Searcharxiv⌕ Search

arXiv subjects

Penghui Li

Publications and source records attributed to Penghui Li.

At least 19 recordsLinked to original sources
arXiv2026

ARQ: Agentic CodeQL Query Refinement for C/C++ Vulnerability Detection

Static analyzers have been widely adopted for vulnerability detection in C/C++ programs. Query-based static analyzers (e.g., CodeQL) encode vulnerable code patterns in detection queries and match them against source code. However, existing queries still suffer from false positives (FPs, incorrectly flagging benign code as vulnerable) and false negatives (FNs, missing real vulnerabilities). We present ARQ, an agentic framework that automatically refines C/C++ CodeQL queries using execution-grounded evidence from synthesized C/C++ programs. Our key insight is that a synthesized program exposes a query's weakness whenever its execution disagrees with the query's verdict. If the program is genuinely vulnerable but the query stays silent, the query has an FN weakness; if the program is safe but the query fires anyway, it has an FP weakness. ARQ then runs an LLM-based refinement loop that repairs the query using these disagreements as ground truth. Unlike previous query refining methods, ARQ requires no labeled datasets, no commit history, and no vulnerability-specific templates. We demonstrate the effectiveness of ARQ by refining 12 official CodeQL queries using three commercial LLMs (GPT-5.4, Claude-Sonnet-4.6, and Gemini-3.5-flash). We compare both ARQ-refined and original CodeQL queries on the Juliet v1.3 and FormAI v2 datasets and show that ARQ-refined queries detect substantially more true positives, by up to 119.8\%, with a Precision of at least 98.0\% throughout. ARQ successfully fixed three unresolved GitHub issues raised in the official CodeQL query repository that had remained open for as long as \textit{27 months}. The refined queries also exposed two previously undiscovered bugs in the real-world libraries libpng and zlib.

cs.CR↗
arXiv2026

Symbolon: Symbolic Execution by Learning Code Transformation

Symbolic execution is a powerful program analysis technique with broad applications, such as vulnerability detection, security testing, and malware analysis. However, this technique is known to suffer from scalability issues, e.g., path explosion, complex constraints, due to certain structural and semantic patterns commonly presented in real-world programs. Existing approaches attempt to escape these patterns by transforming programs into new representations to reduce the execution cost. Unfortunately, these transformations are often too rigid to exploit diverse local program semantics and sometimes rely on compiler optimizations designed for concrete execution that may misalign with the goals of symbolic execution. We present Symbolon, a framework that automatically learns diverse code transformations and applies them context-sensitively to improve symbolic execution. Our key insight is to formulate transformation discovery as a search problem over program representations. To make the search practical, Symbolon learns transformations cheaply offline on small programs, distills them into a reusable library of agent skills, and uses an agent to instantiate these skills on repo-level targets. Our evaluation shows that Symbolon substantially improves the symbolic execution engine KLEE across 16 search strategies on 32 real-world programs, increasing line coverage by 3.69x on average while reducing peak memory and per-query solver time by 29.2x and 123x, respectively. When applied to the latest Linux kernel, Symbolon uncovers 21 previously unknown bugs, all of which have been reported to the kernel maintainers.

cs.CR↗
arXiv2026

Detecting Privilege Escalation in Polyglot Microservices via Agentic Program Analysis

Microservices are widely adopted in modern cloud systems due to their scalability and fault tolerance. However, microservice architectures introduce significant complexity in privilege and permission control, creating risks of privilege escalation where attackers can gain unauthorized access to resources or operations. Detecting such vulnerabilities is challenging due to complex cross-service interactions, polyglot codebases, and diverse privileged operations and permission checks. We present Neo, an agentic program analysis framework that combines large language models (LLMs) with classic program analysis to address these challenges. Neo leverages an LLM-based agent that dynamically generates analysis plans, adapts code search strategies, and validates semantics. We develop code search primitives that enable Neo to perform scalable and flexible code exploration across services and languages. We evaluated Neo on 25 open-source microservice applications spanning 7 programming languages and 6.2 million lines of code. Neo uncovered 24 zero-day privilege escalation vulnerabilities and achieved 81.0% precision and 85.0% recall on a ground-truth dataset. Compared to existing program analysis and agentic solutions, Neo demonstrated significant improvements in both detection accuracy and scalability. We further showcased Neo's extensibility by applying it to other application domains and vulnerability types, uncovering 18 additional zero-day vulnerabilities.

cs.CR↗
arXiv2025

Reasoning under Vision: Understanding Visual-Spatial Cognition in Vision-Language Models for CAPTCHA

CAPTCHA, originally designed to distinguish humans from robots, has evolved into a real-world benchmark for assessing the spatial reasoning capabilities of vision-language models. In this work, we first show that step-by-step reasoning is crucial for vision-language models (VLMs) to solve CAPTCHAs, which represent high-difficulty spatial reasoning tasks, and that current commercial vision-language models still struggle with such reasoning. In particular, we observe that most commercial VLMs (e.g., Gemini, Claude, GPT, etc.) fail to effectively solve CAPTCHAs and thus achieve low accuracy (around 21.9 percent). However, our findings indicate that requiring the model to perform step-by-step reasoning before generating the final coordinates can significantly enhance its solving accuracy, underscoring the severity of the gap. To systematically study this issue, we introduce CAPTCHA-X, the first real-world CAPTCHA benchmark with reasoning, covering seven categories of CAPTCHAs (such as Gobang, hCaptcha, etc.) with step-by-step action solutions and grounding annotations. We further define five reasoning-oriented metrics that enable a comprehensive evaluation of models reasoning capabilities. To validate the effectiveness of reasoning, we also propose a general agentic VLM-based framework that incorporates the models inherent reasoning abilities. Our method achieves state-of-the-art performance across five high-difficulty CAPTCHA types, with an average solving accuracy of 83.9 percent, substantially surpassing existing baselines. These results reveal the limitations of current models and highlight the importance of reasoning in advancing visual-spatial challenges in the future.

cs.CV↗
arXiv2025

PickleBall: Secure Deserialization of Pickle-based Machine Learning Models (Extended Report)

Machine learning model repositories such as the Hugging Face Model Hub facilitate model exchanges. However, bad actors can deliver malware through compromised models. Existing defenses such as safer model formats, restrictive (but inflexible) loading policies, and model scanners have shortcomings: 44.9% of popular models on Hugging Face still use the insecure pickle format, 15% of these cannot be loaded by restrictive loading policies, and model scanners have both false positives and false negatives. Pickle remains the de facto standard for model exchange, and the ML community lacks a tool that offers transparent safe loading. We present PickleBall to help machine learning engineers load pickle-based models safely. PickleBall statically analyzes the source code of a given machine learning library and computes a custom policy that specifies a safe load-time behavior for benign models. PickleBall then dynamically enforces the policy during load time as a drop-in replacement for the pickle module. PickleBall generates policies that correctly load 79.8% of benign pickle-based models in our dataset, while rejecting all (100%) malicious examples in our dataset. In comparison, evaluated model scanners fail to identify known malicious models, and the state-of-art loader loads 22% fewer benign models than PickleBall. PickleBall removes the threat of arbitrary function invocation from malicious pickle-based models, raising the bar for attackers to depend on code reuse techniques.

cs.CR↗
arXiv2025

Explainer-guided Targeted Adversarial Attacks against Binary Code Similarity Detection Models

Binary code similarity detection (BCSD) serves as a fundamental technique for various software engineering tasks, e.g., vulnerability detection and classification. Attacks against such models have therefore drawn extensive attention, aiming at misleading the models to generate erroneous predictions. Prior works have explored various approaches to generating semantic-preserving variants, i.e., adversarial samples, to evaluate the robustness of the models against adversarial attacks. However, they have mainly relied on heuristic criteria or iterative greedy algorithms to locate salient code influencing the model output, failing to operate on a solid theoretical basis. Moreover, when processing programs with high complexities, such attacks tend to be time-consuming. In this work, we propose a novel optimization for adversarial attacks against BCSD models. In particular, we aim to improve the attacks in a challenging scenario, where the attack goal is to limit the model predictions to a specific range, i.e., the targeted attacks. Our attack leverages the superior capability of black-box, model-agnostic explainers in interpreting the model decision boundaries, thereby pinpointing the critical code snippet to apply semantic-preserving perturbations. The evaluation results demonstrate that compared with the state-of-the-art attacks, the proposed attacks achieve higher attack success rate in almost all scenarios, while also improving the efficiency and transferability. Our real-world case studies on vulnerability detection and classification further demonstrate the security implications of our attacks, highlighting the urgent need to further enhance the robustness of existing BCSD models.

cs.CR↗
arXiv2025

Neuro-symbolic Static Analysis with LLM-generated Vulnerability Patterns

In this work, we present MoCQ, a neuro-symbolic static analysis framework that leverages large language models (LLMs) to automatically generate vulnerability detection patterns. This approach combines the precision and scalability of pattern-based static analysis with the semantic understanding and automation capabilities of LLMs. MoCQ extracts the domain-specific languages for expressing vulnerability patterns and employs an iterative refinement loop with trace-driven symbolic validation that provides precise feedback for pattern correction. We evaluated MoCQ on 12 vulnerability types across four languages (C/C++, Java, PHP, JavaScript). MoCQ achieves detection performance comparable to expert-developed patterns while requiring only hours of generation versus weeks of manual effort. Notably, MoCQ uncovered 46 new vulnerability patterns that security experts had missed and discovered 25 previously unknown vulnerabilities in real-world applications. MoCQ also outperforms prior approaches with stronger analysis capabilities and broader applicability.

cs.CR↗
arXiv2025

Relative Serre duality for Hecke categories

We prove a conjecture of Gorsky, Hogancamp, Mellit, and Nakagane in the Weyl group case. Namely, we show that the left and right adjoints of the parabolic induction functor between the associated Hecke categories of Soergel bimodules differ by the relative full twist. This exhibits a relative Serre duality pattern for the Hecke categories.

math.RT↗
arXiv2023

Safe, Efficient, Comfort, and Energy-saving Automated Driving through Roundabout Based on Deep Reinforcement Learning

Traffic scenarios in roundabouts pose substantial complexity for automated driving. Manually mapping all possible scenarios into a state space is labor-intensive and challenging. Deep reinforcement learning (DRL) with its ability to learn from interacting with the environment emerges as a promising solution for training such automated driving models. This study explores, employs, and implements various DRL algorithms, namely Deep Deterministic Policy Gradient (DDPG), Proximal Policy Optimization (PPO), and Trust Region Policy Optimization (TRPO) to instruct automated vehicles' driving through roundabouts. The driving state space, action space, and reward function are designed. The reward function considers safety, efficiency, comfort, and energy consumption to align with real-world requirements. All three tested DRL algorithms succeed in enabling automated vehicles to drive through the roundabout. To holistically evaluate the performance of these algorithms, this study establishes an evaluation methodology considering multiple indicators such as safety, efficiency, and comfort level. A method employing the Analytic Hierarchy Process is also developed to weigh these evaluation indicators. Experimental results on various testing scenarios reveal that the TRPO algorithm outperforms DDPG and PPO in terms of safety and efficiency, and PPO performs best in terms of comfort level. Lastly, to verify the model's adaptability and robustness regarding other driving scenarios, this study also deploys the model trained by TRPO to a range of different testing scenarios, e.g., highway driving and merging. Experimental results demonstrate that the TRPO model trained on only roundabout driving scenarios exhibits a certain degree of proficiency in highway driving and merging scenarios. This study provides a foundation for the application of automated driving with DRL in real traffic environments.

cs.RO↗
arXiv2023

Graded character sheaves, HOMFLY-PT homology, and Hilbert schemes of points on $\mathbb{C}^2$

Using a geometric argument building on our new theory of graded sheaves, we compute the categorical trace and Drinfel'd center of the (graded) finite Hecke category $\mathsf{H}_W^\mathsf{gr} = \mathsf{Ch}^b(\mathsf{SBim}_W)$ in terms of the category of (graded) unipotent character sheaves, upgrading results of Ben-Zvi-Nadler and Bezrukavninov-Finkelberg-Ostrik. In type $A$, we relate the categorical trace to the category of $2$-periodic coherent sheaves on the Hilbert schemes $\mathsf{Hilb}_n(\mathbb{C}^2)$ of points on $\mathbb{C}^2$ (equivariant with respect to the natural $\mathbb{C}^* \times \mathbb{C}^*$ action), yielding a proof of (a $2$-periodized version of) a conjecture of Gorsky-Negut-Rasmussen which relates HOMFLY-PT link homology and the spaces of global sections of certain coherent sheaves on $\mathsf{Hilb}_n(\mathbb{C}^2)$. As an important computational input, we also establish a conjecture of Gorsky-Hogancamp-Wedrich on the formality of the Hochschild homology of $\mathsf{H}_W^\mathsf{gr}$.

math.RT↗
arXiv2023

Functions on the commuting stack via Langlands duality

We calculate the dg algebra of global functions on commuting stacks of complex reductive groups using tools from Betti Geometric Langlands. In particular, we prove that the ring of invariant functions on the commuting scheme is reduced. Our main technical results include: a semi-orthogonal decomposition of the cocenter of the affine Hecke category; and the calculation of endomorphisms of a Whittaker sheaf in a diagram organizing parabolic induction of character sheaves.

math.RT↗
arXiv2022

Depositing boron on Cu(111): Borophene or boride?

Large-area single-crystal surface structures were successfully prepared on Cu(111) substrate with boron deposition, which is critical for prospective applications. However, the proposed borophene structures do not match the scanning tunneling microscopy (STM) results very well, while the proposed copper boride is at odds with the traditional knowledge that ordered copper-rich borides normally do not exist due to small difference in electronegativity and large difference in atomic size. To clarify the controversy and elucidate the formation mechanism of the unexpected copper boride, we conducted systematic STM, X-ray photoelectron spectroscopy and angle-resolved photoemission spectroscopy investigations, confirming the synthesis of two-dimensional copper boride rather than borophene on Cu(111) after boron deposition under ultrahigh vacuum. First-principles calculations with defective surface models further indicate that boron atoms tend to react with Cu atoms near terrace edges or defects, which in turn shapes the intermediate structures of copper boride and leads to the formation of stable Cu-B monolayer via large-scale surface reconstruction eventually.

cond-mat.mtrl-sci↗
arXiv2022

Eisenstein series via factorization homology of Hecke categories

Motivated by spectral gluing patterns in the Betti Langlands program, we show that for any reductive group $G$, a parabolic subgroup $P$, and a topological surface $M$, the (enhanced) spectral Eisenstein series category of $M$ is the factorization homology over $M$ of the $\mathrm{E}_2$-Hecke category $\mathrm{H}_{G, P} = \mathrm{IndCoh}(\mathrm{LS}_{G, P}(D^2, S^1))$, where $\mathrm{LS}_{G, P}(D^2, S^1)$ denotes the moduli stack of $G$-local systems on a disk together with a $P$-reduction on the boundary circle. More generally, for any pair of stacks $\mathcal{Y}\to \mathcal{Z}$ satisfying some mild conditions and any map between topological spaces $N\to M$, we define $(\mathcal{Y}, \mathcal{Z})^{N, M} = \mathcal{Y}^N \times_{\mathcal{Z}^N} \mathcal{Z}^M$ to be the space of maps from $M$ to $\mathcal{Z}$ along with a lift to $\mathcal{Y}$ of its restriction to $N$. Using the pair of pants construction, we define an $\mathrm{E}_n$-category $\mathrm{H}_n(\mathcal{Y}, \mathcal{Z}) = \mathrm{IndCoh}_0\left(\left((\mathcal{Y}, \mathcal{Z})^{S^{n-1}, D^n}\right)^\wedge_{\mathcal{Y}}\right)$ and compute its factorization homology on any $d$-dimensional manifold $M$ with $d\leq n$, \[ \int_M \mathrm{H}_n(\mathcal{Y}, \mathcal{Z}) \simeq \mathrm{IndCoh}_0\left(\left((\mathcal{Y}, \mathcal{Z})^{\partial (M\times D^{n-d}), M}\right)^\wedge_{\mathcal{Y}^M}\right), \] where $\mathrm{IndCoh}_0$ is the sheaf theory introduced by Arinkin--Gaitsgory and Beraldo. Our result naturally extends previous known computations of Ben-Zvi--Francis--Nadler and Beraldo.

math.RT↗
arXiv2022

Revisiting mixed geometry

We provide a uniform construction of "mixed versions" or "graded lifts" in the sense of Beilinson-Ginzburg-Soergel which works for arbitrary Artin stacks. In particular, we obtain a general construction of graded lifts of many categories arising in geometric representation theory and categorified knot invariants. Our new theory associates to each Artin stack of finite type $\mathcal{Y}$ over $\overline{\mathbb{F}}_q$ a symmetric monoidal DG-category $\mathsf{Shv}_{\mathsf{gr}, c}(\mathcal{Y})$ of constructible graded sheaves on $\mathcal{Y}$ along with the six-functor formalism, a perverse $t$-structure, and a weight (or co-$t$-)structure in the sense of Bondarko and Pauksztello, compatible with the six-functor formalism, perverse $t$-structures, and Frobenius weights on the category of (mixed) $\ell$-adic sheaves. Classically, mixed versions were only constructed in very special cases due to the non-semisimplicity of Frobenius. Our construction sidesteps this issue by semi-simplifying the Frobenius action itself. However, the category $\mathsf{Shv}_{\mathsf{gr}, c}(\mathcal{Y})$ agrees with those previously constructed when they are available. For example, for any reductive group $G$ with a fixed pair $T\subset B$ of a maximal torus and a Borel subgroup, we have an equivalence of monoidal DG weight categories $\mathsf{Shv}_{\mathsf{gr}, c}(B\backslash G/B) \simeq \mathsf{Ch}^b(\mathsf{SBim}_W)$, where $\mathsf{Ch}^b(\mathsf{SBim}_W)$ is the monoidal $\mathsf{DG}$-category of bounded chain complexes of Soergel bimodules and $W$ is the Weyl group of $G$.

math.AG↗
arXiv2021

Driver-Specific Risk Recognition in Interactive Driving Scenarios using Graph Representation

This paper presents a driver-specific risk recognition framework for autonomous vehicles that can extract inter-vehicle interactions. This extraction is carried out for urban driving scenarios in a driver-cognitive manner to improve the recognition accuracy of risky scenes. First, clustering analysis is applied to the operation data of drivers for learning the subjective assessment of risky scenes of different drivers and generating the corresponding risk label for each scene. Second, the graph representation model (GRM) is adopted to unify and construct the features of dynamic vehicles, inter-vehicle interactions and static traffic markings in real driving scenes into graphs. The driver-specific risk label provides ground truth to capture the risk evaluation criteria of different drivers. In addition, the graph model represents multiple features of the driving scenes. Therefore, the proposed framework can learn the risk-evaluating pattern of driving scenes of different drivers and establish driver-specific risk identifiers. Last, the performance of the proposed framework is evaluated via experiments conducted using real-world urban driving datasets collected by multiple drivers. The results show that the risks and their levels in real driving environments can be accurately recognized by the proposed framework.

cs.RO↗
arXiv2020

Uniformization of semistable bundles on elliptic curves

Let $G$ be a connected reductive complex algebraic group, and $E$ a complex elliptic curve. Let $G_E$ denote the connected component of the trivial bundle in the stack of semistable $G$-bundles on $E$. We introduce a complex analytic uniformization of $G_E$ by adjoint quotients of reductive subgroups of the loop group of $G$. This can be viewed as a nonabelian version of the classical complex analytic uniformization $ E \simeq \mathbb{C}^*/q^{\mathbb{Z}}$. We similarly construct a complex analytic uniformization of $G$ itself via the exponential map, providing a nonabelian version of the standard isomorphism $\mathbb{C}^* \simeq \mathbb{C}/\mathbb{Z}$, and a complex analytic uniformization of $G_E$ generalizing the standard presentation $E = \mathbb{C}/(\mathbb{Z} \oplus \mathbb{Z} τ)$. Finally, we apply these results to the study of sheaves with nilpotent singular support. As an application to Betti geometric Langlands conjecture in genus 1, we define a functor from $Sh_\mathcal{N}(G_E)$ (the semistable part of the automorphic category) to ${IndCoh}_{\check{\mathcal{N}}}({Locsys}_{\check G} (E))$ (the spectral category).

math.RT↗
arXiv2020

The Jordan--Chevalley decomposition for $G$-bundles on elliptic curves

We study the moduli stack of degree $0$ semistable $G$-bundles on an irreducible curve $E$ of arithmetic genus $1$, where $G$ is a connected reductive group. Our main result describes a partition of this stack indexed by a certain family of connected reductive subgroups $H$ of $G$ (the $E$-pseudo-Levi subgroups), where each stratum is computed in terms of $H$-bundles together with the action of the relative Weyl group. We show that this result is equivalent to a Jordan--Chevalley theorem for such bundles equipped with a framing at a fixed basepoint. In the case where $E$ has a single cusp (respectively, node), this gives a new proof of the Jordan--Chevalley theorem for the Lie algebra $\mathfrak{g}$ (respectively, group $G$). We also provide a Tannakian description of these moduli stacks and use it to show that if $E$ is an ordinary elliptic curve, the collection of framed unipotent bundles on $E$ is equivariantly isomorphic to the unipotent cone in $G$. Finally, we classify the $E$-pseudo-Levi subgroups using the Borel--de Siebenthal algorithm and compute some explicit examples.

math.AG↗