Using LLMs for Adjudication of Static Analysis Alerts — Secure Software by Design

This slide deck introduces LASAA (LLMs for Adjudication of Static Analysis Alerts), an open source tool to automate the triage of static-analysis alerts. By passing analyzer alerts, source code, and context retrieved via tools like `ctags` to Large Language Models (LLMs), LASAA generates automated verdicts and detailed rationales for flagged code. The presentation outlines the tool's core architecture and its mistake-mitigation techniques, including multi-trial Consistency Checking (CC), LLM Reasoning Evaluation (LRE), and dynamic trigger testing that automatically synthesizes runtime test drivers to dynamically verify true positives.

In empirical evaluations across three benchmarks (Juliet, FormAI, and SVCOMP), LASAA achieves high accuracy when using reasoning LLMs. When employing LASAA's mistake-mitigation techniques, the evaluated mid-tier reasoning models (o4-mini, gpt-oss-120b, and gpt-oss-20b) correctly flagged at least 98.0% of real bugs while correctly dismissing at least 94.8% of false alarms.