Large language models (LLMs), e.g., Google's DIDACT [1] and GitHub Copilot, have provided exciting capabilities to software development practices. Automated code generation, code review, vulnerability detection, and program repair tasks are among the capabilities that have been deployed in the past few years and are in use by companies. However, the opacity of LLMs makes it difficult to reason about and predict their behavior and raises concerns about their security. Trojan attacks aim to implant backdoors into models by poisoning a portion of the training data. Attackers create poisonous samples by injecting triggers into the input and mapping the output to erroneous behaviors. When a model is trained with the poisoned data, it acts normally when triggers are not presented in the input, but produces an attacker-intended output when triggered. Several approaches, such as spectral signatures [2] and neuron activations [3] have been proposed to detect poisoned samples. However, these approaches are typically white-box and require access to the model's parameters, which can be challenging to use for models with limited access. In contrast, in a black-box manner, Qi et al. [4] have proposed a word removal approach, called ONION, that identifies the most likely trigger word in an input sentence, leading to a significant decrease in perplexity of the input sentence upon the trigger's removal. However, ONION was originally designed for wordlevel trigger detection and requires an additional pre-trained model to compute the perplexity to detect potential triggers in inputs to textual models.

There is more than a decade-long history of using static analysis to find bugs in systems such as Linux. Most of the existing static analyses developed for these systems are simple checkers that find bugs based on pattern matching. Despite the presence of many sophisticated interprocedural analyses, few of them have been employed to improve checkers for systems code due to their complex implementations and poor scalability. In this article, we revisit the scalability problem of interprocedural static analysis from a “Big Data” perspective. That is, we turn sophisticated code analysis into Big Data analytics and leverage novel data processing techniques to solve this traditional programming language problem. We propose Graspan , a disk-based parallel graph system that uses an edge-pair centric computation model to compute dynamic transitive closures on very large program graphs. We develop two backends for Graspan, namely, Graspan-C running on CPUs and Graspan-G on GPUs, and present their designs in the article. Graspan-C can analyze large-scale systems code on any commodity PC, while, if GPUs are available, Graspan-G can be readily used to achieve orders of magnitude speedup by harnessing a GPU’s massive parallelism. We have implemented fully context-sensitive pointer/alias and dataflow analyses on Graspan. An evaluation of these analyses on large codebases written in multiple languages such as Linux and Apache Hadoop demonstrates that their Graspan implementations are language-independent, scale to millions of lines of code, and are much simpler than their original implementations. Moreover, we show that these analyses can be used to uncover many real-world bugs in large-scale systems code.

There is more than a decade-long history of using static analysis to find bugs in systems such as Linux. Most of the existing static analyses developed for these systems are simple checkers that find bugs based on pattern matching. Despite the presence of many sophisticated interprocedural analyses, few of them have been employed to improve checkers for systems code due to their complex implementations and poor scalability. In this paper, we revisit the scalability problem of interprocedural static analysis from a "Big Data" perspective. That is, we turn sophisticated code analysis into Big Data analytics and leverage novel data processing techniques to solve this traditional programming language problem. We develop Graspan, a disk-based parallel graph system that uses an edge-pair centric computation model to compute dynamic transitive closures on very large program graphs.

Enriched by natural language texts, Stack Overflow code snippets are an invaluable code-centric knowledge base of small units of source code. Besides being useful for software developers, these annotated snippets can potentially serve as the basis for automated tools that provide working code solutions to specific natural language queries.