Research

Papers, and the threads behind them

Agentic systems that pair LLMs with static-analysis tooling for vulnerability detection, exploitation, triage, and remediation — and the evaluation harnesses that decide whether any of it worked. At SFU under Dr. Mohammad Tayebi, currently visiting the University of Edinburgh on a Mitacs Globalink Research Award.

Papers

Publications

1 first-author

2026 Preprint

ZeroFalse: Improving Precision in Static Analysis with LLMs

Mohsen Iranmanesh , Sina Moradi Sabet , Sina Marefat , Ali Javidi Ghasr , Allison Wilson , Iman Sharafaldin , Mohammad A. Tayebi

First-author work, written during my M.Sc. Available as an arXiv preprint.

Abstract Close

A multi-stage LLM pipeline that takes raw static-analyzer alerts and triages them through contextual reasoning and structured evidence validation, reducing false positives without sacrificing recall. Evaluated 10 frontier LLMs across 6 model families (Gemini, GPT, Grok, Mistral, DeepSeek, Qwen) on the OWASP Java Benchmark (1,974 cases / 10 CWE categories) and CWE-bench — a real-world dataset of 755 CodeQL alerts across 56 project–CVE pairs from 37 open-source Java repositories. CWE-specialized prompting improved F1 by up to +0.26 on real-world code; best F1 is 0.912 on OWASP and 0.837 on CWE-bench.

arXiv →

Threads

What’s running now

4 lines

Null result

University of Edinburgh · Mitacs Globalink

Does seeing a working exploit help an agent write a better patch?

The field’s working assumption is yes. I tested it as a controlled ablation — same agent, same model, same prompt wording, with the exploit evidence withheld from one arm so that evidence was the only variable.

The honest answer was no measurable difference: +3.0 points on a 0–100 scale across 12 matched CVE pairs, win/loss/tie 6–5–1, sign test p ≈ 1.0 — a delta smaller than the scoring harness’s own measured noise floor — at roughly 3× the cost per run.

The contribution is the mechanism behind it. A single proof-of-vulnerability is a narrowing signal, so an evaluation gate defined on that one demonstrated path rewards patches that close it rather than the bug class behind it. That diagnosis defines the next experiment.

one matched CVE pair tie noise floor, measured before the comparison

In progress

SFU · AutoSec Lab

Fully agentic vulnerability remediation, end to end

A static-analyzer agent surfaces candidates, a triage agent validates them against code context, a patch agent proposes fixes, and a verification agent runs the patched code through the test suite and re-analyses for regressions. Agents hand off through machine-checkable artifacts rather than prose.

The bet under test: multi-stage prioritization improves precision and remediation coverage together, rather than trading one against the other.

Measured

SFU · AutoSec Lab

A corpus of CVEs that provably reproduce

A LangGraph pipeline that reproduces and patches documented CVEs end to end, with dockerized vulnerable and patched builds for each one. 89 verified completions so far, 61 Python and 28 Java.

The validation loop is the part that matters: the exploit has to succeed on the vulnerable image and fail on the patched one, and the verdict gets re-read from the filesystem in a fresh context so the model cannot simply agree with itself.

Shipped

SFU · CMPT 785, first author

Threat models derived from source, not from a whiteboard

A six-phase static-analysis-grounded multi-agent pipeline that derives system architecture and STRIDE threats directly from a codebase, with no hand-authored data-flow diagram as input. Output conforms to the OWASP Threat Model Library schema.

Ships as a VS Code extension, evaluated with an LLM-as-judge harness doing semantic threat matching against human-authored ground truth.