一句话：通过精心设计的函数行为与函数摘要提问，用 LLM 有效剔除静态分析工具产生的误报。
静态分析工具在缺陷检测中常产生大量误报，人工排查成本高昂。本文探讨大语言模型能在何处、以何种方式辅助静态分析，并针对一个具体的缺陷查找工具，围绕函数级行为或函数摘要构造提问，让 GPT 模型判断被报告的告警是否真实成立。作者先以 20 个误报做试点研究：基于 GPT-3.5 可成功剔除其中 8 个，而 GPT-4 近乎完美，剔除了 16 个，剩余 4 个失败案例涉及并发等当前提问方式未覆盖或不予支持的情形。此外，实验还识别出 1 个漏报（被静态分析遗漏的缺陷）。结果表明，LLM 是有前景的工具，可支撑更有效、更高效的程序分析流程。
Recent advances of Large Language Models (LLMs), e.g., ChatGPT, exhibited strong capabilities of comprehending and responding to questions across a variety of domains. Surprisingly, ChatGPT even possesses a strong understanding of program code. In this paper, we investigate where and how LLMs can assist static analysis by asking appropriate questions. In particular, we target a specific bug-finding tool, which produces many false positives from the static analysis. In our evaluation, we find that these false positives can be effectively pruned by asking carefully constructed questions about function-level behaviors or function summaries. Specifically, with a pilot study of 20 false positives, we can successfully prune 8 out of 20 based on GPT-3.5, whereas GPT-4 had a near-perfect result of 16 out of 20, where the four failed ones are not currently considered/supported by our questions, e.g., involving concurrency. Additionally, it also identified one false negative case (a missed bug). We find LLMs a promising tool that can enable a more effective and efficient program analysis.