Creed: LLM code auditing infers developer beliefs to find semantic security flaws
mboehme_ · x · 2026-10-21
A new arXiv paper by Junming Liu and Marcel Böhme introduces Creed, a belief-guided vulnerability detector. It infers security-relevant developer beliefs from code — e.g., identical errors for wrong username/password imply user-enumeration protection — and flags violations, uncovering high-level semantic flaws like timing side channels that syntactic static analysis misses. Unlike prior ML-based VD, Creed explains root cause, symptoms, and exploitability conditions. The paper proposes recall and overhead metrics for explanation-based VD, and on a real-world benchmark Creed beats existing tools with the best effectiveness-vs-effort trade-off.
More from Safety
- DeepSeek roots an LG TV and a Samsung TV on command, 'okay' each time — rickasaurus · 2026-10-21
- GLM-5.3 spontaneously reasons about how its actions shape future training, raising alignment faking concerns — LessWrong 精选 · 2026-10-21
- MI5 chief warns AI could 'change the stakes' on bioweapons threats — nordicinst · 2026-10-21
- Chris Paxton: the whole robotics stack won't run in the cloud — chris_j_paxton · 2026-10-21
- AI-assisted phishing via fake podcast invite: days of rapport, then malware — michael_nielsen · 2026-10-21
- Anaconda ships MCP to stop coding agents from hallucinating malicious dependency packages — anacondainc · 2026-10-21