Selected work

Representative Papers

Faster Releases, Fewer Risks: A Study on Maven Artifact Vulnerabilities and Lifecycle Management

Mar 31, 2025

The impact of release practices on software supply chain security and dependency health remains poorly understood. Method: We conduct a large-scale empirical study of 203,000 releases across 10,000 Maven Central artifacts and 1.7 million dependency relationships, integrating time-series dependency evolution modeling, statistical testing of CVE associations, and metadata mining. Contribution/Results: We uncover, for the first time, a strong negative correlation between release velocity and dependency staleness duration (p < 0.001), as well as a significant negative association with CVE counts. High-frequency releasing reduces average direct-dependency staleness by 62% and decreases CVE prevalence in transitive dependencies by 47%. These findings establish “rapid releasing” as a quantifiable, generalizable security practice—providing novel empirical evidence and methodological foundations for dependency management and software supply chain risk governance.

1 citationsRead paper

Chasing the Clock: How Fast Are Vulnerabilities Fixed in the Maven Ecosystem?

Mar 28, 2025

This study investigates factors influencing vulnerability remediation time in the Maven ecosystem, focusing on CVE severity, library popularity (number of dependents), and release frequency. Leveraging the largest empirical dependency graph to date—comprising 658,000 libraries and 14 million versions—and integrating the Goblin dependency database, statistical modeling, and survival analysis, we conduct causal inference. Contrary to the common intuition that critical vulnerabilities are repaired substantially faster, we find that critical CVEs are only marginally quicker to remediate than non-critical ones. A tenfold increase in dependent count reduces median remediation time by 19%; libraries releasing ≥2 versions per month remediate vulnerabilities 41% faster. This work is the first to empirically demonstrate significant positive acceleration effects of both popularity and high release frequency on vulnerability response, providing data-driven foundations for vulnerability prioritization policies and ecosystem-wide governance.

1 citationsRead paper

Coupled Tensor-Tensor Completion Method with Applications in Drug Repurposing

Sep 02, 2026

研究提出了一种新的Coupled Tensor-Tensor Completion方法，通过利用张量形式的辅助信息来改进药物重定位中的张量补全问题。

0 citationsRead paper

Comprendia: AI-Augmented Code Comprehension

Aug 10, 2026

This work addresses key challenges in Java program comprehension—namely, complex dependencies, difficulty in identifying repetitive code, and the laborious task of locating security vulnerabilities—by introducing an Eclipse plugin that integrates structured dependency graphs with large language models (LLMs). The system leverages a multi-edged type dependency graph and an interactive visualization interface to enable developers to explore and refactor code in real time. It innovatively employs a Graph-Aware Call Pruning (GACP) strategy to generate traceable and reproducible LLM prompts, while also incorporating code clone detection and vulnerability data from OSV.dev to form a multidimensional comprehension-enhancement framework. Experimental results demonstrate that the approach significantly improves comprehension efficiency on Java projects containing known clones and CVE-listed vulnerabilities, all while preserving full developer control over the analysis process.

0 citationsRead paper

Nonlocal operator learning for fMRI encoding and decoding tasks

May 19, 2026

Functional magnetic resonance imaging (fMRI) data exhibit high-dimensional spatiotemporal structure, posing significant challenges for brain activity encoding and stimulus decoding. This work proposes the first end-to-end framework that integrates neural integral operators into fMRI modeling, leveraging a latent-variable formulation to capture long-range non-local spatiotemporal context through fixed-point iterations in an auxiliary space. Experiments on both visual cortex and whole-brain datasets demonstrate that expanding the spatiotemporal window substantially enhances performance: in decoding tasks, class separability in the latent space surpasses that of the raw signals, while consistent improvements are also observed in encoding tasks. These results underscore the critical role of spatiotemporal extent in effective neural representation learning.

0 citationsRead paper

Recent publications

Latest Papers

Coupled Tensor-Tensor Completion Method with Applications in Drug Repurposing

Sep 02, 2026

研究提出了一种新的Coupled Tensor-Tensor Completion方法，通过利用张量形式的辅助信息来改进药物重定位中的张量补全问题。

0 citationsRead paper

Comprendia: AI-Augmented Code Comprehension

Aug 10, 2026

This work addresses key challenges in Java program comprehension—namely, complex dependencies, difficulty in identifying repetitive code, and the laborious task of locating security vulnerabilities—by introducing an Eclipse plugin that integrates structured dependency graphs with large language models (LLMs). The system leverages a multi-edged type dependency graph and an interactive visualization interface to enable developers to explore and refactor code in real time. It innovatively employs a Graph-Aware Call Pruning (GACP) strategy to generate traceable and reproducible LLM prompts, while also incorporating code clone detection and vulnerability data from OSV.dev to form a multidimensional comprehension-enhancement framework. Experimental results demonstrate that the approach significantly improves comprehension efficiency on Java projects containing known clones and CVE-listed vulnerabilities, all while preserving full developer control over the analysis process.

0 citationsRead paper

Nonlocal operator learning for fMRI encoding and decoding tasks

May 19, 2026

Functional magnetic resonance imaging (fMRI) data exhibit high-dimensional spatiotemporal structure, posing significant challenges for brain activity encoding and stimulus decoding. This work proposes the first end-to-end framework that integrates neural integral operators into fMRI modeling, leveraging a latent-variable formulation to capture long-range non-local spatiotemporal context through fixed-point iterations in an auxiliary space. Experiments on both visual cortex and whole-brain datasets demonstrate that expanding the spatiotemporal window substantially enhances performance: in decoding tasks, class separability in the latent space surpasses that of the raw signals, while consistent improvements are also observed in encoding tasks. These results underscore the critical role of spatiotemporal extent in effective neural representation learning.

0 citationsRead paper

Insights into Security-Related AI-Generated Pull Requests

Apr 21, 2026

This study investigates the security implications of AI-powered coding agents, which, while enhancing developer productivity, may introduce vulnerabilities and exhibit distinct code review behaviors compared to human developers. Analyzing 675 security-related pull requests (PRs) drawn from over 33,000 AI-generated PRs, the work employs large-scale data mining, vulnerability categorization, and qualitative content analysis to characterize recurrent defect patterns in AI-generated secure code—such as inefficient regular expressions, injection flaws, and path traversal vulnerabilities. It extends existing PR rejection taxonomies to accommodate AI contributions and uncovers the significant influence of procedural and social factors on the acceptance of AI-generated code. Notably, many defective PRs are still merged, with rejections primarily driven by process-related issues rather than code quality, and submission metadata shows limited impact on acceptance rates.

0 citationsRead paper

When AI Teammates Meet Code Review: Collaboration Signals Shaping the Integration of Agent-Authored Pull Requests

Feb 22, 2026

This study addresses the gap in understanding how AI-generated code submissions integrate into human-led code review processes. Leveraging the AIDev dataset, the authors combine logistic regression with repository-clustered standard errors and qualitative content analysis to systematically identify collaborative signals—such as reviewer engagement—that critically influence the merge success of AI-generated pull requests. The findings reveal that active reviewer participation significantly increases the likelihood of integration, whereas disruptive behaviors like large-scale changes or force pushes reduce merge probability. These results demonstrate that effective AI collaboration hinges on alignment with established review norms and the formation of a convergent feedback loop, thereby moving beyond prior work that focused narrowly on code quality or iteration frequency.

0 citationsRead paper