Yu Huang

Programming attracts a diverse range of learners, including individuals with dyslexia, a learning difficulty that affects reading, writing, and spelling despite average intelligence and educational opportunities. Although prior work has examined dyslexia in natural-language and code comprehension, we still know little about how dyslexic learners engage with code relative to natural language, and what this implies for inclusive programming environments. This gap is especially important in the AI era, as novice programmers increasingly rely on AI-powered coding and learning tools that may not address the distinct comprehension and cognitive support needs of learners with dyslexia. To address this gap, we conducted an eye-tracking study with a mixed-methods design involving 24 novice programmers (12 with dyslexia, 12 without) who completed paired code-comprehension and English-comprehension tasks. We found that although the two groups showed similar overall visual scanning patterns, eye-gaze features suggest higher cognitive effort among dyslexic novices during code comprehension. We also found that the performance gap between dyslexic and neurotypical learners was smaller in code comprehension than in English comprehension, suggesting that programming-specific representations may reshape, rather than eliminate, dyslexia-related challenges. In addition, dyslexic novices reported lower confidence, viewed general training methods as less effective, and described difficulties with symbolic elements and structurally complex code. These findings provide an empirical basis for designing AI-assisted programming tools that can detect cognitive overload and adapt explanations, feedback, and task support to better support dyslexic novices.

IDE-integrated AI coding assistants, which operate conversationally within developers' working codebases with access to project context and multi-file editing, are rapidly reshaping software development. However, empirical investigation of this shift remains limited: existing studies largely rely on small-scale, controlled settings or analyze general-purpose chatbots rather than codebase-aware IDE workflows. We present, to the best of our knowledge, the first large-scale study of real-world conversational programming in IDE-native settings, analyzing 74,998 developer messages from 11,579 chat sessions across 1,300 repositories and 899 developers using Cursor and GitHub Copilot. These chats were committed to public repositories as part of routine development, capturing in-the-wild behavior. Our findings reveal three shifts in how programming work is organized: conversational programming operates as progressive specification, with developers iteratively refining outputs rather than specifying complete tasks upfront; developers redistribute cognitive work to AI, delegating diagnosis, comprehension, and validation rather than engaging with code and outputs directly; and developers actively manage the collaboration, externalizing plans into persistent artifacts, and negotiating AI autonomy through context injection and behavioral constraints. These results provide foundational empirical insights into AI-assisted development and offer implications for the design of future programming environments.

This paper presents a study of human visual attention during localization of memory bugs in C. Human visual attention refers to the mechanical processes by which we selectively process and prioritize information. Visual attention is important to study because it is central to what information people (who are sighted) use to solve a particular problem. Meanwhile, memory bugs are among the most common types of bugs in C programs that manifest as a variety of program faults. In this paper, we study human visual attention while people attempt to locate memory bugs in code. We recruited 21 programmers to locate between one and eight memory bugs in three C programs for 1.5–2 hours each. In total we collected observations of 31 hours of programmer effort. The bugs in our study cover memory leaks, overflows, and double frees, which are among the most common memory bugs. We analyze the task outcomes in terms of success rate and related factors, patterns of visual attention overall such as what lines and functions are read, and finally we explore differences of visual attention patterns during success versus failure cases.

GitHub is one of the largest open-source software (OSS) communities for development and collaboration. Impersonation maliciously assuming another user's identity to access code, sway projects, or spread misinformation—has driven recent real-world attacks and is an escalating concern. We present the first exploration of impersonation's impact on GitHub. Through structured interviews with 17 OSS contributors, we study perceptions and mitigations: users generally lack awareness and underestimate the risk; after a live demo, concern rises sharply. Current best practices (e.g., commit signing) need usability improvements to encourage adoption. We also assemble a dataset of 12.5 million commits to examine the current status of impersonation and the feasibility of repository-specific commit authorship attribution as a practical mitigation signal. Leveraging modern pretrained code models and verified commits as cryptographic ground truth, we evaluate whether repository-tuned predictors can infer likely authors and surface anomalous author commit pairs for human review. Models that leverage comprehensive commit information achieve high accuracy (e.g., over 96% with CodeT5+). Our metadata-only CrossCheck analysis shows that apparent author-history discrepancies are dominated by legitimate workflow confounders, so deterministic impersonation detection is unreliable without additional ground truth. We therefore evaluate repository-specific authorship attribution as a probabilistic triage signal, including robustness under a targeted style-imitation attack and open-set deployment considerations where the true author may be absent from the known contributor set. The results show that our approach improves stability over code-only attribution, strengthening its value as a practical triage signal under attacker adaptivity. While deterministic impersonation detection remains impossible, these probabilistic signals can help prioritize review and complement existing controls (e.g., commit signing and vigilant-mode alerts).

Code comprehension is a fundamental challenge in software engineering that impacts developer productivity and software quality. While Large Language Models (LLMs) demonstrate strong capabilities in code generation and summarization, they process code differently from human developers, who employ strategic attention patterns focused on semantically critical elements. Recent research has successfully integrated human attention patterns captured through eye-tracking into AI models for software engineering tasks, however, existing human-AI approaches face critical limitations that prevent widespread practical deployment, particularly for LLM enhancement. Existing approaches to incorporate human cognitive insights face scalability limitations due to resource-intensive eye-tracking studies and lack empirical validation for cross-language generalizability. We present ScanCoder, a framework that integrates cognitive simulation with LLM enhancement through (1) generating human-like attention patterns at scale using minimal eye-tracking data via cognitive simulation with Adaptive Character of Thought-Rational (ACT-R) architecture, and (2) cognitively-guided fine-tuning that emphasizes tokens according to their cognitive salience and attention order. Our approach demonstrates cross-language transfer by applying C++-derived cognitive patterns to enhance Java programming tasks. Comprehensive evaluation on CodeXGLUE benchmarks shows consistent improvements across different LLM architectures and scales (1B–8B parameters), achieving gains of up to 41.66 points on CrystalBLEU for code completion and 21.93 points on BERTScore for code summarization. Mechanistic analysis reveals that cognitive guidance reshapes model attention in task-dependent ways, increasing focus on semantically critical tokens by 2.5×. This work establishes the first scalable framework for integrating simulated human cognitive patterns into LLM training, enabling more interpretable and effective code understanding.

Open Source Software for Social Good (OSS4SG), a specialized segment within the Open Source Software (OSS) domain, is gaining increasing recognition for its focus on addressing societal challenges and delivering positive social impact. Learning about how contributors engage with OSS4SG is crucial to its sustainability, as the long-term success of these projects relies heavily on active and ongoing contributor participation. However, no study has yet examined the dynamics of contributors within OSS4SG. To fill this gap, we analyzed over 2.2 million commits made by 5,860 contributors to both OSS4SG and general OSS projects on GitHub, identifying contribution patterns and factors influencing sustained contribution to OSS4SG. We found that although OSS4SG contributors tend to show lower overall contribution intensity and shorter active lifespans, their activity during engaged periods is relatively more regular compared to contributions to general OSS. In addition, contributors from developing regions (e.g., Africa) or women are more likely to start with and continue contributing to OSS4SG, despite their overall contribution levels being lower than those of others. Based on these insights, we propose targeted strategies to increase contributions to OSS4SG projects to maximize their social impact to benefit society and harness their potential to foster broader participation in open source, ultimately enhancing the sustainability of the whole community.