be effective in solving different stages of the incident management lifecycle including RCA. However, existing LLM-based RCA recommendations typically leverage default finetuning or retrieval augmented generation (RAG) methods with static, manually designed prompts, which lead to sub-optimal recommendations. In this work, we leverage 'PromptWizard', a state-of-the-art prompt optimization technique, to automatically identify the best optimized prompt instruction that is combined with semantically similar historical examples for querying underlying LLMs during inference. Moreover, by utilizing more than 180K historical incident data from Microsoft, we developed cost-effective finetuned small language models (SLMs) for RCA recommendation generation and demonstrate the power of prompt optimization on such domain-adapted models. Our extensive experimental results show that prompt optimization can improve the accuracy of RCA recommendations by 21% and 13% on 3K test incidents over RAG-based LLMs and finetuned SLMs, respectively. Lastly, our human evaluation with incident owners have demonstrated the efficacy of prompt optimization on RCA recommendation tasks. These findings underscore the advantages of incorporating prompt optimization into AI for Operations (AIOps) systems, delivering substantial gains without increasing computational overhead. Article Search Article: ase26ind-p86-p doi:10.1145/3832783.3834477
	Mahmoudi, Brahim	ASE '26: "AISmellBench: A Reusable Benchmark ..." AISmellBench: A Reusable Benchmark of AI Code Smells in ML and LLM-Based Systems Brahim Mahmoudi, Naouel Moha, Quentin Stiévenart, and Florent Avellaneda (École de Technologie Supérieure de Montréal, Canada; Université du Québec à Montréal, Canada) Artificial Intelligence (AI) systems are increasingly implemented through Machine Learning (ML) pipelines and Large Language Model (LLM) integrations, where design and implementation choices are scattered across data preprocessing code, model configuration, training scripts, provider APIs, and prompt/output logic. Poorly designed choices may form AI code smells, namely recurring implementation patterns that can undermine reproducibility, robustness, maintainability, and trustworthy behavior. Yet, evaluating AI code smell detection approaches remains difficult due to the lack of reusable benchmarks with validated ground truth. We present AISmellBench, a benchmark for AI code smells built through a reproducible pipeline combining GitHub repository mining, eligibility filtering, tool-assisted identification of potential code smell instances, and manual annotation with adjudicated validation artifacts. AISmellBench brings together 1,221 AI-based Python repositories, including 888 ML repositories and 333 LLM-based repositories. The released benchmark contains 1,265 annotated Python files with 3,714 validated AI code smell instances across 31 AI code smell types. Demonstration video: https://youtu.be/xepUUGSHaiU Dataset availability: https://doi.org/10.5281/zenodo.20085308 Article Search Artifacts Available Article: ase26tool-p35-p doi:10.1145/3832783.3834605
	Mailach, Alina	ASE '26: "Fragmented Markers, Mixed ..." Fragmented Markers, Mixed Results: A Systematic Review of AI Coding Assistants and Developer Productivity Annemarie Wittig, Alina Mailach, and Norbert Siegmund (Leipzig University, Germany) AI coding assistants are increasingly embedded in software engineering practice, yet the literature still offers no cumulative, easily interpretable picture of their effects on software developer productivity. The central problem is not a lack of studies, but a lack of comparability: prior work operationalizes productivity through heterogeneous markers, settings, and reporting styles, making cross-study conclusions difficult. To address this, we conduct a staged systematic literature review. In the first stage, we synthesize studies that explicitly examine developer productivity. In the second, we extend the scope to productivity-related developer outcomes using SPACE as a theory-informed lens, capturing human-centered evidence that explicit productivity studies often omit. Across both stages, we analyze how productivity is operationalized, which confounding factors are discussed, and how reported effects are distributed. We identify 187 unique productivity and productivity-related markers, while individual studies typically only use five, revealing a broad but highly fragmented evidence base. Explicit productivity research is dominated by time-, output-, and artifact-oriented proxies, whereas the broader SPACE-aligned corpus makes satisfaction, psychological aspects, and well-being substantially more visible. Reported effects are often positive, but this pattern is stronger in perceived and tendency-based findings than in objective or statistically evaluated ones. Overall, the literature suggests that AI coding assistants can support productivity, but current evidence does not yet support simple, context-independent conclusions. The key contribution of this review is therefore a structured basis for making productivity evidence more interpretable, multidimensional, and comparable across studies. Article Search Artifacts Available Article: ase26main-p1373-p doi:10.1145/3832783.3834386
	Makihara, Erina	ASE '26: "Where Does Balance Break? ..." Where Does Balance Break? Boundary Discovery for Game Balance Testing under a Finite Simulation Budget Hiroki Mukai, Yusaku Kato, Norihiro Yoshida, Erina Makihara, and Katsuro Inoue (Ritsumeikan University, Japan) Software testing often relies on assumptions such as reproducible executions and stable correctness criteria. However, many modern software systems exhibit non-deterministic executions and large behavior spaces, making exhaustive exploration impractical and single-run judgments unreliable. These characteristics make it difficult to identify where acceptable behavior ends and problematic behavior begins. Competitive multiplayer games represent a challenging instance of such systems, where balance must be maintained so that no single strategy dominates. Even small parameter changes can trigger abrupt balance disruption, yet detecting such failures requires repeated simulations under non-deterministic outcomes and high-dimensional parameter spaces. In this paper, we formulate game balance regression testing as a boundary-discovery problem under a finite simulation budget. The objective is to efficiently identify inputs near the boundary that separates balanced and unbalanced regions. To address this problem, we propose BBExplorer, which combines multi-directional candidate generation, budget-aware two-stage screening, and adaptive step-size shrinkage for boundary refinement. Experimental results on two games with different levels of complexity show that the approach is strong in low-dimensional settings and remains effective in higher-dimensional ones. It also exhibits stable boundary behavior across unseen random seeds and threshold settings. These results indicate that BBExplorer is effective for practical balance regression testing and, more broadly, for boundary-oriented testing in non-deterministic, budget-constrained systems. Article Search Article: ase26main-p2013-p doi:10.1145/3832783.3834407
	Maltagliati, Jacopo	ASE '26: "Continuous On-Commit Certification ..." Continuous On-Commit Certification Testing of Railway Control Software: An Experience Report Jacopo Maltagliati, Salvatore De Simone, and Giovanni Denaro (University of Milano-Bicocca, Italy; Rete Ferroviaria Italiana, Italy) The regulatory standards of railway control software impose stringent certification requirements. These constraints, combined with the heterogeneity of the components, the interactive user interfaces, and the proprietary environments that characterize the development processes of this class of software, complicate the adoption of standard practices for continuous integration and continuous testing. This paper discusses our experience in supporting continuous on-commit certification testing of railway control software in an industrial setting. We describe the challenges that we addressed and the design decisions that we adopted accordingly. The result is a solution for continuous integration and continuous certification testing that decouples build, orchestration, and artifact management using isolated execution environments. It features a multi-runner model that enables efficient on-commit execution of hundreds of certification test sequences, supporting full automation of test sequences that require interactions with both the simulated environment and the driver. It aggregates the results from multiple, heterogeneous logging sources, facilitating regression testing, failure analysis, and certification reporting. Overall, our design enables continuous execution of large certification test suites while preserving reproducibility, traceability, and result analysis. Article Search Article: ase26ind-p431-p doi:10.1145/3832783.3834532
	Mamun, Md Afif Al	ASE '26: "“Impossible to Hide Secret ..." “Impossible to Hide Secret ...”: Uncovering Security and Privacy Issues in LLM-Native IDEs Mostafijur Rahman Akhond, Md Afif Al Mamun, Gias Uddin, and Song Wang (York University, Canada; University of Calgary, Canada) LLM-native IDEs (Integrated Development Environments), aka LIDEs, are designed from the ground up to work with Large Language Models (LLMs). LIDEs have found remarkable success in Software Engineering (SE) tasks such as coding, debugging, and program comprehension. LIDEs are software systems, and, like any system, they can exhibit vulnerabilities. In this paper, we study the security and privacy issues that developers reported while using popular LIDEs in their development tasks. We collected 1.1M posts from 29 popular subreddits related to LIDEs. We identified 446 posts and analyzed over 6K comments to the posts that discussed security and privacy issues in almost all popular LIDEs, such as Cursor, Copilot, Codex, etc. Using a mix of qualitative and quantitative methods, we constructed a taxonomy of the reported security and privacy issues. Our results show that most issues in LIDEs stem from system-level design choices, rather than the underlying LLMs, such as user data access, unchecked autonomous actions, etc. To overcome these issues, developers frequently relied on external safeguards like code sandboxing and manual reviewing, highlighting prevalent mistrust among developers about LIDEs. We share lessons from our study to support future design of secure and privacy-aware LIDEs. Article Search Article: ase26main-p234-p doi:10.1145/3832783.3837429
	Maniatis, Petros	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Manotas, Irene	ASE '26: "How Do LLMs Read Bug Reports? ..." How Do LLMs Read Bug Reports? An Empirical Study of Attention in LLMs for Automated Program Repair Ramtin Ehsani, Irene Manotas, Saurabh Pujar, Luca Buratti, and Preetha Chatterjee (Drexel University, USA; IBM Research, USA) Large Language Model (LLM)-based Automated Program Repair systems are advancing rapidly, yet their performance remains inconsistent. Even when provided with the same contextual information, an LLM may generate a correct patch for one bug but fail on another closely related bug. Why this happens remains poorly understood, and it is unclear how LLMs prioritize the diverse information in bug reports and whether model attention affects repair success. In this paper, we present the first empirical study of attention patterns in LLM-based program repair, providing interpretable insights into how models process bug reports and where their attention is concentrated during repair. We analyze 319 real-world Python and Java bugs from SWE-bench Verified and Multi-SWE-bench to study (RQ1) how model attention is distributed across bug report sections, (RQ2) how attention patterns within each section differ between successful and unsuccessful repairs, and (RQ3) how these patterns compare to information developers consider important for bug fixing. We find that successful repairs are characterized by diffused attention across multiple diagnostic components such as bug descriptions, stacktraces, and test cases, while failures often exhibit over-localized attention toward metadata such as version information. We further observe that stronger alignment between model attention and developer-identified key sections and phrases is associated with higher repair success. Our results provide the first empirical evidence that attention misallocation is a key factor in LLM-based APR failures, and offer actionable insights for designing more interpretable and reliable future APR systems. Article Search Artifacts Available Article: ase26main-p306-p doi:10.1145/3832783.3837434
	Mansur, Muhammed Numair	ASE '26: "Why Is This on My Bill? Documentation-Grounded ..." Why Is This on My Bill? Documentation-Grounded Rule Learning for Itemized Bill Explanation John Konstantinides, Jason Titus Lefever, Muhammed Numair Mansur, Martin Schaef, and Willem Visser (Amazon Web Services, USA; Drexel University, USA; Amazon Web Services, Germany) Complex itemized bills from services such as cloud computing, healthcare, or telecommunications can be difficult to understand because the pricing terms that determine what a customer pays are straightforward, but the eligibility rules that determine whether a given line item, a single charge for a product and quantity, qualifies for a given price are scattered across user guides, service terms, and fine print. No single document describes them all, and without them, it is difficult to explain why a specific charge appears on a bill. We present a neuro-symbolic tool that learns these eligibility rules automatically from billing data and documentation. Pricing terms are evaluated against line items to produce labelled data indicating whether each pricing term was eligible for a given line item. An LLM agent then uses this labelled data, a knowledge base of public documentation, and a small set of rule-evaluation tools to generate rules that are accurate: no rule incorrectly labels a line item as ineligible for a pricing term, and explainable: every rule is backed by a passage from the knowledge base. We showcase the tool on the AWS billing system, evaluating millions of line items across hundreds of internal accounts. The tool learns a small set of rules that, together with the pricing terms, explain the majority of observed discrepancies, and we measure documentation coverage, rule stability across sample sizes, and the impact of ML pre-seeding on discovery cost. Article Search Article: ase26ind-p112-p doi:10.1145/3832783.3834490
	Mao, Xinjun	ASE '26: "BDiff: Block-Aware and Accurate ..." BDiff: Block-Aware and Accurate Text-Based Code Differencing Yao Lu, Wanwei Liu, Tanghaoran Zhang, Kang Yang, Yang Zhang, Wenyu Xu, Longfei Sun, Xinjun Mao, Shuzheng Gao, and Michael R. Lyu (National University of Defense Technology, China; Chinese University of Hong Kong, China) Code differencing is a fundamental technique in software engineering. Traditional line-level differencing tools (e.g., Git Myers algorithm) cannot accurately identify block-level edit actions (EAs) such as block move and copy, which are common in real development. They split multi-line block edits into fragmented line-wise changes, raising developers’ cognitive overhead during code review. This paper presents BDiff, a text-based differencing algorithm capable of identifying two types of block-level EAs and five types of line-level EAs. Building on traditional differencing algorithms, we first construct a candidate set containing all possible line and block mappings. Leveraging the Kuhn-Munkres algorithm, we then compute the optimal mapping set and derive a minimal edit script (ES) that closely aligns with the original developer intent. To evaluate BDiff, we selected five state-of-the-art tools, including large language models (LLMs), as baselines, and adopted a combined qualitative and quantitative approach to assess their performance in terms of ES size, result quality, and running time. Experimental results show that BDiff produces higher-quality differencing results than baseline tools while maintaining competitive runtime performance. Our experiments also show the unreliability of LLMs in code differencing tasks and their infeasibility in terms of runtime efficiency. Based on the proposed algorithm, we have implemented an open-sourced visual differencing tool. Article Search Artifacts Available Article: ase26main-p251-p doi:10.1145/3832783.3837431
	Maquoi, Jérôme	ASE '26: "EnergyTrackr: A Modular Energy ..." EnergyTrackr: A Modular Energy Regressions Detection Tool François Bechet, Jérôme Maquoi, Luís Cruz, Benoît Vanderose, and Xavier Devroey (University of Namur, Belgium; TU Delft, Netherlands) Energy efficiency is increasingly recognized as an important dimension of software quality. As systems evolve rapidly, tracking how energy consumption changes across versions can provide valuable insights for developers and researchers. Although detecting energy regressions (i.e., unintended increases in energy consumption) remains challenging due to measurement variability and complex execution environments, recent advances now make systematic analysis practical. Still, dedicated support for monitoring energy behavior over a project's history is missing. This paper presents EnergyTrackr, a modular, open-source tool for automatically detecting, classifying, and visualizing energy regressions across a commit history. EnergyTrackr traverses a specified set of commits, builds each revision, and measures application-level energy consumption by executing the test suite using the RAPL-based Linux perf utility. It applies established best practices for measurements such as warm-up, randomized execution, repetition, and thermal control. The resulting data are analyzed through a statistical pipeline that filters outliers and classifies energy changes using multiple criteria (e.g., significance, practical impact, ...). EnergyTrackr generates interactive reports that provide a comprehensive view of energy evolution and is designed for easy integration into existing Linux workflows. A preliminary evaluation on large Java projects shows that EnergyTrackr can produce stable measurements at scale and effectively identify energy regressions. Source: https://github.com/snail-unamur/energytrackr. Screencast: https://doi.org/10.5281/zenodo.21507425. Article Search Article: ase26tool-p125-p doi:10.1145/3832783.3834640
	Marcano, Juan	ASE '26: "DragonCrawl: A Generative, ..." DragonCrawl: A Generative, Intent-Based Framework for Scalable Mobile End-to-End Testing Sowjanya Puligadda, Mengdie Zhang, Ali Zamani, Dhruva Dixith Kurra, Eric Chen, and Juan Marcano (Uber Technologies, USA) As mobile applications grow in complexity, traditional End-to-End (E2E) testing frameworks struggle with UI volatility, maintenance overhead, and cross-platform scalability. This paper presents DragonCrawl, an AI-driven mobile testing system for continuous regression testing that has evolved from embedding-based similarity matching to generative intent-based reasoning using large language models. Unlike prior LLM-based testing research focused on exploratory testing and crash detection, DragonCrawl validates specific user flows on every code change, blocking commits that break critical functionality. By leveraging GPT-4o’s multimodal capabilities, DragonCrawl achieves 91.6% pass rate on iOS and 92.2% on Android across 1,013 automated tests running continuously in CI/CD pipelines. The system reduces test onboarding time from 96-120 hours to under 4 hours and has saved an estimated 27 developer years in test maintenance effort. We present the architectural evolution from V1 (semantic embedding matching) to V2 (generative intent-based reasoning), discuss implementation challenges including token explosion and memory constraints, and report operational experience from production deployment. The integration of multimodal vision for end-state detection and tool calling for backend state transitions enables comprehensive regression testing that bridges UI interactions with system state. Our results demonstrate that AI-driven testing can maintain stability while eliminating the brittleness of traditional automated tests, enabling continuous quality assurance at scale. Article Search Article: ase26ind-p2-p doi:10.1145/3832783.3834455
	Marceca, Manuel	ASE '26: "Generation of Web Apps with ..." Generation of Web Apps with Agentic IDEs: An Empirical Assessment Manuel Marceca, Maria Teresa Rossi, and Leonardo Mariani (University of Milano-Bicocca, Italy; Gran Sasso Science Institute, Italy) Agentic IDEs are among the most significant innovations in software engineering, aiming to accelerate application development through LLM-based agents that can assist developers during development. However, their evaluation in end-to-end development tasks involving the generation of complete applications remains limited. To fill this gap, we propose a rigorous comparative analysis of three popular agentic IDEs (Copilot, Cursor, and Windsurf) in the generation of five full-stack Web applications from scratch. Results show high maturity in the generation of established patterns, such as CRUD operations and authentication features. In contrast, the generation of less common distributed architectures, such as a task queue architecture, produces significantly more errors. Overall, results show that Agentic IDEs cannot replace developers but shift their role toward building software by orchestrating LLM-based agents through natural-language instructions and iterative refinement. Yet, each agentic IDE shows its peculiarities, although differences are narrow. Article Search Article: ase26main-p1651-p doi:10.1145/3832783.3837506
	Marcozzi, Michaël	ASE '26: "Not In My Git Yard: Catching ..." Not In My Git Yard: Catching Backdoors at Commit and Release Time Dimitri Kokkonis, Michaël Marcozzi, and Stefano Zacchiroli (Université Paris-Saclay, France; CEA List, France; Télécom Paris, France) Code-level backdoors—stealthy code changes that grant hidden privileges via secret triggers—pose a persistent threat to open-source software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions. Lily offers two key contributions. First, it enhances CI-compatible fuzzing with the capability to detect triggers of suspicious behavior based on historical and current software executions. This enables fast, precise backdoor detection suitable for both CI and update validation workflows. Second, it combines code change analysis with fuzzing data to precisely point maintainers to backdoor-revealing code regions, even when release updates modify millions of lines of code. We also outline five strategies attackers could use to evade Lily, and evaluate corresponding defenses. Our experiments across hundreds of benign and backdoored commits and releases show that Lily achieves high detection accuracy with low false alarm rates, reliably identifies malicious code, resists adversarial attempts, and would have prevented real-world backdoor incidents. Article Search Article: ase26main-p379-p doi:10.1145/3832783.3834352
	Mariani, Leonardo	ASE '26: "Generation of Web Apps with ..." Generation of Web Apps with Agentic IDEs: An Empirical Assessment Manuel Marceca, Maria Teresa Rossi, and Leonardo Mariani (University of Milano-Bicocca, Italy; Gran Sasso Science Institute, Italy) Agentic IDEs are among the most significant innovations in software engineering, aiming to accelerate application development through LLM-based agents that can assist developers during development. However, their evaluation in end-to-end development tasks involving the generation of complete applications remains limited. To fill this gap, we propose a rigorous comparative analysis of three popular agentic IDEs (Copilot, Cursor, and Windsurf) in the generation of five full-stack Web applications from scratch. Results show high maturity in the generation of established patterns, such as CRUD operations and authentication features. In contrast, the generation of less common distributed architectures, such as a task queue architecture, produces significantly more errors. Overall, results show that Agentic IDEs cannot replace developers but shift their role toward building software by orchestrating LLM-based agents through natural-language instructions and iterative refinement. Yet, each agentic IDE shows its peculiarities, although differences are narrow. Article Search Article: ase26main-p1651-p doi:10.1145/3832783.3837506
	Marinov, Darko	ASE '26: "ConfFuzz: Parameter-Aware ..." ConfFuzz: Parameter-Aware Greybox Fuzzing for Configurable Cloud Systems Shuai Wang, Hao Wang, Darko Marinov, Tianyin Xu, and Yongle Zhang (University of Illinois at Urbana-Champaign, USA; University of California at Berkeley, USA; Purdue University, USA) Cloud systems are highly configurable, with hundreds to thousands of configuration parameters. Configuration-related bugs are major sources of cloud failures, yet most tests only run under default configurations, leaving systems vulnerable to untested configurations. This paper applies coverage-based greybox fuzzing to configuration testing of cloud systems. We use developer-written unit tests as fuzz drivers: they avoid the cluster-initialization overhead of system tests and thus provide the high test execution speed that greybox fuzzing demands. Since cloud systems expose hundreds to thousands of configuration parameters but any unit test typically exercises only a small subset of them (15.14% on average), we design parameter-aware mutation and fuzzing energy allocation strategies: (1) we restrict mutation to only the configuration parameters exercised by each seed, and (2) we incorporate both code coverage and configuration parameter coverage into fuzzing energy allocation, giving more effort to seeds that explore more code and parameters. We implement these ideas in ConfFuzz and evaluate it on nine widely used cloud systems. Compared with a greybox fuzzing baseline without parameter-aware mutation and energy allocation, ConfFuzz covers roughly 3.2 times more branches while exploring substantially more configuration parameters. In total, ConfFuzz and its variants have detected 125 bugs, of which 14 have been fixed and 12 more have been confirmed. Article Search Article: ase26main-p1001-p doi:10.1145/3832783.3837476
	Martignetti, Costantino	ASE '26: "AIGen: Automating AI Bill ..." AIGen: Automating AI Bill of Materials Generation through Hybrid MLOps Integration Federica Pepe, Daniele Bifolco, Costantino Martignetti, Aureliano D'Amici, Fabiano Izzo, Damian Andrew Tamburri, and Massimiliano Di Penta (University of Sannio, Italy; Smart Shaped, Italy) The responsible development and deployment of artificial intelligence (AI) systems requires rigorous documentation of their constituent artifacts, e.g., datasets, model weights, training pipelines, and runtime dependencies. Although the Software Package Data Exchange (SPDX) 3.0 standard introduced native support for AI and dataset profiles, practical tooling capable of generating standards-compliant AI Bills of Materials (AIBoMs) in an automated and extensible manner remains scarce. This paper presents AIGen, a modular AIBoM generator that produces machine-readable, interoperable inventories of AI system components that comply with the SPDX 3.0 AI profile. AIGen works on top of the MLflow MLOps framework and combines mining heuristics with Large Language Models to generate AIBoMs. A plugin interface allows practitioners to extend the tool with domain-specific collectors without modifying the core codebase, supporting heterogeneous AI frameworks such as Hugging Face, PyTorch, and TensorFlow. AIGen is designed to facilitate compliance with the European Union AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001, providing a concrete, reusable foundation for transparent, accountable AI supply chain governance. Tool URL: https://github.com/danielebifolco/AIGen Tool Video: https://youtu.be/_nAbXDWfVL4 Article Search Article: ase26tool-p57-p doi:10.1145/3832783.3834615
	Martins, Ruben	ASE '26: "Learning to Triage Vulnerability ..." Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js Ronghao Ni, Aidan Z.H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, and Kevin Cheang (Carnegie Mellon University, USA; Athanor AI, USA; University of California at Berkeley, USA) Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNNs and LLMs, trained on data derived from program analysis tool outputs (NodeMedic-FINE in our case study). The top LLM achieves F1=0.915, while the best provenance-graph-based method achieves F1=0.904. On the reports that the upstream tool flags but cannot automatically confirm, at a target of recovering 90% of the exploitable reports, the leading model eliminates 75% of the benign reports from manual review. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives among all warnings), our approach can report 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage. Article Search Article: ase26main-p1614-p doi:10.1145/3832783.3837503 ASE '26: "ProofPulse: Interactive Proof ..." ProofPulse: Interactive Proof Coverage Analysis for Dafny Álvaro F. Silva, Ruben Martins, and Alexandra Mendes (INESC TEC, Portugal; Universidade do Porto, Portugal; Carnegie Mellon University, USA) Deductive verification ensures that an implementation satisfies its specification, but successful verification does not guarantee the quality of the specification. As such, weak specifications and redundant invariants may create overconfidence in "verified" code. We present ProofPulse, a tool for Dafny that diagnoses specification quality using a three-valued proof coverage model. By analyzing proof dependencies, ProofPulse distinguishes between elements that contribute to specification intent, those used only for auxiliary checks, and those irrelevant to any proof obligation. Evaluated against an oracle of 252 programs from the dafny-synthesis benchmark, ProofPulse provides a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification and reduces false positives across all evaluated categories. These results show that proof coverage is a practical complement to verification. Although it cannot fully capture semantic intent, it can reveal weak proof coupling in programs that otherwise appear fully verified. Just as a pulse check distinguishes vitality from the mere absence of symptoms, ProofPulse exposes weaknesses in proofs that technically verify successfully but still suffer from inadequate or redundant code and specifications. Demo: https://www.youtube.com/watch?v=8pO3NAodjoQ Code: https://github.com/VeriFixer/ProofPulse Prebuilt Docker image: https://doi.org/10.5281/zenodo.21174686 Article Search Artifacts Available Article: ase26tool-p18-p doi:10.1145/3832783.3834600
	Martinson, Johan	ASE '26: "Agent-HAnS: Maintaining Feature ..." Agent-HAnS: Maintaining Feature and Code Traceability in Agentic Development Johan Martinson, Jacob Bengtsson, Moltas Hultin, Kevin Hermann, and Thorsten Berger (Ruhr University Bochum, Germany; University of Gothenburg and Chalmers University of Technology, Sweden) Agentic coding tools using LLMs enable developers to quickly generate software. However, developers quickly lose the overview over their increasingly complex codebases. During code generation, no knowledge about what features exist or where they are implemented is documented. We present Agent-HAnS, an agentic workflow which instructs the LLM to update a feature model and generate embedded feature annotations after each code-generation step. It visualizes the evolving structure on a live dashboard served via a Model Context Protocol server. We demonstrate Agent-HAnS on a C#/.NET 9 web API evolved through 27 prompts across 10 evolution steps, with most annotations maintained automatically and no active annotation effort from the developer. In a manual audit, 92% of fragment annotations and 70% of file mappings remain correct, with errors concentrating at feature merges and splits. In a user study, Agent-HAnS scored 73.9 on the System Usability Scale. Tool video: https://youtu.be/Nb-eDrGokI8 Article Search Article: ase26tool-p225-p doi:10.1145/3832783.3834652
	Masti, Daniele	ASE '26: "Don’t Retest Everything: ..." Don’t Retest Everything: Auditable Regression Scoping for Safety-Critical Systems Francesco Basciani, Daniele Masti, Patrizio Pelliccione, Alberto Petrucci, Franco Raimondi, Emerson Sales, and Paolo Serri (Gran Sasso Science Institute, Italy; Gran Sasso Tech, Italy; Thales Alenia Space Italia, Italy) In safety-critical software development, changes often span technical and organisational boundaries, e.g., repositories, interfaces, libraries, and teams. Under certification and traceability requirements, these changes create a difficult regression-testing problem: organisations must determine what must be revalidated and provide an auditable justification for those decisions. In practice, the resulting uncertainty often drives overly conservative strategies, where large portions of the system are retested after changes or updates, even when a narrower scope would suffice. In this paper, we present CoCoS, an automated regression-testing approach for safety-critical systems written in C and developed under traceability and certification constraints. Developed end-to-end with Thales Alenia Space Italia, a large international aerospace company, and grounded in avionics practice, CoCoS addresses real certification-driven needs rather than an abstract setting. It combines semantic differencing, abstract syntax tree analysis, and function-level call-graph propagation to identify semantically relevant changes across repository and component boundaries, and to derive conservative regression scopes with human-readable justifications. CoCoS prioritizes conservativeness, explainability, and auditability, thereby supporting defensible regression-scoping decisions in regulated workflows. We evaluate CoCoS in an industrial setting with Thales Alenia Space Italia, using a realistic multi-repository aerospace software environment involving application code and external libraries. The results show that CoCoS supports the conservative bounding of regression scopes while preserving compliance-oriented reasoning and providing practical evidence for test planning in safety-critical environments. Article Search Article: ase26main-p115-p doi:10.1145/3832783.3837416
	Mastropaolo, Antonio	ASE '26: "Pattern over Pixels: Measuring ..." Pattern over Pixels: Measuring Pattern Completion Bias in Multimodal Code Generation Khai-Nguyen Nguyen, Oscar Chaparro, and Antonio Mastropaolo (William & Mary, USA) Multimodal large language models (MLLMs) are increasingly used to translate webpage screenshots into front-end code, but repeated UI patterns may sway them toward visually incorrect yet pattern-consistent outputs. In this work, we test how repeated webpage patterns hurt MLLM accuracy on an objective screenshot-to-code fill-in-the-blank task. We introduce the first benchmark for visual pattern-completion bias, where one localized element in a repeated UI pattern is perturbed and the model must recover the masked width or font-size value from the screenshot and HTML context. Starting from 30 webpages curated from the Design2Code dataset, we build 1,440 evaluated screenshots spanning structural card and text-style patterns under standard and noise-overlaid conditions. We evaluate five frontier MLLMs and find that all are strongly biased toward the repeated baseline. Mean bias rate reaches 69.78% on card-width perturbations and 80.22% on text font-size perturbations, while mean accuracy is only 21.17% and 7.89%, respectively.  performs best but still drops from 68.61% accuracy on cards to 13.89% on text, while  reaches 96.11% bias on text. Noise, subtler perturbations, and boundary positions further increase bias rate. Reasoning analysis further shows that greater reasoning effort correlates with lower bias, yet qualitative evidence reveals that models can identify the anomalous element and still override it with the pattern-consistent answer. Our results identify a concrete failure mode in multimodal code generation and show that its severity is strongly associated with visual saliency. Article Search Article: ase26main-p3922-p doi:10.1145/3832783.3834443
	Maton, Megan	ASE '26: "multiplex: A Modular LLM-Based ..." multiplex: A Modular LLM-Based Mutation Framework Megan Maton, Gregory M. Kapfhammer, and Phil McMinn (University of Sheffield, UK; Allegheny College, USA) Mutation testing introduces synthetic defects into a program under test to assess test suite adequacy. While recent advances in large language models (LLMs) have led to more realistic and hard-to-kill mutants, the field is currently dominated by single-purpose research prototypes that tightly couple the mutant generation technique with the LLM provider and build environment, thereby requiring mutation testing researchers to re-implement techniques for empirical comparison. To address this challenge, this paper introduces multiplex, a modular LLM-based mutation framework. multiplex enables researchers to implement their own LLM-based mutant generation (MG) modules to prototype or compare techniques, as well as configure and create language, LLM or framework-specific modules for extended study. In addition to providing an overview of the system design and implementation, this paper demonstrates how researchers can use multiplex to prototype and compare techniques, along with sharing experiments conducted with multiplex and outlining future extensions. The tool is available at https://github.com/LLM-Mutation/multiplex, and a video demonstration is available at https://youtu.be/l-hj7Pmn3oo. Article Search Article: ase26tool-p60-p doi:10.1145/3832783.3834617
	Matragkas, Nikolaos	ASE '26: "PWCC: Probability-Weighted ..." PWCC: Probability-Weighted Combinatorial Coverage for Risk-Informed Scenario Testing of Autonomous Systems Borhaneddine Hamadou, Chokri Mraidha, and Nikolaos Matragkas (Université Paris-Saclay, France; CEA List, France) Scenario-based testing of autonomous systems faces a fundamental unsolved problem: knowing when to stop. Existing coverage metrics measure either structural diversity or combinatorial breadth, but neither tells you how much of the system’s expected real-world operation remains untested. A test suite can score well on every existing metric while systematically missing the conditions the system will actually encounter. We introduce Probability-Weighted Combinatorial Coverage (PWCC), a metric that simultaneously measures coverage of the Op- erational Design Domain (ODD) and test adequacy. PWCC learns a probabilistic model of expected operating conditions from oper- ational profiling data, uses it to assign probability mass to 𝑡-way combinations of scenario features, and declares testing adequate when the uncovered mass falls below a risk-calibrated threshold. This gives practitioners something no existing metric provides: a principled, quantitative answer to “have we tested enough?” Evaluated on four autonomous driving datasets against seven baselines, PWCC demonstrates three properties. First, it is the strongest predictor of fault detection where the operational dis- tribution carries signal, reaching Spearman 𝑟𝑠 = +0.981 on Deep- Collision — 0.167 above the best combinatorial baseline at a lower interaction order. Second, it suppresses false sufficiency: on Deep- Scenario, PWCC achieves FSR = UFC = 0 across all splits versus CC’s mean UFC ≥ 95.8%, false sufficiency eliminated entirely, and, judged at its own stopping point, surfaces 99.6% of failure-triggering com- binations where combinatorial saturation stops after 6.4% of the campaign; on failure-rich datasets UFC drops by up to 4.9×. Third, it is stable: the score varies by at most 0.006 across a ten-fold increase in Monte Carlo sample size and grows monotonically with suite size. These results show that operational probability weighting is the decisive factor in avoiding dangerous false sufficiency verdicts; and that PWCC transforms coverage from a descriptive statistic into a risk-informed stopping decision. Article Search Artifacts Available Article: ase26main-p443-p doi:10.1145/3832783.3837443
	Mazzocca, Nicola	ASE '26: "E-CoDrive: A Co-Simulation ..." E-CoDrive: A Co-Simulation Framework for Testing Energy-Critical Driving Scenarios Manfredi Napolitano, Alessandra Somma, Alessio Gambi, Andrea Stocco, and Nicola Mazzocca (University of Naples Federico II, Italy; Austrian Institute of Technology, Austria; Italian Institute of AI for Industry, Italy; TU Munich, Germany; fortiss, Germany) Autonomous driving research has largely focused on safety while giving limited attention to non-functional aspects such as energy consumption and sustainability. As Autonomous Electric Vehicles (AEVs) become increasingly common in urban traffic, understanding how complex traffic dynamics influence their energy consumption is paramount to test whether AEVs can complete trips before battery depletion. To support energy-aware scenario-based testing of AEVs, we present E-CoDrive, a framework for reproducible closed-loop driving co-simulations that integrates an energy consumption model, a micro-traffic simulator, and a high-fidelity driving simulator to test AEV software stacks in urban scenarios. This tool paper describes the architecture of E-CoDrive and demonstrates its applicability by testing an Autoware-based AEV stack. Our evaluation shows that varying traffic conditions produce substantial differences in vehicle energy consumption. The artifact is publicly available at https://doi.org/10.6084/m9.figshare.32244783, and a screencast showing the tool is available at https://youtu.be/yX9fWHqCvgc. Article Search Article: ase26tool-p162-p doi:10.1145/3832783.3834648
	McGinn, Bridget	ASE '26: "Tangent: An Empirical Study ..." Tangent: An Empirical Study of Testing Practices for LLM-Based Agent Applications Rangeet Pan, Tyler Stennett, Divya Sankar, Bridget McGinn, Alessandro Orso, Raju Pavuluri, Saurabh Sinha, and Maja Vukovic (IBM Research, USA; Georgia Institute of Technology, USA; University of Georgia, USA) Agents built on large language models (LLMs) are increasingly used to develop applications that perform complex, multi-step tasks involving reasoning, tool use, and interaction with external environments. Despite rapid advances in benchmarking LLM-based agents, little is known about how they are tested in practice. In particular, key aspects of testing---such as testing levels, objectives, data patterns, test complexity, and validation strategies---for agent applications remain underexplored. In this paper, we present an empirical study of testing practices for LLM-based agent applications using a corpus of mined open-source projects. We construct an extensive dataset of agent applications, tools, and tests, and manually label 2,572 test methods from 240 modules. From this analysis, we develop a taxonomy of 23 testing patterns across test fixtures, data, objectives, and assertions, and characterize tests by level (unit, module, integration). We complement this with structured interviews of 10 senior industry practitioners building agentic systems. Our results show that testing of LLM-based agent applications is dominated by narrowly scoped unit tests, with limited coverage of complex interactions, realistic scenarios, and non-functional requirements. Tests often rely on simplistic inputs, heavy mocking, and shallow validation, and exhibit low structural complexity. Although industry practice places greater emphasis on non-functional testing than open-source projects, both reveal common gaps, including the lack of formal testing foundations, unclear test objectives, and challenges in generating high-quality test data. Based on these findings, we identify research directions toward more systematic and rigorous testing of agent applications, including foundations for agent testability, formalized test objectives, and fault-based testing techniques tailored to agentic systems. We also release a curated dataset of testing artifacts to support future research. Article Search Article: ase26main-p87-p doi:10.1145/3832783.3837414
	McIntosh, Shane	ASE '26: "Recovering Revisions of Pull ..." Recovering Revisions of Pull Requests with Altered History Gengyi Sun, Georges Aaron Randrianaina, Tao Xiao, Yasutaka Kamei, and Shane McIntosh (University of Waterloo, Canada; Kyushu University, Japan) In pull-based development, Pull Requests (PRs) undergo peer review. To address review feedback, authors may "force-push" after amending, squashing, or rebasing commits. Such revisions can conflate PR-specific changes with updates on the base branch, hindering further review and introducing noise into PR-based datasets. In this paper, we empirically study 935,011 PRs from 1,445 well-maintained GitHub projects. We observe 568,218 force-push events in 242,624 PRs that span 1,366 projects. We denote the HEAD commits of the PR before and after force-pushing as a force-push pair, and observe that 210,837 pairs (37.1%) have a relationship that conflates PR changes with updates to the base branch. To systematically isolate PR-specific changes in such revisions, we propose AntiDiffamine---an ancestry-based approach that aligns commits on a common reference. AntiDiffamine can automatically deconflate 98.1% of the studied revisions, decreasing the diff size by one to three orders of magnitude. We also evaluate AntiDiffamine on fail-fix pairs, i.e., revisions that fix failing builds. A case study of Kubernetes reveals that 130 of 523 pairs have conflated diffs. Moreover, the fixing files identified when AntiDiffamine is applied overlap more with a human-labelled ground truth than when conflation is untreated or excluded. AntiDiffamine is a first attempt at addressing force-push-based diff conflation, which is having a real-world impact on practical and research workflows. To ease practical adoption, we provide a template GitHub Action, which scans PR updates for force-push events and applies AntiDiffamine to deconflate the diff. Article Search Artifacts Available Article: ase26main-p120-p doi:10.1145/3832783.3837417
	McMillan, Collin	ASE '26: "Programming by Chat: A Large-Scale ..." Programming by Chat: A Large-Scale Behavioral Analysis of 11,579 Real-World AI-Assisted IDE Sessions Ningzhi Tang, Chaoran Chen, Zihan Fang, Gelei Xu, Maria Dhakal, Yiyu Shi, Collin McMillan, Yu Huang, and Toby Jia-Jun Li (University of Notre Dame, USA; Vanderbilt University, USA) IDE-integrated AI coding assistants, which operate conversationally within developers' working codebases with access to project context and multi-file editing, are rapidly reshaping software development. However, empirical investigation of this shift remains limited: existing studies largely rely on small-scale, controlled settings or analyze general-purpose chatbots rather than codebase-aware IDE workflows. We present, to the best of our knowledge, the first large-scale study of real-world conversational programming in IDE-native settings, analyzing 74,998 developer messages from 11,579 chat sessions across 1,300 repositories and 899 developers using Cursor and GitHub Copilot. These chats were committed to public repositories as part of routine development, capturing in-the-wild behavior. Our findings reveal three shifts in how programming work is organized: conversational programming operates as progressive specification, with developers iteratively refining outputs rather than specifying complete tasks upfront; developers redistribute cognitive work to AI, delegating diagnosis, comprehension, and validation rather than engaging with code and outputs directly; and developers actively manage the collaboration, externalizing plans into persistent artifacts, and negotiating AI autonomy through context injection and behavioral constraints. These results provide foundational empirical insights into AI-assisted development and offer implications for the design of future programming environments. Article Search Article: ase26main-p1071-p doi:10.1145/3832783.3834377
	McMinn, Phil	ASE '26: "multiplex: A Modular LLM-Based ..." multiplex: A Modular LLM-Based Mutation Framework Megan Maton, Gregory M. Kapfhammer, and Phil McMinn (University of Sheffield, UK; Allegheny College, USA) Mutation testing introduces synthetic defects into a program under test to assess test suite adequacy. While recent advances in large language models (LLMs) have led to more realistic and hard-to-kill mutants, the field is currently dominated by single-purpose research prototypes that tightly couple the mutant generation technique with the LLM provider and build environment, thereby requiring mutation testing researchers to re-implement techniques for empirical comparison. To address this challenge, this paper introduces multiplex, a modular LLM-based mutation framework. multiplex enables researchers to implement their own LLM-based mutant generation (MG) modules to prototype or compare techniques, as well as configure and create language, LLM or framework-specific modules for extended study. In addition to providing an overview of the system design and implementation, this paper demonstrates how researchers can use multiplex to prototype and compare techniques, along with sharing experiments conducted with multiplex and outlining future extensions. The tool is available at https://github.com/LLM-Mutation/multiplex, and a video demonstration is available at https://youtu.be/l-hj7Pmn3oo. Article Search Article: ase26tool-p60-p doi:10.1145/3832783.3834617 ASE '26: "FlakeFighters: A Pytest Plugin ..." FlakeFighters: A Pytest Plugin to Detect Flaky Test Failures Michael Foster, Owain Parry, Michael Hilton, Gregory M. Kapfhammer, and Phil McMinn (University of Sheffield, UK; University of Edinburgh, UK; Carnegie Mellon University, USA; Allegheny College, USA) Flaky tests — tests which non-deterministically pass and fail against the same version of code — pose a well-established painful issue for developers due to the unpredictability of failures. The current state of practice to detect and work around flaky tests is to simply rerun them. However, this can erode confidence in failing test outcomes and represents a significant waste of time and compute resources. A better solution is to detect flaky tests based on static data (collectable without running any tests) and/or execution data (collected by running the test suite) to determine if a test failure has occurred due to flaky behaviour or a genuine bug. Several such techniques have appeared in recent literature, but these exist in isolation as prototype research tools, and typically only support Java codebases. This paper presents FlakeFighters, an extensible pytest extension that implements a "Swiss army knife" of flaky test classification tools to help developers classify the underlying cause of failing tests as genuine bugs or flakiness in Python codebases. We ran pytest with the FlakeFighters extension on 23 failing workflows from the home-assistant/core repository and found that it was able to identify all of the failing flaky tests. A video demonstration of FlakeFighters can be found at https://youtu.be/3J4odtgzQX0. Article Search Artifacts Available Article: ase26tool-p127-p doi:10.1145/3832783.3834641 ASE '26: "Marv: An Interactive Tool ..." Marv: An Interactive Tool for Visualising and Reviewing the Results of Mutation Analysis Daniel Wells, Zalán Lévai, and Phil McMinn (University of Sheffield, UK) Mutation analysis is a useful technique for both practitioners and researchers in examining the strength of a test suite. If the change introduced by a mutant cannot be detected, it may represent a "blind spot" that the test suite failed to consider. However, there are currently no publicly available tools that developers and researchers can use to examine mutants produced by the plethora of existing mutation analysis tools that currently exist for a variety of programming languages (e.g., PIT for Java and Stryker for JavaScript). This is increasingly important given the fact that nowadays, systems are composed of code written in multiple languages. Instead, code editors and diff analysers are used, which are not well optimised for this particular activity. Where tools do exist, they are focused on specific mutation tools/programming languages only. In this paper, we introduce the Marv tool (Mutations Analysis, Review and Visualisation) to specifically address this problem. Marv provides in-code visualisations of mutants and information about them from multiple mutation analysis tools simultaneously. The tool allows users to complete formal textual reviews of each mutant and can export results from all of its supported frameworks in a standardised JSON format. Marv currently includes support for 13 different mutation analysis frameworks that collectively span 12 different programming languages. A screencast demonstrating Marv is available at https://youtu.be/qMjVgXmWrnk. Article Search Article: ase26tool-p144-p doi:10.1145/3832783.3834643
	Mechtaev, Sergey	ASE '26: "Compressing Code Context for ..." Compressing Code Context for LLM-Based Issue Resolution Haoxiang Jia, Earl T. Barr, and Sergey Mechtaev (Peking University, China; University College London, UK) Large Language Models (LLMs) are now capable of resolving real-world GitHub issues. However, current approaches overapproximate the code context and suffer from two compounding problems: the prohibitive cost of processing massive inputs, and low effectiveness as noise floods the context window and distracts the model from the bug-fixing signal. Existing compression techniques fail to resolve this tension: generic compressors compromise the semantic integrity of code, while code-specific tools lack awareness of code structure and task context to preserve essential patch ingredients. To address this, we propose a novel framework consisting of two components. First, Oracle-guided Context Distillation (OCD), a context distillation algorithm that combines genetic search and delta debugging to systematically reduce code contexts to their minimal sufficient subsequence — retaining only the ingredients required for a successful fix. We use this distilled data to fine-tune , a lightweight model that learns to compress code context at inference time, filtering noise and combating distraction while preserving fix ingredients. Evaluated on SWE-bench Verified across three frontier LLMs, maintains a stable compression rate of about 6× across models, reduces the total token budget by 51.8%–71.3% relative to the uncompressed setting, improves issue resolution rates by 5.0%–9.2%, and delivers the best overall balance among effectiveness, compression ratio, and latency compared with state-of-the-art context compression baselines. Article Search Article: ase26main-p1597-p doi:10.1145/3832783.3834397
	Mehboob, Samra	ASE '26: "ReproBreak: A Dataset of Reproducible ..." ReproBreak: A Dataset of Reproducible Web Locator Breaks Thiago Santos de Moura, Leon Adamietz, Samra Mehboob, and Yannic Noller (Ruhr University Bochum, Germany) Automated GUI testing frameworks such as Cypress and Playwright rely on locators to find and interact with web elements. A locator break occurs when a structural change in the application under test causes a locator to no longer find its target element, resulting in test breakages even when the underlying functionality remains unchanged. Despite its impact on test maintenance, no dataset exists to evaluate locator fragility in Cypress and Playwright at scale. In this paper, we present ReproBreak, a dataset of reproducible locator breaks in web GUI tests. We analyzed 359 open-source repositories to identify commits that contain locator changes. To confirm whether these changes are indeed locator breaks, we reproduced them in the top 4 projects with the largest number of locator changes and found 449 locator breaks, which are provided in the dataset along with scripts for automated reproduction. We believe ReproBreak serves as a valuable artifact to support research on locator fragility, repair techniques, and test robustness. The video is available at: https://youtu.be/fM6qQhoTjqY. The dataset is at https://github.com/rub-sq/ReproBreak. Article Search Artifacts Available Article: ase26tool-p118-p doi:10.1145/3832783.3834638
	Mehra, Rohit	ASE '26: "Prompt Coach: An Empirical ..." Prompt Coach: An Empirical Evaluation of an Agentic Tutor for Learning Prompt Engineering in Software Development Rohit Mehra, Kapil Singi, Vikrant Kaulgud, Vibhu Saujanya Sharma, Swapnajeet Gon Choudhury, Swati Sharma, Adam P. Burden, and Majd Sakr (Accenture Labs, India; Accenture, India; Accenture, USA) Prompt engineering has emerged as a critical yet undertaught skill for software developers, one that traditional learning approaches are ill-equipped to support given its evolving, interactive, and context-dependent nature. In this paper, we introduce Prompt Coach (PC), an agentic tutor that helps developers learn how to craft high-quality code-generation prompts through Socratic guidance embedded in-flow within their IDE. PC evaluates prompt quality across multiple dimensions and surfaces targeted questions to guide self-correction, grounded in the developer's codebase and the behavior of the target LLM. We present an early empirical study with 15 professional developers combining quantitative prompt quality scoring with qualitative perception measures. Participants showed statistically significant improvements after a single 60-minute session, with the largest gains across dimensions commonly overlooked by developers. They also reported strong trust, high adoption readiness, and unanimous agreement that PC improved their prompt-writing skills. Article Search Article: ase26ind-p91-p doi:10.1145/3832783.3834478 ASE '26: "Agents That Teach: Towards ..." Agents That Teach: Towards Designing Incidental Learning Back into AI-Assisted Software Development Rohit Mehra, Samdyuti Suri, Prithviraj K. Tagadinamani, Kapil Singi, Vikrant Kaulgud, and Adam P. Burden (Accenture Labs, India; Accenture, USA) AI coding agents are rapidly reshaping how software is built, with developers increasingly delegating substantial coding tasks to autonomous agents in pursuit of higher productivity. While the gains are real, they come at the cost of incidental learning. Developers historically acquired informal knowledge through effortful problem-solving, and this has long shaped how software engineering expertise develops. However, with over-reliance on agentic coding, unpracticed skills could atrophy silently over time. As this learning pathway is short-circuited, developers risk accruing Knowledge Debt, a developer-level analogue of Technical Debt, where changes the agent executes that the developer cannot fully understand accrue over time. In this paper, we argue that incidental learning will not re-emerge on its own and must be consciously designed back into developer-agent interactions, and propose six design principles to guide such systems. We then present SHIELD, a multi-agent system grounded in the notion of "agents that teach", that operationalizes these principles by leveraging the AI coding agent's own reasoning to surface contextual, out-of-band learning moments without disrupting developer flow. Through this work, we envision a path toward learning-aware development environments where productivity and learning are complementary, not competing. Article Search Article: ase26nier-p97-p doi:10.1145/3832783.3834557
	Mendes, Alexandra	ASE '26: "ProofPulse: Interactive Proof ..." ProofPulse: Interactive Proof Coverage Analysis for Dafny Álvaro F. Silva, Ruben Martins, and Alexandra Mendes (INESC TEC, Portugal; Universidade do Porto, Portugal; Carnegie Mellon University, USA) Deductive verification ensures that an implementation satisfies its specification, but successful verification does not guarantee the quality of the specification. As such, weak specifications and redundant invariants may create overconfidence in "verified" code. We present ProofPulse, a tool for Dafny that diagnoses specification quality using a three-valued proof coverage model. By analyzing proof dependencies, ProofPulse distinguishes between elements that contribute to specification intent, those used only for auxiliary checks, and those irrelevant to any proof obligation. Evaluated against an oracle of 252 programs from the dafny-synthesis benchmark, ProofPulse provides a high-precision signal for specification weaknesses, particularly unnecessary preconditions and vacuous proofs. With unsat-core minimization, ProofPulse achieves perfect precision for precondition classification and reduces false positives across all evaluated categories. These results show that proof coverage is a practical complement to verification. Although it cannot fully capture semantic intent, it can reveal weak proof coupling in programs that otherwise appear fully verified. Just as a pulse check distinguishes vitality from the mere absence of symptoms, ProofPulse exposes weaknesses in proofs that technically verify successfully but still suffer from inadequate or redundant code and specifications. Demo: https://www.youtube.com/watch?v=8pO3NAodjoQ Code: https://github.com/VeriFixer/ProofPulse Prebuilt Docker image: https://doi.org/10.5281/zenodo.21174686 Article Search Artifacts Available Article: ase26tool-p18-p doi:10.1145/3832783.3834600 ASE '26: "DSpec2Test: Specification-Driven ..." DSpec2Test: Specification-Driven Test Generation in Dafny Sofia Vieira Pinto, Álvaro F. Silva, João Pascoal Faria, and Alexandra Mendes (INESC TEC, Portugal; Universidade do Porto, Portugal) Verification-aware languages, such as Dafny, integrate logical constructs into code and enable automatic verification of program correctness. However, tests remain helpful in scenarios that verification alone does not address (e.g., to support test-driven development). Existing Dafny test generation tools are implementation-based, limiting their applicability in this context. We present DSpec2Test, a specification-driven test generation tool for Dafny that automatically derives tests from formal specifications, without considering implementation details. Our tool extends Dafny's generate-tests command with a new black-box mode based on Disjunctive Normal Form (DNF) equivalence class partitioning and optional Boundary Value Analysis (BVA). DSpec2Test relies on the Z3 SMT solver to synthesize inputs and expected outputs that meet the specification-derived constraints. We evaluate DSpec2Test on programs from DafnyBench mutated using MutDafny and compare it against Dafny's existing implementation-driven Block mode. DSpec2Test achieves a 93.9% mutation kill rate on a dataset of 131 mutants, outperforming Block's 82.4%, and uniquely killing 17 mutants. These results suggest that specification-driven testing is an effective and complementary approach for testing Dafny programs. Demo: https://youtu.be/mK1EeJfinRQ Code: https://github.com/VeriFixer/DSpec2Test Prebuilt docker image: https://doi.org/10.5281/zenodo.21191158 Article Search Artifacts Available Article: ase26tool-p85-p doi:10.1145/3832783.3834629
	Menendez, Hector	ASE '26: "Quantum Squeeziness: An Information ..." Quantum Squeeziness: An Information Theoretical Metric for Quantum Software Testability Avner Bensoussan, Hector Menendez, and Mohammad Reza Mousavi (King's College London, UK) Testability—the degree to which faults can be revealed and diagnosed—has long been fundamental in software engineering but remains largely unexplored for quantum software. This work presents the first formalisation of testability for quantum programs, adapting classical concepts to quantum computation. We introduce Quantum Squeeziness, an information-theoretic metric inspired by classical squeeziness, to quantify how faults are masked and prevented from propagating to observable outcomes. We treat it as an inverse measure of testability: higher squeeziness implies stronger fault masking and reduced detectability. We propose an efficient method to compute Quantum Squeeziness and validate it through large-scale quantum mutation analysis. Across more than 50k mutants, we observe a strong negative correlation between squeeziness and mutation score, showing that higher squeeziness predicts lower testability. We further introduce a technique that constrains where and how perturbations are injected, reducing cost while preserving accuracy. The computation is 15% faster than a standard error-propagation baseline, while the optimised variant, FastSqueeziness, reduces mean runtime from 3200s to 189s (16.9 times speedup) with 95% accuracy. By establishing a rigorous foundation of testability for quantum software, this work opens new directions at the intersection of software engineering, quantum information theory, and testing. Beyond testing and debugging, it also supports applications in quantum error mitigation and correction, enabling principled assessment and improvement of program robustness. Article Search Artifacts Available Article: ase26main-p151-p doi:10.1145/3832783.3834341
	Meng, Linghan	ASE '26: "No Isolated Evolution, No ..." No Isolated Evolution, No Blind Search: Memory-Guided Prompt Co-evolution for Industrial Multi-agent Vulnerability Detection Jie Xu, Zihan Wu, Yun Peng, Chun Yong Chong, Linghan Meng, Kui Liu, and Xiaohua Jia (City University of Hong Kong, Hong Kong; Chinese University of Hong Kong, Hong Kong; Monash University, Malaysia; Huawei Technologies, China) Large Language Model (LLM)-based multi-agent systems have shown promise for automated vulnerability detection, but our industrial deployment reveals two limitations: 1) each agent's prompt is typically optimized in isolation, degrading global end-to-end performance; and 2) evolutionary prompt search lacks memory across iterations, wasting computation costs. To address these limitations, we propose MemCo, a memory-guided prompt co-evolution framework applied to industrial vulnerability detection. First, MemCo takes an end-to-end prompt co-evolution strategy, which evaluates prompts based on the system's final output rather than assessing each agent in isolation. In each evolutionary iteration, only the prompts of agents responsible for the misclassification undergo further evolution, thereby enhancing the system's global accuracy. Second, MemCo adopts a memory-guided search mechanism, which edits prompts based on records of successful and failed modifications. This reduces redundant blind exploration and significantly lowers computation costs. Comprehensive experiments show that MemCo improves Macro-F1 by +8.4 to +18.0 points on public benchmarks and up to 36.9% relative improvement on a proprietary industrial benchmark, while reducing per-generation evolution tokens by 48.5% and inference tokens by 63.8%. MemCo is deployed as a vulnerability detection assistant in our production security pipeline. Article Search Article: ase26ind-p297-p doi:10.1145/3832783.3834522
	Meng, Mark Huasong	ASE '26: "A Longitudinal Study of Android ..." A Longitudinal Study of Android Apps Signing Key Protection Mark Huasong Meng, Qing Zhang, Weirao Lu, and Chunyang Chen (University College Dublin, Ireland; JD Group, China; TU Munich, Germany) Android app signing relies on developer-managed credentials, making secure key protection essential for the integrity of the software supply chain. A recent platform key leakage incident involving two major OEM manufacturers demonstrates that even robustly designed signing mechanisms can be compromised due to developers' oversight. In this work, we conduct a longitudinal ecosystem study to characterize this threat by mining public repositories for Android signing credentials, recovering compromised keys via exposed passwords, and matching them against signatures from over 4,000 apps collected from major stores and OEM system images. Our analysis identifies 5,673 compromised keystores on GitHub and 26 unique certificates linked to 278 real-world apps. These include 26 third-party apps in public app stores and 252 preinstalled apps from seven manufacturers, collectively affecting over 10 billion users. We demonstrate the practical exploitability of these leaks through a proof-of-concept app replacement attack and identify spillover risks in non-smartphone platforms, including a popular automotive head-unit platform installed in over 1,100 vehicle models. Our results reveal that signing-key mismanagement is a systemic risk, underscoring the need for more rigorous key-management support in Android release engineering and distribution infrastructures. Article Search Article: ase26main-p3058-p doi:10.1145/3832783.3834428
	Meng, Ruijie	ASE '26: "Hybrid Fuzzing in Input Generation ..." Hybrid Fuzzing in Input Generation Logic Siwei Wei, Shihao Zhu, Ruijie Meng, and Yan Cai (Institute of Software at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China; National University of Singapore, Singapore) The core challenge of fuzzing is to consistently generate test inputs that are both syntactically valid and semantically diverse. However, mutation-based coverage-guided fuzzing often struggles to achieve this, especially for highly structured formats. Two lines of work have emerged to address this challenge: (1) hybrid fuzzing uses constraint solving to drive execution toward hard-to-cover program states to increase semantic diversity, and (2) generator-based fuzzing relies on predefined or synthesized input-generation programs to ensure syntactic validity. Both approaches, however, have significant limitations. (1) In hybrid fuzzing, solved inputs are fed back into the fuzzing queue for byte-level mutation, which often breaks syntactic structure (e.g., checksums and cross-field dependencies) and causes early rejection. (2) In generator-based fuzzing, semantic diversity is constrained by static generators based on domain knowledge; although recent work introduces generator mutations, they remain blind and therefore have limited adaptability to the target program’s logic. In this paper, we present hybrid generator space fuzzing, a method that combines the strengths of hybrid fuzzing and generator-based fuzzing to improve the syntactic validity and semantic diversity of test inputs. The key idea is to treat input generators, rather than test inputs, as the unit of targeted solving, and to use the LLM as constraint solver to derive new generators. This design offers two benefits. First, compared with hybrid fuzzing, it preserves syntactic validity because inputs are generated directly from evolving generators rather than through byte-level mutation of solved seeds. Second, compared with generator-based fuzzing, it overcomes the limitations of static generators and blind generator mutations, enabling the fuzzer to adapt to target program logic and explore a broader semantic space. Building on this concept, we implement GenEvo, an LLM-driven hybrid generator space fuzzer. Our evaluation on a large set of real-world programs shows that GenEvo, using a locally deployed medium-sized LLM, significantly outperforms competitive baselines (including general-purpose, hybrid, structure-aware, and LLM-assisted fuzzers) in both branch coverage (with an average improvement of 98.3%) and vulnerability discovery. Furthermore, GenEvo has discovered 25 previously unknown vulnerabilities in these extensively-tested programs. Article Search Article: ase26main-p2343-p doi:10.1145/3832783.3834412
	Meng, Shuo	ASE '26: "CIPIHunter: Detecting Configuration-Induced ..." CIPIHunter: Detecting Configuration-Induced Prediction Instability in Deep Learning Frameworks Yanzhou Mu, Shuo Meng, Mijung Kim, Xiang Chen, Chunrong Fang, Zhenyu Chen, and Juan Zhai (UNIST, Republic of Korea; Nanjing University, China; Nantong University, China; University of Massachusetts at Amherst, USA) Deep learning (DL) frameworks support diverse execution configurations, including precision modes and model optimizations. Even with a fixed model, input, and framework version, changing these configurations can change model predictions, causing Configuration-Induced Prediction Instability (CIPI). CIPI arises when configuration-dependent numerical perturbations propagate and cause potentially harmful model-level behavior. Existing API-level and model-level testing approaches are not well suited to detecting CIPI, as these approaches lack configuration-conditioned exploration and propagation-aware diagnosis. Therefore, we present CIPIHunter, which combines controlled configuration-pair testing, sensitivity-oriented mutation, feedback-guided search, and intermediate tracing to localize suspicious operators or operator groups. On 13 PyTorch models under a 100-round budget, CIPIHunter reports the highest raw CIPI count and 22 deduplicated Type I manifestations, 83.3% more than the strongest baseline, while remaining competitive in overall deduplicated manifestation coverage. In total, we submit 29 PyTorch issue reports. Developers have acknowledged eight, rejected five, and marked four as duplicates; nine remain pending, and three have been closed without an explicit determination. Separately, three reports are labeled “high-priority”. These results demonstrate the practical utility of CIPI testing for framework quality assurance. Article Search Article: ase26main-p163-p doi:10.1145/3832783.3834345
	Meng, Wei	ASE '26: "When Extensions Lie: Large-Scale ..." When Extensions Lie: Large-Scale Study of Privacy Policy Compliance in Browser Extensions Zilun Wang, Zeyang Zhuang, Mingxue Zhang, Wei Meng, and Michael R. Lyu (Chinese University of Hong Kong, China; Zhejiang University, China; Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security, China) Browser extensions can pose significant privacy risks to end users due to their complex permission mechanisms and high privilege levels. Modern websites increasingly embed sensitive personal data within HTML elements, making such threats even more insidious. Although prior studies have examined browser extension privacy risks from different perspectives, they are typically constrained to specific sensitive data sources or a set of extensions tested on a few popular websites. To enable a comprehensive compliance check of browser extensions' privacy practices at scale, we develop an automated dynamic analysis framework, ExtPolice. It applies LLM-based techniques to identify sensitive web content embedded in web pages, performs a multi-type taint analysis in the browser to comprehensively track sensitive data flows across browser components, and checks the compliance of such flows against the extension's privacy policy disclosures. We apply ExtPolice to evaluate 149,216 Chrome extensions across 7,200 unique web pages and identify 2,246 extensions with policy violations, enabling scalable analysis of policy compliance for browser extensions. Our study uncovers thousands of policy violations potentially affecting up to tens of millions of users, highlighting major gaps in current extension-store review processes. Article Search Article: ase26main-p741-p doi:10.1145/3832783.3837459
	Meng, Xiangxin	ASE '26: "How Quantum Bugs Live and ..." How Quantum Bugs Live and Die: A Lifecycle-Based Empirical Study of Bugs in Quantum Software Yasai Shi, Xiangxin Meng, Xiangjie Huang, Jian Zhang, Tianyu Wo, and Xu Wang (Beihang University, China) Despite growing evidence that bugs in quantum software exhibit distinctive characteristics, existing studies are typically scoped to individual frameworks or single quality attributes and do not examine how quantum-specific bugs behave across the broader software lifecycle. To address this gap, we construct QBugsSet, a lifecycle-based benchmark containing 2,429 bugs and 1,793 realistic negative samples, mined from real GitHub bug-fixing commits in the Qiskit, Cirq, and PennyLane ecosystems, and use it to conduct a comprehensive empirical study comparing quantum-specific and classical bugs across lifecycle distribution, bug-fix latency and pre-fix spatial propagation, repair burden, and LLM-based debugging effectiveness. We find that quantum-specific bugs are more concentrated in semantically critical stages, tend to persist longer before repair (median 17 vs. 7 days), and more often require coordinated multi-hunk repairs (37.8% vs. 27.3%). These lifecycle characteristics highlight a practical limitation of current automation: even the best frontier LLM achieves an end-to-end full repair rate of only 3.82% on quantum-specific bugs, compared with 8.51% on classical bugs. Overall, these findings provide evidence-based guidance for future debugging support that integrates stronger quantum-aware semantic reasoning with broader repository context. Article Search Article: ase26main-p3477-p doi:10.1145/3832783.3834439
	Menghi, Claudio	ASE '26: "Test Suite Generation for ..." Test Suite Generation for Simulink Models: An Experience with Reactis Andrea Bombarda, Nunzio Marco Bisceglia, Marco Saini, Federico Formica, Angelo Gargantini, and Claudio Menghi (University of Bergamo, Italy; Gran Sasso Science Institute, Italy; McMaster University, Canada) Testing Simulink models is a widely recognized, relevant, and challenging problem for automated software engineering. It is relevant to industry practitioners since Simulink is a development and simulation language widely used by the Cyber-Physical System (CPS) industry. It is challenging since CPS are usually complex, entail many components, and failures are not easily identifiable without automated support. This paper reports our experience in applying Reactis, an industrial tool for testing Simulink models, to the ten Cyber-Physical Challenges Simulink models from Lockheed Martin. We considered 48 requirements from these challenge models. We assess the effectiveness of Reactis in identifying failure-revealing test cases and its efficiency. We compare our results and those from an academic testing tool (HC), and two model checking tools (QVtrace and CoCoSim). Our results show that Reactis could return a failure-revealing test case for a requirement that was considered correct. They also show that the efficiency of Reactis is comparable to that of existing tools. Article Search Article: ase26ind-p98-p doi:10.1145/3832783.3834483
	Meraj, Sabbir Hussain	ASE '26: "An Empirical Study of Data ..." An Empirical Study of Data Access Practice in Android AR Apps to Understand User Privacy Risks Sabbir Hussain Meraj, Long Trac, Xiaoyin Wang, Xusheng Xiao, and Wei Wang (University of Texas at San Antonio, USA; Arizona State University, USA) Mobile Augmented Reality (AR) applications have rapidly expanded across domains such as gaming, education, and healthcare. However, AR's reliance on continuous camera input and access to sensitive data, such as faces and the surrounding environment, raises major privacy concerns. Adhering to best privacy practices requires applications to clearly disclose their use of sensitive data and follow the Principle of Least Privilege (PoLP). This paper presents an empirical study of 179 Android AR applications to assess their data access behaviors and evaluate whether these practices are upheld in the real world. To this end, we developed a novel static analysis technique to examine data accesses of these apps and identify potential privacy risks. Our analysis centers on core AR components, namely anchors and trackables, which link virtual content to real-world entities. Our findings revealed that AR apps often access sensitive data without adequate disclosure and frequently access more data than their functionality requires through unrestricted SDK APIs. Notably, our analysis identified 58 instances of undisclosed access to facial data, 2D images, and skeletal information, and 82 instances of PoLP violations through overly broad data access. A subset of these findings was further confirmed through dynamic instrumentation. Furthermore, our analysis suggests that protecting user privacy in AR apps can benefit from fine-grained access control, AR SDK API redesign, automated disclosure verification, and control/data-flow analysis. Particularly, there are 317 common call paths among the 754 AR-related paths we analyzed, suggesting that many AR apps share similar data usage patterns that can be leveraged for efficient privacy auditing and anomaly detection with manageable overhead. Article Search Artifacts Available Article: ase26main-p1726-p doi:10.1145/3832783.3834402
	Mi, Penghui	ASE '26: "OpsLens: Runbook-Free Root ..." OpsLens: Runbook-Free Root Cause Analysis via Multi-agent Collaboration and Tool Management Haiyu Huang, Jiewei Lyu, Gou Tan, Pengfei Chen, Zhihan Jiang, Guangba Yu, Penghui Mi, Fuqiang Wang, Jian Han, Chongkang Tan, and Michael R. Lyu (Sun Yat-sen University, China; Chinese University of Hong Kong, China; Huawei, China; Independent Researcher, China) Root Cause Analysis (RCA) is critical for cloud service reliability, requiring correlation of multi-modal observability data (i.e., traces, logs, and metrics) to identify failure causes. Current LLM-based RCA approaches face two key limitations: over-reliance on system-specific artifacts (e.g., runbooks), limiting transferability; and difficulty ensuring the quality and reuse of LLM-generated diagnostic tools across modalities. To address these issues, we propose OpsLens, an RCA framework that combines modality-specialized multi-agent collaboration with quality-focused tool management , including feedback-driven refinement and a tool graph with scoreboard. On OpenRCA (335 real-world incidents from three production systems), OpsLens achieves a score rate of 0.80, outperforming baselines by 1.79–4.75×. More importantly, OpsLens has been tested on Platform A in Huawei since June 2025, achieving over 80% RCA accuracy across two industrial datasets and reducing diagnosis time from over 1 hour to under 5 minutes. Article Search Artifacts Available Article: ase26ind-p181-p doi:10.1145/3832783.3834501
	Miao, Weikai	ASE '26: "Clarity Is Not Assumed: Understanding ..." Clarity Is Not Assumed: Understanding LLM-Based Code Generation under Ambiguous Requirements Di Yang, Xinou Xie, Xiuwen Yang, Ming Hu, Yihao Huang, Yueling Zhang, Weikai Miao, Ting Su, Chengcheng Wan, and Geguang Pu (East China Normal University, China; Shanghai Innovation Institute, China) Software requirement ambiguity is ubiquitous in real-world development, stemming from the inherent imprecision of natural language and the varying interpretations of stakeholders. While Large Language Models (LLMs) have demonstrated impressive capabilities in generating code from precise specifications, such ambiguity poses a significant obstacle to reliable automated code generation. Existing benchmarks typically assume clear and unambiguous requirements, leaving an empirical gap in understanding how LLMs behave when faced with the inherent uncertainty of real-world software requirements. In this paper, we introduce Orchid, a code generation benchmark specifically designed with ambiguous requirements. It comprises 1,304 function-level tasks covering four distinct types of ambiguity: lexical, syntactic, semantic, and vagueness. Leveraging this dataset, we conduct the first systematic empirical study to evaluate the impact of requirement ambiguity on LLM-based code generation. Our results demonstrate that ambiguity consistently degrades the performance of all evaluated LLMs, with the most pronounced negative effects observed in highly advanced models. Furthermore, we observe that LLMs frequently produce functionally divergent implementations for the same ambiguous requirement and lack the capability to identify or resolve such ambiguity autonomously. These findings reveal a significant performance gap between clear and ambiguous requirements, underscoring the urgent need for ambiguity-aware techniques in the next generation of automated software engineering tools. The Orchid benchmark is publicly available at https://huggingface.co/datasets/SII-YDD/Orchid. Article Search Article: ase26main-p1878-p doi:10.1145/3832783.3834403
	Ming, Zhong	ASE '26: "Beyond Benchmarks: A Case ..." Beyond Benchmarks: A Case Study of LLM-Generated Verus Specification Failures on Asterinas Vostd Dugang Liu, Ding Wang, Chao Jiang, Cheng Wen, Zhiwu Xu, Zhong Ming, Yuwei Liu, Xinyi Wan, and Lin Huang (Shenzhen University, China; Ant Group, China) Large language models (LLMs) have recently shown promise in automating formal specification generation, but their effectiveness has mainly been demonstrated on self-contained benchmark tasks. This paper examines the changes that occur when LLM-generated specifications are applied to an industrial verification project. To answer this question, we conducted experiments on Asterinas OSTD's Vostd repository, a Rust-based OS-kernel verification codebase built around cross-file dependencies and Entity--Model proof abstractions. We analyze six formal verification targets spanning 156 function-level tasks, 50 Rust source files, and 7,149 lines of code; the failure corpus contains 1,587 reviewed failure episodes nested within 270 model-specific repair traces produced by DeepSeek-V4-Flash, GPT-4o, and Qwen-Coder. Our results show that existing methods effective on benchmarks face significant challenges on Vostd, and that framework customization for industrial validation is necessary and has considerable potential. LLM-generated specifications break in systematic rather than random ways: they cluster across four verification stages (i.e., repository integration, Verus legality, semantic modeling, and proof construction), and their distributions vary across models and targets. We further show that verifier diagnostics do not always identify the true source of failure, and that verifier-guided repair can regress or stall rather than converge. These findings indicate that LLM-generated specifications fail not merely because industrial code is harder, but because failures are structured, stage-dependent, and often repaired in the wrong direction. Future evaluation and tooling should therefore move beyond final pass/fail outcomes and account for where specifications break, whether diagnostics identify the real cause, and whether repair makes progress or simply cycles through new errors. Article Search Artifacts Available Article: ase26ind-p194-p doi:10.1145/3832783.3834504
	Minhas, Muhammad	ASE '26: "Can Formal Specifications ..." Can Formal Specifications Be Synthesized from Tests Alone? Tianhai Liu, Maximilian Müller, Tobias Hey, Vitus Lüntzel, Muhammad Minhas, Anne Koziolek, and Bernhard Beckert (KIT, Germany) Formal specifications offer strong guarantees, but remain costly to write manually. Recent LLM-based approaches automate this by inferring specifications from source code, yet their reliance on white-box access poses barriers to industrial adoption due to intellectual property risks and deployment costs. Our approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden. Candidate specifications are validated locally using bounded model checking, with feedback guiding iterative refinement. Initial results on the SpecGenBench benchmark suggest that tests can guide LLMs towards meaningful Java Modeling Language specifications, while also highlighting checker compatibility and diagnostic feedback as key challenges for reliable refinement. Article Search Artifacts Available Article: ase26nier-p62-p doi:10.1145/3832783.3834549
	Miranda, Brando	ASE '26: "A Few Pages of Markdown: Committed ..." A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, and Sanmi Koyejo (Stanford University, USA; Carnegie Mellon University, USA; Grid Dynamics, USA) Coding agents increase development velocity but also technical debt. Prior work reports only average effects across adopters, hiding wide differences between teams. We introduce RAMP (Repository AI Maturity Profile), a four-level cumulative maturity model grounded in version-controlled artifacts that teams commit to configure AI tools. RAMP runs from behavioral rules and coding standards through named agent definitions to multi-agent orchestration, with observed practice concentrated in the first three levels. Across 441 repositories the levels behave as a cumulative scale, and independent human annotation reproduces RAMP’s repository-level labels on 97 Article Search Article: ase26main-p2970-p doi:10.1145/3832783.3837546
	Mirandola, Raffaela	ASE '26: "TraceGate: A Framework for ..." TraceGate: A Framework for Policy-Controlled Failure Evidence in LLM-Assisted Program Repair Nicolas Schuler, Vincenzo Scotti, and Raffaela Mirandola (KIT, Germany) TraceGate is a reusable research artifact for policy-controlled disclosure of crash evidence in LLM-assisted program repair. Rather than relying on fixed evidence bundles or unconstrained LLM-driven tool usage, TraceGate mediates the repair process by capturing structured crash snapshots, selecting evidence and budget actions according to configurable policies, materializing the selected evidence for existing repair backends, validating candidate patches, and logging decisions and outcomes. The artifact provides backend adapters, benchmark workflows, evaluation scripts, and recorded logs to enable reproducible studies of failure-time observability and cost-success trade-offs. In evaluations across four Python benchmarks, five repair backends, and three model sizes, TraceGate recovered an average of 20.5% of residual failures, i.e., tasks that remained unsolved after the underlying backends had exhausted their own repair attempts. Screencast: https://youtu.be/Gcr6A7tVBis Artifact: https://github.com/NicolasSchuler/tracegate Data: https://zenodo.org/records/19678467 Article Search Artifacts Available Article: ase26tool-p6-p doi:10.1145/3832783.3834596
	Misir, Mustafa	ASE '26: "SustainSR: Interpretable OSS ..." SustainSR: Interpretable OSS Sustainability Prediction via Symbolic Regression Yang Deng, Mustafa Misir, Jinfu Chen, and Jifeng Xuan (Wuhan University, China; Duke Kunshan University, China) Open-source software (OSS) has become a foundational component of modern software ecosystems. Early prediction of OSS sustainability is crucial for identifying potential risks and supporting timely intervention.Existing approaches formulate OSS sustainability prediction task as a binary classification problem using Deep Learning (DL) models.However, their black-box nature obscures the decision process and undermines the credibility of the predictions.To address this limitation, we propose SustainSR, an interpretable symbolic regression–based method for OSS sustainability prediction.SustainSR reformulates prediction task as a function-learning problem and uses Genetic Programming (GP) algorithm to learn explicit sustainability expressions.We further apply Taylor expansion to quantify feature importance and pairwise interactions.The quantified results facilitate early risk identification and actionable intervention guidance.We evaluate SustainSR on Apache and GitHub projects from three dimensions: fitting performance, predictive performance, and interpretability.Results show that SustainSR significantly outperforms most baselines, it improves AUC by 1%-4% and F1avg by 3%-7% over the best-performing baseline.Case studies further demonstrate that SustainSR offers actionable sustainability insights to support risk identification, project selection, and community governance.Overall, SustainSR provides an effective and interpretable solution for OSS sustainability analysis, bridging the gap between predictive performance and interpretability. Article Search Article: ase26main-p823-p doi:10.1145/3832783.3834366
	Miyazaki, Keisuke	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Mockus, Audris	ASE '26: "Automating Low-Risk Code Review ..." Automating Low-Risk Code Review at Meta: RADAR, Risk Calibration, and Review Efficiency Audris Mockus, Peter C. Rigby, and Nachiappan Nagappan (University of Tennessee, USA; Meta, USA; Concordia University, Canada) Article Search Article: ase26ind-p116-p doi:10.1145/3832783.3834493 ASE '26: "The Ground Is Shifting: A ..." The Ground Is Shifting: A Reflection on the Foundations of Software Measurement Thomas Bock, Audris Mockus, and Bogdan Vasilescu (Carnegie Mellon University, USA; University of Tennessee, USA) For most of the past six decades, software measurement relied on labor-intensive manual collection of proprietary data, which hampered progress. The shift to repurposing traces from version control and related tools dramatically expanded data availability—especially with the rise of open-source software—but hinged on an often unstated assumption: that these tools are used by professional developers to build genuine software systems. However, as trace-generating tools, data types and scale, and empirical methods have all evolved, it has become clear that changes in data generation and analytical approaches affect many prior findings about software development, maintenance, and evolution. With AI agents now actively using these same tools, the resulting traces frequently violate the original assumption of human origin. To preserve the relevance of software measurement research, immediate action is needed: We must detect when foundational assumptions are violated in contemporary data and develop new methodologies that remain valid under changed circumstances. To this end, we propose a systematic AI-assisted replication program that revisits key findings using modern techniques, aiming for methods that yield consistent results on current data to keep software measurement meaningful. Article Search Artifacts Available Article: ase26nier-p76-p doi:10.1145/3832783.3834553
	Møller, Anders	ASE '26: "Defensive Capability Analysis ..." Defensive Capability Analysis for JavaScript Libraries Wenyuan Xu and Anders Møller (Aarhus University, Denmark) Capability analysis is a key building block for JavaScript supply-chain security tasks such as malware detection, security auditing, and runtime policy construction. However, existing approaches do not provide guarantees in the presence of JavaScript’s dynamic features. We present a defensive capability analysis for JavaScript libraries that soundly reports every exercised capability for code executed under a lightweight protected runtime. The analysis tracks only objects that are relevant to capabilities. It reports capability usage either at the program locations where such objects are used, or conservatively when relevant objects escape through operations that the analysis does not model precisely. To address a small number of dynamic language features that would otherwise invalidate this analysis, we complement the static analysis with a lightweight runtime enforcement mechanism that blocks those patterns. We implement the approach and evaluate it on large datasets of benign and malicious npm packages. The results show that the approach scales to real-world packages, pinpoints capability-usage locations with high accuracy, and remains compatible with 98.2% of benign libraries when using the protected runtime. Moreover, it detects capability usage in 99.8% of the malicious packages in our dataset, while the remaining cases are blocked by the runtime protection. Our study also shows that at least 72.9% of the npm packages use no security-sensitive capabilities at all, suggesting that capability analysis can substantially reduce auditing effort in practice. Article Search Artifacts Available Article: ase26main-p1332-p doi:10.1145/3832783.3837491
	Moha, Naouel	ASE '26: "AISmellBench: A Reusable Benchmark ..." AISmellBench: A Reusable Benchmark of AI Code Smells in ML and LLM-Based Systems Brahim Mahmoudi, Naouel Moha, Quentin Stiévenart, and Florent Avellaneda (École de Technologie Supérieure de Montréal, Canada; Université du Québec à Montréal, Canada) Artificial Intelligence (AI) systems are increasingly implemented through Machine Learning (ML) pipelines and Large Language Model (LLM) integrations, where design and implementation choices are scattered across data preprocessing code, model configuration, training scripts, provider APIs, and prompt/output logic. Poorly designed choices may form AI code smells, namely recurring implementation patterns that can undermine reproducibility, robustness, maintainability, and trustworthy behavior. Yet, evaluating AI code smell detection approaches remains difficult due to the lack of reusable benchmarks with validated ground truth. We present AISmellBench, a benchmark for AI code smells built through a reproducible pipeline combining GitHub repository mining, eligibility filtering, tool-assisted identification of potential code smell instances, and manual annotation with adjudicated validation artifacts. AISmellBench brings together 1,221 AI-based Python repositories, including 888 ML repositories and 333 LLM-based repositories. The released benchmark contains 1,265 annotated Python files with 3,714 validated AI code smell instances across 31 AI code smell types. Demonstration video: https://youtu.be/xepUUGSHaiU Dataset availability: https://doi.org/10.5281/zenodo.20085308 Article Search Artifacts Available Article: ase26tool-p35-p doi:10.1145/3832783.3834605
	Mohamad, Mazen	ASE '26: "Same Scrutiny, More Time: ..." Same Scrutiny, More Time: Eye Tracking Insights into Reviewing LLM-Labelled Code Ranim Khojah, Francisco Gomes de Oliveira Neto, Mazen Mohamad, Julian Frattini, and Philipp Leitner (Chalmers University of Technology, Sweden; University of Gothenburg, Sweden; RISE Research Institutes of Sweden, Sweden) Modern software development increasingly involves the use of large language models (LLMs) to generate code. Despite their rapid advancement, LLMs remain prone to errors and hallucinations, emphasizing the importance of careful code inspection. However, in practice, developers' trust in LLM-generated code and their willingness to review it thoroughly may not align with these recommendations, which is a gap that remains largely unexplored. In this study, we conduct a Wizard-of-Oz experiment to examine how software engineers behave when code is explicitly labelled as LLM-generated during a code review task. We collect both behavioral data and participant feedback through eye-tracking and exit interviews. Combining Bayesian data analysis with qualitative analysis, we found that while the thoroughness of code review did not change for participants, they spent more time fixating on LLM-labelled code, indicating that the label itself influences attention. Practitioners also adapted their review strategy for LLM-labelled code by assessing the code based on specific criteria (e.g., logical correctness), or using the prompt to guide their review. These findings inform LLM-based tool design on labelling while incorporating the prompt as a software artifact. Our study reveals a gap between reviewers' intentions and actual reviewing behaviour, highlighting the need for software companies to revisit their AI policies (particularly regarding LLM-assisted development) to better support developers in reviewing LLM-generated code. Article Search Artifacts Available Article: ase26main-p2693-p doi:10.1145/3832783.3834423
	Molina, Facundo	ASE '26: "TORI: A Tool for Oracle Quality ..." TORI: A Tool for Oracle Quality Assessment Facundo Molina, Nazareno Aguirre, and Alessandra Gorla (Complutense University of Madrid, Spain; University of Rio Cuarto, Argentina; CONICET, Argentina; Guangdong Technion-Israel Institute of Technology, China; IMDEA Software Institute, Spain) Oracle quality is a critical factor in software testing, directly influencing the fault-detection capability and overall effectiveness of test suites. Despite its importance, assessing oracle quality remains challenging: existing techniques predominantly rely on dynamic analysis, which incurs substantial computational overhead and limits adoption in large-scale or time-constrained development settings. In this tool demo paper, we present Tori, a lightweight static analysis tool designed to help testers evaluate oracle quality efficiently. Tori operates by analyzing assertion-based oracles within test cases and generating a quality report based on the state field coverage metric, a measure of how comprehensively the assertions exercise the internal state fields of the software under test. A demonstration video showcasing the use of Tori is available at https://youtu.be/neb3B-Dyacw. Article Search Article: ase26tool-p238-p doi:10.1145/3832783.3834653
	Monteiro, Felipe R.	ASE '26: "Kani: A Model Checker for ..." Kani: A Model Checker for Rust Rémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech (Amazon Web Services, USA; Amazon Web Services, UK; Queen Mary University, UK; Brown University, USA; Datadog, USA; Massachusetts Institute of Technology, USA) Rust's ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust's Mid-level Intermediate Representation (MIR) into CBMC's bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign. Article Search Artifacts Available Article: ase26ind-p163-p doi:10.1145/3832783.3834499
	Moon, Hyungon	ASE '26: "Safe Multi-site Binary Instrumentation ..." Safe Multi-site Binary Instrumentation of Running x86-64 Programs Jihun Baek, Sanghoon Han, and Hyungon Moon (UNIST, Republic of Korea) Applying binary instrumentation to a running x86-64 process is difficult because variable-length instructions and weak alignment guarantees prevent safe in-place code modification under concurrent execution. Existing run-time approaches either trap concurrent threads on every overwrite or require global synchronization, limiting scalability. This paper presents DIBE, a run-time binary editing framework that safely instruments running x86-64 programs without trapping in the common case. An admin process resolves all instrumentation decisions, including multi-site patching tactics and trampoline placement, and exports them as metadata. A lightweight runtime inside the target process replays these edits, safely activating E9Patch's multi-site rewriting tactics on the live process by applying their dependent overwrites in an order that keeps every intermediate program state correct under concurrent execution, a guarantee that single-site punning and offline rewriting do not provide. It applies 77-90% of overwrites using hardware atomic primitives invisible to concurrent threads, with a trap-based fallback only for the remaining cross-boundary cases. We evaluate DIBE on 28 SPEC CPU2006 benchmarks and a multi-process Nginx server, and demonstrate it at browser scale on a running Chrome renderer and as a live memory-safety checker. DIBE matches static E9Patch on both instrumentation coverage (near-complete) and execution time overhead (within 0.5% at the geometric mean), keeps per-instruction overwrite latency sub-microsecond, and records zero trap hits across all Nginx configurations under sustained load. Article Search Article: ase26main-p1407-p doi:10.1145/3832783.3837494
	Moon, Seokhyeon	ASE '26: "EvoLLM: High-Coverage, Readable, ..." EvoLLM: High-Coverage, Readable, and Token-Efficient Unit Test Generation for Industrial Java Codebases Seokhyeon Moon, Myungho Lee, Jihun Kim, Yoon-Chan Jhi, Jihoon Cho, and Hakjoo Oh (Samsung SDS, Republic of Korea; Korea University, Republic of Korea) Adopting automated Java unit-test generation in industrial settings requires high coverage, readability, token efficiency, and modern-Java deployability. No existing technique meets all four: search-based test generators struggle with readability and modern-Java deployability, LLM-centric generators consume tens of millions of tokens, and prior LLM-based test refactoring methods drop baseline coverage by 8–21 percentage points (pp) in our controlled setups. We report on EvoLLM, a hybrid Java unit-test generator we built and deployed to address all four requirements. EvoLLM combines EvoSuiteng—a failure-analysis-driven hardening of EvoSuite that resolves deployability issues and strengthens baseline coverage—with cluster-wise LLM-based refactoring that groups tests by coverage goals and rewrites each cluster in a single LLM call grounded in compact program-under-test context. Across six open-source and three industrial projects, EvoLLM outperforms six state-of-the-art baselines, improving line coverage by 8.2–20.7 pp, branch coverage by 6.2–19.4 pp, and mutation score by 6.8–24.5 pp, while reducing LLM token usage by 47.3%–93.0%. In addition, the test generation stage of EvoLLM demonstrates robust deployability across target projects built with JDKs 8, 11, and 17, while achieving strong effectiveness on a Spring-core release requiring JDK 17. Finally, a 14-participant developer survey further suggests that EvoLLM-generated tests ranked higher in readability than those from prior tools and developer-written tests. Article Search Article: ase26ind-p335-p doi:10.1145/3832783.3834525
	Mordoch, Argaman	ASE '26: "HyTri: Hybrid Triage of CI ..." HyTri: Hybrid Triage of CI Failures via LLM Guided Semantic Reasoning and Change Attribution Lior Broide, Argaman Mordoch, and Roni Stern (Ben-Gurion University of the Negev, Israel) Continuous Integration (CI) builds execute large test suites that often yield multiple simultaneous failures, many originating from a common underlying fault. Test failure triage -- grouping failing tests by their root cause -- is therefore critical for reducing debugging effort. Existing approaches work poorly in CI builds with multiple faults, and either lack semantic reasoning or ignore highly informative structural and change-aware signals. To address these limitations, we propose HyTri, a framework that integrates LLM-guided causal reasoning into test failure triage. HyTri derives similarity signals that consider failure semantics and hypothesized root causes. It fuses these signals using confidence weighting and error-type adjustment into a unified similarity measure that is used to cluster the failing tests. To evaluate HyTri we created Multi-Fault CI Build Benchmark (MFCI-Benchmark), a novel benchmark for test failure triage algorithms comprising synthesized multi-fault CI builds from well-known bug repositories. Experimental results over MFCI-Benchmark and the multifault Defects4J fault localization benchmark showed that HyTri outperforms existing baselines, maintaining strong performance even in datasets where stack traces are shallow and uninformative. Article Search Article: ase26main-p811-p doi:10.1145/3832783.3837467
	Mou, Xudong	ASE '26: "CAPMix: Robust KPI Anomaly ..." CAPMix: Robust KPI Anomaly Detection for AIOps in Noisy and Dynamic Environments Xudong Mou, Rui Wang, Tiejun Wang, Zexin Wu, Fangda Guo, Jie Sun, Shiru Chen, Penghao Zhang, Tiezi Zhang, Tianyu Wo, Hao Peng, Chunming Hu, Xudong Liu, and Renyu Yang (Beihang University, China; Chinese Academy of Sciences, China; Inspur, China; Kuaishou, China) Time-series anomaly detection is crucial in AIOps for maintaining large-scale service reliability. In production, streams of Key Performance Indicators (KPI) are high-dimensional, non-stationary, and affected by noise, deployment changes, and latent anomalies, making real failures hard to distinguish from benign variation. Most existing methods assume either normality (learning from “normal” history) or rely on injected anomalies for training. Yet injected patterns often misalign with real failure modes, skewing decision boundaries – aka. Anomaly Shift. We propose CAPMix, a controllable anomaly augmentation framework with prior-guided injection for realistic temporal behaviors. CAPMix combines label revision and dual-space mixup to enhance robustness under contaminated and mixed data. CAPMix consistently outperforms state-of-the-art methods on public AIOps and time-series benchmarks. It has been deployed in a large-scale production system, reducing false alarms and improving monitoring reliability. A real-world dataset is also released to enrich the research on robust KPI anomaly detection. Article Search Article: ase26ind-p110-p doi:10.1145/3832783.3834487
	Mou, Zhanhong	ASE '26: "ChangeWiki: Repository-Level ..." ChangeWiki: Repository-Level Change Summarization Augmented with Architecture Semantics Zijun Wang, Wuxia Jin, Jiale Li, Zhanhong Mou, and Ting Liu (Xi'an Jiaotong University, China) Understanding software evolution at the repository level is essential for tasks such as release management, code review, and regression testing. However, existing change summarization techniques are largely confined to single commits or functions, failing to capture cross-commit evolutionary context, while recent repository-level understanding tools focus on static documentation of single-version codebases, overlooking evolution over time. To bridge this gap, we propose ChangeWiki, an architecture semantic-augmented approach for repository-level change summarization. ChangeWiki first constructs hierarchical, multi-granularity change entity trees enriched with multi-source contexts to infer change intent and impact. It then recovers modular structures across versions and employs a bidirectional context-guided aggregation mechanism, synthesizing code-level changes from the bottom up while injecting architectural semantics as top-down constraints. ChangeWiki finally generates coherent, traceable summaries that capture both local modifications and system-level evolution. We construct comprehensive benchmarks and evaluate ChangeWiki on real-world projects. Experimental results demonstrate significant improvements in semantic accuracy, completeness, and cross-granularity traceability. A prototype of ChangeWiki has been deployed in an industrial setting for upstream-downstream code evolution, where developers reported that the hierarchical summaries significantly reduced manual effort in issue localization caused by upstream changes and show potential for automating version release notes. Article Search Article: ase26main-p3335-p doi:10.1145/3832783.3834436
	Mousavi, Mohammad Reza	ASE '26: "Quantum Squeeziness: An Information ..." Quantum Squeeziness: An Information Theoretical Metric for Quantum Software Testability Avner Bensoussan, Hector Menendez, and Mohammad Reza Mousavi (King's College London, UK) Testability—the degree to which faults can be revealed and diagnosed—has long been fundamental in software engineering but remains largely unexplored for quantum software. This work presents the first formalisation of testability for quantum programs, adapting classical concepts to quantum computation. We introduce Quantum Squeeziness, an information-theoretic metric inspired by classical squeeziness, to quantify how faults are masked and prevented from propagating to observable outcomes. We treat it as an inverse measure of testability: higher squeeziness implies stronger fault masking and reduced detectability. We propose an efficient method to compute Quantum Squeeziness and validate it through large-scale quantum mutation analysis. Across more than 50k mutants, we observe a strong negative correlation between squeeziness and mutation score, showing that higher squeeziness predicts lower testability. We further introduce a technique that constrains where and how perturbations are injected, reducing cost while preserving accuracy. The computation is 15% faster than a standard error-propagation baseline, while the optimised variant, FastSqueeziness, reduces mean runtime from 3200s to 189s (16.9 times speedup) with 95% accuracy. By establishing a rigorous foundation of testability for quantum software, this work opens new directions at the intersection of software engineering, quantum information theory, and testing. Beyond testing and debugging, it also supports applications in quantum error mitigation and correction, enabling principled assessment and improvement of program robustness. Article Search Artifacts Available Article: ase26main-p151-p doi:10.1145/3832783.3834341
	Moyón Constante, Fabiola	ASE '26: "From Backlog Items to Security ..." From Backlog Items to Security Guidance: Towards Continuous Security Compliance Ignacio García Núñez, Florian Angermeir, and Fabiola Moyón Constante (Technical University of Munich, Germany; fortiss, Germany; Blekinge Institute of Technology, Sweden; Siemens Technology, Germany) Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief, free-form descriptions and often lack timely guidance on applicable requirements. We present an NLP-based backlog enrichment system that detects security-relevant backlog items and links them to relevant security requirements. The approach combines a security-relevance classifier with a retrieval-augmented generation (RAG) pipeline over security requirements documents. The approach was developed and evaluated in the context of a large enterprise in highly regulated domains. We present three contributions. First, we release a dataset of 288 backlog items labeled for security relevance by nine security practitioners, with substantial agreement (Fleiss’ κ=0.787). Second, a recall-oriented classifier achieving F2=0.774 in-distribution and mean zero-shot G-measure ≈ 0.65 across five established benchmarks, matching or outperforming most published classical-ML and open-source GPT baselines. Third, we preliminarily evaluated a four-stage security requirements document-grounded RAG pipeline with two practitioners on industrial backlogs using company-internal security policies and CIS Benchmarks. Of the retrieved 24 clauses, 12 were rated at least 4/5 for relevance. Our findings provide first indicators that NLP-based product backlog enrichment can support engineers in identifying security requirements early in the development process. With this work we aim to facilitate continuous security compliance through proactive introduction of security requirements in continuous software engineering. Article Search Artifacts Available Article: ase26ind-p344-p doi:10.1145/3832783.3834527
	Mraidha, Chokri	ASE '26: "PWCC: Probability-Weighted ..." PWCC: Probability-Weighted Combinatorial Coverage for Risk-Informed Scenario Testing of Autonomous Systems Borhaneddine Hamadou, Chokri Mraidha, and Nikolaos Matragkas (Université Paris-Saclay, France; CEA List, France) Scenario-based testing of autonomous systems faces a fundamental unsolved problem: knowing when to stop. Existing coverage metrics measure either structural diversity or combinatorial breadth, but neither tells you how much of the system’s expected real-world operation remains untested. A test suite can score well on every existing metric while systematically missing the conditions the system will actually encounter. We introduce Probability-Weighted Combinatorial Coverage (PWCC), a metric that simultaneously measures coverage of the Op- erational Design Domain (ODD) and test adequacy. PWCC learns a probabilistic model of expected operating conditions from oper- ational profiling data, uses it to assign probability mass to 𝑡-way combinations of scenario features, and declares testing adequate when the uncovered mass falls below a risk-calibrated threshold. This gives practitioners something no existing metric provides: a principled, quantitative answer to “have we tested enough?” Evaluated on four autonomous driving datasets against seven baselines, PWCC demonstrates three properties. First, it is the strongest predictor of fault detection where the operational dis- tribution carries signal, reaching Spearman 𝑟𝑠 = +0.981 on Deep- Collision — 0.167 above the best combinatorial baseline at a lower interaction order. Second, it suppresses false sufficiency: on Deep- Scenario, PWCC achieves FSR = UFC = 0 across all splits versus CC’s mean UFC ≥ 95.8%, false sufficiency eliminated entirely, and, judged at its own stopping point, surfaces 99.6% of failure-triggering com- binations where combinatorial saturation stops after 6.4% of the campaign; on failure-rich datasets UFC drops by up to 4.9×. Third, it is stable: the score varies by at most 0.006 across a ten-fold increase in Monte Carlo sample size and grows monotonically with suite size. These results show that operational probability weighting is the decisive factor in avoiding dangerous false sufficiency verdicts; and that PWCC transforms coverage from a descriptive statistic into a risk-informed stopping decision. Article Search Artifacts Available Article: ase26main-p443-p doi:10.1145/3832783.3837443
	Mu, Yanzhou	ASE '26: "CIPIHunter: Detecting Configuration-Induced ..." CIPIHunter: Detecting Configuration-Induced Prediction Instability in Deep Learning Frameworks Yanzhou Mu, Shuo Meng, Mijung Kim, Xiang Chen, Chunrong Fang, Zhenyu Chen, and Juan Zhai (UNIST, Republic of Korea; Nanjing University, China; Nantong University, China; University of Massachusetts at Amherst, USA) Deep learning (DL) frameworks support diverse execution configurations, including precision modes and model optimizations. Even with a fixed model, input, and framework version, changing these configurations can change model predictions, causing Configuration-Induced Prediction Instability (CIPI). CIPI arises when configuration-dependent numerical perturbations propagate and cause potentially harmful model-level behavior. Existing API-level and model-level testing approaches are not well suited to detecting CIPI, as these approaches lack configuration-conditioned exploration and propagation-aware diagnosis. Therefore, we present CIPIHunter, which combines controlled configuration-pair testing, sensitivity-oriented mutation, feedback-guided search, and intermediate tracing to localize suspicious operators or operator groups. On 13 PyTorch models under a 100-round budget, CIPIHunter reports the highest raw CIPI count and 22 deduplicated Type I manifestations, 83.3% more than the strongest baseline, while remaining competitive in overall deduplicated manifestation coverage. In total, we submit 29 PyTorch issue reports. Developers have acknowledged eight, rejected five, and marked four as duplicates; nine remain pending, and three have been closed without an explicit determination. Separately, three reports are labeled “high-priority”. These results demonstrate the practical utility of CIPI testing for framework quality assurance. Article Search Article: ase26main-p163-p doi:10.1145/3832783.3834345
	Mukai, Hiroki	ASE '26: "Where Does Balance Break? ..." Where Does Balance Break? Boundary Discovery for Game Balance Testing under a Finite Simulation Budget Hiroki Mukai, Yusaku Kato, Norihiro Yoshida, Erina Makihara, and Katsuro Inoue (Ritsumeikan University, Japan) Software testing often relies on assumptions such as reproducible executions and stable correctness criteria. However, many modern software systems exhibit non-deterministic executions and large behavior spaces, making exhaustive exploration impractical and single-run judgments unreliable. These characteristics make it difficult to identify where acceptable behavior ends and problematic behavior begins. Competitive multiplayer games represent a challenging instance of such systems, where balance must be maintained so that no single strategy dominates. Even small parameter changes can trigger abrupt balance disruption, yet detecting such failures requires repeated simulations under non-deterministic outcomes and high-dimensional parameter spaces. In this paper, we formulate game balance regression testing as a boundary-discovery problem under a finite simulation budget. The objective is to efficiently identify inputs near the boundary that separates balanced and unbalanced regions. To address this problem, we propose BBExplorer, which combines multi-directional candidate generation, budget-aware two-stage screening, and adaptive step-size shrinkage for boundary refinement. Experimental results on two games with different levels of complexity show that the approach is strong in low-dimensional settings and remains effective in higher-dimensional ones. It also exhibits stable boundary behavior across unseen random seeds and threshold settings. These results indicate that BBExplorer is effective for practical balance regression testing and, more broadly, for boundary-oriented testing in non-deterministic, budget-constrained systems. Article Search Article: ase26main-p2013-p doi:10.1145/3832783.3834407
	Müller, Maximilian	ASE '26: "Can Formal Specifications ..." Can Formal Specifications Be Synthesized from Tests Alone? Tianhai Liu, Maximilian Müller, Tobias Hey, Vitus Lüntzel, Muhammad Minhas, Anne Koziolek, and Bernhard Beckert (KIT, Germany) Formal specifications offer strong guarantees, but remain costly to write manually. Recent LLM-based approaches automate this by inferring specifications from source code, yet their reliance on white-box access poses barriers to industrial adoption due to intellectual property risks and deployment costs. Our approach uses LLMs to infer candidate specifications solely from test code and dynamic execution traces: the LLM observes only the program interface, selected inputs, and corresponding outputs or state changes, while the implementation internals remain hidden. Candidate specifications are validated locally using bounded model checking, with feedback guiding iterative refinement. Initial results on the SpecGenBench benchmark suggest that tests can guide LLMs towards meaningful Java Modeling Language specifications, while also highlighting checker compatibility and diagnostic feedback as key challenges for reliable refinement. Article Search Artifacts Available Article: ase26nier-p62-p doi:10.1145/3832783.3834549
	Müller, Peter	ASE '26: "Certified Program Synthesis ..." Certified Program Synthesis with a Multi-modal Verifier Yueyang Feng, Dipesh Kafle, Vladimir Gladshtein, Vitaly Kurin, George Pîrlea, Qiyuan Zhao, Peter Müller, and Ilya Sergey (National University of Singapore, Singapore; Neapolis University Pafos, Cyprus; ETH Zurich, Switzerland) Certified program synthesis (a.k.a. vericoding) is the process of automatically generating a program, its formal specification, and a machine-checkable proof of program/specification alignment from a natural-language task description. Two key challenges make vericoding difficult. First, specifications synthesised from natural language descriptions are often either too weak to be meaningful or too strong to be implementable, yet existing approaches lack systematic means to detect such defects. Second, the program verifiers used to validate results are fragmented: each tool supports a particular reasoning mode—auto-active (e.g., Dafny, Verus) or interactive (e.g., Rocq, Lean)—with its own trade-off between automation and expressivity. This forces each synthesis methodology to target a single paradigm, limiting the tasks it can handle. We overcome both challenges by structuring the synthesis workflow in stages around a multi-modal verifier—a single tool that combines dynamic validation, automated proofs, and interactive proof scripting within one foundational framework. We realise this idea in LeetProof, a new agentic pipeline built on Velvet, a multi-modal program verifier built in the Lean theorem prover. Multi-modality enables LeetProof to validate generated specifications via randomised property-based testing before any code is synthesised, decompose the synthesis task into sub-problems guided by verification conditions, and delegate residual proof obligations to frontier AI provers specialised for Lean. We evaluate LeetProof on an extensive benchmark suite derived from prior work on certified synthesis. Our specification validation uncovers defects in existing reference benchmarks, and LeetProof's staged pipeline achieves a significantly higher rate of fully certified solutions than a single-mode baseline at the same fixed budget—consistently across two different frontier LLM backends. Article Search Artifacts Available Article: ase26main-p4427-p doi:10.1145/3832783.3837559
	Munakata, Satoshi	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Murali, Vijayaraghavan	ASE '26: "REAP: Automatic Curation of ..." REAP: Automatic Curation of Coding Agent Benchmarks from Interactive Production Usage Smriti Jha, Matteo Paltenghi, Chandra Maddila, Vijayaraghavan Murali, Shubham Ugare, and Satish Chandra (Meta Platforms, USA) Production deployment of AI coding agents requires fast, reproducible evaluation signals. Existing industrial practices trade off speed and fidelity: online A/B testing takes weeks and risks user experience, shadow deployment yields signals that are not reproducible across runs, and public benchmarks diverge from production workloads in language distribution, prompt style, and codebase structure. This paper presents REAP (Relevance and Execution-Audited Pipeline), an automated curation pipeline that constructs production-derived benchmarks from real developer-agent sessions without manual labeling. Such curation, while in-distribution to production usage, runs into several challenges. Untestable prompts, misaligned tests, and test flakiness all compromise evaluation reliability. While tasks can be manually audited to ensure only high-quality tasks remain in the benchmark, this approach is infeasible in the monorepo setting: the build infrastructure state is often ephemeral in large monorepos and requires the benchmark to be continuously re-curated against the current codebase. As manual verification cannot be sustained at this cadence, REAP adds an automated verification layer using LLM-based task classification, agentic test-relevance validation, and multi-run stability checks to ensure the executable benchmark yields trustworthy signals. We use REAP to curate Harvest, a benchmark where each task feeds the coding agent a real developer prompt and verifies the resulting code change against fail-to-pass tests retrieved from production. Harvest’s distribution spans more than four programming languages with a majority of tasks drawn from Hack, a meaningful divergence from public benchmarks which are skewed towards Python. Model and harness evaluations reveal that solve rates range from 42.9% to 58.2% across five frontier models, surfacing capability differences that inform concrete deployment decisions. The underlying corpus contains proprietary source code and cannot be released publicly; we share our automated curation methodology and case studies to enable other organizations to construct similar production-derived benchmarks at scale. Article Search Artifacts Available Article: ase26ind-p266-p doi:10.1145/3832783.3834519
	Murray, Toby	ASE '26: "UIXPOSE: Screen-Conditioned ..." UIXPOSE: Screen-Conditioned Runtime Discrepancy Analysis for Security-Aware Android GUI Exploration Amirmohammad Pasdar, Van-Thuan Pham, and Toby Murray (University of Melbourne, Australia) Android GUI explorers typically optimise structural coverage, crash discovery, or human-like interaction, but these objectives do not identify which UI transitions expose runtime behaviour that deserves security inspection. We introduce screen-conditioned runtime discrepancy, a steering signal that measures disagreement between activity justified by the visible UI and activity observed at runtime. We implement this concept in UIXPOSE, a source-code-agnostic Android framework that associates each action-conditioned transition with replayable UI, network, memory, and resource evidence and uses the resulting discrepancy to guide subsequent exploration. In a preliminary evaluation of six oracle-backed Android applications, UIXPOSE reached known UI-triggered behaviours that vanilla state-aware exploration missed within the same execution budget. It also visited substantially more distinct abstract states and action-conditioned transitions while producing step-aligned evidence for analyst review. These results indicate that runtime discrepancy can redirect state-aware exploration toward behaviourally informative states and support downstream analyst-led application labelling through ranked, replayable evidence. Article Search Article: ase26nier-p83-p doi:10.1145/3832783.3834556
	Musgrave, Kevin	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Nadi, Sarah	ASE '26: "All or Nothing: How Library ..." All or Nothing: How Library Type Annotations Affect Client-Side Errors in Python Eric Asare, Luca Di Grazia, and Sarah Nadi (New York University Abu Dhabi, United Arab Emirates; University of St. Gallen, Switzerland) Python’s gradual typing promises that library-side type annotations will propagate safety benefits to downstream clients. Despite over 83% of popular libraries now containing annotations, no empirical evidence exists on whether these efforts actually reduce type errors in client code. We present the first large-scale empirical study of this downstream impact, analyzing the interaction between 13,751 actively maintained client repositories and over 4,178 distinct third-party libraries using the Pyright static type checker. Our results show that (i) 70% of client repositories contain at least one type error stemming from third-party API usage, (ii) the error distribution is heavily skewed, with a small subset of widely used libraries, i.e., numpy, django, pandas, and pytorch, accounting for a disproportionate share of the ecosystem-wide error burden, (iii) measurable benefits of reduced error risks and propagation can only be seen with near-complete annotation coverage (≥ 90%), and (iv) although 60% of library-client pairs are aligned in their typing efforts, only 10% achieve the ideal scenario where highly annotated libraries meet client-side static type checking. Our findings expose a pervasive ecosystem gap: client adoption of static type checking outpaces library annotation efforts, with 19% of cases representing missed opportunities where clients use type checkers but their dependencies lack sufficient annotations. These results call for prioritizing comprehensive annotation of widely used libraries to unlock the full potential of Python’s gradual typing. Article Search Artifacts Available Article: ase26main-p3300-p doi:10.1145/3832783.3834434
	Nagappan, Nachiappan	ASE '26: "Automating Low-Risk Code Review ..." Automating Low-Risk Code Review at Meta: RADAR, Risk Calibration, and Review Efficiency Audris Mockus, Peter C. Rigby, and Nachiappan Nagappan (University of Tennessee, USA; Meta, USA; Concordia University, Canada) Article Search Article: ase26ind-p116-p doi:10.1145/3832783.3834493
	Nakashima, Satoshi	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Nakashima, Sota	ASE '26: "How Well Do LLMs Generate ..." How Well Do LLMs Generate Taxonomies in the SE Domain? A Multi-perspective Evaluation Framework Sota Nakashima, Yuta Ishimoto, Masanari Kondo, Tao Xiao, and Yasutaka Kamei (Kyushu University, Japan) Taxonomies provide a shared conceptual framework for organizing heterogeneous observations in software engineering (SE) research. Manually constructing such taxonomies is labor-intensive and requires annotators with expertise in the SE domain. While advances in Large Language Models (LLMs) have led to the emergence of automated taxonomy generation methods outside the SE domain, their applicability to technically complex SE artifacts remains unclear. In this experience paper, we present the first comprehensive empirical evaluation of how state-of-the-art automated methods perform on SE artifacts through a multi-perspective evaluation framework, including taxonomy quality, alignment with taxonomies defined by human experts, reliability under independent annotation, and efficiency. To support this evaluation, we systematically collect seven SE papers with publicly available artifacts and human-defined taxonomies, and conduct experiments using two automated methods (TnT-LLM and CLIMB) with five state-of-the-art LLMs. Our evaluation reveals a clear trade-off: TnT-LLM constructs high-quality taxonomies comparable to human-defined ones but incurs substantially higher cost and runtime and tends to generate overly complex taxonomies, whereas CLIMB is 15–40× faster and 8–49× cheaper but tends to score lower on quality when technical inference beyond surface-level similarity is required. These findings suggest that TnT-LLM and CLIMB can be used in practical situations in the SE domain, while researchers should first assess the complexity of the generated taxonomies and their cost using a subset of the target data to decide whether to use automated methods or human experts. Our work represents a first step toward a systematic understanding of automated taxonomy generation in SE, offering actionable insights for future research and practice. Article Search Article: ase26main-p3263-p doi:10.1145/3832783.3837551
	Nambi, Akshay	ASE '26: "eARCO: Efficient Automated ..." eARCO: Efficient Automated Root Cause Analysis with Prompt Optimization Drishti Goel, Raghav Magazine, Supriyo Ghosh, Akshay Nambi, Prathamesh Deshpande, Xuchao Zhang, Chetan Bansal, and Saravan Rajmohan (University of Illinois at Urbana-Champaign, USA; Microsoft Research, India; Inception, United Arab Emirates; Microsoft, India; Microsoft Research, USA; Microsoft, USA; Microsoft 365, USA) Root cause analysis (RCA) for incidents in large-scale cloud systems is a complex, knowledge-intensive task that often requires significant manual effort from on-call engineers (OCEs). Improving RCA is vital for accelerating the incident resolution process and reducing service downtime and manual efforts. Recent advancements in Large-Language Models (LLMs) have proven to be effective in solving different stages of the incident management lifecycle including RCA. However, existing LLM-based RCA recommendations typically leverage default finetuning or retrieval augmented generation (RAG) methods with static, manually designed prompts, which lead to sub-optimal recommendations. In this work, we leverage 'PromptWizard', a state-of-the-art prompt optimization technique, to automatically identify the best optimized prompt instruction that is combined with semantically similar historical examples for querying underlying LLMs during inference. Moreover, by utilizing more than 180K historical incident data from Microsoft, we developed cost-effective finetuned small language models (SLMs) for RCA recommendation generation and demonstrate the power of prompt optimization on such domain-adapted models. Our extensive experimental results show that prompt optimization can improve the accuracy of RCA recommendations by 21% and 13% on 3K test incidents over RAG-based LLMs and finetuned SLMs, respectively. Lastly, our human evaluation with incident owners have demonstrated the efficacy of prompt optimization on RCA recommendation tasks. These findings underscore the advantages of incorporating prompt optimization into AI for Operations (AIOps) systems, delivering substantial gains without increasing computational overhead. Article Search Article: ase26ind-p86-p doi:10.1145/3832783.3834477
	Napolitano, Manfredi	ASE '26: "E-CoDrive: A Co-Simulation ..." E-CoDrive: A Co-Simulation Framework for Testing Energy-Critical Driving Scenarios Manfredi Napolitano, Alessandra Somma, Alessio Gambi, Andrea Stocco, and Nicola Mazzocca (University of Naples Federico II, Italy; Austrian Institute of Technology, Austria; Italian Institute of AI for Industry, Italy; TU Munich, Germany; fortiss, Germany) Autonomous driving research has largely focused on safety while giving limited attention to non-functional aspects such as energy consumption and sustainability. As Autonomous Electric Vehicles (AEVs) become increasingly common in urban traffic, understanding how complex traffic dynamics influence their energy consumption is paramount to test whether AEVs can complete trips before battery depletion. To support energy-aware scenario-based testing of AEVs, we present E-CoDrive, a framework for reproducible closed-loop driving co-simulations that integrates an energy consumption model, a micro-traffic simulator, and a high-fidelity driving simulator to test AEV software stacks in urban scenarios. This tool paper describes the architecture of E-CoDrive and demonstrates its applicability by testing an Autoware-based AEV stack. Our evaluation shows that varying traffic conditions produce substantial differences in vehicle energy consumption. The artifact is publicly available at https://doi.org/10.6084/m9.figshare.32244783, and a screencast showing the tool is available at https://youtu.be/yX9fWHqCvgc. Article Search Article: ase26tool-p162-p doi:10.1145/3832783.3834648
	Narducci, Fedelucio	ASE '26: "Doc2Test: An Industrial Multi-agent ..." Doc2Test: An Industrial Multi-agent Framework for Document-Driven End-to-End Selenium Test Generation Andrea Lops, Antonio Ferrara, Fedelucio Narducci, Azzurra Ragone, and Michelantonio Trizio (Polytechnic University of Bari, Italy; Wideverse, Italy; University of Bari, Italy) End-to-end (E2E) testing is a persistent industrial bottleneck: Selenium, a widely used open-source framework for automating web browsers via scripted interactions that emulate user behaviour, relies on brittle scripts, while off-the-shelf Large Language Models (LLMs) hallucinate selectors and saturate the context window when asked to synthesise complete user journeys over production DOMs. We present Doc2Test, a Multi-Agent System (MAS) deployed inside Wideverse (a software engineering and digital transformation ICT company) that translates unstructured requirement documents into executable Selenium suites through three specialised phases: requirements analysis, dynamic DOM/visual context perception, and adaptive code generation with a self-healing loop. Across 90 independent runs on a production Angular cruise-booking platform (~145k LoC, under NDA), four open-sourced internal Wideverse applications, and one independently-developed external application (RealWorld), Doc2Test achieves a 94.4% generation success rate (95% CI: [87.5%, 98.2%]), detects 98.9% of 180 injected UI regressions, and reduces token usage by 86% against a zero-shot single-prompt baseline. Over three months of nightly Jenkins operation, it reduced maintenance effort by ~2.6 person-days / sprint and the flaky-test rate from 11.4% to 4.6%. We further report cost breakdowns and deployment lessons from integrating Doc2Test into our industrial partner's CI/CD pipeline. Article Search Article: ase26ind-p201-p doi:10.1145/3832783.3834507
	Negrini, Luca	ASE '26: "GoLiSA: An Advanced Static ..." GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts Luca Olivieri, Luca Negrini, Vincenzo Arceri, Pietro Ferrara, Fausto Spoto, and Agostino Cortesi (Ca’ Foscari University of Venice, Italy; University of Parma, Italy; University of Verona, Italy) GoLiSA is a static analysis tool that allows the verification of smart contracts written in Go, the most widely used language for developing smart contracts in Hyperledger Fabric. GoLiSA relies on abstract interpretation to model program semantics and identify potential risks and vulnerabilities in smart contracts. It supports advanced analyses such as information flow tracking and numerical and string value analysis, enabling the approximation of semantic program behaviors. Building on these analyses, GoLiSA implements a suite of checks for detecting non-trivial issues and potential risks in Hyperledger Fabric, including non-determinism, phantom reads, untrusted cross-contract invocations, read-after-write and over-write issues, cross-channel invocation risks, numerical issues, and unhandled errors. GoLiSA is publicly available at https://github.com/lisa-analyzer/go-lisa. A demonstration video showcasing the tool is available at https://youtu.be/WqkYOpWc9oE. Article Search Artifacts Available Article: ase26tool-p147-p doi:10.1145/3832783.3834644
	Ngan, Kwun Ho	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Nguyen, Duc Anh	ASE '26: "MIMOS-Tools: An Integrated ..." MIMOS-Tools: An Integrated Toolchain for Model-Based Design of Embedded Systems Wang Yi, Chengzi Huang, Behnam Khodabandeloo, and Duc Anh Nguyen (Uppsala University, Sweden) Despite decades of progress in model-based methods and tools for embedded real-time systems, there is still no integrated environment that supports the entire development lifecycle. This paper presents MIMOS-Tools, a comprehensive toolchain spanning the key phases of development, including modeling, simulation, formal verification, real-time scheduling, schedulability and end-to-end latency analysis, and code generation for heterogeneous multicore platforms. All phases are grounded in a single, coherent, and deterministic model of computation: the MIMOS model, a multi-rate task graph formalism for which we present a formal operational semantics and establish both functional and timing determinism. This semantic foundation ensures that properties verified at the model level are preserved throughout the development process and in the generated implementation. A distinguishing feature of MIMOS-Tools is its support for not only deterministic but also modular, compositional design. Unlike synchronous design environments such as SCADE and Simulink, which rely on a global base clock and offline static scheduling, MIMOS-Tools supports time-triggered asynchronous communication together with flexible real-time scheduling of computation. This removes the tight global coupling of the synchronous paradigm: components can be added, modified, or updated without recomputing a system-wide schedule, enabling scalable and incremental design and dynamic updates throughout the system lifecycle. However, MIMOS-Tools also supports Simulink models when the deadlines of tasks are set to zero to emulate the zero-time semantics of synchronous design. The toolchain is available at https://uu-mimos.github.io. Article Search Article: ase26tool-p77-p doi:10.1145/3832783.3834624
	Nguyen, Khai-Nguyen	ASE '26: "Pattern over Pixels: Measuring ..." Pattern over Pixels: Measuring Pattern Completion Bias in Multimodal Code Generation Khai-Nguyen Nguyen, Oscar Chaparro, and Antonio Mastropaolo (William & Mary, USA) Multimodal large language models (MLLMs) are increasingly used to translate webpage screenshots into front-end code, but repeated UI patterns may sway them toward visually incorrect yet pattern-consistent outputs. In this work, we test how repeated webpage patterns hurt MLLM accuracy on an objective screenshot-to-code fill-in-the-blank task. We introduce the first benchmark for visual pattern-completion bias, where one localized element in a repeated UI pattern is perturbed and the model must recover the masked width or font-size value from the screenshot and HTML context. Starting from 30 webpages curated from the Design2Code dataset, we build 1,440 evaluated screenshots spanning structural card and text-style patterns under standard and noise-overlaid conditions. We evaluate five frontier MLLMs and find that all are strongly biased toward the repeated baseline. Mean bias rate reaches 69.78% on card-width perturbations and 80.22% on text font-size perturbations, while mean accuracy is only 21.17% and 7.89%, respectively.  performs best but still drops from 68.61% accuracy on cards to 13.89% on text, while  reaches 96.11% bias on text. Noise, subtler perturbations, and boundary positions further increase bias rate. Reasoning analysis further shows that greater reasoning effort correlates with lower bias, yet qualitative evidence reveals that models can identify the anomalous element and still override it with the pattern-consistent answer. Our results identify a concrete failure mode in multimodal code generation and show that its severity is strongly associated with visual saliency. Article Search Article: ase26main-p3922-p doi:10.1145/3832783.3834443
	Nguyen, Thanh	ASE '26: "Kani: A Model Checker for ..." Kani: A Model Checker for Rust Rémi Delmas, Zyad Hassan, Qinheping Hu, Rahul Kumar, Felipe R. Monteiro, Thanh Nguyen, Adrián Palacios, Celina Val, Michael Tautschnig, Justus Adam, Daniel Schwartz-Narbonne, and Carolyn Zech (Amazon Web Services, USA; Amazon Web Services, UK; Queen Mary University, UK; Brown University, USA; Datadog, USA; Massachusetts Institute of Technology, USA) Rust's ownership type system prevents memory errors in safe code, but certain desirable properties remain orthogonal to compilation: the soundness of unsafe operations (e.g., raw pointer dereferences), functional correctness, and absence of runtime panics. We present Kani, an open-source model checker for Rust that pushes bounded model checking beyond bug-finding to provide correctness guarantees for these properties. Kani compiles proof harnesses from Rust's Mid-level Intermediate Representation (MIR) into CBMC's bit-precise verification engine, automatically checking a comprehensive set of safety properties with no user annotation. To extend verification from bounded to unbounded, Kani provides a specification language comprising function contracts, loop contracts, quantifiers, and function stubbing. We demonstrate feasibility through case studies on industrial Rust projects, where contracts upgraded verification from panic-freedom to functional correctness, uncovering six previously unknown bugs. Kani operates at scale in production CI, with over 16,000 harnesses verified per code change in the Rust standard library verification campaign. Article Search Artifacts Available Article: ase26ind-p163-p doi:10.1145/3832783.3834499
	Nguyen, Tien N.	ASE '26: "Post-hoc Attention Steering ..." Post-hoc Attention Steering of Large Language Models for Robust Code Understanding under Obfuscation Xiaokai Rong, Aashish Yadavally, and Tien N. Nguyen (University of Texas at Dallas, USA; University of Central Florida, USA) Code obfuscation is widely used in software systems and malware to conceal program logic and hinder analysis, posing significant challenges for both human developers and automated tools. While large language models (LLMs) have shown strong capabilities in code understanding, our preliminary study shows that LLM performance significantly degrades on obfuscated code, suggesting a reliance on superficial lexical cues rather than deep semantic reasoning. To address this limitation, we propose CodeSteer, a novel attention steering approach that reallocates model attention toward semantically relevant program elements, including backward slices for output prediction and control-flow paths for execution reasoning. Our method integrates lightweight program analysis with inference-time attention steering to guide LLMs toward the core input-to-output dependencies of a program. Experiments across multiple models and datasets demonstrate that CodeSteer significantly improves performance on obfuscated code, often recovering comparable accuracy to the level of unobfuscated programs. We also show CodeSteer’s practical utility through a case study on buffer overflow detection, highlighting its potential for malware/vulnerability analysis and reverse engineering of obfuscated code. Article Search Article: ase26main-p3738-p doi:10.1145/3832783.3837556
	Nguyen, Vincent	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Ni, Chao	ASE '26: "AEG-Edit: Bridging API Evolution ..." AEG-Edit: Bridging API Evolution and Code Semantics for Accurate API Usage in Code Generation Yitong Lin, Haoye Tian, Dehai Zhao, Chao Ni, Xiaohu Yang, and Xiaoxue Ren (Zhejiang University, China; Aalto University, Finland) As APIs across standard libraries and software ecosystems evolve, the API knowledge frozen in pre-trained LLMs becomes outdated. Prompt-based methods supply updated documentation at inference time yet suffer from context neglect, often reverting to memorized deprecated usages. Existing parametric approaches, whether fine-tuning or model editing, face two common challenges: they treat API changes as textual fact updates, overlooking the changes in code semantics needed for executable correctness (C1), and lack a mechanism to concentrate updates on positions involved in the API evolution, causing parameter interference beyond the evolution boundary (C2). We propose AEG-Edit, which constructs a heterogeneous API evolution graph, encodes and aligns the graph signal with the LLM hidden space, and concentrates gradient effort on positions involved in the API evolution through API-weighted windowing and optimization. On RustEvo²+ (708 Rust tasks) and PyEvo (622 Python tasks) across two representative open-source LLMs at the 7–8B parameter scale, AEG-Edit achieves statistically significant Pass@1 gains on RustEvo²+, improving over the strongest baseline by up to 6.49% on Qwen2.5-7B-Instruct. Ablation and transferability analyses confirm that the heterogeneous API evolution graph drives the gains and transfers to alternative editing backbones. Article Search Artifacts Available Article: ase26main-p2449-p doi:10.1145/3832783.3834415
	Ni, Guangsen	ASE '26: "Characterizing and Mitigating ..." Characterizing and Mitigating Productivity Loss in Large-Scale Model Training: An Empirical Study Dinghao Xue, Yanxiang Chen, Junhong Liu, Yepeng Zhang, Guangsen Ni, Menghao Zhang, Tianyu Wo, Zheng Zheng, Chunming Hu, Jin Ouyang, and Renyu Yang (Beihang University, China; Kuaishou, China; Unaffiliated, China) Training large-scale foundation models often uses thousands of GPUs for weeks or months. In production clusters, training productivity is reduced not only by explicit failures but also by scheduling delays, repeated recoveries, alive-but-unproductive hangs, and performance degradation during seemingly normal execution. However, existing metrics such as Effective Training Time Ratio (ETTR) mainly account for time lost to failures and restarts, and do not directly capture jobs that remain alive but make slow progress. Prior diagnosis and mitigation efforts typically target specific failure modes, leading to case-by-case fixes and offering limited support for cluster-wide attribution of productivity loss or systematic reliability improvements. In this paper, we present the Effective Training Productivity Ratio (ETPR), a reliability-oriented decomposition of end-to-end training productivity to stabilize the large-scale machine learning (ML) systems. ETPR characterizes productivity loss by accounting for pre-execution loss, unproductive allocated compute time, and reduced execution quality. We conduct an empirical study of thousands of training jobs over three months on Kuaishou's production cluster. Our analysis shows that productivity is mainly degraded by diagnosis and recovery for fail-stop and fail-hang incidents, as well as subtle fail-slow anomalies that delay fault localization and worsen overall efficiency. Based on these findings, we build and deploy an automated stability governance framework that integrates: (i) a multi-stage log-based fail-stop diagnosis pipeline, (ii) temporal stack invariance analysis for fail-hang localization, (iii) an adaptive fail-slow detector with straggler detection, and (iv) hierarchical recovery strategies. Experiments show that this framework accelerates failure diagnosis, accurately localizes anomalous ranks, mitigates silent slowdowns, and improves cluster-wide ETPR in production. Article Search Article: ase26ind-p34-p doi:10.1145/3832783.3834462
	Ni, Ronghao	ASE '26: "Learning to Triage Vulnerability ..." Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js Ronghao Ni, Aidan Z.H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, and Kevin Cheang (Carnegie Mellon University, USA; Athanor AI, USA; University of California at Berkeley, USA) Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNNs and LLMs, trained on data derived from program analysis tool outputs (NodeMedic-FINE in our case study). The top LLM achieves F1=0.915, while the best provenance-graph-based method achieves F1=0.904. On the reports that the upstream tool flags but cannot automatically confirm, at a target of recovering 90% of the exploitable reports, the leading model eliminates 75% of the benign reports from manual review. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives among all warnings), our approach can report 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage. Article Search Article: ase26main-p1614-p doi:10.1145/3832783.3837503
	Nie, Liming	ASE '26: "SecChain: Operationalizing ..." SecChain: Operationalizing Security Guidelines for Multi-agent Smart Contract Generation Dianxiang Sun, Liming Nie, and Yang Liu (Nanyang Technological University, Singapore; Shenzhen Technology University, China) Smart contracts generated by large language models (LLMs) can compile yet still violate basic security obligations, and existing generation frameworks largely treat security as post-hoc verification rather than as a constraint that persists throughout generation and repair. We present SecChain, a multi-agent smart-contract generation framework built around a persistent SecuritySpec artifact that makes requirement-level security obligations explicit and preserves them across planning, coding, testing, auditing, and fixing. Five LLM-powered agents collaborate with a fully deterministic Coordinator through stage-specific procedures, deterministic pre-test verification, and nested repair loops, while an Auditor provides complementary semantic review grounded in a three-layer security knowledge base. We evaluate SecChain on 1,000 contracts from the finite-state-machine-guided smart-contract generation (FSM-SCG) dataset against vanilla GPT-4o, GPT-5.4, Claude Sonnet 4.6, and the FSM-SCG framework. SecChain achieves an 89.0% final compilation rate and a Zero Risk Contract Proportion (ZRCP) of 60.3%, compared with 12.7% for vanilla GPT-4o and 23.3% for FSM-SCG. With a GPT-4o backbone, SecChain still outperforms the tested vanilla current-generation models (GPT-5.4, Claude Sonnet 4.6) on the primary security metrics. Article Search Artifacts Available Article: ase26main-p1030-p doi:10.1145/3832783.3837480
	Nie, Yiran	ASE '26: "Mind the Gap: Do Widely-Used ..." Mind the Gap: Do Widely-Used SAST Tools Really Cover the Language-Specific Top CWEs? Zhilin Li, Yiran Nie, Xianglong Qi, Jiwei Yan, and Jun Yan (Institute of Software at Chinese Academy of Sciences, China; Hangzhou Institute for Advanced Study at University of Chinese Academy of Sciences, Hangzhou, China; Beijing University of Technology, China) Static Application Security Testing (SAST) tools play a key role in identifying vulnerabilities early in the development cycle. While these tools claim to detect a wide range of CWEs, their actual coverage is often unclear. In particular, due to language-specific characteristics, it is unclear to what extent SAST tools cover the CWEs most relevant to a given programming language, creating a gap between tool capabilities and developers’ security needs. To address these questions, this experience paper presents a large-scale empirical investigation into the gap between SAST Tools and Language-Specific Top CWEs. Using a heuristic labeling approach on 197,016 CVEs reported over the past decade, we construct the TopLan CWE Lists for three widely used programming languages: C/C++, Java, and Python. Based on these datasets, we evaluate nine popular SAST tools to identify coverage gaps and tool-specific performance characteristics. Our study yields several key findings. First, the language-specific TopLan CWE lists differ a lot from the globally ranked CWE list, indicating that SAST tools need to focus on different types of vulnerabilities for different languages. Second, the whole SAST tool set now exhibits low coverage of the TopLan CWE list, highlighting the need for more targeted code checkers. Third, the covered TopLan CWE sets for different SAST tools vary substantially, underscoring the need to select and combine tools based on vulnerability types. Finally, for top CWEs shared across multiple languages, existing multi-language SAST tools may support detection in only one language, suggesting opportunities to enhance coverage by migrating existing checkers. These findings reveal fundamental challenges for static analysis in detecting certain types of vulnerabilities and provide insights for improving future SAST tool design. They offer practical guidance for practitioners in selecting and combining tools to detect language-specific vulnerabilities more effectively. Article Search Artifacts Available Article: ase26main-p316-p doi:10.1145/3832783.3837435
	Niehues, Nils	ASE '26: "xDECAF: An Extensible Data ..." xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security Benjamin Arp, Felix Schwickerath, Alexander Vogt, Tom Hüller, Nils Niehues, and Nicolas Boltz (KIT, Germany) xDECAF is an extensible tool for architecture-based data flow analysis with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domain-specific constraint language with different flow operations, and a browser-based editor backed by an analysis engine. In this paper, we present the xDECAF tool library and a curated catalog of over 20 example models with documented constraints and expected violations, intended as a reusable dataset for the community. The tool has already been adopted by several research lines, providing concrete evidence of its utility. The tool, dataset, and a hosted online editor are publicly available. Screencast: https://youtu.be/L-PGdWoPtlw Code & Dataset: https://github.com/DataFlowAnalysis • https://doi.org/10.5281/zenodo.20083877 Article Search Article: ase26tool-p34-p doi:10.1145/3832783.3834604
	Nimje, Vedant	ASE '26: "Automated Assertion Generation ..." Automated Assertion Generation and Regression Testing for Machine Learning Notebooks Yingao (Elaine) Yao, Vedant Nimje, Varun Viswanath, and Saikat Dutta (Cornell University, USA; Veermata Jijabai Technological Institute, India; Dwarkadas J Sanghvi College of Engineering, India) Jupyter Notebooks have become the de-facto choice for data scientists and machine learning (ML) engineers for prototyping and experimenting with ML pipelines. Notebooks provide a rich interactive interface with support for code, data, and visualization in one place. However, notebooks provide limited support for testing. As a result, during continuous development, many silent (non-crashing) regressions often go unnoticed and make notebooks unreliable and results hard to reproduce. To enable more systematic testing of ML notebooks, we introduce NBTestGen – the first automated assertion generation approach for ML notebooks. NBTestGen generates regression-based assertions that check properties related to data processing, model building, and model evaluation steps in a typical ML notebook. To support systematic integration of such assertions in notebooks, we introduce the first regression testing framework (called NBTest) that can be used as a Jupyter plugin and allows developers to write cell-scoped assertions in notebooks. Three key features of such assertions are that they are 1) cell-scoped: they are linked to specific notebook cells and execute only after those cells are executed, 2) non-intrusive: they do not block notebook execution (in a Jupyter session), so that development can continue when they fail, and 3) they integrate with pytest and CI pipelines, allowing developers to easily do regression testing of their notebooks. We evaluate NBTestGen on a corpus of 585 notebooks from the popular Kaggle platform. NBTestGen generates a total of 21542 assertions (36.82 on average per notebook). The generated assertions kill 72.21% of ML-specific mutations, while maintaining a high passrate of 100.00%. We also show that NBTestGen can detect 69.68% of historical regressions in 531 older versions of Kaggle notebooks. A popular ML library, SHAP, integrated NBTest into their CI. Further, we perform a user study with 17 ML developers that shows that such users find NBTest highly intuitive and useful. Article Search Artifacts Available Article: ase26main-p1451-p doi:10.1145/3832783.3834390
	Ning, Jianting	ASE '26: "How Your Credentials Are Leaked ..." How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study Zhihao Chen, Ying Zhang, Yi Liu, Gelei Deng, Yuekang Li, Yanjun Zhang, Jianting Ning, Leo Yu Zhang, Lei Ma, and Zhiqiang Li (Griffith University, Australia; Wake Forest University, USA; Nanyang Technological University, Singapore; University of New South Wales, Australia; Zhejiang Sci-Tech University, China; University of Tokyo, Japan; University of Alberta, Canada; Independent Researcher, China) Large Language Model (LLM) agents increasingly rely on third-party skills that operate within privileged execution environments and routinely handle sensitive credentials, yet how these credentials are leaked remains largely unexplored. To fill this gap, we present the first large-scale empirical study on credential leakage in agent skills. From 170,226 artifacts on SkillsMP, the largest open-source skill marketplace, we sampled 17,022 skills via stratified random sampling and analyzed each through static secret extraction (regex and AST parsing), dynamic sandbox testing of flagged candidates seeded with mock credentials, and cross-referencing developer intent against runtime behavior. Our analysis identifies 520 affected skills containing 1,708 security issues, and yields a taxonomy of 10 leakage patterns. Three findings stand out. First, 76.3% of cases require jointly analyzing natural-language descriptions and programming logic, showing that credential exposure in skills is fundamentally cross-modal. Second, Information Exposure accounts for 73.5% of vulnerability issues because agent frameworks feed stdout into the LLM context window, turning routine debugging into a credential exposure vector. Third, 89.6% of leaked credentials are immediately exploitable, and the fork-based distribution model defeats remediation, as secrets removed from upstream repositories persist across 50+ independent forks. Following responsible disclosure, all malicious skills have been removed. We release our dataset, taxonomy, and detection pipeline to support future agent security research. Article Search Article: ase26main-p928-p doi:10.1145/3832783.3834373
	Nishimura, Keisuke	ASE '26: "Generating Loop Invariants ..." Generating Loop Invariants for Deductive Verification using Iterator Profiles Keisuke Nishimura, Jean-Pierre Lozi, and Julia Lawall (Inria, France) Recent advances in deductive verification have gradually made it practical to verify the functional correctness of real-world software. However, creating loop invariants still requires manual effort. We propose to reduce this burden by automatically generating invariants. In the context of generating invariants for real-world software, the key requirements are to support diverse index iteration patterns and to capture precise information about loop behaviors. In this paper, we introduce the idea of an iterator profile: a loop-invariant template for an iteration pattern. Once a user writes a profile, it can be reused for any iterator-based loop that shares the same iteration pattern. We present LoopAnnotator, a tool that generates loop invariants for iterator-based loops by combining an iterator profile with the result of automatic program analysis of the loop body. LoopAnnotator successfully generates invariants for more than 70 Article Search Article: ase26main-p2432-p doi:10.1145/3832783.3837530
	Niu, Nan	ASE '26: "A Scalable Rule-Based Deep ..." A Scalable Rule-Based Deep Reinforcement Learning Framework for the Next Release Problem Hemanth Gudaparthi, Nan Niu, Prem Swaroopaanda Ramalingam, and Laxman Chowdary Kakara (Governors State University, USA; University of North Florida, USA) Next-release planning and feature selection remain critical challenges in the software deployment cycle, especially with the rapid introduction of updates and AI-driven functionalities. Selecting a subset of high-impact features that balances customer satisfaction with stakeholder business goals requires scalable models capable of producing near real-time predictions from requirements descriptions. However, uncertainty about which features truly align with customer needs makes this task difficult. This paper proposes a scalable feature prioritization framework that leverages rules derived from feature perplexity, probabilistic relevance, and customer-oriented criteria. We introduce a dual deep-reinforcement learning (DDRL) architecture that recommends high-value requirements through a hierarchical strategy. The first level applies graph reinforcement learning (GRL) guided by rule-based reasoning to structure tasks and reduce search space, while the second level uses deep reinforcement learning (DRL) to refine predictions. Experimental results on Zoom, Webex, and Teams datasets show that the approach maintains linear complexity (O(m)) compared to the cubic complexity (O(m^3)) of traditional graph-based methods, where m is the number of edges. The model achieves up to 85.56 Article Search Artifacts Available Article: ase26main-p350-p doi:10.1145/3832783.3834348
	Niu, Xintao	ASE '26: "Beyond Syntactic Differencing: ..." Beyond Syntactic Differencing: Semantic-Aware Scheduling for Cross-Configuration Incremental Builds Xiaolong Dai, Shanshan Li, Jun Lyu, and Xintao Niu (Nanjing University, China) Modern configurable software systems are routinely built and tested across thousands of configuration variants to ensure correctness under diverse settings. Reusing build artifacts across configurations is therefore crucial to reduce redundant effort, yet remains challenging. Existing approaches estimate rebuild cost using syntactic option differences and apply greedy scheduling, which often misestimate true costs and yield suboptimal build orders. We present SIBS, the first semantics-aware scheduling framework for incremental builds across configurations, addressing both inaccurate cost estimation and the limitations of greedy scheduling. The key idea is a semantic distance metric that models the impact of configuration changes on rebuild scope by capturing option-level effects on code generation, accounting for global configuration headers, and propagating changes through dependency graphs. This enables cost-aware global scheduling formulated as an Asymmetric Traveling Salesman Problem (ATSP). Across 21 real-world systems and five independently sampled configuration batches, SIBS reduces observed build time relative to the state-of-the-art build scheduler in 17 systems. On average, it saves 196s (21%), with a median saving of 40s (3%), and achieves a 27.7% geometric-mean reduction in build time across projects. Batch-level reductions range from 25.7% to 29.3%, and the scheduling overhead remains modest (median 3.1s; mean 12.9s). These results demonstrate that semantics-aware cost modeling and global scheduling provide substantial and robust efficiency gains across diverse configurable systems. Article Search Artifacts Available Article: ase26main-p2497-p doi:10.1145/3832783.3837533
	Nocera, Sabato	ASE '26: "On the Effects of Customized ..." On the Effects of Customized Configurations of Static Code Analysis Tools: A Prospective Cohort Study of SonarQube Cloud Sabato Nocera, Sira Vegas, and Giuseppe Scanniello (University of Salerno, Italy; Polytechnic University of Madrid, Spain) Static Code Analysis (SCA) tools are used to detect issues and enforce code quality standards in software projects. SCA tools like SonarQube Cloud provide predefined configurations that project owners can customize depending on the goal of the project at hand. One such configuration is the quality gate, which defines the set of conditions that source code must satisfy to pass automated quality checks during software development. This paper investigates the impact of customizing SonarQube Cloud quality gates on security, reliability, and maintainability. We employ a prospective cohort study design to explore causal relationships using observational data. We track 230 open-source GitHub projects forward in time, monitoring transitions in configurations to ensure consistent adherence to either customized or predefined ones. A significant effect was observed only for security under less strict configurations, suggesting that developers could be more motivated to fix security issues when the requirements are perceived as attainable. For reliability and maintainability customizations, we speculate that the lack of impact may stem from these quality attributes being perceived as less essential or pressing compared to security. Article Search Article: ase26main-p2032-p doi:10.1145/3832783.3834408 ASE '26: "AIRBORNE: Augmented fIne-grained ..." AIRBORNE: Augmented fIne-grained softwaRe Bill Of mateRials geNerator for stack ovErflow Sabato Nocera, Massimiliano Di Penta, Simone Romano, and Giuseppe Scanniello (University of Salerno, Italy; University of Sannio, Italy) SBOM (Software Bills of Materials) generation tools operate at coarse granularity, capturing only package- or library-level dependencies while overlooking smaller artifacts such as code snippets from Questions & Answers (Q&A) forums such as Stack Overflow (SO). In this tool demo paper, we present AIRBORNE (Augmented fIne-grained softwaRe Bill Of mateRials geNerator for stack ovErflow), a tool that analyzes a software project and generates an augmented fine-grained SBOM enriched with information on self-admitted SO references. AIRBORNE integrates source code analysis, repository mining, and clone detection techniques to align SO provenance with the CycloneDX SBOM standard. We conducted a preliminary assessment of 383 GitHub projects with known self-admitted SO references. The results show that our tool captures fine-grained dependencies whenever developers explicitly acknowledge code snippet reuse through self-admitted references to SO posts. Tool link: https://github.com/MSR4SBOM/airborne Video link: https://youtu.be/HX9wpnrM5tA Article Search Article: ase26tool-p88-p doi:10.1145/3832783.3834631
	Noller, Yannic	ASE '26: "ReproBreak: A Dataset of Reproducible ..." ReproBreak: A Dataset of Reproducible Web Locator Breaks Thiago Santos de Moura, Leon Adamietz, Samra Mehboob, and Yannic Noller (Ruhr University Bochum, Germany) Automated GUI testing frameworks such as Cypress and Playwright rely on locators to find and interact with web elements. A locator break occurs when a structural change in the application under test causes a locator to no longer find its target element, resulting in test breakages even when the underlying functionality remains unchanged. Despite its impact on test maintenance, no dataset exists to evaluate locator fragility in Cypress and Playwright at scale. In this paper, we present ReproBreak, a dataset of reproducible locator breaks in web GUI tests. We analyzed 359 open-source repositories to identify commits that contain locator changes. To confirm whether these changes are indeed locator breaks, we reproduced them in the top 4 projects with the largest number of locator changes and found 449 locator breaks, which are provided in the dataset along with scripts for automated reproduction. We believe ReproBreak serves as a valuable artifact to support research on locator fragility, repair techniques, and test robustness. The video is available at: https://youtu.be/fM6qQhoTjqY. The dataset is at https://github.com/rub-sq/ReproBreak. Article Search Artifacts Available Article: ase26tool-p118-p doi:10.1145/3832783.3834638
	Oh, Hakjoo	ASE '26: "EvoLLM: High-Coverage, Readable, ..." EvoLLM: High-Coverage, Readable, and Token-Efficient Unit Test Generation for Industrial Java Codebases Seokhyeon Moon, Myungho Lee, Jihun Kim, Yoon-Chan Jhi, Jihoon Cho, and Hakjoo Oh (Samsung SDS, Republic of Korea; Korea University, Republic of Korea) Adopting automated Java unit-test generation in industrial settings requires high coverage, readability, token efficiency, and modern-Java deployability. No existing technique meets all four: search-based test generators struggle with readability and modern-Java deployability, LLM-centric generators consume tens of millions of tokens, and prior LLM-based test refactoring methods drop baseline coverage by 8–21 percentage points (pp) in our controlled setups. We report on EvoLLM, a hybrid Java unit-test generator we built and deployed to address all four requirements. EvoLLM combines EvoSuiteng—a failure-analysis-driven hardening of EvoSuite that resolves deployability issues and strengthens baseline coverage—with cluster-wise LLM-based refactoring that groups tests by coverage goals and rewrites each cluster in a single LLM call grounded in compact program-under-test context. Across six open-source and three industrial projects, EvoLLM outperforms six state-of-the-art baselines, improving line coverage by 8.2–20.7 pp, branch coverage by 6.2–19.4 pp, and mutation score by 6.8–24.5 pp, while reducing LLM token usage by 47.3%–93.0%. In addition, the test generation stage of EvoLLM demonstrates robust deployability across target projects built with JDKs 8, 11, and 17, while achieving strong effectiveness on a Spring-core release requiring JDK 17. Finally, a 14-participant developer survey further suggests that EvoLLM-generated tests ranked higher in readability than those from prior tools and developer-written tests. Article Search Article: ase26ind-p335-p doi:10.1145/3832783.3834525
	Ohtsuji, Hiroki	ASE '26: "Kozuchi Agent: A Language-Agnostic ..." Kozuchi Agent: A Language-Agnostic Open-Weight Agent for Software Repair Mehdi Bahrami, Kosaku Kimura, Satoshi Munakata, Satoshi Nakashima, Yu Ishikawa, Kosuke Maeda, Nao Soma, Kenichi Kobayashi, Keisuke Miyazaki, Keizo Kato, Shigeki Fukuta, Tatsuo Kumano, Nobutaka Imamura, Kevin Musgrave, Shahbaz Abdul Khader, Kwun Ho Ngan, Joe Townsend, Fayas Asharindavida, Matthieu Parizy, Akira Sakai, Yuma Ichikawa, Yang Zhao, Michiaki Takizawa, Taku Fukui, Hiroki Ohtsuji, Wei-Peng Chen, and Hiro Kobashi (Fujitsu Research of America, USA; Fujitsu Research, Japan; Fujitsu Research of Europe, UK; Fujitsu Research & Development, China) Industrial software-engineering teams increasingly need LLM agents that turn bug reports into correct patches, yet benchmark-scale operation adds long horizons, tool-use discipline, context persistence, heterogeneous clusters, and evaluation reuse. We present Kozuchi Agent, a language-agnostic open-weight repair agent and CI-operated evaluation pipeline. Explicit phases, persistent state, deterministic tools, a model-independent action interface, and cross-agent test-time selection make runs auditable and repeatable. With locally hosted Qwen3.5-27B, no fine-tuning, and TTS@8, Kozuchi resolves 374/500 SWE-bench Verified instances on the official evaluator. Unchanged on Multi-SWE-bench Java, the same 27-billion-parameter agent resolves 41/128 instances (32.03%), ranking first among strict open-weight submissions and fourth of 42 overall; on Python it ranks 12th of 135 and first among open-weight systems. Per-phase behavior remains within ± 5 percentage points across languages. Remaining failures mainly reflect semantic correctness, Java-specific harness issues, and selection errors. Across both tracks, results compare favorably with open/local peers by parameter count. Analysis of candidate diversity, selector regret, and patch reliability shows that the remaining gap is primarily semantic correctness and selection rather than edit formatting or proprietary-model access. Operationally, reusable CI stages reduce operator touch-points from five to one across heterogeneous internal clusters. Article Search Article: ase26ind-p408-p doi:10.1145/3832783.3834531
	Okafor, Chinenye	ASE '26: "Context-Aware Trust Verification ..." Context-Aware Trust Verification for Identity-Based Software Signing Chinenye Okafor, James C. Davis, and Santiago Torres-Arias (Purdue University, USA) Modern software release infrastructure uses identity-based software signing to associate software artifacts with a known identity. For example, registries such as npm and Docker Hub rely on Sigstore’s identity-based software signing in their artifact provenance workflows. However, existing verification procedures only provide evidence of a signer’s identity, but not the conditions under which signing occurred. As a result, compromised credentials, identity providers, or signing tools can still produce signatures that pass verification. This gap prevents software engineering tools (e.g., package registries, dependency analysis tools, deployment systems, and CI/CD verification stages) from enforcing verifiable context-aware trust policies for software signing. We present DiVerify, a framework for automated verification of software signing conditions. A DiVerify signature binds identity claims from multiple independent scope providers, signing-environment attestation from a TEE-isolated daemon, and the signing key into a single verifiable object. A machine-checkable policy language specifies the identity, authentication, and environment conditions required for accepting a signature. We formally analyze DiVerify and show that it is sound, prototype it across three deployment modes, and demonstrate overhead under 400ms, with storage overhead of less than 1.6% of average PyPI package size. Case study integrations with existing systems confirm DiVerify composes well. Article Search Article: ase26main-p30-p doi:10.1145/3832783.3834333
	Olatunji, Iyiola E.	ASE '26: "Evaluating Inference-Time ..." Evaluating Inference-Time Defenses against Package Hallucination in LLM-Generated Code Alberick Euraste Djire, Iyiola E. Olatunji, Melissa Tessa, Earl T. Barr, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg; University College London, UK) LLMs are increasingly used for code generation, yet they frequently hallucinate non-existent software packages, creating exploitable entry points into the software supply chain. We make four contributions to this problem. First, we show that prior evaluation methodologies systematically inflate hallucination rates by misclassifying standard-library modules as hallucinations in some languages. For Python, the overestimation reaches 9.4 percentage points. Second, we evaluate seven inference-time defenses for mitigating package hallucinations, including five guided decoding strategies (Greedy, Contrastive, DoLa, Nudging, and Active Layer-Contrastive Decoding), an iterative self-refinement approach (Self-Refine), and a Retrieval-Augmented Generation (RAG)-based defense. Across eight models spanning five families and four programming languages (Python, JavaScript, Ruby, Rust), RAG reduces the package hallucination rate (PHR) in 18 of 32 model–language configurations. Third, we introduce Package Utility (PU) to assess whether defenses preserve valid and task-relevant recommendations. Among strategies evaluated, Greedy decoding provides the strongest average mitigation–utility trade-off. Fourth, we stress-test all strategies under adversarial prompts seeded with fabricated package names and find that PHR surges by up to 45 percentage points relative to standard prompts, with Ruby consistently the most vulnerable language (80.9–95.2%). Under adversarial conditions, RAG and Self-Refine outperform all decoding-only strategies, indicating that robust defense requires either external grounding or iterative self-verification when prompts are actively hostile. Our results recast package hallucination as both a measurement problem and a decoding-time control problem, and they demonstrate that the choice of defense must be matched to the threat model and recommendation utility. Article Search Article: ase26main-p3592-p doi:10.1145/3832783.3837555 ASE '26: "Do Not Copy/Paste: Soft Barriers ..." Do Not Copy/Paste: Soft Barriers for Copying in AI-Assisted Programming Iyiola E. Olatunji, Alberick Euraste Djire, Jacques Klein, and Tegawendé F. Bissyandé (University of Luxembourg, Luxembourg) Copying a function from a chat window into an editor takes less than a second. For many uses of AI coding tools, that speed is the point; in settings such as programming education, code review, and security-sensitive development, it can also be the problem. This paper frames copy-paste as an AI code handoff problem: the moment model-generated text crosses from a conversational context into executable or committed software is a design boundary that current tools leave largely unmanaged. We argue that AI coding assistants should not only be evaluated by the code they generate, but also by how they mediate the transfer of that code into software artifacts. We propose soft barriers as one class of handoff-aware mechanisms. Soft barriers preserve access to AI assistance while making unexamined transfer less frictionless. As an initial technical probe, we instantiate this idea using Unicode output perturbations that preserve visual readability but disrupt naive copy-paste execution. We introduce Copy-Paste Resistance (CPR), the fraction of functionally correct clean solutions that become syntactically invalid after perturbation. Across HumanEval and MBPP with four LLMs and four perturbation families, we find that output-level barriers can achieve high copy-paste resistance, but their effectiveness is highly model- and task-dependent. An exploratory pilot with 18 participants provides early evidence that soft barriers can shift users from direct transfer toward editing and reconstruction. We do not present Unicode perturbations as a deployment-ready solution; rather, we use them as a minimal probe for a broader research agenda on practical, transparent, and policy-aware AI code handoff. Article Search Article: ase26nier-p79-p doi:10.1145/3832783.3834554
	Oliva, Gustavo	ASE '26: "When Elo Lies: Hidden Biases ..." When Elo Lies: Hidden Biases in Codeforces-Based Evaluation of Large Language Models in Practice Shenyu Zheng, Ximing Dong, Xiaoshuang Liu, Chun Yong Chong, Gustavo Oliva, Dayi Lin, Boyuan Chen, Shaowei Wang, and Ahmed E. Hassan (Huawei Canada, Canada; Huawei, China; Monash University, Malaysia; Queen's University, Canada; University of Manitoba, Canada) As Large Language Models (LLMs) achieve breakthroughs in complex reasoning, Codeforces-based Elo ratings have emerged as a prominent metric for evaluating competitive programming capabilities in industry. However, these ratings are often reported without critical experimental details, leading to significant discrepancies-illustrated by recent reports where the same model version’s score fluctuated by nearly 500 points (out of 2,029). This paper presents a systematic empirical study on the hidden factors biasing Elo evaluations: (1) the temporal ordering of submissions, (2) contest difficulty selection, and (3) run-to-run stochastic variability of LLMs. Utilizing a controlled benchmark of 37 recent Codeforces contests and 13,691 generated test cases, we demonstrate that Elo scores are highly sensitive to these parameters. Our findings reveal that varying submission orders can shift scores by 394 points, while contest selection can cause differences of up to 1,122 points for the same model. Run-to-run performance exhibits substantial instability, with a maximum difference of 349 points in mean scores observed when evaluating identical contests. We conclude that direct Elo comparisons are unreliable and potentially misleading without strict standardization and transparent reporting of experimental settings. Article Search Article: ase26ind-p20-p doi:10.1145/3832783.3834458
	Olivieri, Luca	ASE '26: "GoLiSA: An Advanced Static ..." GoLiSA: An Advanced Static Analysis Tool for Detecting Potential Risks and Vulnerabilities in Hyperledger Fabric Smart Contracts Luca Olivieri, Luca Negrini, Vincenzo Arceri, Pietro Ferrara, Fausto Spoto, and Agostino Cortesi (Ca’ Foscari University of Venice, Italy; University of Parma, Italy; University of Verona, Italy) GoLiSA is a static analysis tool that allows the verification of smart contracts written in Go, the most widely used language for developing smart contracts in Hyperledger Fabric. GoLiSA relies on abstract interpretation to model program semantics and identify potential risks and vulnerabilities in smart contracts. It supports advanced analyses such as information flow tracking and numerical and string value analysis, enabling the approximation of semantic program behaviors. Building on these analyses, GoLiSA implements a suite of checks for detecting non-trivial issues and potential risks in Hyperledger Fabric, including non-determinism, phantom reads, untrusted cross-contract invocations, read-after-write and over-write issues, cross-channel invocation risks, numerical issues, and unhandled errors. GoLiSA is publicly available at https://github.com/lisa-analyzer/go-lisa. A demonstration video showcasing the tool is available at https://youtu.be/WqkYOpWc9oE. Article Search Artifacts Available Article: ase26tool-p147-p doi:10.1145/3832783.3834644
	Omran, Ahmed	ASE '26: "Customizing an LLM for Enterprise ..." Customizing an LLM for Enterprise Software Engineering Aditya Kini, Satish Chandra, Milad Hashemi, Saksham Thakur, Aditya Pandey, Vincent Nguyen, Marc Brockschmidt, Franjo Ivančić, Danny Tarlow, Parthasarathy Ranganathan, Petros Maniatis, Ahmed Omran, Zaheer Abbas, Anita Gergely, Martin Sevenich, Gufeng Zhang, Amy Hua, and Alexander Frömmgen (Google, USA; Meta, USA; Google DeepMind, USA; Google Brain, USA) Enterprise software development is a continuous evolutionary process, characterized by incremental additions, architectural revisions, production deployments and rigorous maintenance. These activities generate valuable data that modern LLMs could be finetuned on, to unlock additional tool possibilities for enterprise software engineering. While frontier LLMs are already very capable, this form of customization offers a compelling path for enterprise-specific optimization. We introduce Gemini for Google (GfG), an adaptation of Gemini specialized for Google's internal software engineering ecosystem. This paper details the model's end-to-end development, from curating a trillion-token proprietary dataset to implementing a mid-training strategy that mitigates catastrophic forgetting. In a large-scale blind A/B study across 29,000 developers, Gemini for Google significantly outperformed baselines: reducing the mean number of iterations per turn by 23%, and increasing the percentage of AI-generated code lines that remains in the codebase unmodified after 14 days (code survival rate) by about 17%. Beyond metrics, we provide a comprehensive blueprint for enterprise model adaptation, covering: (1) the extraction of high-value signals from software engineering data, (2) data preparation strategies, (3) full-stack model tuning (continued pre-training and post-training), and (4) the deployment of downstream applications. We believe this methodology offers a guiding framework for other organizations to unlock the full potential of their internal engineering data. Article Search Article: ase26ind-p210-p doi:10.1145/3832783.3834508
	Ong, Trevor Yee Siang	ASE '26: "UIBenchKit: A Unified Toolkit ..." UIBenchKit: A Unified Toolkit for Design-to-Code Model Evaluation Chinh T. Le, Trevor Yee Siang Ong, Jingyu Xiao, Yuxuan Wan, and Yintong Huo (Singapore Management University, Singapore; Chinese University of Hong Kong, Hong Kong) Recent years have seen substantial progress in automated design-to-code generation, with many methods proposed for generating HTML and CSS from webpage screenshots. However, the absence of a standardized evaluation platform makes it difficult to compare these methods fairly, limiting both practical adoption and systematic research progress. To bridge this gap, we introduce UIBenchKit, an open-source, integrated toolkit designed to unify the evaluation of design-to-code tasks. UIBenchKit abstracts the complexities of environment setup, model inference, and code rendering, offering researchers a plug-and-play architecture to compare various methods under consistent settings. In addition, it offers an analytical interface for comparison across multiple metrics. Using UIBenchKit, we conduct a benchmarking study of existing tools and derive several findings that highlight directions for future improvement. By providing a streamlined environment for both experimentation and evaluation, UIBenchKit aims to accelerate future benchmarking and innovations in web engineering. The evaluation platform and toolkit are available at the project pages https://www.uibenchkit.com/ and https://github.com/chinh02/UIBenchKit. A video of UIBenchKit is available at https://youtu.be/UyeYyASovuU. Article Search Artifacts Available Article: ase26tool-p53-p doi:10.1145/3832783.3834612
	O'Quinn, Austin	ASE '26: "Clarity: From Formal System ..." Clarity: From Formal System Designs to Verified RL Controllers Austin O'Quinn, Conor Snedeker, Max Taylor, Lance Joneckis, and Christopher Stewart (Ohio State University, USA; Boise State University, USA; Idaho National Lab, USA) Safety-critical cyber-physical systems increasingly use reinforcement learning-based controllers, yet existing engineering methodologies cannot assure these systems’ safety. Assuring safety requires connecting three concerns that are currently addressed in isolation: the system’s design, the reinforcement learning pipeline, and runtime verification. This paper introduces CLARITY, a system that ingests designs written in SysML v2 and, through novel translational semantics to the nuXmv model checker, verifies safety requirements, synthesizes a reinforcement learning pipeline, and generates a runtime monitor. CLARITY enables fully traceable safety assurance arguments for reinforcement learning-based systems, closing the gap between system design, controller synthesis, and runtime assurance. We validate CLARITY on three CPS benchmarks of increasing complexity, demonstrating verified safety requirements, effective learned controllers, and lightweight runtime monitoring from a single SysML v2 specification. Article Search Artifacts Available Article: ase26main-p3070-p doi:10.1145/3832783.3834429
	Orso, Alessandro	ASE '26: "Tangent: An Empirical Study ..." Tangent: An Empirical Study of Testing Practices for LLM-Based Agent Applications Rangeet Pan, Tyler Stennett, Divya Sankar,