Abstract:Python is a popular dynamic programming language, evidenced by its ranking as the second most commonly used language on GitHub. However, its dynamic type system can lead to potential type errors, leading researchers to explore automatic type inference approaches for Python programs. Existing type inference approaches can be generally grouped into three categories, i.e., rule-based, supervised, and cloze-style approaches. The rule-based type inference approaches can ensure the accuracy of predicted variable types, but they suffer from low coverage problems caused by dynamic features and external calls. Supervised type inference approaches, while feature-agnostic and able to mitigate the low coverage problem, require large, high-quality annotated datasets and are limited to pre-defined types. As zero-shot approaches, the cloze-style approaches reformulate the type inference problem into a fill-in-the-blank problem by leveraging the general knowledge in powerful pre-trained code models. However, their performance is limited since they ignore the domain knowledge from static typing rules which reflect the inference logic. What is more, their predictions are not interpretable, hindering developers' understanding and verification of the results. This paper introduces TYPEGEN, a few-shot generative type inference approach that incorporates static domain knowledge from static analysis. TYPEGEN creates chain-of-thought (COT) prompts by translating the type inference steps of static analysis into prompts based on the type dependency graphs (TDGs), enabling language models to learn from how static analysis infers types. By combining COT prompts with code slices and type hints, TYPEGEN constructs example prompts from human annotations. TYPEGEN only requires very few annotated examples to teach language models to generate similar COT prompts via in-context learning. Moreover, TYPEGEN enhances the interpretability of results through the use of the input-explanation-output strategy, which generates both explanations and type predictions in COT prompts. Experiments show that TYPEGEN outperforms the best baseline Type4Py by 10.0% for argument type prediction and 22.5% in return value type prediction in terms of top-1 Exact Match by using only five examples. Furthermore, TYPEGEN achieves substantial improvements of 27% to 84% compared to the zero-shot performance of large language models with parameter sizes ranging from 1.3B to 175B in terms of top-1 Exact Match.

CATI: Context-Assisted Type Inference from Stripped Binaries

BinSub: The Simple Essence of Polymorphic Type Inference for Machine Code

Securing c programs by dynamic type checking

Learning Type Inference for Enhanced Dataflow Analysis

iJTyper: An Iterative Type Inference Framework for Java by Integrating Constraint- and Statistically-based Methods

DIComP: Lightweight Data-Driven Inference of Binary Compiler Provenance with High Accuracy

TIPICAL -- Type Inference for Python In Critical Accuracy Level

DLInfer: Deep Learning with Static Slicing for Python Type Inference.

BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching

Generative Type Inference for Python

Realizing Implicit Computational Complexity

Polymorphic type inference for machine code

Assessing the Effectiveness of Binary-Level CFI Techniques

KCAT: A Knowledge-Constraint Typing Annotation Tool

Improving type information inferred by decompilers with supervised machine learning

A Program Understanding Approach for Stripped Binary Code

ToolPhet: Inference of Compiler Provenance From Stripped Binaries With Emerging Compilation Toolchains

Revisiting Deep Learning for Variable Type Recovery

STRIDE: Simple Type Recognition In Decompiled Executables

Static Type Analysis for Python

Reconstruction of Data Type in Obfuscated Binary Programs