After the Hitchhiker’s Guide: Toward Principled LLM Assistance for Static Analysis

Abstract

Practical static analysis of large systems such as the Linux kernel often depends on information that is difficult to capture precisely and on identifying the parts of a large codebase where precise reasoning is needed. This dissertation studies how LLMs can complement static analysis through two roles: specification recovery and analysis localization. The first part shows that LLMs can refine static-analysis warnings when guided by program-analysis principles; in LLift (OOPSLA’24) and BugLens (ASE’25), these workflows reduce false positives and uncover genuine Linux kernel bugs. Building on these results, the next part moves more of the program reasoning back into the analyzer, while using LLMs to recover specifications and localize analysis targets. Their outputs then become explicit premises for analysis rather than final bug judgments. The remaining work studies how these premises can be validated or qualified before they affect analysis results.