Context: AI systems increasingly support requirements, coding, testing, security review, release, and project coordination. Existing AI-governance guidance is useful, but often too general to specify how much authority AI should have in concrete software engineering decisions. Objective: This study develops and evaluates SE-AIGov, a governance matrix that links SE decisions to AI autonomy, human approval, audit needs, escalation triggers, reversibility, and risk. Method: We derived a 35-row candidate matrix from AI-governance, software-engineering, secure- development, DevOps/change-governance, human–AI oversight, and LLM-security sources. It was refined through a survey of 73 respondents, blind scenario review by eight role-specialized experts, a neutral re-check of domain-sensitive scenarios, and evaluation by six additional domain-aware experts. Results: The process produced an 18-row matrix and a domain-sensitive escalation overlay for healthcare/ safety-critical software, regulated finance, education/minor data, public-sector accessibility and language inclusion, critical infrastructure, and legal/procurement commitments. Expert judgments showed strongest agreement on risk, reversibility, approval, and audit requirements. Autonomy required more conditional wording, especially at the transition from review and recommendation to human-authorized execution. Conclusions: The evidence supports SE-AIGov as an understandable artifact for formative review and structured governance discussion. Respondents and experts could apply the matrix and identify cases needing stricter rules. The study does not establish that its autonomy levels are objectively correct or that SE-AIGov improves organizational outcomes. Field evaluation is still needed.
Context: Generative-AI coding assistants have moved rapidly into software development practice, raising human-factor questions about trust, usability, and responsible adoption that lab studies and surveys do not fully answer; sustained turn-by-turn production traces remain rare. Objective: This study examines four human-factor dimensions of sustained generative-AI-assisted development — trust calibration, developer gating, delegation-related prompt dynamics, and authorial identity — in a real production setting. Methods: Longitudinal autoethnography of a 16-month single-developer construction of a cloud-native institutional service at a Taiwanese university (424 git commits, Dec 2024–Apr 2026), with two prompt corpora across two IDE-mediated assistants used in succession: 172 user prompts plus 2777 assistant turns from Cursor IDE (Sep–Dec 2025), and 50 user prompts from Claude Code CLI (Apr 2026). Per-session formal indicators (Eqs. (1), (2), (3), (4), (5)), an analysis of a pre-stated directional prediction (Section 5.3), and triangulation with a companion architectural analysis (Chi, 2026) constrain interpretation. Results: (T) Trust calibration — in the trace-documented stuck-loop episode, the developer escalated model tier rather than revising specification (a capacity-oriented escalation). (G) Gating — the agent iteration ratio rises with task ambiguity, consistent with reduced developer gating of the agent loop when prompting is under-specified. (D) Delegation — within the Cursor window, prompt length compresses by up to 98.7% within a session (first to last third) while rewrite signals do not consistently decline, and prompt-skill improvement is not measurable under the study’s indicators, a pattern interpreted as consistent with a shift from prompting towards delegation rather than a direct measurement of it; in the later Claude Code window, 33 of 50 prompts are follow-ups (66%), a cross-tool observation reported descriptively. (I) Identity diffusion — authoring voice in commit messages converges towards the assistant’s register. Conclusion: Engineering throughput appeared to decouple from the developer-side communication indicators across the period; potential developer-side effects of sustained AI assistance may not register in conventional engineering metrics, supporting a cautionary reading for human-factor-aware adoption. All quantitative magnitudes reported are observations from one case; the four dimensions are offered for analytical generalisation, as hypotheses for multi-developer studies to test, not as evidence of general developer behaviour. The article closes with responsible-adoption implications for IDE-assistant design.
Context: Quantum services differ in cost and reliability. A quantum computation is run repeatedly, and these runs (shots) can be shared among services. Finding a good allocation requires comparing many possibilities, which can be expensive. Objective: We extend an existing search method to allocate shots across multiple services and test whether these allocations add useful cost-reliability choices to those available from a single service. Methods: We evaluated the extended method using 840 hardware executions across four backends and six 12-qubit circuits, followed by a matched 420-execution comparison that added a fifth backend. Simulations examined up to six service profiles and shot counts up to 10,000. Results: When 40% of candidate designs were evaluated, guided search found trade-offs closer to the best available set than random search. Some combinations filled gaps between single-service choices, and adding a fifth real backend increased the number of best trade-off choices for all six circuits. Simulations found more choices as services were added, although the additional gain in trade-off coverage plateaued near five profiles. More shots helped some circuits much more than others. A numerical audit found that the fourth, cost-related measure was constant and did not change which choices were considered best. Conclusion: Multi-service shot allocation creates additional cost-reliability choices in the tested hardware and controlled-simulation settings, but marginal hypervolume benefit is not unlimited and shot benefit depends on the output distribution.
Context: The rapid adoption of large language models (LLMs) in software development has blurred the boundary between human-written and machine-generated code, creating critical challenges for authorship attribution, plagiarism detection, and software forensics. Existing approaches, predominantly based on token-level statistics or learned embeddings, are fragile under semantics-preserving transformations and fail to capture deeper structural regularities inherent to program organization. Objectives: This study aims to establish a paradigm-agnostic and interpretable framework for code authorship and provenance analysis by explicitly modeling structural organization, and to investigate whether LLM-generated code exhibits systematic structural regularities that can be reliably distinguished from human-authored programs. Methods: We propose a structural-entropy-guided, multi-relational framework in which each program is represented as a heterogeneous graph integrating six complementary views: abstract syntax, control flow, data dependence, stylistic patterns, complexity metrics, and semantic relations. The core mechanism minimizes a two-dimensional structural entropy objective to quantify global organizational regularity. An unsupervised inference scheme combines entropy-driven clustering with graph-theoretic centrality and stylistic priors, enabling authorship identification without labeled data. Results: Extensive experiments on a large-scale benchmark of 30,000 code samples spanning five programming paradigms and multiple state-of-the-art LLM families demonstrate that the proposed approach consistently outperforms representative baselines, achieving up to 95.8 F1 and 97.2 AUROC. The framework remains robust under semantics-preserving transformations such as refactoring and identifier renaming, and generalizes effectively to unseen paradigms and LLMs, indicating that structural entropy captures invariant signals beyond surface-level lexical features. Conclusion: The findings reveal that LLM-generated code exhibits measurable structural regularization patterns that can be effectively characterized through entropy minimization. By shifting the focus from token-level cues to global structural organization, the proposed framework provides a scalable, interpretable, and transformation-resilient solution for code provenance analysis in modern AI-assisted software ecosystems.
Context: The performance of deep learning-based smart contract vulnerability detection heavily depends on sufficient labelled training data. However, the availability of labelled vulnerable smart contracts remains extremely limited. Existing data augmentation methods are often ill-suited to smart contract vulnerabilities with domain-specific security semantics and structural characteristics. Objective: To address the above issues, this paper proposes SmartAUG, a novel large language model (LLM)-driven data augmentation framework for smart contract vulnerabilities. SmartAUG leverages the generative capabilities of LLMs to produce vulnerability-oriented smart contract samples, thereby enhancing the effectiveness of downstream vulnerability detection models. Method: SmartAUG leverages LLMs’ code comprehension and generation capabilities to systematically inject vulnerabilities into benign contracts, producing augmentation samples that help downstream detection models learn vulnerability-relevant patterns. The framework employs two primary mechanisms: precise exemplar retrieval from a dual-representation demonstration library to provide contextual guidance, and dynamic smart contract vulnerability knowledge prompting to compensate for LLMs’ limited domain knowledge. Results: Evaluation across ten LLMs demonstrates SmartAUG’s effectiveness, achieving up to a 96% success rate in reentrancy vulnerability generation, representing an absolute improvement of 70 percentage points. Moreover, datasets augmented by SmartAUG outperform five competitive augmentation baselines, boosting downstream vulnerability detection F1 scores by up to 26.86 percentage points. Conclusion: SmartAUG highlights the potential of LLM-driven augmentation to address data scarcity and improve smart contract vulnerability detection. Code and data are made publicly available to facilitate further research.
