# LLM-Driven Adaptive Source-Sink Identification and False Positive Mitigation for Static Analysis

arXiv: https://arxiv.org/abs/2511.04023 · HTML: https://mlsanity.com/paper/2511.04023/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Nov 2025.

## Built on by (most cited first, 8 of 8)

- [Adaptive Detector-Verifier Framework for Zero-Shot Polyp Detection in Open-World Settings](https://mlsanity.com/paper/2512.12492/) (2025)
- [Adaptive Multi-Stage Patent Claim Generation with Unified Quality Assessment](https://mlsanity.com/paper/2601.09120/) (2026)
- [VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers](https://mlsanity.com/paper/2605.21392/) (2026)
- [EVLA: An Electro-Aware Multimodal Assistant for Physically-Grounded Driving Reasoning and Control](https://mlsanity.com/paper/2606.28938/) (2026)
- [A3M: Adaptive, Adversarial and Multi-Objective Learning for Strategic Bidding in Repeated Auctions](https://mlsanity.com/paper/2606.28943/) (2026)
- [Beyond Skepticism: Evaluating LLMs Pedagogical Intent Reasoning with the Adaptive Pedagogical Vigilance Framework](https://mlsanity.com/paper/2607.01581/) (2026)
- [FedCausal-Dyn: A Causal-Dynamic Paradigm for Federated Learning under Dynamic Feature Drift](https://mlsanity.com/paper/2607.09695/) (2026)
- [Graph-Based Modeling of Financial Volatility Dynamics](https://mlsanity.com/paper/2608.26127/) (2026)

## Abstract (arXiv)

Static analysis is effective for discovering software vulnerabilities but notoriously suffers from incomplete source--sink specifications and excessive false positives (FPs). We present textscAdaTaint, an LLM-driven taint analysis framework that adaptively infers source/sink specifications and filters spurious alerts through neuro-symbolic reasoning. Unlike LLM-only detectors, textscAdaTaint grounds model suggestions in program facts and constraint validation, ensuring both adaptability and determinism. We evaluate textscAdaTaint on Juliet 1.3, SV-COMP-style C benchmarks, and three large real-world projects. Results show that textscAdaTaint reduces false positives by 43.7% on average and improves recall by 11.2% compared to state-of-the-art baselines (CodeQL, Joern, and LLM-only pipelines), while maintaining competitive runtime overhead. These findings demonstrate that combining LLM inference with symbolic validation offers a practical path toward more accurate and reliable static vulnerability analysis.