From Backlog Items to Security Guidance: Towards Continuous Security Compliance

arXiv:2607.27374 · cs.SE, cs.CR · Submitted 2026-07-29 · Read on arXiv

cs.SE, cs.CR

Submitted: 2026-07-29

Updated: 2026-09-20

Comments: 11 pages, 3 figures, 3 tables. Accepted at the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE 2026), Industry Showcase track

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Benchmark — 38× in this paper · explained in 2 episodes
• Generalizability — 8× in this paper · explained in 6 episodes
• RAG — 6× in this paper · explained in 3 episodes
• Abstraction — 5× in this paper · explained in 1 episode
• Calibration — 5× in this paper · explained in 7 episodes
• AUC — 4× in this paper · explained in 2 episodes
• Commentary — 4× in this paper · explained in 2 episodes
• Fine-Tuning — 4× in this paper · explained in 5 episodes
• Transformer — 4× in this paper · explained in 2 episodes
• Failure Modes — 3× in this paper · explained in 3 episodes
• Generalization — 3× in this paper · explained in 13 episodes
• Regularization — 3× in this paper · explained in 3 episodes
• Actionability — 2× in this paper · explained in 3 episodes
• Embeddings — 2× in this paper · explained in 2 episodes
• Retrieval-Augmented Generation (RAG) — 2× in this paper · explained in 16 episodes
• Transferability — 2× in this paper · explained in 4 episodes
• Aggregation — 1× in this paper · explained in 1 episode
• Alignment — 1× in this paper · explained in 1 episode
• Clustering — 1× in this paper · explained in 2 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Cosine Similarity — 1× in this paper · explained in 3 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• International Requirements Engineering Conference — 1× in this paper
• Quantization — 1× in this paper · explained in 12 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Semantic Gap — 1× in this paper · explained in 2 episodes
• Sparsity — 1× in this paper · explained in 4 episodes
• Trace — 1× in this paper · explained in 2 episodes
• Verification — 1× in this paper · explained in 2 episodes

Sources

• Guidelines for Empirical Studies in Software Engineering involving Large Language Models
• Passage Re-ranking with BERT
• Evaluating Large Language Models for Security Bug Report Prediction

Related papers

• Falsification-Based Verification of LLM-Generated Optimization Models: Sound Test Batteries and Their Detection Limits
• GitSkills: A Dataset of Agent Skills on GitHub
• SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces
• PackMonitor: Enabling Zero Package Hallucinations Through Decoding-Time Monitoring
• IntentCoding: Amplifying User Intent in Code Generation
• Incentives and Outcomes in Bug Bounties