Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces PolyFlow, a neuro-symbolic framework designed to enhance static analysis of information flow across multiple programming languages by integrating large language models (LLMs) with traditional static analysis techniques. By leveraging LLMs to identify implicit flow facts and employing a multi-LLM expert panel for validation, PolyFlow effectively addresses the limitations of existing analyzers that struggle with heterogeneous language semantics. Experimental results demonstrate that PolyFlow outperforms state-of-the-art methods in identifying previously undetected cross-language vulnerabilities in real-world systems, highlighting its cost-effectiveness and superior analytical capabilities.
PolyFlow uncovers hidden cross-language vulnerabilities that traditional static analyzers miss, thanks to its innovative use of LLMs in a neuro-symbolic framework.
Modern software systems are commonly constructed in multiple, interacting programming languages. This construction leads to additional, often stealthy vulnerabilities buried in complex information flow due to language interactions. Existing static analyzers are impeded by the heterogeneous semantics of different languages, whereas dynamic approaches suffer from the limited coverage of (available and/or generated) test inputs. In this paper, we develop PolyFlow, a neural-symbolic framework for statically reasoning about information flow across language boundaries, combining large language models (LLMs) and static analysis synergistically. Governed by the control-flow representation of a given multi-language system, PolyFlow leverages LLMs to identify implicit flow facts due to challenging language features, hence augmenting the base representation and then propagating data flow through the system. It tackles inherent barriers (e.g., token limit and hallucination) of LLMs by putting them under careful guidance (e.g., static-analysis-guided scoping, context management, and fact checking), along with a multi-LLM expert panel for negotiated validation. Our experiments on real-world Python-C and Java-C systems show that PolyFlow is cost-effective and superior to various kinds of state-of-the-art baselines, revealing previously unknown cross-language vulnerabilities that are missed by all the baselines.