Provenance-based Intrusion Detection Systems (PIDSes) have become one of the most promising solutions for detecting sophisticated attacks. However, many existing PIDSes can be evaded by approaches obfuscating malicious nodes among frequent benign events (i.e., gadgets) or replacing rare malicious events with frequent benign sequences. While effective against earlier PIDSes, those approaches largely overlook advanced node-level PIDSes, which leverage semantic information, temporal ordering, and graph representation learning to model the full context of nodes. This enriched view makes evasions that rely only on frequency of events less effective, as malicious nodes can still be distinguished by their semantic and structural relationships. Based on such an observation, we propose Contorter, an evasion framework that leverages the enhanced embeddings of node-level PIDSes to guide gadget generation and uncovers their blind spots for improving robustness. Specifically, Contorter identifies benign nodes of the same entity type as each malicious node, and selects one with a similar context that is labeled benign with high confidence by the target PIDS. It then replicates edges of the selected node around the malicious node to further align their contexts and hide the latter from the PIDS. We implement and evaluate Contorter on Darpa E3, OpTC, Unicorn, and StreamSpot datasets, and based on four exemplar node-level PIDSes. The results show that Contorter can reduce the recall to as low as 0 % (average 59 % reduction), while keeping the false positive rate mostly unchanged to avoid suspicion. Finally, compared to prior approaches, Contorter achieves over a 35 % greater reduction in recall under the same assumptions, while it requires about seven times fewer added edges.
We present InsPIRe that is the first private information retrieval (PIR) construction simultaneously obtaining both high-throughput and low query communication while using only server-side preprocessing (meaning no offline communication). Prior PIR schemes with both high-throughput and low query communication required substantial offline communication of either downloading a database hint that is $10-100 \mathrm{x}$ larger than the communication cost of a single query (such as SimplePIR and DoublePIR [Henzinger et al., USENIX Security 2023]) or streaming the entire database (such as Piano [Zhou et al., S&P 2024]). In contrast, recent works such as YPIR [Menon and Wu, USENIX Security 2024] avoid offline communication at the cost of increasing the query size by $1.8-2 \mathrm{x}$, up to $1-2 \text{MB}$ per query. Our new PIR protocol, InsPIRe, obtains the best of both worlds by obtaining high-throughput and low communication without requiring any offline communication. Compared to YPIR, InsPIRe requires 5x smaller cryptographic keys, requires up to 50 % less online query communication while obtaining up to 25 % higher throughput. We show that InsPIRe enables improvements across a wide range of applications and database shapes including the InterPlanetary File System and private device enrollment. At the core of InsPIR, we develop a novel ring packing algorithm, InspiRING, for transforming LWE ciphertexts into RLWE ciphertexts. InspiRING is more amenable to the server-side preprocessing setting that allows moving the majority of the necessary operations to offline preprocessing. InspiRING only requires two key-switching matrices whereas prior approaches needed logarithmic key-switching matrices. We also show that InspiRING has smaller noise growth and faster packing times than prior works in the setting when the total key-switching material sizes must be small. To further reduce communication costs in the PIR protocol, InsPIRe performs the second level of PIR using homomorphic polynomial evaluation, which only requires one additional ciphertext from the client.
Despite decades of research, memory safety solutions see limited adoption, as they often incur high overheads, are complex to deploy, or cover only a narrow scope of bugs. In this paper, we present QuickSafe — a targeted approach to harden programs against exploitation of known but unresolved memory errors with minimal overhead. QuickSafe yields a stopgap patch that is immediately available, while the bug awaits eventual resolution. Where most existing automatic patch generators rely on inserting runtime constraint checks in the code to stop exploits, QuickSafe instead isolates memory objects associated with a known bug from the rest of the program. Object isolation can be implemented in different ways, depending on hardware support and desired security guarantees. To assess the viability, we present two such implementations. On traditional architectures, we allocate vulnerable objects on dedicated pages flanked by inaccessible guard pages. On platforms that support Memory Tagging Extensions (MTE), we offer stronger guarantees by enforcing disjoint tag domains. To reliably identify the objects associated with a given memory error, we introduce TagASan — an extension of AddressSanitizer (ASan) that uses tagged pointers to trace faulting accesses back to their originating allocation sites. As an additional contribution, we present a new dataset of 223 real-world memory errors across ten prominent projects to measure the performance of automatic patch generators. We evaluate QuickSafe on (1) this new benchmark suite, (2) the Juliet Test Suite, and (3) buggy benchmarks from SPEC CPU2006/2017. Using the guard-page-based isolation backend, QuickSafe protects against the exploitation of all evaluated bugs, incurring a geomean memory overhead of 2.46 % and a geomean runtime overhead of 2.67 % - with the vast majority of applications slowing down by only around 1 %. We apply the MTE-based isolation strategy to a representative subset of the dataset, confirming its effectiveness and showing negligible runtime overhead of $\approx 0.12 \%$.
To promote shared learning and accountability around differential privacy (DP) deployments, Dwork, Kohli, and Mulligan [1] proposed a public-facing repository (“registry”) of real-world DP deployments. The DP community has recently started working toward realizing this vision. We contribute to this effort by (1) developing a holistic, hierarchical schema to describe any given DP deployment and (2) designing and implementing an interactive interface to act as a registry where practitioners can access information about past DP deployments. We (3) populate our interface with 21 real-world DP deployments and (4) conduct an exploratory user study with DP practitioners ($\mathbf{n} \boldsymbol{=} \mathbf{1 6}$) to understand how they would use the registry, as well as what challenges and opportunities they foresee around its adoption. We find that participants were enthusiastic about the registry as a valuable resource for evaluating prior deployments and making future deployments. They also identified several opportunities for the registry, including that it can become a “hub” for the community and support broader communication around DP (e.g., to legal teams). At the same time, they identified challenges around the registry gaining adoption, including the effort and risk involved with making implementation choices public and moderating the quality of entries. Based on our findings, we offer recommendations for encouraging adoption and increasing the registry's value not only to DP practitioners, but also to policymakers, data users, and data subjects.
Web storages, e.g., cookies, are isolated across different browser modes (e.g., normal vs. incognito) and browsers (e.g., Chrome vs. Safari) to ensure user privacy. Despite such browser-level isolation, researchers have found covert communication channels between different modes and browsers, which can break such a security mechanism. However, existing covert communications are impractical and unreliable in the real world scenarios, where noise is prevalent. Furthermore, multiple prior covert channels only support cross-mode-not cross-browser-communications, because the relevant resources are shared within a single browser. In this paper, we discover a novel covert channel due to GPU command queue contention and then design a framework, called $\mathbf{C}^{3} \mathbf{F}$, for both cross-mode and cross-browser covert communication. $\mathbf{C}^{3} \mathbf{F}$ negotiates an adaptive communication speed between the sender and the receiver and then facilitates the covert communication. We evaluated $\mathbf{C}^{3} \mathbf{F}$ in real-world settings by deploying it to crowd-sourced workers on Amazon Mechanical Turk, simply asking them to visit two websites without imposing additional constraints. Our evaluation shows that covert communication achieves a 100 % accuracy once the data transmission is completed, with an overall completion rate of 92.81 % across 1,434 AMT experiments. So far, Firefox, Safari and Tor developers have confirmed our attack and are working with us on practical defenses.
User interfaces (UIs) are the primary gateway for users to access digital systems, ranging from healthcare and finance applications to AI-powered platforms. Yet many of these interfaces embed dark patterns - manipulative design strategies that deceive, coerce, or otherwise influence users into making unintended decisions that benefit services while threatening users' privacy, safety, and autonomy. Recently, the UI design process has evolved rapidly with the widespread adoption of generative AI. In particular, designers increasingly use prompt-to-design generators (Prodegens) to create UI prototypes directly from natural language prompts. This emerging paradigm of designer-Prodegen collaboration may reshape the landscape of dark patterns, yet its effects remain largely unexplored. In this study, we investigate how such collaborations influence dark patterns that harm users' privacy rights. Specifically, We conducted designer-centric studies with 17 professional UI designers to examine their awareness, attitudes, and practices, and complemented this with a technical evaluation of real-world prompts across multiple Prodegens. Our analysis identifies both designer practices related to dark pattern occurrence and mitigation, as well as system-level factors in Prodegens that facilitate dark patterns, providing insights for mitigating privacy risks from the perspectives of designers, Prodegen developers, and end users.
Configuration leaking attack is an emerging security threat in large language model applications (LLM apps), where adversaries can manipulate the LLM app to reveal its sensitive configurations, such as system prompts, external APIs, and knowledge files. Despite their critical implications, these attacks remain understudied within commercial LLM app stores, leaving open questions about their real-world effectiveness, prevalence, and impacts. In this paper, we propose LLMThief, a novel end-to-end framework designed to systematically evaluate configuration leaking risks in LLM app stores. LLMThief comprises three phases. First, it extracts grounding information from store-level features to construct a high-quality seed pool of attack prompts. Second, it leverages shadow LLM apps as probing oracles and a genetic algorithm to identify adaptive mutation strategies. Third, it fuzzes victim LLM apps with the resulting insightful prompts and uses a fine-tuned LLM to determine whether a configuration leakage has occurred. We evaluated LLMThief on ground truth datasets across 6 widely used LLM app stores, including OpenAI GPT Store, ByteDance Coze, and Baidu Wenxin. Evaluation results show that LLMThief can effectively leak the confidential configuration of LLM apps and significantly outperforms baselines. Beyond performance evaluation, our large-scale analysis of 4,164 real-world LLM apps reveals a range of critical risks, including system prompt leaks, external API exposures, and knowledge file leaks. Those issues can not only compromise developers' intellectual property but also leak personal privacy and even disclose corporate secrets. We have responsibly disclosed our findings to the affected vendors and received acknowledgments and bug bounties from Baidu, ByteDance, Alibaba, etc.
There is increasing use of model checking to verify the security of processors, including those with speculative execution. However, model checkers face scalability challenges and are limited in the scale of processors and specific security properties they can currently handle. This research shows how exploiting domain-specific information about the design of secure processors can be used to scale model checking and make it more efficient. Our key observation is that proofs of non-interference properties require both information-flow invariants and functionality-based invariants, while model checkers often spend substantial effort deriving functionality invariants that do not directly contribute to the final security proof. To address this problem, we introduce Uninterpreted Functions with History (HUF), a modular abstraction for sequential modules that preserves relevant information-flow properties while abstracting away security-irrelevant functionality. We further show that the same verification insight can guide hardware design: security mechanisms become significantly easier to verify when their security depends less on hard-toprove global functional correctness. We build a verification framework to automate the use of HUF abstractions in security verification. Practical demonstration of the verification methodology is conducted through case studies on BOOM processors for secure-speculation mitigations designed with the HUF-guided design guideline.
Rust is an increasingly popular language that has gained traction among developers. As a memory-safe language, Rust reduces the burden for developers to create reliable and fast software. However, the same features can also hinder reverse engineering tasks. For instance, malware developers have also picked up on the trend of Rust, using it to make their malware more reliable and difficult to analyze. Reverse engineering tasks often rely on decompilers to recover the source code from these binaries. However, analysts find it difficult to analyze Rust binaries using modern C decompilers. Modern $\mathbf{C}$ decompilers fail on Rust binaries because they fail to recover high-level Rust abstractions from low-level implementations. As a result, the decompiled output is often verbose and inaccurate. Therefore, we believe that to achieve high-quality Rust decompilation, a decompiler must bridge the gap between high-level Rust abstractions and lowlevel implementations. In this paper, we study how $\mathbf{C}$ decompilers fail at decompiling Rust binaries. We identify a comprehensive list of decompilation failures, find the root causes of these failures, and develop a novel decompiler, Oxidizer, for decompiling Rust binaries to Rust pseudocode. We evaluate Oxidizer on 28 popular Rust projects across multiple optimization levels and compiler versions, comparing it against angr, Hex-Rays, Ghidra, and Binary Ninja. Oxidizer outperforms all baselines on most conciseness and fidelity metrics, and is the only tool capable of recovering Rust enums and macros. A human study further shows that participants using Oxidizer achieved 28 % higher accuracy and completed tasks 20 % faster than those using Hex-Rays.
Today's mobile applications (apps) increasingly reuse third-party SDKs to provide essential functionalities. However, the integration of these SDKs into an app's supply chain introduces complexity, making it challenging to manage the SDKs and ensure their collective compliance with privacy regulations. Recently, consent management platforms (CMPs) have emerged, being increasingly adopted by mobile apps as a centralized mechanism and app-global configuration to help manage SDKs, particularly enabling all SDKs in an app to comply with the same user consent status for personal data processing. However, the question of whether the adoption of established CMPs ensures the validity of user consent specifically in mobile apps remains underexplored. This study addresses this gap in knowledge by conducting the first systematic investigation of the problems associated to obtaining user consent with CMP GUIs in realworld mobile apps (across Android and iOS). To achieve this, we developed a novel framework, Diulens, that efficiently and comprehensively discovers CMP GUIs using a series of LLM-aided GUI analysis techniques tailored to CMPs. The framework analyzes both CMP GUIs and actual SDK usage within the apps to identify violations of privacy-accountable design, implementation, and use of CMPs (CMP DIU risks or DIU risks in short). Our findings reveal various Diu risks, such as failures to properly and consistently disclose thirdparty SDKs, ambiguous consent effects resulting from user interactions with CMP GUIs, and instances where consent is either difficult to withdraw or coerced. Attributing the causes, we found that both app developers' use (or configuration) of CMPs and flawed CMP implementations, or their combination, could cause DIU risks. We further observed differences in the adoption of CMPs and the DIU risks across the Android and iOS platforms, likely influenced by platform-specific privacy features, such as Apple's App Tracking Transparency (ATT) framework. This study provides new insights and bridges a critical knowledge gap regarding the assurance of CMPs in obtaining valid user consent in mobile apps.
Managed cloud-identity services issue short-lived credentials so that mobile and web clients can access storage, database, and serverless APIs without passing through application servers. These services are layered on top of a security-token engine and an account-wide policy system, yet prior work has examined each layer in isolation. We present the first end-to-end analysis of this multi-plane workflow, using Amazon Cognito as a representative case. Treating Cognito, the Security Token Service and IAM as a single security graph, we (i) provide the first in-depth security analysis of session-bypass risk and (ii) uncover two additional design flaws that allow users to exploit overly permissive or divergent trust policies and to assume “hanging” roles left behind after reconfiguration. A crawl of $\mathbf{8 4 4}$ Cognito-backed Android apps reveals these flaws in 179 deployments, affecting at least 1.7 million users. To detect such drift automatically, we build C-Verifier, a tool that converts an account snapshot into Satisfiability Modulo Theories formulas spanning all three control planes and checks five security properties. C-Verifier yields precise counter-examples, outperforms four state-of-the-art tools, and analyzes 400 identity pools with 1,400 roles in under 40 s. We release both the tool and a curated benchmark, Cognito Configuration Bench, to facilitate reproducible cross-service policy research.
Fully homomorphic encryption (FHE) promises end-to-end secure cloud databases by enabling arbitrary queries directly over encrypted data, without ever exposing plaintext. However, existing FHE-based databases must trade off SIMD parallelism against exact query semantics, as they rely on approximate methods to exploit large-scale SIMD, limiting their practicality. This paper presents APEX, the first FHE database that jointly achieves efficient SIMD execution and precise SQL semantics within a single-scheme BGV/BFV framework. Our key insight is that the dominant bottleneck lies not in the schemes themselves but in data encoding: prior layouts misalign ciphertext slots with column and predicate semantics, squandering SIMD capacity. Therefore, Apex introduces a semantics-aware unified encoding UniCo that decomposes numeric and string values into bounded, position-weighted segments and aligns them with ciphertext slots across rows by data type and position. This alignment enables predicate comparisons to exploit bounded value ranges via Range-Aware Homomorphic Comparison (RAHC) and operate over an application-chosen small domain rather than the full plaintext modulus, making SIMD far more effective. Furthermore, to preserve efficiency and correctness for arbitrary-precision values, Apex employs Parallel Lazy Carry Propagation (PLCP), which defers crosssegment carry handling until needed and thus simplifies homomorphic query execution. Compared to state-of-the-art FHE databases, APEX achieves up to $8 \times$ speedup on TPC$\mathbf{H}$ benchmarks, and up to $\mathbf{2 0 9, 2 1 3} \times$ acceleration for string pattern matching with single- and multi-character wildcards.
Pointcloud perception systems are critical for autonomous driving, robotics, and embodied intelligence. While existing adversarial attack research predominantly focuses on digital manipulations, this paper introduces a novel physicalworld attack, Stride, that strategically disrupts pointcloud classification, segmentation, and object detection by exploiting the walk error, a systematic depth measurement error induced by reflectivity variations. By developing a quantitative model that maps reflectivity variations to depth errors, we demonstrate how infrared-specific dyes, inconspicuous in the visible light spectrum, can systematically manipulate pointcloud representations, fundamentally compromising the reliability of perception algorithms. To this end, our approach presents a physically feasible optimization method for applying inconspicuous coatings that can induce targeted misclassifications, missegmentations, and object detection failures without resorting to digital manipulations. Experiments across LiDAR and depth cameras reveal significant performance degradation in downstream perception tasks, highlighting the profound vulnerabilities of current 3D sensing technologies. These findings underscore the critical need for robust sensing mechanisms capable of withstanding subtle yet strategic physical interventions.
No $t$-resilient Byzantine Agreement (or Reliable Broadcast) protocol can guarantee agreement among $n$ correct processes in a non-synchronous network if the actual number of faulty processes $f$ is $\geq n-2 t$. This limitation highlights the need to augment such fragile protocols with mechanisms that detect safety violations, such as forensic support and accountability. This paper introduces simple and efficient techniques to address this challenge by proposing a new generic transformation, $\mathcal{A} \mathcal{B} \mathcal{C}^{++}$. The transformation leverages two key primitives: the ratifier and the propagator. By sequentially composing these primitives with any closed-box Byzantine Agreement (or Reliable Broadcast) protocol, $\mathcal{A} \mathcal{B} \mathcal{C}^{++}$produces a robust counterpart that provides both (adaptively-secure) forensic support and (1-delayed adaptively-secure) accountability. The transformation incurs a subquadratic additive communication overhead, with only 1 round of overhead for decision and forensic support, and 2 additional rounds for detection in case of a safety violation (or $O(\log n)$ additional rounds with optimized communication). The generality of $\mathcal{A} \mathcal{B} \mathcal{C}^{++}$ offers a compelling general alternative to the subquadratic forensic support solution by Sheng et al. (FC'23) tailored to HotStuff-like protocols, while being more efficient than the (strongly-adaptively-secure) quadratic $\mathcal{A} \mathcal{B} \mathcal{C}$ accountable transformation (IPDPS'22, JPDC'23). Moreover, it provides the first subquadratic accountable Byzantine Agreement (or Reliable Broadcast) protocols against a (1-delayed) adaptive adversary. Finally, any subquadratic accountable Reliable Broadcast protocol can be integrated into the $\tau_{s c r}$ transformation (ICDCS'22) to produce an improved variant, $\tau_{s c r}^{++}$. This new version compiles any deterministic (and even beyond) protocol into its accountable counterpart with subquadratic multiplicative communication overhead, significantly improving upon the original quadratic overhead in $\tau_{s c r}$.
Modern microarchitecture security research requires a deep understanding of the microarchitecture designs of commodity hardware, specifically how the hardware is isolated between privilege domains. Since these details are usually undocumented, researchers must conduct reverse engineering experiments to learn the microarchitecture parameters of various processors. Currently, the state of the art approach is to modify commodity operating systems in an ad-hoc manner to enable these experiments. Our objective is to systematize the requirements of microarchitecture security research workflows, and to create new lightweight system software precisely tailored to these requirements. We present Fractal, a new operating system kernel built from the ground up to enable practical low-noise microarchitecture reverse engineering research at the user to kernel hardware boundary. Fractal enables seamless concurrency between privilege levels and a user-controlled scheduler for fine-grained thread ordering to enable new microarchitecture reverse engineering workflows with minimal noise. We ported Fractal to a variety of real systems and evaluate Fractal by using it to analyze the Apple M1 CPU. We uncovered a number of new insights about the branch predictor on M1, demonstrating for the first time evidence that limited Phantom speculation is present on Apple Silicon.
This paper analyzes the security of EMV contactless mobile payment (ECM) apps, virtualization of physical EMV chip cards, in a less explored but relevant threat model. In this threat model, a local adversary such as the legitimate ECM app user (possibly, with root privileges) launches attacks to expose the EMV protocol's internal secret states from the app. Such secret leakage combined with the attacker's capability to modify the ECM app behavior can be exploitable for potentially self-serving purposes (e.g., double-spending). To formally study such secret state leakage attacks (SecStLeak) and their impacts, we pose the minimal satisfying cut-set identification problem for the EMV contactless protocol design where the goal is identifying the minimal number of the protocol's secret state fields whose leakage can entail different attacks. We solve this problem by proposing a meta-level protocol analysis approach. Our analysis identified 4 minimal sets of secret state fields that ECM app developers must protect to prevent such attacks. We analyzed 136 Android ECM apps and identified all secret fields for 2 of the 4 minimal sets across 24 apps. In addition, one can leak a third minimal set in 3 of the 24 apps. The potential impact is significant, with these 24 apps having 82 M downloads, 6 coming from developing countries, and 3 operating in a country without support for Google Wallet. To establish our findings' real-world applicability, we demonstrate a core guarantee-violating end-to-end attack on a real ECM app in an isolated test environment. This successful exploitation motivated us to study how developers in the real world protect the secret state fields belonging to the 4 minimal sets to thwart SecStLeak attacks. We observe that a majority of these apps, contrary to EMV standard's recommendation, rely on circumventable, sub-optimal software-only defenses.
Voting within video conferences has gained popularity among organizations for its convenience and efficiency, promoting voting participation by removing physical boundaries. During online voting events, participants typically enable their web cameras to formally engage, prove their identities, and demonstrate that they are voting without coercion. Moreover, many Internet voting platforms start video streaming the voter throughout the process to provide continuous authentication, prevent voter fraud, and ensure no external parties influence voting decisions. However, when participants interact with an online voting platform by reading prompts, making selections, and submitting ballots, their eye movements captured by the webcam may already disclose their secret choices. This paper investigates privacy leakage from eye movements during video streaming, specifically in the context of online voting and online form selections. We find that existing webcam-based methods (also dedicated eye-trackers) cannot discern users' onscreen selections from their eye gazes, even under ideal camera calibration. Since on-screen choices may be separated by only a small distance (e.g., 1 cm), such inference requires sub-centimeter gaze localization, which in turn demands sub-pixel-level angular eye-movement accuracy from the webcam, given the eye-camera distance (e.g., 50 cm). Thus, this work addresses the challenge of inferring on-screen choices by capturing how users look, rather than where they look. We show that eye motion behaviors captured by a webcam can leak on-screen selection secrets, although the screen itself is not visible in the video frame. The key insight is that, as users align the mouse with their chosen checkbox and confirm their selection, subtle eye motions occur in coordination with hand movements. To capture the eye-based voting behaviors, we derive the gaze direction and rotation features to recognize the voting actions, including reading questions, browsing options, electing choices, and confirming. Based on the voting action periods, we use the facial landmarks for calibrating the eye behavioral features and a pre-trained general eye motion model to reduce the noise caused by head orientations, facial movements, and low-quality webcam streams. Further, we develop a transformer model to infer voting choices based on the eye-behavioral features. Experiments show that our method achieves up to 96.6% accuracy in inferring web-based voting forms and up to 94.2% accuracy for video conference polls.
We present a liveness attack on the Ethereum PoS protocol, under which no blocks can be finalized. Our attack can be launched even when the network is synchronous and no validator is slashed (i.e., a slashed validator will eventually be removed from the system), which is the weakest assumption for any attack. Our experimental results using 16,384 validators on the latest Ethereum codebase validate our attack. To our knowledge, our attack is the first liveness attack that can be performed without manipulating the network or triggering the slashing condition, and has been experimentally validated.
Today's advanced cyber attacks routinely circumvent existing protection measures. Analysts must rely on after-the-fact detection, based on provenance logs, to understand and recover from these intrusions. Since attackers prize the ability to stay hidden, they take every measure to remove all signs of attacks from these logs. In this research, we begin with a study of previous work on protecting provenance logs from such tampering. Through a motivating experimental study, we show that audit logging systems deployed today are highly susceptible to tampering. Moreover, existing tamper detection measures either require specialized hardware and custom OS modifications, or they incur excessive performance costs. To overcome these challenges, we first analyze previous research to identify their key bottlenecks. We then present new techniques and algorithms that avoid these bottlenecks, while also providing several additional benefits. Our techniques have been implemented into a system WinSeal that achieves well over a $10 \times$ reduction in overhead as compared to previous tamper detection techniques. On the protection front as well, WinSeal improves a key metric, namely, tamper window duration, by an order of magnitude as compared to previous techniques compatible with stock hardware and software. Our software is being open-sourced along with this paper.
Static analysis has been widely used for bug detection in real-world systems. However, traditional static analysis depends on manually written rules that match specific code forms. They often fail to handle semantically equivalent code variants and diverse bug patterns. Recent advances in large language models (LLMs) provide new opportunities for bug detection due to their capability to understand code semantics. However, directly applying LLMs to bug auditing is ineffective and expensive. Without clear guidance, LLMs fall back on memorized common patterns. They struggle with system-specific semantics and rare bug patterns that require domain knowledge. Therefore, it is necessary to provide high-quality audit specifications that clearly describe where to audit and under what conditions a bug occurs, for guiding LLMs to perform effective bug detection. In this paper, we propose SpecAuditor, an end-to-end framework that automatically generates and applies audit specifications for LLM-driven bug detection. SpecAuditor leverages historical bug patches to obtain specifications and then uses them to detect new bugs. Instead of directly extracting syntactic patterns from patches, SpecAuditor generalizes specifications at the semantic level to obtain new, broader specifications, thereby significantly extending the coverage of bug detection. In particular, SpecAuditor proceeds in three stages: (1) It extracts seed specifications from bug patches and validates them via differential checking. (2) It generalizes each seed specification to capture its underlying behavior and uses documentation-based semantic retrieval to identify other code entities performing similar behaviors, generating new specifications for them. (3) It performs LLM-driven bug detection by combining AST-based code search with LLM-based semantic auditing, followed by context-aware report pruning to reduce false positives. Our evaluation on the Linux kernel shows that SpecAuditor generates diverse specifications that go beyond syntactic patterns seen in patches. Using these specifications, SpecAuditor detects 71 long-latent new bugs, with an average lifetime of more than 7 years, including memory leaks, use-after-free, and out-of-bounds bugs. To date, 52 bugs have been confirmed by maintainers and 37 have been fixed. Moreover, 21 of the bug patches have been backported to the Linux stable trees for long-term release stability.
