Three Ways to Combine LLMs with Static Analysis

▶ Watch (01:17)

Three architectures cover the current thinking on pairing LLMs with SAST tools. In the AI-enhanced design, the static scanner runs first and the LLM filters its output. In the AI-explorer design, the LLM leads exploration while static analysis verifies control-flow correctness. In the AI-native design, the LLM acts as the scanner itself, driving tool calls and mimicking both machine and human behavior.

Each position shifts cost differently. The first is already in commercial products. The second and third trade rule-based speed for agent flexibility, but that flexibility grows expensive fast as the path count scales.

The False Positive Trap and the One-by-One Cost Problem

▶ Watch (03:15)

SAST tools face a hard tradeoff: aggressive false-positive filtering misses real vulnerabilities. CodeQL had over 500 pull requests dedicated to fixing false positives alone. The rules that enforce strict domination relationships in control flow are precise, but they throw out findings the LLM downstream never gets to see.

“false alarms filtering even goes beyond the importance of zero day funings” — Zong Cao

Scaling LLM review one report at a time makes the cost problem worse. Each pass takes seconds or minutes. Thousands of paths mean the bill grows fast, whether you use a chat-style call or an agentic multi-step chain.

Closed-Loop CodeQL Optimization in the Development Phase

▶ Watch (09:28)

The team mapped Google’s OPRO framework onto CodeQL development: an LLM generates rules, the compiler tests them against a public suite, and the runtime log feeds back into the next pass. Two failures hit early. Generated CodeQL mixed in Python or SQL syntax, causing compilation death loops. And without context isolation, the LLM chased edge cases unrelated to the root cause being tested.

Strict output constraints and isolated test cases fixed both problems. In the closed-loop CodeQL optimizer results (13:08), precision held near 100% while recall tripled.

Path Segmentation and Operation Caching at Runtime

▶ Watch (14:37)

Human auditors recognize code patterns and accelerate as they review more reports. Relaxed SAST rules produce massive path counts where results differ only slightly, because branching multiplies paths exponentially. Summarizing at the function level drops cross-function context. Reading every path separately brings the cost problem back.

The fix: segment at the outermost function call, the natural business-logic boundary with a complete stack frame, then build an operation database keyed by function call chain. Similar paths reuse the same cache entry. In the path segmentation cache hit rate benchmark (22:42), this approach hit 80% cache reuse.

Notable Quotes

false alarms filtering even goes beyond the importance of zero day funings Zong Cao · ▶ 3:38

we could increase the recall rate to about three times better Zong Cao · ▶ 13:30

humans uh domain knowledge add values to the system Zong Cao · ▶ 25:03

Key Takeaways

  • Relaxing SAST rules triples recall but floods the LLM with redundant paths that must be deduplicated before review.
  • Closed-loop CodeQL generation with context isolation and strict output limits avoids the language-pollution death loop.
  • Segmenting paths at the outermost function call and caching by operation type can hit 80% cache reuse, cutting LLM costs at scale.