PredicateFix: Repairing Static Analysis Alerts with Bridging Predicates

2025-03-15

AI Summary

Large language models (LLMs) suffer from severe hallucination and poor performance on complex static analysis warnings, while retrieval-augmented generation (RAG) approaches struggle with low relevance of retrieved code examples. Method: This paper introduces a semantic bridging mechanism grounded in static analysis rule predicates to precisely align warnings with critical clean-code examples; designs an automated key-example retrieval algorithm to overcome traditional RAG’s example-quality bottleneck; and builds a RAG-based repair pipeline tailored for CodeQL and Go static analyzers, augmented by a multi-LLM collaborative evaluation framework. Contribution/Results: Experiments demonstrate that our method improves correct-fix rates by 27.1%–72.5% across multiple mainstream LLMs, significantly outperforming existing RAG baselines. It establishes, for the first time, a rule-predicate-driven, high-fidelity code repair retrieval paradigm.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Planning, Routing, and Scheduling: Replanning and Plan Repair
• Knowledge Representation and Reasoning: Qualitative Reasoning

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Using Large Language Models (LLMs) to fix static analysis alerts in program code is becoming increasingly popular and helpful. However, these models often have the problem of hallucination and perform poorly for complex and less common alerts, limiting their performance. Retrieval-augmented generation (RAG) aims to solve this problem by providing the model with a relevant example, but the unsatisfactory quality of such examples challenges the effectiveness of existing approaches. To address this challenge, this paper utilizes the predicates in the analysis rule, which can serve as a bridge between the alert and relevant code snippets within a clean code corpus, called key examples. Based on the above insight, we propose an algorithm to retrieve key examples for an alert automatically. Then, we build PredicateFix as a RAG pipeline to fix alerts flagged by the CodeQL code checker and another imperative static analyzer for Golang. Evaluation with multiple LLMs shows that PredicateFix increases the number of correct repairs by 27.1% ~ 72.5%, significantly outperforming other baseline RAG approaches.

Problem

• Improves static analysis alert repair using LLMs
• Addresses hallucination and poor performance in complex alerts
• Enhances retrieval-augmented generation with bridging predicates

Innovation

• Uses predicates to bridge alerts and code snippets
• Automates retrieval of key examples for alerts
• Enhances RAG pipeline for static analysis repairs