Finding Vulnerabilities via LLM-Augmented Semantics-Aware Type-Checking
2026-08-14 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors present a new way to find security problems in software by looking at the meanings of words and symbols in the code, not just the code's structure. They created SETYPE, a system that uses language models to understand and check types based on these meanings, where mistakes can point to vulnerabilities. Their tool, PYSETYPE, tested on Python web apps, showed good accuracy and found 15 new issues, with developers confirming 9 of them. This approach helps catch security flaws by understanding code more like humans do.
static analysissoftware vulnerabilitiessyntax vs semanticstype systemLarge Language Modelstype inferencetype checkingPython web applicationszero-day vulnerabilities
Authors
Ruizhe Wang, Meng Xu, N. Asokan
Abstract
Vulnerability detection via static analysis traditionally relies on security experts encoding insecure coding patterns into algorithmic rules. However, this approach often focuses on syntactic patterns and overlooks deeper semantic information in the code, such as the meanings of variable and function names. As software systems grow more complex, modeling vulnerabilities using only syntactic rules becomes increasingly challenging. In this paper, we propose a semantics-aware approach to detecting software vulnerabilities. We present SETYPE, a semantics-aware type system that can be derived directly from source code based solely on the meanings of symbols and expressions in natural language. In the SETYPE type system, both type inference and checking are performed by Large Language Models (LLMs), and a failed type check indicates a potential vulnerability. We prototype PYSETYPE to demonstrate the feasibility of SETYPE for detecting vulnerabilities in Python web applications. Our evaluation on real-world applications achieves 87% detection precision and 88% detection accuracy. Using PYSETYPE, we identified 15 potential zero-day vulnerabilities, nine of which were confirmed by developers.