Guiding Symbolic Execution with Static Analysis and LLMs for Vulnerability Discovery

Paper 2 addresses a fundamental scalability bottleneck in vulnerability discovery and demonstrates striking real-world results: 379 previously unknown memory-safety vulnerabilities across 6.8M LOC, vastly outperforming baselines (12 vulnerabilities). Its combination of static analysis, LLMs, symbolic execution, and concrete validation is methodologically rigorous with clear ablations proving each component's necessity. The security impact is broad and immediately actionable. Paper 1 tackles an important but narrower niche (LLM gateway auditing) with elegant methodology, but its impact is more specialized and its findings less transformative for broad scientific or engineering communities.

Paper 2 presents a highly rigorous neuro-symbolic approach that solves a long-standing scalability bottleneck in symbolic execution. By discovering 379 zero-day vulnerabilities in large-scale real-world software, it demonstrates immense practical impact and methodological soundness, supported by comprehensive ablation studies and concrete validation. While Paper 1 introduces an exciting benchmark, Paper 2's automated synthesis pipeline provides a more immediately transformative, verifiable, and broadly applicable breakthrough in software security and automated vulnerability discovery.

SAILOR demonstrates dramatic empirical impact: 379 previously unknown vulnerabilities across 6.8M lines of real code, dwarfing the strongest baseline's 12. It addresses a critical, timely security bottleneck (harness automation) with a rigorous ablation showing each component's necessity, and applies broadly to software security. Paper 1 is elegant hardware-algorithm co-design with solid privacy guarantees, but RRAM-DP's impact is constrained to specialized emerging hardware and incremental over existing DP-SGD. SAILOR's demonstrated real-world discovery of actionable vulnerabilities gives it broader, more immediate applicability.

Paper 2 demonstrates higher scientific impact due to its massive empirical success and methodological rigor. While Paper 1 introduces a novel defense for LLM agents, Paper 2 solves a longstanding scalability bottleneck in symbolic execution by effectively combining static analysis, LLMs, and concrete replay. The discovery of 379 previously unknown vulnerabilities in 6.8 million lines of real-world C/C++ code showcases an immediate, undeniable real-world application. Furthermore, its rigorous ablation studies prove this hybrid approach vastly outperforms state-of-the-art LLM agents, establishing a new paradigm for automated vulnerability discovery.

Paper 1 introduces a novel threat class (indirect data poisoning of autonomous research agents) with broad implications for scientific integrity across many fields, timely given AI's growing role in research. It combines empirical rigor (450 runs, multiple frontier models, five topics) with actionable mitigations. Paper 2 is strong technically with impressive concrete results (379 vulnerabilities), but its impact is more contained within software security engineering. Paper 1's cross-disciplinary relevance, societal urgency, and framing of an emerging systemic risk give it broader potential impact, despite Paper 2's excellent methodological execution.

While Paper 2 presents a highly effective automated vulnerability discovery tool, Paper 1 introduces a groundbreaking paradigm shift in hardware security. By demonstrating the first GPU-to-CPU privilege escalation via Rowhammer that defeats IOMMU protections, it fundamentally alters the threat model for multi-tenant GPU cloud and AI infrastructure. Hardware exploits of this magnitude compel significant architectural redesigns and inspire deep foundational follow-up research across hardware, OS, and cloud security, granting it exceptionally high scientific impact.

Paper 1 likely has higher impact: it introduces a novel, tightly integrated pipeline (static analysis targeting + iterative LLM harness synthesis + symbolic execution + concrete replay) and demonstrates large-scale effectiveness (379 new memory-safety vulnerabilities across 6.8M LOC) with strong ablations and baselines, suggesting broad applicability to real-world software security workflows. Its methodology is unusually rigorous for LLM-assisted security (ground-truth validation) and its results are immediately actionable across many C/C++ ecosystems. Paper 2 is timely and valuable for agent safety, but appears narrower and more evaluation-dependent.

Paper 2 (SAILOR) likely has higher scientific impact due to a strong, timely contribution at the intersection of static analysis, symbolic execution, and LLMs, with clear real-world security applicability. The methodology shows convincing end-to-end rigor (targeting, iterative synthesis with feedback, and concrete replay validation) and large-scale evaluation (6.8M LOC) with substantial discovered/confirmed vulnerabilities and strong ablations/baselines. Its approach can broadly influence program analysis, software engineering, and cybersecurity practices. Paper 1 is innovative and rigorous, but its impact may be narrower to blockchain protocol design/deployment and depends more on adoption and assumptions.

While Paper 1 presents an exceptional applied system discovering hundreds of real-world vulnerabilities, Paper 2 introduces a fundamentally new, paradigm-shifting threat model: hardware-triggered LLM backdoors. Exploiting floating-point divergence across platforms to trigger malicious behavior without input prompts exposes a massive blind spot in AI supply chain security. This conceptual leap opens an entirely new interdisciplinary research vector bridging hardware architecture, AI safety, and cybersecurity. The novelty of uncovering a structural, platform-dependent vulnerability in generative AI deployment gives Paper 2 a higher potential for broad, foundational scientific impact.

Paper 2 (Bifrost) likely has higher scientific impact due to broader cross-field relevance and timeliness: it targets a central, rapidly growing need—privacy-preserving LLM serving—bridging systems, cryptography (FHE/CKKS), and trusted computing (TEEs). The hybrid TEE–FHE partitioning and prefill/decode split offer a generally applicable architectural principle (“selective encrypted execution”) that could influence deployed cloud inference stacks. Paper 1 is strong and rigorous with impressive vulnerability yield, but its impact is more specialized to software security tooling and depends on LLM-assisted synthesis reliability.