SWGeno 2026 – Preliminary Table of Contents

2nd International Workshop on Software Genomics (SWGeno 2026)

Frontmatter

Papers

ForkOps: Operating Fleets of Generated Software Variants
Laurent Bindschaedler
(MPI-SWS, Germany)
Code generation with large language models (LLMs) is making specialization cheap: file systems synthesized from specifications, database engines generated per workload, services regenerated per customer instead of configured. This paper asks the question that arrives immediately after: what are the operational problems of owning the resulting fleet of variants? A fork is no longer a copy event with version-control lineage: a variant’s identity lives in its derivation record, the specification, kernel, and generator that produced it. The record is the genotype, the emitted code only a phenotype. Regeneration is nondeterministic expression, so two guarantees that existing tooling relies on break at once: derivation relatedness no longer implies code correspondence, and re-deriving from a fixed input preserves only what the specification pins down. Clone detection and diff-based patch porting lose their basis, and we find no infrastructure that joins identity, patching, and assurance across a population of variants. Product lines, model-driven co-evolution, and supply-chain provenance each supply pieces, but none integrates them for an independently operated fleet. This paper maps the problem space, proposes four primitives, and states a falsifiable agenda.
Article Search Article: asews26swgenomain-p5-p (type: Short Paper (4 pages)) doi:10.1145/3844178.3844641

Same Task, Different Fate: Population Structure in Trajectory-Based Analyses of Coding Agents
Simarjot Khanna
(Independent, Canada)
Coding-agent trajectories are read as evidence about the software process, and analyses pool runs from many different tasks. The task predicts both the behaviour and the outcome, so a pooled estimate mixes a within-task and a between-task channel, and is read as a statement about runs. We quantify that mixing with the genomic inflation factor, calibrated by a null that permutes outcomes within task, compare a pooled against a task-stratified test, and recondition a published signature. Under a null with no run-level association at all, the pooled test is inflated to at least 1.62 while the stratified test stays calibrated at 1.02. Reproducing a published behavioural signature and recomputing it holding the task fixed keeps most of it: one effect becomes indistinguishable from zero, and one reverses sign between the two estimands. The pooled and within-task quantities answer different questions, and a pooled estimate is read as if it were the within-task one. Report both, and calibrate against a within-task permutation.
Article Search Article: asews26swgenomain-p33-p (type: Full Paper) doi:10.1145/3844178.3844642

RepoTune: Co-evolving Vulnerability Detection with a Repository’s Genome
Yuqiang Sun, Ruozhao Yang, and Ying Li
(Nanyang Technological University, Singapore; Singapore Management University, Singapore; Independent, USA)
Every automated vulnerability detector is pinned to a tradeoff between precision and recall, fixed by its algorithm and chosen to work well enough across all code. But code is not uniform: every project has its own conventions, idioms, and functionality (the recurring, project-stable patterns that software genomics reads as a codebase’s genes), and these are exactly the information that could push a detector past its global frontier. Tuning a detector to a specific codebase has always helped, but it demands expert effort per project across millions of projects, so we settle for one universal detector. We argue that LLM agents overturn this compromise, making per-project customization automatable for the first time. We take the position that security is not a fixed external checker but part of a project’s genome, so detection should be optimized per project and co-evolve with it, synthesizing for each repository a detector specialized to its attack surface across static analysis, invariants, formal verification, and fuzzing, grounded in the project’s code style, semantics, and history of past defects. We outline RepoTune, an agentic feedback loop that profiles a repository’s genome and evolves a specialized detector against the repository’s own code and vulnerability history to minimize false positives and maximize recall, with developers contributing domain knowledge, and we lay out the research agenda this opens for software genomics, including how such detectors propagate through a software supply chain.
Article Search Article: asews26swgenomain-p36-p (type: Short Paper (4 pages)) doi:10.1145/3844178.3844643

Reachability Is Only the Beginning: Toward Effect-Aware Vulnerability Analysis for AI Agents
Yu Ji, Yang Wei, Yueming Wu, and Deqing Zou
(Huazhong University of Science and Technology, China)
AI agents increasingly rely on tools built on or dependent on open source software (OSS) to access data, invoke services, and modify external resources. Vulnerabilities in these dependencies can there- fore propagate into agent systems. Conventional analyses trace vulnerability effects through explicit program states and data or control dependencies. Agent systems introduce model inference be- tween tool output and subsequent action, so affected states become model-visible observations whose influence depends on semantic interpretation. Program analysis can show that such values reach model input, but not whether they change the generated action or external system. We assess three successive links in this process. Vulnerable execution must change the observation, the changed observation must influence the generated action, and the executed action must change an external resource. Our framework combines program tracing, repeated executions under matched contexts, and external state verification to establish these links.
Article Search Article: asews26swgenomain-p47-p (type: Short Paper (4 pages)) doi:10.1145/3844178.3844644

From Code to Knowledge: Enhancing Coding Agents via Reverse-Engineered Software Knowledge
Yiran Zhang, Yifei Ge, and Xiaoxia Liu
(Nanyang Technological University, Singapore; Nanjing University, China; Zhejiang University, China)
Despite advances in code retrieval and static analysis, LLM-based coding agents rarely construct or consult structured representations of a codebase's architectural design, domain model, or behavioral patterns, the very knowledge that human developers depend on when making nontrivial changes. This absence of explicit knowledge models may cause agents to produce code that, while syntactically correct, can violate architectural constraints, ignore established patterns, and fail to align with the codebase's conceptual vocabulary. We argue that reverse-engineering this structured knowledge from existing code and injecting it into coding agents addresses this limitation. We propose a three-layer knowledge taxonomy covering architectural, domain, and behavioral knowledge; a multi-level extraction framework using static analysis, schema mining, and pattern detection; and integration strategies based on prompt augmentation and retrieval-augmented generation. Our approach is lightweight, model-agnostic, and can layer onto existing coding agents without retraining.
Article Search Article: asews26swgenomain-p51-p (type: Short Paper (4 pages)) doi:10.1145/3844178.3844645

The Gene Is Not the Gate: Conceptualizing the Semantic Genome of Quantum Software
Jiongchi Yu, Yue Duan, Ziming Zhao, Xiaofei Yue, and Zhaoxuan Li
(Nanyang Technological University, Singapore; Singapore Management University, Singapore; Zhejiang University, China; Beijing Institute of Technology, China; Institute of Information Engineering at Chinese Academy of Sciences, China; University of Chinese Academy of Sciences, China)
Quantum software spans applications, program representations, compilers, runtimes, and hardware-facing control. Existing abstractions describe these artifacts and layers, but they do not capture the semantic responsibilities that must remain valid as a computation is transformed across the stack. This limits systematic reasoning about cross-layer correctness, evolution, and reuse.
We present QGenome, a semantic foundation for quantum software genomics. We define a quantum software gene as a typed, reusable responsibility characterized by an explicit contract, execution context, concrete expressions, and supporting evidence. QGenome organizes genes across five software strata and ten responsibility families grouped into computational semantics, coordination, realization, and assurance. Typed genes compose into pathways and genomes through dependency, refinement, provenance, and phenotype relations, enabling responsibilities to be traced across alternative implementations and execution contexts.
We illustrate the taxonomy using representative public artifacts across the quantum software stack and define principles for contextual validity, genome evolution, environmental adaptation, and capability expression. Rather than presenting a complete taxonomy or an automated extraction technique, QGenome establishes a falsifiable framework and a concrete research agenda for gene mining, lineage recovery, cross-layer regression testing and repair, and evidence-grounded quantum software agents.
Article Search Article: asews26swgenomain-p59-p (type: Short Paper (4 pages)) doi:10.1145/3844178.3844646

Vulnerability Proof-of-Concepts in Software Supply Chain: Real-World Usage Scenarios from the Perspective of Migration
Wenjing Dang, Xiaohong Li, and Sen Chen
(Tianjin University, China; Nankai University, China)
The security community widely uses software composition analysis (SCA) to identify vulnerabilities introduced by third-party libraries (TPLs) in the software supply chain. However, static analysis produces many false positives, so a Proof-of-Concept (PoC) is needed to confirm that a vulnerability is exploitable. Existing research studies PoC migration for cross-project vulnerability propagation. Propagation across operating systems and hardware architectures has received far less attention, yet each type raises distinct migration requirements and challenges. In this paper, we present three real-world usage scenarios of PoC migration, one for each propagation type: cross-project, cross-OS, and cross-architecture. For each scenario, we analyze its challenges and propose preliminary solutions by synthesizing existing research and empirically analyzing dozens of reproduced PoC cases. We regard the difference between the original and target vulnerability vectors as the mutation that a vulnerability undergoes as it propagates. Building on this view, we reuse an already-verified PoC_o as a high-fidelity seed and propose diff-based PoC migration as the preliminary solution. We further discuss how, in the era of large language models (LLMs), an agentic workflow can use LLMs to interpret these differences and to drive the program-analysis tools that adapt the PoC. We hope this work provides a basis for studying real-world PoC migration and for strengthening supply-chain security.
Article Search Article: asews26swgenomain-p86-p (type: Short Paper (4 pages)) doi:10.1145/3844178.3844647

Seeing the Forest: A Taxonomy-Guided Analysis and Improvement of Malicious PyPI Package Detectors
Zibo Liu, Junjie Wang, and Sen Chen
(Tianjin University, China; Nankai University, China)
Malicious packages pose a growing threat to open-source software ecosystems, yet existing detectors rely on fragmented and tool-specific behavior definitions, making it difficult to systematically characterize malicious intent or identify their detection blind spots. This paper presents an automated framework for constructing a fine-grained taxonomy of malicious behaviors in PyPI packages. We collect 11,362 real-world malicious packages from four public datasets and threat intelligence gathered from 12 mirror sources. Our framework combines four static analysis tools to locate sensitive code, leverages an LLM to reconstruct code context and extract structured behavior sequences, and applies card sorting and frequent subsequence mining to normalize behaviors and uncover recurring malicious intents. The framework achieves 95.6% accuracy in context reconstruction and 93.4% accuracy in behavior description, while a three-stage cross-review yields a Cohen's Kappa of 0.83. Based on 11,881 behavior sequences, we derive a taxonomy comprising seven major categories and 31 fine-grained behavior patterns. Using this taxonomy, we evaluate four existing static detectors and reveal substantial category-level blind spots that are obscured by aggregate metrics, particularly for code obfuscation and unauthorized system operations. We further use GuardDog as a case study and improve its recall for three weak behavior categories to above 90%. These results demonstrate that the proposed taxonomy provides a systematic basis for understanding malicious intent, evaluating detector coverage, and guiding the improvement of malicious package detection.
Article Search Article: asews26swgenomain-p93-p (type: Full Paper) doi:10.1145/3844178.3844648

proc time: 0.22