用大模型与图分析统一检测修复代码异味和漏洞
The Code Whisperer: LLM and Graph-Based AI for Smell and Vulnerability Resolution
- 融合语法树、控制流图与代码嵌入，联合学习结构与语义信息
- 在多语言数据集上检测准确率显著高于单一方法，修复建议更实用
- 支持可解释性与流水线集成，适合实际开发场景落地
代码异味和软件漏洞都会增加维护成本，但现有工具常独立处理，缺乏上下文且误报率高。本文提出 The Code Whisperer，一种结合图结构程序分析与大语言模型的混合框架，可在统一流程中检测、解释并修复可维护性与安全性问题。该方法对抽象语法树（AST）、控制流图（CFG）、程序依赖图（PDG）及词级代码嵌入进行对齐，实现结构与语义信号的联合学习。我们在多语言数据集上评估该框架，并与基于规则的分析器及单模型基线对比。结果表明，混合设计在检测性能上优于纯图或纯语言模型方法，生成的修复建议更具实用性。此外，我们还考察了可解释性与 CI/CD 集成能力，以满足日常软件工程中 AI 辅助代码审查的实际需求。
原文摘要 · Abstract (English)
Code smells and software vulnerabilities both increase maintenance cost, yet they are often handled by separate tools that miss structural context and produce noisy warnings. This paper presents The Code Whisperer, a hybrid framework that combines graph-based program analysis with large language models to detect, explain, and repair maintainability and security issues within a unified workflow. The method aligns Abstract Syntax Trees (ASTs), Control Flow Graphs (CFGs), Program Dependency Graphs (PDGs), and token-level code embeddings so that structural and semantic signals can be learned jointly. We evaluate the framework on multi-language datasets and compare it with rule-based analyzers and single-model baselines. The results indicate that the hybrid design improves detection performance and produces more useful repair suggestions than either graph-only or language-model-only approaches. We also examine explainability and CI/CD integration as practical requirements for adopting AI-assisted code review in everyday software engineering workflows.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。