Collaborative research: SHF: documentation-guided adaptable static analysis

The National Science Foundation Division of Information and Intelligent Systems awarded $300,000 to The Regents Of The University Of California (UC Riverside) on October 1, 2026, under the Computer and Information Science and Engineering program (CFDA 47.070) for research into documentation-guided static analysis of software.

The project develops approaches to automatically translate framework documentation into formal specifications and use those specifications to verify whether application code complies with framework guidelines. The work combines targeted retrieval and controlled generation to extract formal rules from multimodal documentation, then applies those rules to detect safety violations, reason about obligation discharge, and analyze object-sensitive protocol conformance in application code. The project aims to improve software reliability, security, and performance by catching framework-rule violations early and creating tools that adapt as frameworks evolve.

Work is performed in Riverside, California, with a period of performance from October 1, 2026, through September 30, 2029.

Abstract

Modern software applications are built using frameworks that come with extensive, evolving documentation describing the rules that keep software secure and reliable. However, these rules are scattered across textual descriptions, diagrams, and code examples, making IT difficult to determine whether a program complies with them. As a result, rule violations often go undetected until they cause crashes, security vulnerabilities, or performance problems. This project develops approaches that understand the documentation, verify whether software complies with framework guidelines, and help to fix violations. The project's novelties are the automatic translation of informal framework documentation into formal rules and the use of those rules to analyze application code. The project's broader significance includes the potential to improve the reliability, security, and performance of software systems by catching errors early and creating adaptable tools that keep pace as frameworks evolve. The project achieves these goals by developing a methodology that turns scattered framework documentation into formal rules, checks application code against those rules, and explains any violations IT finds. First, the project induces formal specifications from multimodal framework documentation, using targeted retrieval and controlled generation to build a model of how a framework behaves and what obligations each program must meet. Second, the project interprets these specifications over application code by combining the framework model with a reachability analysis that reasons selectively about object- and event-dependent behavior and scales without enumerating every execution path. This approach supports several classes of analysis, including witness-based checking, safety violation detection, obligation discharge reasoning, and object-sensitive, demand-driven protocol conformance analysis. Third, the project produces explanations that trace each violation back to the rule and localize the violation to code, enabling targeted guidance for automated repair tools under limited compute budgets. These advancements will improve software debugging and testing workflows and increase the overall safety of digital systems, while training students in program analysis and artificial intelligence. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are not planned for this award.