PhD Position F/M: How does Reasoning with LLM Help Repair Vulnerabilities in Repo-level Software Projects?

Context
Within the framework of the ANR PRCI project "
SecLLM4SVD (Secured Large Language Models in Reliable Software Vulnerability Detection)",
Principal Investigator:
Dr. Yufei Han
.
Assignment
Context and Motivation:
Large Language Models (LLMs) have demonstrated remarkable capabilities in automating the detection of software vulnerabilities (SVD) due to their ability to process both natural and programming languages. However, a critical reliability concern with state-of-the-art LLMs is their susceptibility to adversarial attacks. Subtle, problem-space modifications to source code—such as variable renaming or dead code insertion—can mislead the model without changing the code's main functionality or underlying vulnerabilities. Furthermore, the opaque, "black-box" nature of LLMs makes it difficult to understand whether they truly grasp code semantics or simply recognize superficial statistical artifacts.
Collaboration :
The recruited person will be in connection with Dr. Yuejun Guo at Luxembourg Institute of Science and Technology.
Responsibilities :
The person recruited is responsible for conducing full-time research activities centered at the theme of the thesis.
Steering/Management :
The person recruited will be supervised by Dr. Yufei Han
Main activities
Thesis Objectives
This 36-month PhD position aims to advance the state of the art in software security. It focuses on repository-level code vulnerability detection and root cause analysis using Large Language Models (LLMs). A central methodological thread is reinforcement learning (RL) fine-tuning to strengthen the reasoning capability of LLMs on security tasks. The candidate will lead research in two phases. The first phase targets deep vulnerability discovery across complex codebases. The second phase targets automated and reliable code remediation.
The first phase will focus on navigating complex repository structures to detect systemic vulnerabilities. Current LLMs often reason superficially over code. They struggle with long, multi-step analyses that span many files. The candidate will investigate Reinforcement Learning (RL)-based fine-tuning to improve the model’s security reasoning. The model will be trained to produce structured reasoning chains that trace execution and data flows across functions, files, and libraries. Training will rely on verifiable reward signals. Examples include the correctness of the localized vulnerable code, the consistency of the inferred root cause, and confirmation by static analysis or proof-of-concept execution. The candidate will also study how RL can steer the model’s analytical path during inference. This includes deciding which code regions to explore next and when to stop. The goal is to unveil hidden vulnerabilities that arise from intricate cross-function, cross-file, and cross-library dependencies. The approach moves beyond localized scanning. It aims to pinpoint the exact root causes of security flaws deeply embedded in the repository ecosystem.
Building on the identification and root cause analysis of the first phase, the second phase will shift to automated remediation. The candidate will explore how LLMs can produce robust fixes for the detected vulnerabilities. A key challenge is preserving utility integrity alongside the security gains. RL fine-tuning will again play a central role. The patch generation model will be optimized with multi-objective rewards. These rewards will capture whether the vulnerability is eliminated, whether existing tests still pass, and whether performance is preserved. The candidate will develop rigorous methodologies to ensure that generated patches integrate into the broader repository context. Patches must not break existing functionality, introduce regressions, or degrade performance. The final goal is reliable, production-ready code repair.
Skills
Candidate Profile and Requirements
To successfully carry out the research objectives of WP2 and WP3, the ideal candidate should possess a strong foundational background in both artificial intelligence and software security. We are looking for candidates who meet the following requirements:
Educational Background:
A Master’s degree or equivalent engineering degree in Computer Science, Artificial Intelligence, Cybersecurity, or a closely related discipline.
Deep Learning Expertise:
Solid knowledge and proven project experience in designing, training, and evaluating Deep Neural Network (DNN)-based classification models.
Program Analysis Proficiency:
Demonstrated understanding and practical experience in program analysis. Specifically, the candidate must be familiar with the static analysis of source code using semantic representations, such as Control Flow Graphs (CFG) and Data Flow Graphs (DFG).
Programming Skills:
Strong programming skills in Python and proficiency with standard deep learning frameworks (e.g., PyTorch, TensorFlow). Experience with code parsing and analysis tools (e.g., Tree-sitter, Joern) is highly desirable.
Additional Assets:
Prior exposure to Large Language Models (LLMs), Natural Language Processing (NLP), or Adversarial Machine Learning will be considered a significant plus.
Soft Skills:
Excellent analytical and problem-solving skills, an autonomous and rigorous work ethic, and good communication skills in English for scientific writing and presentation within an international consortium.