arXiv cs.AI· Oshando Johnson, Ranjith Krishnamurthy, Rohith Kumar Shanmuganathan, Goran Piskachev, Eric Bodden·· 3 小时前AI 评分33
SAFE 插件用代码溯源的 Agent 解释来解读静态分析漏洞发现
Code-Grounded Agentic Explanations for Static Analysis Vulnerability Findings
AI 导读
一项 arXiv 研究将开源 IntelliJ IDEA 插件 SAFE 重新设计为仅负责解释、保留分析器检测职责的架构，通过必须查阅仓库和触发规则的 Agent 替代单提示词后端。24 人交叉实验显示系统可用性量表得分从 77.3 升至 85.0，正确修复的几率提高 2.6 倍；信任度未变，分诊准确率和耗时无明显差异。该插件支持任何以 SARIF 格式报告的分析器。
正文 · 原文
Abstract:Static application security testing (SAST) tools surface vulnerabilities early and their verdicts are rule-based and auditable. Yet developers routinely dismiss findings they cannot interpret. Large language models can supply the missing explanation, but designs that also hand the model the detection give up the auditability that makes static analysis defensible. We keep detection with the analyser and give the model only the explaining. A preliminary user study with 20 participants and a workshop with 19 practitioners yielded five requirements. Guided by these we redesigned SAFE, an open-source IntelliJ IDEA plugin that explains findings from any analyser reporting in the Static Analysis Results Interchange Format. It tiers explanations by demand, ties them to the reported data flow, and replaces the single-prompt backend with an agent that must consult the repository and the rule that fired before answering. A within-subjects crossover experiment with 24 participants compared the redesign against its predecessor. Perceived usability rose from 77.3 to 85.0 on the System Usability Scale. Actionability gained most among the explanation-quality items, the aspect both earlier studies flagged as weakest, and the odds of a correct remediation were 2.6 times higher. Triage accuracy and time per finding were indistinguishable, which we read as uninformative rather than as equivalence. Trust was the one measure that did not move, and the closing interviews indicate that grounding made findings easier to understand rather than easier to believe. Participants also drew a boundary no requirement anticipated, wanting the tool to find and explain while they judge and apply.
| Subjects: | Software Engineering (cs.SE); Artificial Intelligence (cs.AI); Human-Computer Interaction (cs.HC) |
| Cite as: | arXiv:2611.13041 [cs.SE] |
| (or arXiv:2611.13041v1 [cs.SE] for this version) | |
| https://doi.org/10.48550/arXiv.2611.13041 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Oshando Johnson [view email]
[v1]
Mon, 9 Nov 2026 11:40:08 UTC (945 KB)
来源：arXiv cs.AI · arxiv.org