污点流模型的可靠性检查

AI 摘要

该论文提出一种「猜测-验证」方法，用 LLM 代理为 Go 库方法生成精确的污点流模型，再用符号算法验证其可靠性。算法通过推导模型可靠所必须不发生的污点流，并借助类型系统和指针分析等轻量静态分析来证明这些「must-not-flows」，必要时递归验证被调用者模型，从而在多数情况下避免完整的跨过程污点分析。在 6 个大型 Go 代码库的 97 个 LLM 生成模型上，93% 被证明可靠且未引入新的误报。

正文节选

Soundness Checking of Taint Flow Models Abstract. Existing state-of-the-art static taint flow analyses for imperative programming languages can scale to large applications by using precise user-provided taint flow models of library methods. However, manually and precisely modeling a method’s taint flows is tedious and potentially unsound. Furthermore, automatically modeling the method via an inter-procedural taint analysis can be inefficient. To solve this problem, we propose a guess-and-check a

发布时间：2026-09-25 12:00

抓取时间：2026-09-25 14:49

来源机构：arXiv