Search papers, labs, and topics across Lattice.
The paper introduces L3icNexus, a tool leveraging LLMs for automated detection of open source license conflicts, addressing limitations in existing methods regarding license coverage and accuracy. L3icNexus constructs a domain-specific dataset of 3,238 OSS licenses using a joint labeling method and proposes AdaFine, a Domain-Adaptive Pre-Training (DAPT) and Supervised Fine-Tuning (SFT) approach to create the License-Llama3-8B model. Experiments show L3icNexus achieves an F1-score of 85.58% in license term and attitude recognition, outperforming existing methods by 20.69%, and demonstrates superior performance in license conflict detection on GitHub projects with low false positive and negative rates.
LLMs can now detect open-source license conflicts with high accuracy (85.58% F1-score), potentially saving developers and companies significant legal headaches.
With the rapid growth of the open source software (OSS) ecosystem, the use of open source has become the predominant model for contemporary software development. OSS licenses define the conditions for the reuse, distribution, and modification of OSS and form the foundation of the open source ecosystem. However, recent research shows that over half (53%) of OSS software experiences license conflicts, adversely affecting the sustainability of OSS and community collaboration and leading to significant legal risks. Researchers propose various methods for detecting license conflicts, yet these approaches face challenges such as limited license coverage and insufficient model accuracy. The recent emergence of large language models (LLMs) offers new opportunities for license conflict detection. However, there remains a lack of in-depth and systematic research on utilizing LLMs for this purpose. To address this challenge, we propose L3icNexus, an effective tool for automatically detecting license conflicts using LLMs. Specifically, L3icNexus employs a joint labeling method based on embedded model label inference and expert verification and constructs a domain dataset consisting of 3,238 OSS licenses. Subsequently, L3icNexus proposes the AdaFine approach, combining Domain-Adaptive Pre-Training (DAPT) and Supervised Fine-Tuning (SFT), resulting in the License-Llama3-8B model. This model identifies terms, infers OSS license attitudes, and autonomously understands licenses end-to-end. Finally, L3icNexus generates summaries of the rights and obligations associated with licenses using License-Llama3-8B, and detects conflicts by extracting the license hierarchy of OSS. Experimental results demonstrate that L3icNexus achieves an F1-score of 85.58% in license term and attitude recognition, surpassing the best results of other methods by 20.69%. Moreover, an empirical study conducted on license conflict detection for 500 popular GitHub projects reveals that L3icNexus achieves a false positive rate of 5.88% and a false negative rate of 2.47%. The performance of L3icNexus exceeds that of existing state-of-the-art methods, illustrating the potential of LLMs in addressing license conflict detection. We summarize the insights from this research and release the OSS license dataset and License-Llama3-8B model weights on Hugging Face to encourage further exploration in related fields (Dataset available: this URL; Model available: this URL).
