PhD Position F/M PhD Position F/M: How does Reasoning with LLM Help Repair Vulnerabilities in Repo-level Software Projects?

The Inria Rennes - Bretagne Atlantique Centre is one of Inria's eight centres and has more than thirty research teams. The Inria Center is a major and recognized player in the field of digital sciences. It is at the heart of a rich R&D and innovation ecosystem: highly innovative PMEs, large industrial groups, competitiveness clusters, research and higher education players, laboratories of excellence, technological research institute, etc.

Within the framework of the ANR PRCI project "SecLLM4SVD (Secured Large Language Models in Reliable Software Vulnerability Detection)", Principal Investigator: Dr. Yufei Han.

Context and Motivation:

Large Language Models (LLMs) have demonstrated remarkable capabilities in automating the detection of software vulnerabilities (SVD) due to their ability to process both natural and programming languages. However, a critical reliability concern with state-of-the-art LLMs is their susceptibility to adversarial attacks. Subtle, problem-space modifications to source code—such as variable renaming or dead code insertion—can mislead the model without changing the code's main functionality or underlying vulnerabilities. Furthermore, the opaque, "black-box" nature of LLMs makes it difficult to understand whether they truly grasp code semantics or simply recognize superficial statistical artifacts.

Collaboration :

The recruited person will be in connection with Dr. Yuejun Guo at Luxembourg Institute of Science and Technology.

Responsibilities :
The person recruited is responsible for conducing full-time research activities centered at the theme of the thesis. 

Steering/Management :
The person recruited will be supervised by Dr. Yufei Han

Thesis Objectives

This 36-month PhD position aims to advance the state of the art in software security by focusing on repository-level code vulnerability detection and root cause analysis using Large Language Models. The candidate will spearhead research in two dedicated phases, transitioning from deep vulnerability discovery across complex codebases to automated, reliable code remediation.

The first phase of the thesis will focus on navigating complex repository structures to detect systemic vulnerabilities. The candidate will investigate how to use reinforcement learning to guide the reasoning processes of Large Language Models during code analysis. By dynamically steering the model's analytical path, the research aims to successfully unveil hidden vulnerabilities that arise from intricate cross-function, cross-file, and cross-library dependencies. This approach will allow the model to trace execution and data flows across various architectural boundaries, moving beyond localized scanning to pinpoint the exact root causes of security flaws deeply embedded within the repository ecosystem.

Building upon the precise identification and root cause analysis achieved in the first phase, the subsequent research will shift towards automated remediation. The candidate will explore how Large Language Models can be leveraged to actively produce robust fixes for the detected vulnerabilities. A critical challenge in this phase will be ensuring utility integrity in parallel with the security enhancements. The research will require developing rigorous methodologies to guarantee that the LLM-generated patches seamlessly integrate into the broader repository context without breaking existing functionalities, introducing functional regressions, or degrading software performance, ultimately providing reliable and production-ready code repairs.

Candidate Profile and Requirements

To successfully carry out the research objectives of WP2 and WP3, the ideal candidate should possess a strong foundational background in both artificial intelligence and software security. We are looking for candidates who meet the following requirements:

• Educational Background: A Master’s degree or equivalent engineering degree in Computer Science, Artificial Intelligence, Cybersecurity, or a closely related discipline.
• Deep Learning Expertise: Solid knowledge and proven project experience in designing, training, and evaluating Deep Neural Network (DNN)-based classification models.
• Program Analysis Proficiency: Demonstrated understanding and practical experience in program analysis. Specifically, the candidate must be familiar with the static analysis of source code using semantic representations, such as Control Flow Graphs (CFG) and Data Flow Graphs (DFG).
• Programming Skills: Strong programming skills in Python and proficiency with standard deep learning frameworks (e.g., PyTorch, TensorFlow). Experience with code parsing and analysis tools (e.g., Tree-sitter, Joern) is highly desirable.
• Additional Assets: Prior exposure to Large Language Models (LLMs), Natural Language Processing (NLP), or Adversarial Machine Learning will be considered a significant plus.
• Soft Skills: Excellent analytical and problem-solving skills, an autonomous and rigorous work ethic, and good communication skills in English for scientific writing and presentation within an international consortium.

• Subsidized meals
• Partial reimbursement of public transport costs
• Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.)
• Possibility of teleworking (after 6 months of employment) and flexible organization of working hours
• Professional equipment available (videoconferencing, loan of computer equipment, etc.)
• Social, cultural and sports events and activities
• Access to vocational training
• Social security coverage

monthly gross salary 2300 euros