Multimodal large language models (MLLMs) are increasingly used to translate visual artifacts into code, from UI mockups into HTML to scientific plots into Python scripts. A circuit diagram can be viewed as a visual domain-specific language for hardware: it encodes timing, topology, and bit level semantics that are invisible to casual inspection yet safety critical once fabricated in silicon. Translating such diagrams into register-transfer-level(RTL) code therefore represents an extreme reliability test for vision-to-code generation. We reveal a phenomenon we call Mirage: replacing a circuit diagram with a blank image leaves Pass@k unchanged or even higher, because models bypass the visual input and instead exploit identifier semantics in the module header to retrieve canonical RTL templates. This constitutes a new, highly covert class of defect in AI-assisted code generation that directly undermines MLLMs' trustworthiness. To quantify the effect, we construct C2VEVAL and evaluate eight MLLMs under a paired Normal/Anony protocol in which Anony mode anonymizes all identifiers in both the diagram and the module header; Anony-mode scores drop sharply across all models, confirming that high Normal-mode accuracy is largely a Mirage. We then propose VeriGround (4B), trained with identifier anonymization, refusal augmentation, and D-ORPO (Decision-Focused ORPO) preference alignment that up-weights pivotal generate-or-refuse tokens. VeriGround achieves Functional Pass@1 of 46.11

Automated Program Repair (APR) has made substantial advancements in fixing real-world defects. However, the overfitting problem, namely the phenomenon where APR-generated patches pass the given test suite but fail to correctly fix the underlying defects, remains a major challenge. To mitigate this problem, numerous Automated Patch Correctness Assessment (APCA) methods have been proposed. Among them, learning-based APCA methods currently represent the state-of-the-art (SOTA). However, these methods require training on large, high-quality patch datasets. Moreover, their lack of interpretability, as they often produce only simple binary predictions, provides little support for subsequent manual review. Finally, existing APCA methods often fail to fully leverage the rich contextual information both within and beyond the patched program, and they struggle to incorporate expert knowledge about patch correctness assessment. Large Language Models (LLMs) offer a promising path to address these limitations. Trained on vast corpora, they demonstrate strong generalization across tasks and an ability to learn from experience, allowing them to provide interpretable explanations in a manner analogous to human reasoning. In this paper, we propose a multi-agent framework FURINA, which formulates APCA as a reasoning task. The framework employs a pre-trained retriever and four specialized agents to analyze a candidate patch from multiple perspectives: a Profiler to analyze developer intent from failing tests and bug reports; an Interpreter to analyze code semantics according to the function-level patch; a Critic to analyze potential degradations from the patch context; and a final Judge to synthesize the patches, failing tests, bug reports, intermediate reasoning reports generated by other agents, the retrieved similar patches, along with instructive empirical tips derived from prior APCA studies to determine patch correctness. Evaluation results on the public benchmark CACHE-small demonstrate that FURINA, when equipped with popular LLMs, outperforms SOTA APCA baselines, achieving improvements of at least 5.58% in \(Accuracy\) and 5.93% in \(F1\) . To further assess its reasoning quality, we design a new evaluation scheme that considers three dimensions: factual consistency, logical clarity, and readability. The results show that FURINA achieves a score of at least 4.8 out of 5, demonstrating superior reasoning quality compared with SOTA baselines. Finally, based on our constructed dataset, FURINA still achieves competitive performance, indicating strong generalization ability.

Large language models (LLMs) for Verilog code generation are increasingly adopted in hardware design, yet remain vulnerable to backdoor attacks where adversaries inject malicious triggers during training to induce vulnerable hardware designs. Unlike patchable software vulnerabilities, hardware trojans become irreversible once fabricated, making remediation extremely costly or impossible. Existing active defenses require access to training data, impractical for third-party LLM users, while passive defenses struggle against semantically stealthy triggers that naturally blend into design specifications. In this paper, we hypothesize that under the requirements of both effectiveness and stealthiness, attackers are strongly biased toward embedding triggers in non-functional requirements (e.g., style modifiers, quality descriptors) rather than functional specifications that determine hardware behavior. Exploiting this insight, we propose Semantic Consensus Decoding (SCD), an inference-time passive defense with two key components: (1) functional requirement extraction that identifies essential requirements from user specifications, and (2) consensus decoding that adaptively fuses output distributions based on full user specifications and extracted functional requirements. When these distributions diverge significantly, SCD automatically suppresses suspicious components. Extensive experiments with three representative backdoor attacks demonstrate that SCD reduces average attack success rate from 89

LLM-based systems increasingly incorporate long-term memory to improve cross-session continuity. However, once insecure coding preferences are stored, they may silently influence security-critical decisions in subsequent generations. In this study, we conduct the first systematic empirical study on the impact of insecure coding preferences stored in long-term memory on the security of LLM-based code generation. We evaluate four LLMs (ChatGPT, Gemini, Qwen, and Grok) across five programming languages (Python, C, C++, Go, and JavaScript). Our results show that insecure memories significantly increase the risk of generating vulnerable code by 2.7-50.3 percentage points (pp). Moreover, they create a 5.4-14.0 percentage-point risk-warning gap, where warning-rate increases lag behind vulnerability-rate increases. Further analysis reveals that insecure memories are difficult to overwrite through normal interactions and can broadly influence model outputs even when prompts are phrased differently. Finally, we evaluate three mitigation strategies: security-requirement appending and memory storage reduce vulnerability rates by 19.7-33.6 pp but may degrade functional correctness by up to 15.9 pp; memory-level safety filtering achieves a 100% detection rate on our evaluated risky memory entries and restores generation behavior to the without-memory baseline. Based on these findings, we provide actionable suggestions to improve the security of long-term memory in LLM-based code generation.

Deep Learning (DL) frameworks are fundamental components of DL systems in their development, deployment, and execution, while defects in DL frameworks can cause severe consequences. Ensuring the quality of DL frameworks has therefore become a pressing challenge. Among the various testing techniques, model mutation has emerged as a widely adopted approach. Such methods generate mutants by applying mutation operators to DL models (e.g., structural changes or parameter edits) and then analyzing inconsistencies, crashes, or abnormal behaviors across different frameworks or hardware. Despite its effectiveness, existing methods suffer from the following limitations. First, they mainly reuse operators designed for model testing, raising doubts about their ability to expose framework-level defects. Besides, they insufficiently consider mutation constraints, such as mutation type, position, and order, which directly affect the defect detection ability of generated mutants. Finally, they rely on the limited detection range and narrow test oracles, focusing on functional correctness in model inference while overlooking defects in efficiency, resource usage, and other defects that developers care about in other stages, such as model training or deployment. These limitations result in a weak alignment with the critical defects that developers are most concerned about in practice. Motivated by these observations, this study conducts a comprehensive investigation into the effectiveness of existing mutation-based testing methods. We first collect and classify defect reports from PyTorch and MindSpore according to developers' priority tags, building a taxonomy of seven categories and 19 sub-categories of HP defects. We then map the defects reported by five state-of-the-art methods into this taxonomy to evaluate their detection abilities. To explain these limitations, we further analyze how three key factors, mutation type, mutation position, and mutation order, affect the generated mutants. Based on the experiment results, we summarize ten findings ranging from revealing the priority of developers on fixing framework defects, evaluating the defect detection ability of existing methods, to how mutation factors affect the generated mutants. Furthermore, we reveal four limitations and their root causes of existing methods and propose four targeted optimization strategies. We further apply these strategies to COMET and successfully uncover six new defects spanning four types, including two previously unreported categories. Overall, our study identifies 38 unique framework defects, of which 30 are confirmed by developers and 12 have been fixed, demonstrating the practical value of our findings.

Context:Modern software development's reliance on open-source components introduces security risks throughout the software supply chain. Existing Software Composition Analysis (SCA) tools mainly detect vulnerable dependencies through version matching, but such evidence alone cannot confirm whether the vulnerable behavior is reachable and triggerable in a specific downstream application, and generating executable tests for such confirmation remains challenging due to multi-layered call graphs and subtle vulnerability behaviors requiring dedicated test oracles.Objective:To address these limitations, we propose VulTrigger, a multi-agent, LLM-based framework for generating downstream vulnerability-triggering tests for third-party library vulnerabilities. VulTrigger aims to distinguish dependency-level exposure from confirmed downstream triggerability by providing executable, runtime-validated evidence.Method:VulTrigger extracts vulnerability metadata, dependency evidence, and downstream usage context from vulnerability reports, PoC examples, and downstream source code, then applies bridging-point path analysis and source-preservation reasoning to identify Reachable Triggering Paths along which vulnerability-related inputs propagate to the vulnerable library API. A blackboard-based multi-agent workflow coordinates trigger-plan construction, constrained test generation, execution-based verification, and debugger-guided iterative repair to improve the executability and effectiveness of the generated tests.Results:On 68 vulnerability–downstream application samples spanning 30 third-party dependencies and 44 downstream projects across Java and Python, VulTrigger confirms 57 samples (83.82% success rate), outperforming TRANSFER and VulEUT by 35.29 and 13.24 percentage points, respectively (both statistically significant under the exact McNemar test). Ablation and comparative analyses further show that trigger-plan construction, path analysis, source-preservation reasoning, blackboard-based coordination, multi-agent collaboration, iterative repair, and stronger LLMs each contribute to the observed effectiveness.Conclusions:These results suggest that program-analysis-guided LLM agents can provide executable evidence of the triggerability of downstream vulnerabilities under the evaluated settings. VulTrigger is intended to complement, rather than replace, dependency-level SCA alerts and static reachability analysis.

Code generation represents a critical intersection of Software Engineering (SE) and Artificial Intelligence (AI). Within this broader landscape, Verilog, as a representative hardware description language (HDL), is fundamental to Electronic Design Automation (EDA), recent research has increasingly focused on leveraging Large Language Models (LLMs) to automate Verilog code generation, particularly at the Register Transfer Level (RTL) design. Despite growing interest, a comprehensive survey of this domain remains absent. This review addresses this gap by providing a systematic literature review of LLM-based Verilog code generation, analyzing 102 papers (70 published and 32 high-quality preprints) from SE, AI, and EDA venues. We structure our analysis around four key research questions: (1) identifying the LLMs utilized, (2) examining evaluation datasets and metrics, (3) categorizing generation techniques, and (4) analyzing alignment approaches. Furthermore, we synthesize findings to identify critical limitations in current studies regarding effectiveness and integration. Finally, we outline a roadmap highlighting potential opportunities for future research in LLM-assisted hardware design.

Recent advances in large language models (LLMs) have enhanced automated program repair (APR) by interpreting failures, generating context-aware patches, and iteratively refining fixes, thereby improving repair accuracy and coverage. However, existing methods still face three key limitations: they often rely on centralized training on sensitive codebases; their pipelines are rigid, one-pass processes that cannot adapt to the complexity of a defect; and they do not fully exploit auxiliary semantic signals, such as bug reports or documentation. To address these challenges, we propose FedDualFix, a federated multi-agent repair framework that improves repair accuracy, efficiency, and semantic coherence in heterogeneous and data-locality-constrained environments. FedDualFix decomposes the repair process into specialized agents for (i) context modeling, (ii) semantic slicing, (iii) fault localization, (iv) patch generation, and (v) cross-modal alignment. A hierarchical controller with confidence-guided scheduling enables early exits for simple defects and triggers deeper, structure-aware reasoning for complex or ambiguous cases. Dual-modality alignment further associates code-level edits with natural-language descriptions to enhance semantic plausibility. Experiments on Defects4J using several LLMs, including GPT-4o, show that FedDualFix produces 58 correct repairs and achieves 52.1% Top-1 precision, outperforming representative APR baselines and a same-backend GPT-4o Direct baseline. The adaptive scheduling mechanism reduces inference time by more than 25%, and ablation studies demonstrate the contribution of hierarchical control, multi-agent design, and dual-modality integration. These results highlight the potential of combining federated coordination with adaptive multi-agent reasoning to support accurate and scalable APR in real-world software maintenance settings.

Software Vulnerability Assessment (SVA) plays a vital role in evaluating and ranking vulnerabilities in software systems to ensure their security and reliability. Although Large Language Models (LLMs) have recently shown remarkable potential in SVA, they still face two major limitations. First, most LLMs are trained on general-purpose corpora and thus lack domain-specific knowledge essential for effective SVA. Second, they tend to rely on shallow pattern matching instead of deep contextual reasoning, making it challenging to fully comprehend complex code semantics and their security implications. To alleviate these limitations, we propose a novel framework ReVul-CoT that integrates Retrieval-Augmented Generation (RAG) with Chain-of-Thought (COT) prompting. In ReVul-CoT, the RAG module dynamically retrieves contextually relevant information from a constructed local knowledge base that consolidates vulnerability data from authoritative sources (such as NVD and CWE), along with corresponding code snippets and descriptive information. Building on DeepSeek-V3.1, CoT prompting guides the LLM to perform step-by-step reasoning over exploitability, impact scope, and related factors. We curated a dataset consisting of 12,070 vulnerability samples, of which 10% were used as the test set to evaluate ReVul-CoT. Experimental results show that ReVul-CoT outperforms state-of-the-art SVA baselines by 16.50%-42.26% in terms of MCC, and outperforms the best baseline by 10.43%, 15.86%, and 16.50% in Accuracy, F1-score, and MCC, respectively. Our ablation studies further validate the contributions of considering dynamic retrieval, knowledge integration, and CoT-based reasoning. Our results demonstrate that combining RAG with CoT prompting significantly enhances LLM-based SVA and point out promising directions for future research.

Large language models (LLMs) have achieved remarkable success across diverse applications, but their development and deployment depend heavily on deep learning (DL) frameworks. The massive scale, long execution cycles, and complex workflows of LLMs place stringent demands on framework usability, functionality, and reliability. When these demands are not well supported, developers may suffer from reduced efficiency, severe failures, and substantial resource waste. However, a fundamental question remains underexplored: what challenges do DL frameworks face in supporting LLMs? To answer this question, we analyze issue reports from three major DL frameworks (i.e., MindSpore, PyTorch, and TensorFlow) and eight associated LLM toolkits such as DeepSpeed. Based on a manual review of these reports, we construct a taxonomy that captures LLM-centric framework bugs, user requirements, and user questions. We then refine and enrich this taxonomy through interviews with 11 LLM users and eight DL framework developers. Using the taxonomy and interview findings, our study further reveals key technical challenges and mismatches between LLM user needs and developer priorities. Overall, our contributions are threefold: (1) we develop a comprehensive taxonomy comprising five question themes (11 sub-themes), five requirement themes (17 sub-themes), and ten bug themes (47 sub-themes); (2) we assess the importance and priority of different categories in the taxonomy based on insights from LLM users and framework developers; and (3) we identify five key findings across the LLM development lifecycle and propose five actionable recommendations to improve the quality of DL frameworks in supporting LLMs. Our results highlight critical limitations in current DL frameworks and offer concrete guidance for advancing their support for future LLM development, deployment, and applications.

Autonomous agent frameworks built upon large language models (LLMs) are evolving into complex, tool-integrated, and continuously operating systems, introducing security risks beyond traditional prompt-level vulnerabilities. As this paradigm is still at an early stage of development, a timely and systematic understanding of its security implications is increasingly important. Although a growing body of work has examined different attack surfaces and defense problems in agent systems, existing studies remain scattered across individual aspects of agent security, and there is still a lack of a layered review on this topic. To address this gap, this survey presents a layered review of security risks and defense strategies in autonomous agent frameworks, with OpenClaw as a case study. We organize the analysis into four security-relevant layers: the context and instruction layer, the tool and action layer, the state and persistence layer, and the ecosystem and automation layer. For each layer, we summarize its functional role, representative security risks, and corresponding defense strategies. Based on this layered analysis, we further identify that threats in autonomous agent frameworks may propagate across layers, from manipulated inputs to unsafe actions, persistent state contamination, and broader ecosystem-level impact. Finally, we highlight potential key challenges, including research imbalance across layers, the lack of long-horizon evaluation, and weak ecosystem trust models, and outline future directions toward more systematic and integrated defenses.

Deep learning (DL) frameworks are critical AI infrastructures that often hide bugs with serious security implications. While dynamic approaches such as fuzzing are effective in uncovering these bugs, they require real test execution and incur high computational costs. Static analysis is a natural complement because it can detect bugs without runtime execution, offering fast and scalable testing. Unfortunately, there is still limited work targeting static analysis for DL frameworks due to their multilingual architectures and tensor-related program state. We present Phoenix, the first LLM-based static analysis technique for DL frameworks. Our key insight is that cross-language tensor flows in DL frameworks can be modeled, together with concrete code context, as a structured semantic bridge intermediate representation (SBIR) that LLMs can analyze for potential bugs in tensor semantic propagation. We implement this insight through a multi-agent workflow. A summarization agent first distills bug summaries from historical bug-fix patches and CWE rules. Guided by each summary, an extraction agent identifies bug-relevant repository symbols for code retrieval, and a generation agent synthesizes grounded SBIRs from the retrieved context. Finally, an analysis agent is leveraged to check SBIRs and report potential bugs. Our evaluation shows that Phoenix is a practical complement to dynamic DL framework testing for bug finding. To date, Phoenix has found 31 real new bugs in PyTorch for different heterogeneous hardware backends (Intel CPU, NVIDIA CUDA, and Apple MPS). Among them, 20 submitted bug-fixing patches have been merged into upstream.

High-quality code comments can improve the efficiency of code comprehension and maintenance. Previous studies have proposed various automatic source code summarization methods. A recent trend is to improve the generative comment capabilities of neural network models with Information Retrieval (IR), i.e., incorporating comments of similar code snippets as an additional source. However, these approaches rely primarily on sparse vector representations of code, which often fail to retrieve the most analogous code snippets effectively. Moreover, such methods usually represent source code as code token sequences, abstract syntax tree (AST) sequences, or a combination of both, and neglect important information such as data flow. In this paper, we propose a novel code summarization approach named FTIR by deeply fusing the Transformer model and IR. FTIR employs the pre-trained model CodeBERT to represent source code with dense vectors to retrieve the most similar code snippet more effectively. The comment of the retrieved code is regarded as the external feature to guide the Transformer model in generating a more accurate comment. FTIR integrates multiple features of source code, including semantic (code tokens), syntactic and structural information (e.g. AST), and global syntactic structures (e.g., data flow) as internal features. This integration aims to strengthen token-level alignment across various code representations. To effectively leverage external features, we propose a cross-attention mechanism that guides the fusion of the current decoding state with this feature. Finally, a deep fusion of both internal and external features is performed to determine the probability distribution over the vocabulary. Summarization tokens are then generated using a beam search. Experiments on a commonly used benchmark dataset show that FTIR achieves BLEU, ROUGE-L, and METEOR scores of 46.17, 55.90, and 28.15, respectively, significantly outperforming existing hybrid approaches. These scores represent improvements of 0.28-18.57 for BLEU, 0.11-14.8 for ROUGE-L, and 0.3-15.54 for METEOR compared to the state-of-the-art approaches.

Medical vision–language models (MVLMs) are increasingly used as perceptual backbones in radiology pipelines and as the visual front end of multimodal assistants, yet their reliability under real clinical workflows remains underexplored. Prior robustness evaluations often assume clean, curated inputs or study isolated corruptions, overlooking routine acquisition, reconstruction, display, and delivery operations that preserve clinical readability while shifting image statistics. To address this gap, we propose CoDA, a chain-of-distribution framework that constructs clinically plausible pipeline shifts by composing acquisition-like shading, reconstruction and display remapping, and delivery and export degradations. Under masked structural-similarity constraints, CoDA jointly optimizes stage compositions and parameters to induce failures while preserving visual plausibility. Across brain MRI, chest X-ray, and abdominal CT, CoDA substantially degrades the zero-shot performance of CLIP-style MVLMs, with chained compositions consistently more damaging than any single stage. We also evaluate multimodal large language models (MLLMs) as technical-authenticity auditors of imaging realism and quality rather than pathology. Proprietary multimodal models show degraded auditing reliability and persistent high-confidence errors on CoDA-shifted samples, while the medical-specific MLLMs we test exhibit clear deficiencies in medical image quality auditing. Finally, we introduce a post-hoc repair strategy based on teacher-guided token-space adaptation with patch-level alignment, which improves accuracy on archived CoDA outputs. Overall, our findings characterize a clinically grounded threat surface for MVLM deployment and show that lightweight alignment improves robustness in deployment.

Accurate wind speed forecasting is crucial for improving the wind power generation efficiency and supporting wind energy development. Yet wind speed is highly stochastic and difficult to control, making precise prediction challenging. Many existing approaches underutilize the coupled effects of terrain and meteorological conditions on near-surface wind dynamics and offer limited support for multi-objective, collaborative optimization. This study proposes PIMFNet, a multi-task wind speed prediction framework that combines physics-informed interaction feature construction with a Bayesian-optimized composite loss to address these limitations. First, it constructs five physically grounded interactive features. Second, it embeds a Multi-Scale Feature Fusion Module (MSFF) within a Residual Network (ResNet) to jointly model spatial patterns across scales. Third, it integrates a Feature-Aware Adaptive Memory Decay Module (FAMD) into the Liquid Time-Constant Networks (LTCs) to adaptively regulate temporal memory retention based on input features. Finally, for deterministic, interval, and probability prediction, the framework uses a Bayesian optimization adaptive composite loss to balance task-specific objectives during training. The proposed method is validated on ERA5 hourly single-levels data. Results demonstrated that PIMFNet can achieve high-precision point predictions with an RMSE of 0.6541 m/s, an R of 0.9496, and a MAE of 0.4826 m/s, appropriate prediction intervals with a CP of 0.9763 and a PINAW of 0.2295, and reliable probability predictions with a CRPS of 0.3007. These capabilities provide technical support for wind resource assessment and optimized wind farm operation.

Large Language Models (LLMs) generate register-transfer-level (RTL) code with rapidly improving functional correctness. Security of LLM-generated code, however, has been studied mainly for software, where flaws can still be patched after deployment. Insecure RTL offers no such remedy once taped out into silicon. We construct SECRTL-GEN, a multi-language resource-access security benchmark grounded in real SoC IP: 392 tasks over five CWE families and four HDLs (Verilog, SystemVerilog, VHDL, and Python), each with black-box functional and security testbenches. Functional specifications intentionally omit security obligations, matching how obligations are often kept out of functional docs in practice. An empirical study of five frontier LLMs shows a sharp gap: under vanilla prompts they pass functional tests in about 73-79

The rapid advancement of large language models (LLMs), exemplified by OpenAI’s GPT series, has significantly impacted various domains, including natural language processing, software development, education, healthcare, finance, and scientific research. However, OpenAI APIs introduce unique challenges that differ from traditional APIs, such as the complexities of prompt engineering, token-based cost management, non-deterministic outputs, and operation as black boxes. To the best of our knowledge, the challenges developers encounter when using OpenAI APIs have not been explored in previous empirical studies. To fill this gap, we conduct the first comprehensive empirical study by analyzing 2,874 OpenAI API-related discussions from the popular Q&A forum Stack Overflow. We first examine the popularity and difficulty of these posts. After manually categorizing them into nine OpenAI API-related categories, we identify specific challenges associated with each category through topic modeling analysis.Our analysis indicates that API configuration issues are a fundamental barrier, significantly impacting all OpenAI APIs. Maintaining context across multiple dialogue turns remains a major challenge for chat-based APIs, with the GPT Actions API proving particularly difficult among the nine API categories. Moreover, our study highlights that the core challenge in many OpenAI API integrations is technical stack compatibility. This arises from factors such as API version upgrades or deprecations, mismatches between development frameworks and external services, language-specific limitations, and inconsistent API behavior across different environments.Based on our empirical findings, we finally propose actionable implications for developers, LLM vendors, and researchers.

Novice programmers often face challenges in fault localization due to their limited experience and understanding of programming syntax and logic. Traditional methods like Spectrum-Based Fault Localization (SBFL) and Mutation-Based Fault Localization (MBFL) help identify faults but often lack the ability to understand code context, making them less effective for beginners. In recent years, Large Language Models (LLMs) have shown promise in overcoming these limitations by utilizing their ability to understand program syntax and semantics. LLM-based fault localization provides more accurate and context-aware results than traditional techniques. This study evaluates six closed-source and seven open-source LLMs using the Codeflaws, Condefects, and BugT datasets, with BugT being a newly constructed dataset specifically designed to mitigate data leakage concerns. Advanced models with reasoning capabilities, such as OpenAI o3 and DeepSeekR1, achieve superior accuracy with minimal reliance on prompt engineering. In contrast, models without reasoning capabilities, like GPT-4, require carefully designed prompts to maintain performance. While LLMs perform well in simple fault localization, their accuracy decreases as problem difficulty increases, though top models maintain robust performance in the BugT dataset. Over-reasoning is another challenge, where some models generate excessive explanations that hinder fault localization clarity. Additionally, the computational cost of deploying LLMs remains a significant barrier for real-time debugging. LLM's explanations demonstrate significant value for novice programmer assistance, with one-year experience participants consistently rating them highly. Our findings demonstrate the potential of LLMs to improve debugging efficiency while stressing the need for further refinement in their reasoning and computational efficiency for practical adoption.

The widespread use of Large Language Models (LLMs) in software engineering has intensified the need for improved model and resource efficiency. In particular, for neural code generation, LLMs are used to translate function/method signature and DocString to executable code. DocStrings, which capture user requirements for the code and are typically used as the prompt for LLMs, often contain redundant information. Recent advancements in prompt compression have shown promising results in Natural Language Processing (NLP), but their applicability to code generation remains uncertain. Our empirical study show that the state-of-the-art prompt compression methods achieve only about 10% reduction, as further reductions would cause significant performance degradation. In our study, we propose a novel compression method, ShortenDoc, dedicated to DocString compression for code generation. Our experiments on six code generation datasets, five open-source LLMs (1B to 10B parameters) and one closed-source LLM GPT-4o confirm that ShortenDoc achieves 25–40% compression while preserving the quality of generated code, outperforming other baseline methods at similar compression levels. The benefit of this method is to improve efficiency and reduce the token processing cost while maintaining the quality of the generated code, especially when calling third-party APIs.

Software vulnerability assessment (SVA) based on pre-trained language models (PLMs) has shown promising capability in modeling vulnerability severity. However, existing PLM-based SVA methods are still constrained by limited input length, which makes it difficult to process long source code effectively and may introduce substantial irrelevant content into model inputs. Although code simplification offers a potential solution, naive simplification may remove vulnerability-relevant information and degrade assessment quality. To address this problem, we propose CS-SVA, an attention-guided hierarchical code simplification method for PLM-based SVA. CS-SVA first partitions source code into structurally meaningful code snippets through a keywords-based code splitting criterion. It then estimates token-level and statement-level importance signals using PLMs, and performs hierarchical simplification through statement selection and token pruning. In this way, CS-SVA reduces redundant code while preserving vulnerability-relevant information for severity assessment. The simplified code snippets are finally used as input for PLM fine-tuning. Experiments on real-world C/C++ vulnerabilities aligned with CVSS 3.0 show that CS-SVA provides a favorable balance between predictive performance and computational efficiency under the current setting. Compared with the evaluated baselines, CS-SVA achieves stronger overall predictive performance while reducing computational cost on PLM-based models. In addition, ablation results further show that the hierarchical simplification design is effective for balancing structure preservation and fine-grained pruning. These findings suggest that attention-guided hierarchical code simplification is a promising direction for improving PLM-based SVA.