Soundness Checking of Taint Flow Models

The authors contribute an approach that pairs LLM-generated taint flow models with a soundness checker, rather than constructing every model through inter-procedural taint analysis.

Source: [3], [12]

The evaluation uses six Go repositories, 16 taint-flow properties and 97 interesting methods to model; interface implementations bring the checked total to 2,535 methods. The authors manually keep scenarios with zero to a few actual flows, no observed baseline false positives and nontrivial call-graph exploration. They report proving nine properties for which baseline taint analysis timed out. This selected benchmark design limits generalization beyond the tested scenarios.

Source: [8], [17]

The approach is instantiated for Go with Argot’s static analysis. The authors identify unsafe pointer manipulation, reflection and concurrency as difficult Go features; this instantiation does not establish efficient, precise handling of every language feature.

Source: [5]

Interface-method models are checked against every concrete implementation in the analyzed application, so soundness is application-relative. The checkable model format excludes flows to or from global and bound/free variables, subject to the stated resolved-closure exception; models with unsupported inputs or outputs are conservatively considered unsound. Interface inputs and outputs must be field-insensitive. These are model-format restrictions, not a claim that Argot itself cannot analyze such features.

Source: [15], [16]

Soundness assumes data-race-free execution, a sound call graph and no free variables in modeled methods’ inputs or outputs; these assumptions are not validated by the instantiation. Proof sketches also depend on the authors’ interpretation of Go semantics. Omitted or misinterpreted language semantics could make the checker incorrectly declare an unsound model sound.

Source: [11]

The evaluation’s taint-flow scenarios may be unrealistic, and the flows reported are not indicative of actual security issues.

Source: [4]

The checker derives must-not-flows by subtracting the candidate model from a most-general summary, then uses lightweight analyses to try to prove those flows cannot occur.

Source: [2], [18]

If lightweight analyses leave must-not-flows unproven, the checker analyzes intra-procedural flows, deduces maximally general callee summaries subject to the soundness constraints, and recursively checks them. For recursion, inability to prove must-not-flows for a previously deduced callee summary causes the model to be conservatively treated as unsound.

Source: [1], [2], [6]

The model-generation agent uses program-analysis tools and is tasked with producing candidate taint flow models; the system automatically checks each generated model after the agent finishes.

Source: [9], [14]

The evaluation asks how precise and efficient the soundness checker is, how useful its lightweight analyses are, how sound and precise LLM-generated models are, and whether checked models make otherwise intractable taint properties tractable.

Source: [7]

The claimed security-analysis scope is explicit taint-flow properties; modeling implicit taint flows, including control-flow-based flows, is out of scope.

Source: [11], [19]