{"id":"7ab759a211db46fa9d6e6517e0273d8c93d1f50d25cb6dc88e31fa4e5b86dd4a","title":"arXiv cs.AI: A Hybrid Approach for Automated Security Pattern Recovery","argument":"Anh Minh Nguyen, Tuan Dat Tran, Alzubair Hassan and Liliana Pasquale present SecPatRec, a system for finding security patterns in source code. Security patterns describe reusable architectural solutions to recurring security problems, but their implementations can span multiple components and take many valid forms. SecPatRec treats a pattern as a reference architecture and looks for its prescribed roles, the code entities that fill those roles, and the interactions among them. A ReAct-style LLM agent uses semantic and lexical code search to detect and ground roles; static code property graph analysis recovers interactions. The authors evaluate the system on a human-validated dataset of 100 pattern instances covering five security patterns in 93 open-source Java and Python repositories. Across four LLMs, average role-detection accuracy and role-grounding similarity are each 0.84, while the interaction-recovery score is 0.66. Compared with a one-shot end-to-end LLM baseline, SecPatRec has higher aggregate recovery scores and lower estimated LLM API costs per run, and processes repositories beyond the baseline’s configured input limit. The authors say its recovered role mappings and interaction sequences can support inspection of security-pattern implementations.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported evaluation covers 100 pattern instances, five security patterns, and 93 open-source Java and Python repositories; the abstract does not establish how results generalize beyond that scope. The reported scores measure recovery against the study's ground truth; they do not by themselves establish the reliability of security-pattern implementations in deployed software. The abstract gives aggregate results across four LLMs but does not provide per-model results or further detail about the baseline configuration.","speaker":{"name":"Nguyen, Anh Minh, Tran, Tuan Dat, Hassan, Alzubair, Pasquale, Liliana","roleAtSource":"Article author"},"source":{"title":"A Hybrid Approach for Automated Security Pattern Recovery","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.05823","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors introduce SecPatRec, which combines an LLM agent for role detection and grounding with static analysis for recovering interactions.","excerpt":"SecPatRec pairs a ReAct-style LLM agent equipped with semantic and lexical code search for role detection and grounding with static code property graph analysis for interaction recovery.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"The evaluation uses a human-validated dataset of 100 pattern instances across five security patterns and 93 open-source Java and Python repositories.","excerpt":"a human-validated ground-truth dataset of 100 pattern instances covering five security patterns across 93 open-source Java and Python repositories","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"Across the evaluated models and pattern instances, average role-detection accuracy and role-grounding similarity were 0.84; the interaction-recovery score was 0.66.","excerpt":"Averaged over all models and pattern instances, SecPatRec achieves role-detection accuracy of 0.84, role-grounding similarity of 0.84, and an interaction-recovery score of 0.66.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"Compared with a one-shot end-to-end LLM baseline, SecPatRec had higher aggregate recovery scores and lower estimated API costs per run, and processed repositories exceeding the baseline's configured input limit.","excerpt":"Compared to a one-shot end-to-end LLM baseline, SecPatRec achieves higher aggregate recovery scores and lower estimated LLM API costs per run, while processing repositories that exceed the baseline's configured input limit.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"The authors say the recovered mappings and sequences can provide evidence to support inspection of security-pattern implementations.","excerpt":"The recovered role mappings and statically derived interaction sequences provide structural and behavioural evidence that can support inspection of security-pattern implementations.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05823","checkedAt":"2026-11-09T07:48:06.830Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well does SecPatRec recover security patterns beyond the five patterns and 93 Java and Python repositories in the evaluation?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: A Hybrid Approach for Automated Security Pattern Recovery","summary":"Anh Minh Nguyen, Tuan Dat Tran, Alzubair Hassan and Liliana Pasquale present SecPatRec, a system for finding security patterns in source code. Security patterns describe reusable architectural solutions to recurring security problems, but their implementations can span multiple components and take many valid forms. SecPatRec treats a pattern as a reference architecture and looks for its prescribed roles, the code entities that fill those roles, and the interactions among them. A ReAct-style LLM agent uses semantic and lexical code search to detect and ground roles; static code property graph analysis recovers interactions. The authors evaluate the system on a human-validated dataset of 100 pattern instances covering five security patterns in 93 open-source Java and Python repositories. Across four LLMs, average role-detection accuracy and role-grounding similarity are each 0.84, while the interaction-recovery score is 0.66. Compared with a one-shot end-to-end LLM baseline, SecPatRec has higher aggregate recovery scores and lower estimated LLM API costs per run, and processes repositories beyond the baseline’s configured input limit. The authors say its recovered role mappings and interaction sequences can support inspection of security-pattern implementations.","question":"How well does SecPatRec recover security patterns beyond the five patterns and 93 Java and Python repositories in the evaluation?","claims":[{"text":"The authors introduce SecPatRec, which combines an LLM agent for role detection and grounding with static analysis for recovering interactions.","excerpt":"SecPatRec pairs a ReAct-style LLM agent equipped with semantic and lexical code search for role detection and grounding with static code property graph analysis for interaction recovery.","support":"source-stated"},{"text":"The evaluation uses a human-validated dataset of 100 pattern instances across five security patterns and 93 open-source Java and Python repositories.","excerpt":"a human-validated ground-truth dataset of 100 pattern instances covering five security patterns across 93 open-source Java and Python repositories","support":"source-stated"},{"text":"Across the evaluated models and pattern instances, average role-detection accuracy and role-grounding similarity were 0.84; the interaction-recovery score was 0.66.","excerpt":"Averaged over all models and pattern instances, SecPatRec achieves role-detection accuracy of 0.84, role-grounding similarity of 0.84, and an interaction-recovery score of 0.66.","support":"source-stated"},{"text":"Compared with a one-shot end-to-end LLM baseline, SecPatRec had higher aggregate recovery scores and lower estimated API costs per run, and processed repositories exceeding the baseline's configured input limit.","excerpt":"Compared to a one-shot end-to-end LLM baseline, SecPatRec achieves higher aggregate recovery scores and lower estimated LLM API costs per run, while processing repositories that exceed the baseline's configured input limit.","support":"source-stated"},{"text":"The authors say the recovered mappings and sequences can provide evidence to support inspection of security-pattern implementations.","excerpt":"The recovered role mappings and statically derived interaction sequences provide structural and behavioural evidence that can support inspection of security-pattern implementations.","support":"source-stated"}],"limitations":["The reported evaluation covers 100 pattern instances, five security patterns, and 93 open-source Java and Python repositories; the abstract does not establish how results generalize beyond that scope.","The reported scores measure recovery against the study's ground truth; they do not by themselves establish the reliability of security-pattern implementations in deployed software.","The abstract gives aggregate results across four LLMs but does not provide per-model results or further detail about the baseline configuration."],"mediaId":"26da12177dc977a62093638bf661b668a3b153d5e7cfb375e23d57db427e5335","correctionReason":null,"id":"7ab759a211db46fa9d6e6517e0273d8c93d1f50d25cb6dc88e31fa4e5b86dd4a","publicationId":"6226a6a3-cc2f-4609-83b3-403e411ac91b","version":1,"sourceUrl":"https://arxiv.org/abs/2611.05823","sourceTitle":"A Hybrid Approach for Automated Security Pattern Recovery","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:06:42.422Z","createdAt":"2026-11-09T07:33:05.048Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"26da12177dc977a62093638bf661b668a3b153d5e7cfb375e23d57db427e5335","kind":"article","url":"https://arxiv.org/abs/2611.05823","sourceUrl":"https://arxiv.org/abs/2611.05823","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T07:32:17.304Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05823","checkedAt":"2026-11-09T07:48:06.830Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"26da12177dc977a62093638bf661b668a3b153d5e7cfb375e23d57db427e5335","confidence":0.74,"provider":"typesafe","model":"jev-1.13.0","inputHash":"b5286cfacc517cff01ece86cb5ba41d6f42ff5aa5662294a71b1a9a5e6a65b5c","decidedAt":"2026-11-09T07:32:18.821Z"},"provenance":{"textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observationId":"c87921a7f4f7effb68fce66eef252e9a30929b54a94ab5470a024a5fb72790d3","retrievedAt":"2026-11-09T07:32:17.031Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"e398a3e4-4e56-48d8-8f09-b485407e2d32"},"reviewer":{"model":"gpt-6-luna","runId":"915051fb-9270-4d98-81d3-cd2445aecc67"}},"audit":{"status":"passed","reviewedAt":"2026-11-09T07:33:05.048Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Nguyen, Anh Minh","url":null,"kind":"unknown"},{"name":"Tran, Tuan Dat","url":null,"kind":"unknown"},{"name":"Hassan, Alzubair","url":null,"kind":"unknown"},{"name":"Pasquale, Liliana","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Nguyen, Anh Minh","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Nguyen, Anh Minh","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}},{"actor":{"name":"Tran, Tuan Dat","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tran, Tuan Dat","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}},{"actor":{"name":"Hassan, Alzubair","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hassan, Alzubair","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}},{"actor":{"name":"Pasquale, Liliana","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Pasquale, Liliana","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.05823","snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/7ab759a211db46fa9d6e6517e0273d8c93d1f50d25cb6dc88e31fa4e5b86dd4a/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-a-hybrid-approach-for-automated-security-pattern-7ab759a2","formats":{"html":"/readings/arxiv-cs-ai-a-hybrid-approach-for-automated-security-pattern-7ab759a2","markdown":"/readings/arxiv-cs-ai-a-hybrid-approach-for-automated-security-pattern-7ab759a2.md","json":"/readings/arxiv-cs-ai-a-hybrid-approach-for-automated-security-pattern-7ab759a2.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"},{"id":"term-api","name":"API","explanation":"An application programming interface: a defined way for software to request data or actions from another system.","referenceUrl":"https://developer.mozilla.org/en-US/docs/Glossary/API"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"7ab759a211db46fa9d6e6517e0273d8c93d1f50d25cb6dc88e31fa4e5b86dd4a","revision":"6226a6a3-cc2f-4609-83b3-403e411ac91b","revisionKind":"publication-id","title":"arXiv cs.AI: A Hybrid Approach for Automated Security Pattern Recovery","url":"https://escapemeridian.com/readings/arxiv-cs-ai-a-hybrid-approach-for-automated-security-pattern-7ab759a2"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.05823","revision":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","revisionKind":"sha256-source-text","title":"A Hybrid Approach for Automated Security Pattern Recovery","url":"https://arxiv.org/abs/2611.05823"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"7ab759a211db46fa9d6e6517e0273d8c93d1f50d25cb6dc88e31fa4e5b86dd4a","title":"arXiv cs.AI: A Hybrid Approach for Automated Security Pattern Recovery","argument":"Anh Minh Nguyen, Tuan Dat Tran, Alzubair Hassan and Liliana Pasquale present SecPatRec, a system for finding security patterns in source code. Security patterns describe reusable architectural solutions to recurring security problems, but their implementations can span multiple components and take many valid forms. SecPatRec treats a pattern as a reference architecture and looks for its prescribed roles, the code entities that fill those roles, and the interactions among them. A ReAct-style LLM agent uses semantic and lexical code search to detect and ground roles; static code property graph analysis recovers interactions. The authors evaluate the system on a human-validated dataset of 100 pattern instances covering five security patterns in 93 open-source Java and Python repositories. Across four LLMs, average role-detection accuracy and role-grounding similarity are each 0.84, while the interaction-recovery score is 0.66. Compared with a one-shot end-to-end LLM baseline, SecPatRec has higher aggregate recovery scores and lower estimated LLM API costs per run, and processes repositories beyond the baseline’s configured input limit. The authors say its recovered role mappings and interaction sequences can support inspection of security-pattern implementations.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported evaluation covers 100 pattern instances, five security patterns, and 93 open-source Java and Python repositories; the abstract does not establish how results generalize beyond that scope. The reported scores measure recovery against the study's ground truth; they do not by themselves establish the reliability of security-pattern implementations in deployed software. The abstract gives aggregate results across four LLMs but does not provide per-model results or further detail about the baseline configuration.","speaker":{"name":"Nguyen, Anh Minh, Tran, Tuan Dat, Hassan, Alzubair, Pasquale, Liliana","roleAtSource":"Article author"},"source":{"title":"A Hybrid Approach for Automated Security Pattern Recovery","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.05823","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors introduce SecPatRec, which combines an LLM agent for role detection and grounding with static analysis for recovering interactions.","excerpt":"SecPatRec pairs a ReAct-style LLM agent equipped with semantic and lexical code search for role detection and grounding with static code property graph analysis for interaction recovery.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"The evaluation uses a human-validated dataset of 100 pattern instances across five security patterns and 93 open-source Java and Python repositories.","excerpt":"a human-validated ground-truth dataset of 100 pattern instances covering five security patterns across 93 open-source Java and Python repositories","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"Across the evaluated models and pattern instances, average role-detection accuracy and role-grounding similarity were 0.84; the interaction-recovery score was 0.66.","excerpt":"Averaged over all models and pattern instances, SecPatRec achieves role-detection accuracy of 0.84, role-grounding similarity of 0.84, and an interaction-recovery score of 0.66.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"Compared with a one-shot end-to-end LLM baseline, SecPatRec had higher aggregate recovery scores and lower estimated API costs per run, and processed repositories exceeding the baseline's configured input limit.","excerpt":"Compared to a one-shot end-to-end LLM baseline, SecPatRec achieves higher aggregate recovery scores and lower estimated LLM API costs per run, while processing repositories that exceed the baseline's configured input limit.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"},{"text":"The authors say the recovered mappings and sequences can provide evidence to support inspection of security-pattern implementations.","excerpt":"The recovered role mappings and statically derived interaction sequences provide structural and behavioural evidence that can support inspection of security-pattern implementations.","url":"https://arxiv.org/abs/2611.05823","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05823","checkedAt":"2026-11-09T07:48:06.830Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well does SecPatRec recover security patterns beyond the five patterns and 93 Java and Python repositories in the evaluation?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: A Hybrid Approach for Automated Security Pattern Recovery","summary":"Anh Minh Nguyen, Tuan Dat Tran, Alzubair Hassan and Liliana Pasquale present SecPatRec, a system for finding security patterns in source code. Security patterns describe reusable architectural solutions to recurring security problems, but their implementations can span multiple components and take many valid forms. SecPatRec treats a pattern as a reference architecture and looks for its prescribed roles, the code entities that fill those roles, and the interactions among them. A ReAct-style LLM agent uses semantic and lexical code search to detect and ground roles; static code property graph analysis recovers interactions. The authors evaluate the system on a human-validated dataset of 100 pattern instances covering five security patterns in 93 open-source Java and Python repositories. Across four LLMs, average role-detection accuracy and role-grounding similarity are each 0.84, while the interaction-recovery score is 0.66. Compared with a one-shot end-to-end LLM baseline, SecPatRec has higher aggregate recovery scores and lower estimated LLM API costs per run, and processes repositories beyond the baseline’s configured input limit. The authors say its recovered role mappings and interaction sequences can support inspection of security-pattern implementations.","question":"How well does SecPatRec recover security patterns beyond the five patterns and 93 Java and Python repositories in the evaluation?","claims":[{"text":"The authors introduce SecPatRec, which combines an LLM agent for role detection and grounding with static analysis for recovering interactions.","excerpt":"SecPatRec pairs a ReAct-style LLM agent equipped with semantic and lexical code search for role detection and grounding with static code property graph analysis for interaction recovery.","support":"source-stated"},{"text":"The evaluation uses a human-validated dataset of 100 pattern instances across five security patterns and 93 open-source Java and Python repositories.","excerpt":"a human-validated ground-truth dataset of 100 pattern instances covering five security patterns across 93 open-source Java and Python repositories","support":"source-stated"},{"text":"Across the evaluated models and pattern instances, average role-detection accuracy and role-grounding similarity were 0.84; the interaction-recovery score was 0.66.","excerpt":"Averaged over all models and pattern instances, SecPatRec achieves role-detection accuracy of 0.84, role-grounding similarity of 0.84, and an interaction-recovery score of 0.66.","support":"source-stated"},{"text":"Compared with a one-shot end-to-end LLM baseline, SecPatRec had higher aggregate recovery scores and lower estimated API costs per run, and processed repositories exceeding the baseline's configured input limit.","excerpt":"Compared to a one-shot end-to-end LLM baseline, SecPatRec achieves higher aggregate recovery scores and lower estimated LLM API costs per run, while processing repositories that exceed the baseline's configured input limit.","support":"source-stated"},{"text":"The authors say the recovered mappings and sequences can provide evidence to support inspection of security-pattern implementations.","excerpt":"The recovered role mappings and statically derived interaction sequences provide structural and behavioural evidence that can support inspection of security-pattern implementations.","support":"source-stated"}],"limitations":["The reported evaluation covers 100 pattern instances, five security patterns, and 93 open-source Java and Python repositories; the abstract does not establish how results generalize beyond that scope.","The reported scores measure recovery against the study's ground truth; they do not by themselves establish the reliability of security-pattern implementations in deployed software.","The abstract gives aggregate results across four LLMs but does not provide per-model results or further detail about the baseline configuration."],"mediaId":"26da12177dc977a62093638bf661b668a3b153d5e7cfb375e23d57db427e5335","correctionReason":null,"id":"7ab759a211db46fa9d6e6517e0273d8c93d1f50d25cb6dc88e31fa4e5b86dd4a","publicationId":"6226a6a3-cc2f-4609-83b3-403e411ac91b","version":1,"sourceUrl":"https://arxiv.org/abs/2611.05823","sourceTitle":"A Hybrid Approach for Automated Security Pattern Recovery","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:06:42.422Z","createdAt":"2026-11-09T07:33:05.048Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"26da12177dc977a62093638bf661b668a3b153d5e7cfb375e23d57db427e5335","kind":"article","url":"https://arxiv.org/abs/2611.05823","sourceUrl":"https://arxiv.org/abs/2611.05823","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T07:32:17.304Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05823","checkedAt":"2026-11-09T07:48:06.830Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"26da12177dc977a62093638bf661b668a3b153d5e7cfb375e23d57db427e5335","confidence":0.74,"provider":"typesafe","model":"jev-1.13.0","inputHash":"b5286cfacc517cff01ece86cb5ba41d6f42ff5aa5662294a71b1a9a5e6a65b5c","decidedAt":"2026-11-09T07:32:18.821Z"},"provenance":{"textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observationId":"c87921a7f4f7effb68fce66eef252e9a30929b54a94ab5470a024a5fb72790d3","retrievedAt":"2026-11-09T07:32:17.031Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"e398a3e4-4e56-48d8-8f09-b485407e2d32"},"reviewer":{"model":"gpt-6-luna","runId":"915051fb-9270-4d98-81d3-cd2445aecc67"}},"audit":{"status":"passed","reviewedAt":"2026-11-09T07:33:05.048Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Nguyen, Anh Minh","url":null,"kind":"unknown"},{"name":"Tran, Tuan Dat","url":null,"kind":"unknown"},{"name":"Hassan, Alzubair","url":null,"kind":"unknown"},{"name":"Pasquale, Liliana","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Nguyen, Anh Minh","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Nguyen, Anh Minh","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}},{"actor":{"name":"Tran, Tuan Dat","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tran, Tuan Dat","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}},{"actor":{"name":"Hassan, Alzubair","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hassan, Alzubair","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}},{"actor":{"name":"Pasquale, Liliana","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Pasquale, Liliana","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05823","locator":"head/meta[name=author|citation_author]"},"assertionId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T07:48:06.830Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","sourceUrl":"https://arxiv.org/abs/2611.05823","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.05823","snapshotId":"227bb975829c9d179da21b29e24d3d60d6ce447441532e3f2c46f79ce0b1fc3e","contentSha256":"3bf60fff2538dba63f135f00e027009a04b391b4b382e1a9b2efdaa23e87f6e8","textHash":"5b3feddb7f7392e72fd0d2cca1199524442e407a0e625c198b46fac732b4e67f","observedAt":"2026-11-09T07:48:06.830Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/7ab759a211db46fa9d6e6517e0273d8c93d1f50d25cb6dc88e31fa4e5b86dd4a/source"}}}],"audits":[{"publicationId":"6226a6a3-cc2f-4609-83b3-403e411ac91b","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly credits Anh Minh Nguyen, Tuan Dat Tran, Alzubair Hassan and Liliana Pasquale for SecPatRec. It keeps the results and the inspection-support claim as the authors' statements rather than presenting them as established fact.","excerpt":"Authors:Anh Minh Nguyen, Tuan Dat Tran, Alzubair Hassan, Liliana Pasquale"},{"dimension":"summary","status":"pass","explanation":"The reading faithfully follows the abstract. It explains security patterns and why recovering them from code is hard, then covers the method, dataset, scores, the baseline comparison and the stated use for inspection. Terms such as ReAct-style LLM agent, code property graph and grounding are kept exactly; tooltip entries are suggested if they are missing. The core development stays readable without them. The question is a real open issue about generalization. The title prefix reflects the cs.AI feed, although the primary category is cs.CR.","excerpt":"We present SecPatRec, a hybrid approach for automated security pattern recovery from source code repositories."},{"dimension":"date","status":"pass","explanation":"originalPublished is 2026-11-04. This matches the arXiv v1 submission date. The feed date of 2026-11-05 is correctly not used.","excerpt":"[v1]\nWed, 4 Nov 2026 02:01:23 UTC (2,525 KB)"},{"dimension":"support","status":"pass","explanation":"Every claim, figure and comparison matches the abstract: 0.84, 0.84 and 0.66, plus lower estimated API costs and handling repositories beyond the baseline's configured input limit. The limitations properly keep test scores separate from real-world reliability and note that the abstract gives no per-model detail. No benefits or costs are invented.","excerpt":"Averaged over all models and pattern instances, SecPatRec achieves role-detection accuracy of 0.84, role-grounding similarity of 0.84, and an interaction-recovery score of 0.66."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source.","excerpt":null}],"createdAt":"2026-11-09T07:33:05.048Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}