Code-Grounded Agentic Explanations for Static Analysis Vulnerability Findings
Story 11, from arXiv
A new tool called SAFE improves the explainability of static analysis findings by using large language models to provide context-specific explanations without compromising auditability. A user study showed improved usability and actionability.
Key points
- SAFE is an open-source IntelliJ IDEA plugin that explains static analysis findings using large language models.
- The tool separates detection from explanation, keeping auditability while providing contextual explanations.
- A user study with 24 participants showed increased usability and actionability of explanations.
- Explanations are tied to data flow and require the model to consult the repository and the rule that triggered the finding.
- Trust in findings did not improve, but participants found explanations easier to understand.
Why it matters
Software engineers often dismiss static analysis findings due to poor explainability. This tool addresses that by providing clear, context-aware explanations without sacrificing the auditability that makes static analysis defensible.
Counterpoint
Trust in findings did not improve, suggesting that while explanations are clearer, they may not necessarily increase confidence in the validity of the findings.
Sources
This summary was written by a language model and may contain errors. Read the original for the full story.