SmartHomeSecure, a prototype for automated detection and repair of Home Assistant configuration errors using lightweight program analysis and constraint-guided large language model generation, is presented, suggesting that combining domain-aware program analysis with constrained generative AI is a feasible approach for improving the reliability and usability of smart home configuration repair.
Abstract
Smart home automation platforms increasingly rely on user-authored YAML configuration files to define device behaviors, but these files are prone to syntax, formatting, and semantic logic errors that can cause automation failures and safety risks. Existing YAML validators, static analysis tools, and general-purpose large language models offer limited support for end-to-end diagnosis and repair because they lack domain-specific understanding and validated correction workflows. This paper presents SmartHomeSecure, a prototype for automated detection and repair of Home Assistant configuration errors using lightweight program analysis and constraint-guided large language model generation. SmartHomeSecure parses YAML files, detects syntactic and common semantic errors, normalizes error context, applies deterministic auto-fixes for routine defects, and constructs constrained prompts that guide LLMs toward minimal and structurally valid repairs. The system is implemented as a modular web application with four layers: UI Shell, Feature Orchestrator, Domain Engine, and Integration Layer. Its repair pipeline was evaluated on 100 real-world Home Assistant YAML files with manually injected errors across five categories: syntax/parsing, indentation, mapping, sequence, and scalar quoting errors. Four models were tested: gpt-oss-20b, gpt-oss-120b, llama-3.1-8b, and llama-3.3-70b. Results show that three models achieved 100% error detection accuracy, with repair success rates ranging from 87% to 93%. Manual verification found no hallucinated or incorrect repairs among successful outputs. These findings suggest that combining domain-aware program analysis with constrained generative AI is a feasible approach for improving the reliability and usability of smart home configuration repair.
User experience (UX) evaluation is central to software quality, yet it remains difficult to integrate into software engineering workflows in a systematic, explainable, and early-stage manner. This paper presents TraceUX, a framework for operationalizing UX heuristics and design guidance into a rule-based static evaluation pipeline that combines machine-interpretable formalization, executability-aware assessment, context-sensitive scoring, and actionable reporting. The framework is instantiated using Apple Human Interface Guidelines, Swift abstract syntax trees, and mobile games, and implemented in a proof-of-concept tool named TraceHIG. Evaluation was conducted in four layers: analysis of the full rule repository, controlled synthetic validation with injected violations, baseline assessment of 12 public Swift game projects, and a case study on one project. The full repository contained 206 rules; after excluding non-iOS yet platform-specific rules, 193 rules were retained for the downstream experiments. In controlled validation, 216 injected violations yielded 99.2% precision, 61.6% recall, and an F1-score of 0.760. In baseline analysis, overall project scores ranged from 41.6 to 88.0, reflecting rule-conformance spread under the instantiated rule base rather than direct measures of UX quality. The case study demonstrated that profile-aware scoring can yield materially different UX assessments for the same codebase under different game configurations, highlighting the importance of app profiling in static UX evaluation. These findings show that a meaningful subset of UX knowledge can be operationalized into explainable, context-aware static analysis that provides structured and actionable decision support while complementing, rather than replacing, manual and empirical UX evaluation.
Smart home virtual assistants are increasingly powered by large language models to enable information retrieval and home device actuation. As a result, intelligent home environments are becoming more exposed to untrusted inputs, increasing their susceptibility to prompt injection, role confusion, and indirect prompt injection through retrieved context. In this paper, we propose a layered architecture that separates LLM-driven intent interpretation from the authorization and safety enforcement mechanisms governing the managed environment. The architecture is developed and evaluated using an incremental hardening approach, in which a naive baseline system is progressively enhanced with authentication and role tagging, pre-LLM policy enforcement, context sanitization and prompt rewriting, and post-LLM action gating mechanisms. Early findings of a small scenario setting indicate that progressive layered enforcement largely diminishes potential risks whereas post-LLM gating inhibits more complex prompt-based threats even when the language model itself produces unsafe commands. The results are preliminary and are limited to four attack scenarios and one local LLM backend but the model can be generalized to more extensive policies of smart-homes and more complex jailbreak and multimodal attack cases.
Shazid Bin Zaman, Sohan Gyawali, C. Popoviciu et al.· 2026 International Conferenc...· 0 citations
The effectiveness of protocol fuzzing depends on the quality of test templates, specifically the Pit file (XML-based definitions used by the Peach frameworks). These Pit files define both data models and state models. However, manually creating these Pit files is not only time-consuming and error-prone but also requires specialized domain knowledge, hindering the automation process. In this paper, we introduce Shark2Pit, an automated tool that generates Pit files from network traffic. Shark2Pit uses Tshark to parse traffic, extract protocol metadata, and construct data models. Then Shark2Pit synthesizes new data models while preserving their structure. The state model is built from data model sequences, further enhanced by state recombination and repetition. Shark2Pit combines these models with predefined configurations to generate a Pit file. We evaluated Shark2Pit on 8 open-source protocols. The branch coverage of the generated Pit files is comparable to or even higher than that of manually created Pit files (99.4%-106.3% for Peach and 90.6%-102.3% for Peach*). Furthermore, fuzzing with these Pit files revealed 5 previously unknown bugs.
Yulai Fu, Yuanliang Chen, Fuchen Ma et al.· SIGSOFT FSE Companion· 0 citations
To address the difficulty of detecting silent inconsistencies in Train Real-time Data Protocol implementations, we propose TRDP-Guard, an automated protocol consistency checking architecture based on large language model (LLM)-driven semantic analysis. TRDP-Guard extracts structured rules from the IEC 61375 standard, localizes relevant implementation logic via LLM guided program slicing, and performs semantic consistency analysis between rules and code to identify latent deviations. Experiments on real-world TRDP implementations show that TRDP-Guard effectively detects representative defects such as timer mismanagement, PULL/PUSH misuse, and missing field validation, achieving 86.4% precision and 95.0% recall, significantly outperforming existing static analysis tools. Furthermore, we model three classes of consistency breaking attacks timing, scheduling, and semantic confusion attacks and design corresponding defense mechanisms. Simulation results demonstrate that the proposed defenses effectively mitigate protocol inconsistency-induced threats, enhancing the robustness of train communication systems.
Jiewei Du, Bo Ai, Yunlong Lu et al.· IEEE Transactions on Cogniti...· 0 citations
Many Internet of Things (IoT) services provide Representational State Transfer (REST) APIs, which require client developers to implement applications that conform to the corresponding API specifications. When client programs contain API misuse, developers debug them based on error responses. However, such responses are often insufficient for identifying the root cause, requiring developers to repeatedly communicate with the server. Retrieval-Augmented Generation (RAG) is a promising approach for providing large language models (LLMs) with external knowledge. However, in automated repair of REST API misuses, it remains unclear how specifications should be stored in a RAG database. This study evaluates how different configurations for organizing API specifications affect RAG-based repair of REST API misuse. We constructed 11 RAG configurations with different database structures and compared their repair rates with a baseline method. For evaluation, we used REST API misuse cases collected from real-world repositories. The results show that, in the studied datasets, the baseline method achieved a repair rate of 54.3%, whereas a RAG-based method using four databases achieved a maximum repair rate of 88.6%. These results indicate that organizing specifications according to version and content type can be an effective design choice for RAG-based REST API misuse repair.
Shoei Inoue, Norihiro Yoshida, Erina Makihara et al.· 0 citations
The rapid integration of Large Language Models into autonomous agentic systems has introduced unprecedented capabilities for task automation, reasoning, and tool utilization. However, equipping these agents with the ability to access external APIs, internal databases, and arbitrary web resources significantly broadens the attack surface for data exfiltration. Malicious actors can leverage prompt injection and indirect prompt injection techniques to hijack the agent control flow, forcing it to retrieve sensitive information and transmit it to attacker-controlled destinations. Existing security mechanisms, which predominantly rely on static prompt filtering or heuristic anomaly detection, fail to maintain context across complex, multi-step tool invocations. This paper introduces a comprehensive framework based on Tool-Flow Taint Analysis designed to mitigate data exfiltration in Large Language Model agents. By adapting classical dynamic taint analysis principles to the semantic and operational workflows of agent toolchains, the proposed architecture tracks sensitive data from predefined sources through intermediate natural language reasoning steps to potential external sinks. We establish robust semantic taint propagation rules capable of operating within the non-deterministic environment of Large Language Models. Extensive experimental evaluations demonstrate that the proposed system achieves high efficacy in intercepting exfiltration attempts while maintaining a low false-positive rate and negligible latency overhead. The findings provide a critical foundation for securing next-generation autonomous agents against sophisticated data-stealing attacks in enterprise environments.
Chun Tian, Hiu-Tung Li, Michelle Yu· Journal of innovative resear...· 0 citations