Kevin Leach

GitHub is one of the largest open-source software (OSS) communities for development and collaboration. Impersonation maliciously assuming another user's identity to access code, sway projects, or spread misinformation—has driven recent real-world attacks and is an escalating concern. We present the first exploration of impersonation's impact on GitHub. Through structured interviews with 17 OSS contributors, we study perceptions and mitigations: users generally lack awareness and underestimate the risk; after a live demo, concern rises sharply. Current best practices (e.g., commit signing) need usability improvements to encourage adoption. We also assemble a dataset of 12.5 million commits to examine the current status of impersonation and the feasibility of repository-specific commit authorship attribution as a practical mitigation signal. Leveraging modern pretrained code models and verified commits as cryptographic ground truth, we evaluate whether repository-tuned predictors can infer likely authors and surface anomalous author commit pairs for human review. Models that leverage comprehensive commit information achieve high accuracy (e.g., over 96% with CodeT5+). Our metadata-only CrossCheck analysis shows that apparent author-history discrepancies are dominated by legitimate workflow confounders, so deterministic impersonation detection is unreliable without additional ground truth. We therefore evaluate repository-specific authorship attribution as a probabilistic triage signal, including robustness under a targeted style-imitation attack and open-set deployment considerations where the true author may be absent from the known contributor set. The results show that our approach improves stability over code-only attribution, strengthening its value as a practical triage signal under attacker adaptivity. While deterministic impersonation detection remains impossible, these probabilistic signals can help prioritize review and complement existing controls (e.g., commit signing and vigilant-mode alerts).

AI tools in Software Engineering (SE) rely internally on high dimensional vector embeddings to perform tasks like code generation and debugging. To better coordinate AI tools with developers' goals, we propose to align their embeddings with those translated from human brain activity. This position paper proposes a simple approach for bridging these modalities by training ridge regression models to translate between brain activity, measured as Blood Oxygen Level Dependent (BOLD) signal during software tasks, and pretrained model embeddings. We discuss how such translation models could support cognitively informed AI tools at different hierarchies, from high-level functionality to low-level implementation details. Finally, we highlight open challenges and potential solutions for both translating from brain activity to vector embeddings, and incorporating this information during model training or fine-tuning.

Code comprehension is a fundamental challenge in software engineering that impacts developer productivity and software quality. While Large Language Models (LLMs) demonstrate strong capabilities in code generation and summarization, they process code differently from human developers, who employ strategic attention patterns focused on semantically critical elements. Recent research has successfully integrated human attention patterns captured through eye-tracking into AI models for software engineering tasks, however, existing human-AI approaches face critical limitations that prevent widespread practical deployment, particularly for LLM enhancement. Existing approaches to incorporate human cognitive insights face scalability limitations due to resource-intensive eye-tracking studies and lack empirical validation for cross-language generalizability. We present ScanCoder, a framework that integrates cognitive simulation with LLM enhancement through (1) generating human-like attention patterns at scale using minimal eye-tracking data via cognitive simulation with Adaptive Character of Thought-Rational (ACT-R) architecture, and (2) cognitively-guided fine-tuning that emphasizes tokens according to their cognitive salience and attention order. Our approach demonstrates cross-language transfer by applying C++-derived cognitive patterns to enhance Java programming tasks. Comprehensive evaluation on CodeXGLUE benchmarks shows consistent improvements across different LLM architectures and scales (1B–8B parameters), achieving gains of up to 41.66 points on CrystalBLEU for code completion and 21.93 points on BERTScore for code summarization. Mechanistic analysis reveals that cognitive guidance reshapes model attention in task-dependent ways, increasing focus on semantically critical tokens by 2.5×. This work establishes the first scalable framework for integrating simulated human cognitive patterns into LLM training, enabling more interpretable and effective code understanding.

To meet the ever-increasing demands of the cybersecurity workforce, AI tutors have been proposed for personalized, scalable education. But, while AI tutors have shown promise in introductory programming courses, no work has evaluated their use in hands-on exploration and exploitation of systems (e.g., ``capture-the-flag'') commonly used to teach cybersecurity. Thus, despite growing interest and need, no work has evaluated how students use AI tutors or whether they benefit from their presence in real, large-scale cybersecurity courses. To answer this, we conducted a semester-long observational study on the use of an embedded AI tutor with 309 students in an upper-division introductory cybersecurity course. By analyzing 142,526 student queries sent to the AI tutor across 396 cybersecurity challenges spanning 9 core cybersecurity topics and an accompanying set of post-semester surveys, we find (1) what queries and conversational strategies students use with AI tutors, (2) how these strategies correlate with challenge completion, and (3) students' perceptions of AI tutors in cybersecurity education. In particular, we identify three broad AI tutor conversational styles among users: Short (bounded, few-turn exchanges), Reactive (repeatedly submitting code and errors), and Proactive (driving problem-solving through targeted inquiry). We also find that the use of these styles significantly predicts challenge completion, and that this effect increases as materials become more advanced. Furthermore, students valued the tutor's availability but reported that it became less useful for harder material. Based on this, we provide suggestions for security educators and developers on practical AI tutor use.