LLMs are making formal software verification feasible at a much larger scale

Domain Theory: the forgotten step in program verification - Bertrand Meyer's technology+ blog

  Program verification is making considerable progress but is hampered by a lack of abstraction in specifications. A crucial step is, almost always, absent from the process; this omission is the principal obstacle to making verification a standard component of everyday software development. 1. Steps in software verification In the first few minutes of any ... Read more

Provisional Guidance for Users of LLM-Based Code Generators

available intuition for avoiding big risks

Using Claude to reduce the attack surface of code

Automated attack surface analysis and reduction can meaningfully improve the security of deployed software in the near term. In this post, we preview data we’ve collected from applying attack surface reduction techniques to large open-source codebases using Claude.

Histomat of F/OSS: We should reclaim LLMs, not reject them

A few days ago, I came across a blog post titled On FLOSS and training LLMs that articulates a growing frustration within the free and open source software…

Copyrightability of LLM-generated code: Can we license “vibe code” into Free Software? - FSFE

The use of large language models (“LLMs”) has exploded in recent years, including in the generation of source code. But even as their usage gains popularit...

Automated Verification of Proofs in the Universal Composability Framework with Markov Decision Processes

Designing cryptographic protocols and proving these rigorously secure is an arduous and challenging task. Among the methods commonly used to prove security of cryptographic protocols, formalizing it in Canneti's Universal Composability (UC) Framework offers several benefits: (1) Modular design, (2) demonstrating that security remains under arbitrary composition and concurrent execution, (3) the security against any computationally polynomially bound adversary. However, working within the UC Framework can be cumbersome, requires a long time commitment by the prover, and it is prone to errors. While utilization of proof assistants in Cryptography and IT Security is a prominent research area, proof assistants for UC are still in their infancy. Here we show our ongoing work to utilize model checking for verification of proofs in the UC Framework, which to the best of our knowledge is the first attempt to do so. In this work we (1) formally create a Markov Decision Process (MDP) encoding a given proof in the UC Framework, (2) define and proof notions of soundness and completeness for the constructed MDP, (3) implement a proof of concept and (4) demonstrate practical feasibility through experimental evaluation. In summary, in this work we lay out the formal foundations for model checking UC proofs and create a tool that can not only be used for proof verification but also as an assistant for developing proofs in the UC Framework.

When Science Goes Agentic

In a couple of years, we will inspect AI-generated source code about as often as we inspect the assembly output of a compiler. Which is to say, far less often—outside of high-stakes and adversarial settings. The trajectory is clear: vibe coding is not a fad but a transition, a stepping stone. Debugging AI-generated code will shrink dramatically for a lot of everyday software—not because the code will be flawless, but because the feedback loops between generation, testing, and correction will tighten until human inspection becomes the bottleneck rather than the safeguard. In this respect, requiring the co-generation, with code, of mechanically verifiable formal attestations can also improve the process.

Building a Browser-Native Verification Stack for Tinfoil

Learn how we built a browser-based confidentiality and integrity verifier with implementations of browser-native Sigstore and TUF libraries.

Extensible Software in the age of LLMs | Jeremy Morrell

Solid core + capability-based sandboxes + LLMs = Users with superpowers

Fine-grained and accurate source code differencing | Proceedings of the 29th ACM/IEEE International Conference on Automated Software Engineering

As part of the Digital Library's transition to Open Access, new features for researchers are available in the Premium Edition. Click here to learn more.

Magicoder: Empowering Code Generation with OSS-Instruct

We introduce Magicoder, a series of fully open-source (code, weights, and data) Large Language Models (LLMs) for code that significantly closes the gap with top code models while having no more...

The Spoofax language workbench | Proceedings of the ACM international conference companion on Object oriented programming systems languages and applications companion

As part of the Digital Library's transition to Open Access, new features for researchers are available in the Premium Edition. Click here to learn more.