Zuohua Ding

Call graph construction serves as a foundational component in Python static analysis and software engineering. However, it faces significant challenges due to the language's unique characteristics. That is, the dynamic typing system, extensive use of third-party libraries, and runtime-dependent behaviors in Python create substantial obstacles for traditional static analysis methods. Although these methods typically achieve high precision, they suffer from low recall, making it difficult to strike a balance between soundness and precision. In this paper, we present InferCG , a hybrid framework that addresses these limitations by combining coarse-grained static analysis with large language model (LLM)–based semantic reasoning. InferCG first constructs a high-recall candidate call set using permissive name- and arity-based matching, and then employs powerful LLMs such as DeepSeek and Qwen to semantically filter implausible edges. This two-stage design balances recall and precision without requiring dynamic execution or extensive type annotations. Experiments on curated open-source Python projects and the DyPyBench benchmark demonstrate that InferCG outperforms state-of-the-art static tools, which achieves up to 13.9% improvement in average recall and a 5.0% gain in average F1 score over PyCG. Moreover, in a real-world vulnerable-function detection scenario, InferCG enables more accurate reachability analysis than dependency-based tools.

Simulation-based testing is essential for evaluating the safety of Autonomous Driving Systems (ADSs). Comprehensive evaluation requires testing across diverse scenarios that can trigger various types of violations under different conditions. While existing methods typically focus on individual diversity metrics, such as input scenarios, ADS-generated motion commands, and system violations, they often fail to capture the complex interrelationships among these elements. For instance, identical motion commands can produce different collision risks in varying scenes, and the same collision may result from different commands under different scenarios. This oversight leads to gaps in testing coverage, potentially missing critical issues in the ADS under evaluation. In this paper, we propose Causal-Fuzzer, the first causality-aware fuzzing technique that enables efficient and comprehensive testing of ADSs by constructing causal graphs to model the interrelationships among scenarios, actions, and violations. Unlike existing methods that treat diversity metrics independently, we recognize these elements are causally interconnected and use their relationships to identify more diverse violations triggered by fundamentally different causal mechanisms. Specifically, Causal-Fuzzer proposes (1) a causality-based feedback mechanism that quantifies the combined diversity of test scenarios by assessing whether they activate new causal relationships, and (2) a causality-driven mutation strategy that prioritizes mutations on input scenario elements with higher causal impact on ego action changes and violation occurrence to enable interpretable and efficient test generation. We evaluated Causal-Fuzzer on an industry-grade ADS Apollo, with a high-fidelity simulator LGSVL. Our empirical results demonstrate that Causal-Fuzzer significantly outperforms existing methods in (1) identifying a greater diversity of violations (96.5 violations on average, compared to 66.9 for the best baseline method), (2) providing enhanced testing sufficiency with improved coverage of causal relationships (13.6 unique sceneaction- violation patterns on average, compared to 8.6 for the best baseline method), and (3) achieving greater efficiency in detecting critical scenarios, strong robustness under noise conditions, and good generalizability across varying scenario complexities and violation types. Our source code and experimental results are available at https://sites.google.com/view/causal-fuzzer.

Large Language Models (LLMs) in the financial domain have predominantly focused on highrisk financial market prediction. However, there remains a severe scarcity of tools and corresponding high-quality datasets capable of generating in-depth financial analysis reports to assist human experts in investment decision making. To address this research gap, this paper makes two main contributions. First, we construct and release MultiModal Stock Analytics (MMSA), the first large-scale multimodal financial data set that deeply couples real stock charts with expert-level analytical texts. Second, we propose a novel reinforcement learning method named Stock-R1, which enhances the Group Relative Policy Optimization (GRPO) framework by introducing two core mechanisms. The first mechanism operationalizes the principles of Axiomatic Construction in a composite reward function to ascertain the validity and optimality of the analysis. The second mechanism introduces a Progressive Curriculum Reward strategy, which enables efficient curriculum learning by dynamically reshaping the incentive landscape. Extensive experiments on MMSA demonstrate that Stock-R1’s performance significantly outperforms several State-ofthe- Art (SOTA) models, including those with larger parameter counts. Furthermore, compared to the conventional Supervised Fine-Tuning (SFT) method, it achieves an improvement of up to 30% in the F1 score on key analytical tasks. This work provides a new benchmark dataset and an efficient training methodology, driving the paradigm shift of financial Large Vision-Language Models (LVLMs) from market prediction to decision support.

Control barrier certificate generation is an efficient and powerful technique for the safe control of cyber-physical systems. Feed-forward neural networks (FNNs) are commonly used to synthesize control barrier certificates and safe controllers, but they struggle to effectively address the challenges posed by high-dimensional complex systems. In this paper, we propose a novel method for generating control barrier certificates and controllers using Kolmogorov-Arnold Networks (KANs). Specifically, it utilizes KANs to replace FNNs as the template of control barrier certificates and contrllers. Since KAN has learnable activation functions, it can efficiently improve the representation power. Then, it leverages the pruning and symbolization properties of KANs, which significantly simplify the network structure, allowing for more efficient formal verification of the simplified candidate KAN control barrier certificates and controllers using Satisfiability Modulo Theories. We implement the tool KAN4CBC, and evaluate its performance over a set of benchmarks. The experimental results demonstrate that our method addresses the issues of system dimension expansion and improved solution efficiency.

Trusted Execution Environment (TEE) provides isolation for sensitive data in electronic devices and its compromise can lead to enormous losses. TEE's information-flow security is essential and can be robustly ensured by formal methods. Nevertheless, the cross-domain API invocation of TEE is intricate for information-flow analysis, and the service provider on the TEE, i.e., trusted application, brings complexity to the TEE specification and verification. Existing research seldom delves into general TEEs that are compliant with GlobalPlatform (GP), which is an important and universal TEE standard. Furthermore, they do not align with the requirements for Common Criteria certification. In this paper, we propose a TEE-applicable and Common Criteria-oriented framework to specify and verify the information-flow security of GP TEE, which is applied to the verification of the real-world commercial MiTEE. Firstly, we present a framework for TEE that aligns with the requirements of Common Criteria's highest assurance level (EAL 7). It incorporates a domainswitch based mechanism to model the cross-domain TEE API invocation and a parameterized modeling approach to handle trusted applications. Secondly, we model GlobalPlatform-compliant TEE with the framework as GP TEE security model layer and function layer, which are reusable for all GP TEEs. Thirdly, we specify MiTEE as the MiTEE design layer that refines GP TEE model. Lastly, we verify the information-flow security of GP TEE and MiTEE via theorem proving and uncover four critical vulnerabilities in MiTEE. This work contributes to MiTEE's acquirement of an EAL 5+ certificate. All works are carried out in Isabelle/HOL, with nearly 32000 lines of code.