让大模型像侦探一样分步推理，用结构化证据判断代码漏洞
Agentic Interpretation: Lattice-Structured Evidence for LLM-Based Program Analysis
- 将程序分析任务拆解为局部命题，用格结构追踪每条结论的依据
- 通过工作列表算法动态推进分析，支持中途修正与聚焦搜索
- 适合依赖文档、版本信息等非代码数据的复杂安全分析
大语言模型能访问固定静态分析器无法获取的信息，如文档、安全通告、版本元数据和非正式API契约，使其成为依赖源码之外信息的程序分析理想选择。然而，直接要求大模型进行一次性全程序分析存在脆弱性，因其将多个依赖证据的判断压缩成一个不透明答案，未能揭示哪些结论有支持或争议，也难以利用中间结果引导后续更精准的检索。本文提出代理解释（agentic interpretation）框架，将基于格的静态分析方法引入大模型驱动的程序推理中。整体上，该框架将高层分析目标分解为局部命题，并在有限高度的格结构中追踪大模型对每个命题的判断。工作列表算法控制命题及其判断在分析过程中的演化。本文提出了代理解释的形式化模型，探索其设计空间，并通过分析依赖不透明第三方组件的代码实例展示了该方法的应用。
原文摘要 · Abstract (English)
Large language models can consult information that fixed static analyzers cannot, such as documentation, current security advisories, version-specific metadata, and informal API contracts. This makes LLMs a compelling option for program analyses that depend on information beyond the source program, or that are otherwise not amenable to conventional static analyzers. However, directly asking an LLM for a one-shot whole-program analysis is brittle because it compresses many evidence-dependent judgments into a single opaque answer, rather than exposing which conclusions are supported or disputed and using intermediate findings to guide later, more focused searches. In this paper, we propose agentic interpretation, a framework that brings the discipline of lattice-based static analysis to LLM-driven program reasoning. At a high level, agentic interpretation decomposes a high-level analysis goal into localized claims, and tracks the LLM's judgment about each claim in a finite-height lattice. A worklist algorithm governs how claims and their judgments evolve during the analysis. We introduce a formal model of agentic interpretation, explore the design space it opens, and illustrate the approach with a worked example analyzing code that depends on opaque third-party components.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。