Recent advancements in large language models (LLMs) have highlighted the
potential for vulnerability detection, a crucial component of software quality
assurance. Despite this progress, most studies have been limited to the
perspective of a single role, usually testers, lacking diverse viewpoints from
different roles in a typical software development life-cycle, including both
developers and testers. To this end, this paper introduces an approach to
employ LLMs to act as different roles to simulate real-life code review
process, engaging in discussions towards a consensus on the existence and
classification of vulnerabilities in the code. Preliminary evaluation of the
proposed approach indicates a 4.73% increase in the precision rate, 58.9%
increase in the recall rate, and a 28.1% increase in the F1 score.

大语言模型可用于模拟软件开发生命周期中不同角色的讨论，提高漏洞检测的准确性、召回率和 F1 得分。

多角色共识下的漏洞检测

Multi-role Consensus through LLMs Discussions for Vulnerability  Detection

Software defects consume 40% of the total budget in software development and
cost the global economy billions of dollars every year. Unfortunately, despite
the use of many software quality assurance (SQA) practices in software
development (e.g., code review, continuous integration), defects may still
exist in the official release of a software product. Therefore, prioritizing
SQA efforts for the vulnerable areas of the codebase is essential to ensure the
high quality of a software release. Predicting software defects at the line
level could help prioritize the SQA effort but is a highly challenging task
given that only ~3% of lines of a codebase could be defective. Existing works
on line-level defect prediction often fall short and cannot fully leverage the
line-level defect information. In this paper, we propose Bugsplorer, a novel
deep-learning technique for line-level defect prediction. It leverages a
hierarchical structure of transformer models to represent two types of code
elements: code tokens and code lines. Unlike the existing techniques that are
optimized for file-level defect prediction, Bugsplorer is optimized for a
line-level defect prediction objective. Our evaluation with five performance
metrics shows that Bugsplorer has a promising capability of predicting
defective lines with 26-72% better accuracy than that of the state-of-the-art
technique. It can rank the first 20% defective lines within the top 1-3%
suspicious lines. Thus, Bugsplorer has the potential to significantly reduce
SQA costs by ranking defective lines higher.

软件缺陷，软件质量保证，行级缺陷预测，Bugsplorer，SQA 成本

用分级变压器捕捉代码上下文预测行级缺陷

Predicting Line-Level Defects by Capturing Code Contexts with  Hierarchical Transformers

Software quality assurance activities become increasingly difficult as
software systems become more and more complex and continuously grow in size.
Moreover, testing becomes even more expensive when dealing with large-scale
systems. Thus, to effectively allocate quality assurance resources, researchers
have proposed fault prediction (FP) which utilizes machine learning (ML) to
predict fault-prone code areas. However, ML algorithms typically make use of
stochastic elements to increase the prediction models' generalizability and
efficiency of the training process. These stochastic elements, also known as
nondeterminism-introducing (NI) factors, lead to variance in the training
process and as a result, lead to variance in prediction accuracy and training
time. This variance poses a challenge for reproducibility in research. More
importantly, while fault prediction models may have shown good performance in
the lab (e.g., often-times involving multiple runs and averaging outcomes),
high variance of results can pose the risk that these models show low
performance when applied in practice. In this work, we experimentally analyze
the variance of a state-of-the-art fault prediction approach. Our experimental
results indicate that NI factors can indeed cause considerable variance in the
fault prediction models' accuracy. We observed a maximum variance of 10.10% in
terms of the per-class accuracy metric. We thus, also discuss how to deal with
such variance.

软件质量保证资源分配中的变异性分析及处理方法研究

机器学习软件故障预测的方差：我们真的在改进故障预测吗？

Variance of ML-based software fault predictors: are we really improving  fault prediction?

It is often overseen that AI-enabled systems are also software systems and
therefore rely on software quality assurance (SQA). Thus, the goal of this
study is to investigate the software quality assurance strategies adopted
during the development, integration, and maintenance of AI/ML components and
code. We conducted semi-structured interviews with representatives of ten
Austrian SMEs that develop AI-enabled systems. A qualitative analysis of the
interview data identified 12 issues in the development of AI/ML components.
Furthermore, we identified when quality issues arise in AI/ML components and
how they are detected. The results of this study should guide future work on
software quality assurance processes and techniques for AI/ML components.

研究调查了 10 家奥地利中小型企业在开发人工智能 / 机器学习组件和代码时采用的软件质量保证策略，发现质量问题在何时出现并如何检测，同时识别了 12 个开发 AI/ML 组件时存在的问题，为未来 AI/ML 组件的软件质量保证流程提供指导。