arXiv cs.AI· Oshando Johnson, Ranjith Krishnamurthy, Rohith Kumar Shanmuganathan, Goran Piskachev, Eric Bodden·· 10 小时前AI 评分32
SAFE：用代码接地的智能体解释静态分析漏洞发现
Code-Grounded Agentic Explanations for Static Analysis Vulnerability Findings
AI 导读
开源 IntelliJ IDEA 插件 SAFE 完成重新设计，将检测留给分析器、只让 LLM 负责解释，并要求智能体在回答前查阅代码仓库与触发规则。24 人交叉实验显示，System Usability Scale 可用性评分从 77.3 升至 85.0，正确修复的几率提高 2.6 倍，可操作性提升最明显；分诊准确率与单条发现耗时无差异，信任度未变化。
正文 · 原文
Abstract:Static application security testing (SAST) tools surface vulnerabilities early and their verdicts are rule-based and auditable. Yet developers routinely dismiss findings they cannot interpret. Large language models can supply the missing explanation, but designs that also hand the model the detection give up the auditability that makes static analysis defensible. We keep detection with the analyser and give the model only the explaining. A preliminary user study with 20 participants and a workshop with 19 practitioners yielded five requirements. Guided by these we redesigned SAFE, an open-source IntelliJ IDEA plugin that explains findings from any analyser reporting in the Static Analysis Results Interchange Format. It tiers explanations by demand, ties them to the reported data flow, and replaces the single-prompt backend with an agent that must consult the repository and the rule that fired before answering. A within-subjects crossover experiment with 24 participants compared the redesign against its predecessor. Perceived usability rose from 77.3 to 85.0 on the System Usability Scale. Actionability gained most among the explanation-quality items, the aspect both earlier studies flagged as weakest, and the odds of a correct remediation were 2.6 times higher. Triage accuracy and time per finding were indistinguishable, which we read as uninformative rather than as equivalence. Trust was the one measure that did not move, and the closing interviews indicate that grounding made findings easier to understand rather than easier to believe. Participants also drew a boundary no requirement anticipated, wanting the tool to find and explain while they judge and apply.
| Subjects: | Software Engineering (cs.SE); Artificial Intelligence (cs.AI); Human-Computer Interaction (cs.HC) |
| Cite as: | arXiv:2611.13041 [cs.SE] |
| (or arXiv:2611.13041v1 [cs.SE] for this version) | |
| https://doi.org/10.48550/arXiv.2611.13041 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Oshando Johnson [view email]
[v1]
Mon, 9 Nov 2026 11:40:08 UTC (945 KB)
来源：arXiv cs.AI · arxiv.org