ICSOFT 2026 Abstracts


Area 1 - Foundational and Trigger Technologies

Full Papers
Paper Nr: 88
Title:

Beyond the Black Box: Neuro-Symbolic Integration for Interpretable Video-Based Reinforcement Learning

Authors:

Lorenzo Cardone, Giorgia Ghisolfo, Giorgio Mongardi, Stefano Quer and Giovanni Squillero

Abstract: This paper introduces a cognitively inspired neuro-symbolic framework for extracting interpretable world models from raw video streams in dynamic 2D environments. While traditional end-to-end deep reinforcement learning systems often function as opaque “black boxes,” our approach decouples visual perception from policy learning to enhance transparency. By leveraging Core Knowledge theory (specifically object persistence, physical causality, and agent representation), the system transforms visual patches into structured symbolic entities and governing interaction rules. The core of this architecture is a symbolic module that reconstructs persistent objects, infers parametric motion laws (such as velocity inversion upon contact), and incrementally consolidates class-specific behaviors into a compact knowledge base. This world model instantiates a domain-agnostic environment wrapper, enabling a Deep Q-Network to operate on symbolic state vectors rather than pixels. We further propose a domain-agnostic agent that develops complex behaviors driven by a composite intrinsic reward based on causal impact and event-driven curiosity. Experimental evaluations on Arkanoid and Pong demonstrate that this framework achieves near-optimal performance without task-specific external rewards. On Arkanoid, the agent matches the win rate of fully supervised models while remaining robust to structural modifications, such as changes in ball size or brick configuration. In Pong, the same mechanism transfers without architectural adjustments, consistently improving survival times. These results provide a transparent, generalizable alternative to dominant AI paradigms with good performance across varied environmental conditions.
Download

Paper Nr: 96
Title:

Cooperative Multi-Heuristic Parallelization for the Maximum Common Induced Subgraph Problem

Authors:

Lorenzo Cardone and Stefano Quer

Abstract: The Maximum Common Induced Subgraph problem is a central challenge in combinatorial optimization, with applications across diverse fields. Its NP-hard nature has led to a long line of branch-and-bound algorithms, among which the McSplit family stands out for its search-space representation and effective pruning. More recent extensions, such as McSplit-DAL, integrate Domain Action Learning to guide branching decisions using dynamic reward functions. However, they remain essentially sequential and rely on a single heuristic configuration, underutilizing modern multi-core architectures and heuristic diversification. In this work, we introduce CP-McSplitDAL, a cooperative parallel framework that extends McSplit-DAL with portfolio-style multi-heuristic search on shared-memory machines. The original recursive algorithm is reformulated as an iterative engine, enabling explicit management of search states, load sharing among threads, and controlled thread migration between heuristics. Each context couples a topological vertex-ranking metric with a specific ordering scheme and learns its own reward landscape. Cooperation is achieved through a globally shared variable that represents the size of the largest solution found so far, enabling cross-heuristic pruning and adaptive reward handling, and supporting both unified and distributed matrices. At the same time, a master evaluation periodically decays rewards and deactivates under-performing heuristics, shifting from early diversification to late exploitation. We evaluate CP-McSplitDAL on standard benchmarks, including small instances solvable to optimality and a large set of real-world graph pairs. The results show that our cooperative multi-heuristic configuration achieves lower regret in time to optimality, improves solution quality under time limits, and better exploits multi-core hardware than non-cooperative or purely sequential variants.
Download

Short Papers
Paper Nr: 101
Title:

Blockchain-Based Predictive Resource Sharing in NFV Environments with LSTM-Based Demand Forecasting

Authors:

Khaled Gadouh, Hend Koubaa and Manel Boujelben

Abstract: Network Function Virtualization (NFV) enables network functions to be implemented as software through flexible deployment capabilities. However, static demand assumptions, centralized security dependencies, and reactive decision-making approaches hinder efficient resource allocation among VNFs. This paper addresses these challenges by proposing a hybrid framework that integrates LSTM-based demand prediction regression model for time series forecasting, game-theoretic resource allocation, and blockchain-based access control. The blockchain provides decentralized, tamper-proof storage of cryptographic keys and automated enforcement of sharing agreements through smart contracts, eliminating reliance on trusted third parties. The proposed predictive algorithm combines real-time demand data with LSTM forecasts to estimate effective demand, enabling proactive resource allocation. The framework is evaluated through extensive simulations, comparing the proposed method with greedy matching and diagonalization baseline approaches. Results show that the proposed method achieves a 10.3% improvement in social utility over greedy matching, while reaching a nearoptimal solution with a cost 6.3× lower than diagonalization. The LSTM model achieves a Mean Absolute Percentage Error (MAPE) of 8.91% and an R^2 score of 0.880.These results demonstrate that integrating demand prediction into game-theoretic NFV resource sharing significantly enhances efficiency while preserving strong security guarantees.
Download

Paper Nr: 131
Title:

TLA-Prover: Verifiable TLA+ Specification Synthesis via Preference-Optimized Low-Rank Adaptation

Authors:

Eric Spencer, Arslan Bisharat, Brian Ortiz, Mujtaba Nazari, Khushboo Bhadauria, TaiNing Wang, George K. Thiruvathukal, Konstantin Läufer and Mohammed Abuhamad

Abstract: TLA+ Is a formal specification language for verifying distributed systems and safety-critical protocols. Large language models (LLMs) frequently produce TLA+ specifications that fail the TLC model checker for semantic reasons. Across 25 LLMs, the best public baseline is 26.6% syntactic parse and 8.6% semantic modelcheck. We present TLA-Prover, a 20-billion-parameter model for TLA+ specification synthesis. Training combines supervised fine-tuning (SFT) on verified examples with repair-based group-relative policy optimization (GRPO). In the GRPO stage, the model learns to fix its own rejected specifications. We also train a direct preference optimization (DPO) variant from the same SFT checkpoint as an ablation. TLC provides the reward signal directly, with no learned reward model. Each output falls into one of four tiers: Bronze (parses), Silver (no warnings), Gold (passes TLC), and Diamond. To reach Diamond, the model’s correctness property is automatically altered in a small way; TLC must then detect a violation. If TLC still passes, the property was always-true and contributes nothing; the output fails Diamond. TLA-Prover reaches 9/30 (i.e. pass@1= 30%) at both Gold and Diamond on a held-out 30-problem benchmark. This is roughly 3.5× the 8.6% untuned baseline. The DPO variant reaches 20% at Diamond. Gold and Diamond coincide at every checkpoint; this prevents the trivial-property failure mode.
Download

Paper Nr: 134
Title:

Benchmarking Classical, Transformer-Based, and RAG Approaches with LLMs for Automated Bug Triage

Authors:

Márk Lajkó, Balázs Nagy and László Vidács

Abstract: Automatic bug triage is a critical software maintenance task that reduces the high human resource cost of manual developer assignment. In this paper we evaluate various machine learning approaches on Eclipse dataset. We compare classical machine learning approaches like TF IDF + XGBoost, LogReg, NaiveBayes and modern transformer based architectures including: Bert, Nomic, Mpnet, Jina, BGE, E5, CodeLlama, Llama-3.1-8B-Instruct, ChatGPT few-shot prompting. We compare various approaches including using transformer based architectures with frozen weights as embedding with a fine-tuned neural network classification head (MLP). For maximal performance we selected the best performing model E5 (47.63% accuracy) and fully fine-tuned it and achieved 72.49% top-1 accuracy which is the best performing deep learning based approach to the best of our knowledge slightly under performing our best approach: TF IDF+XGBoost 76.47%. Furthermore we also experienced with adding the embedding vectors of some of the aforementioned transformer-based models to the best performing TF IDF+XGBoost models but we experienced slightly worse performance than with only TF IDF+XGBoost. We also experimented with Retrieval Augmented Generation (RAG) and achieved 36.81% top-1 accuracy. The RAG results were primarily influenced by the retrieval rather than the generator.
Download

Area 2 - Software Engineering and Systems Development

Full Papers
Paper Nr: 40
Title:

Quantum Low-Code Metamodel and Transformation Pipeline

Authors:

Daniel Georg, Johanna Barzen, Fabian Bühler and Lavinia Stiliadou

Abstract: Model-driven engineering (MDE) and low-code development treat models as primary artifacts and enable the systematic derivation of executable software through automated transformations. This brings the benefits of modeling, such as abstraction, reuse, and early validation, into the development process by shifting effort from manual coding to a guided, tool-supported approach. Quantum computing, however, introduces challenges such as managing quantum states and entanglement. These require a deep understanding of mathematics and quantum software engineering principles. Several low-code and MDE-inspired approaches have been proposed to simplify quantum software development by abstracting quantum-specific details. However, existing approaches are often tied to specific platforms or application domains and do not provide a fully transparent model-to-code transformation. To bridge this gap between visual modeling and execution, we present a metamodel and transformation pipeline that provide the backend for graph-based quantum low-code models and automatically translate them into executable quantum programs. A prototypical implementation and use case demonstrate the feasibility of the proposed model-to-code transformation. To facilitate interoperability across different quantum cloud providers, we generate a widely supported intermediate representation.
Download

Paper Nr: 51
Title:

Barriers to Use: Perspectives on Environmental Research Software

Authors:

Yvette D. Hastings, Jeffrey C. Carver, Clemente Izurieta and Ann Marie Reinhold

Abstract: Research software is essential for modeling complex Earth system interactions, yet poor software quality-inuse (QIU) often hinders its adoption. This study investigates QIU barriers in environmental research software through a survey of environmental scientists (n = 45) grounded in the ISO/IEC 25019:2023 QIU framework. The survey evaluated seven QIU subcharacteristics relevant to environmental research workflows. Our results indicate that the subcharacteristics of Accessibility, Suitability, and Experience represent the most significant barriers to adoption. These barriers are associated with steep learning curves, the need to learn new programming environments, and the reliance on additional tools to extend software capabilities. These findings, primarily reflecting R-based environmental research workflows, highlight recurring challenges faced by users and provide guidance for improving user-centered research software.
Download

Paper Nr: 53
Title:

Can LLMs Write Correct TLA + Specifications? Evaluating Natural-Language-to-TLA + Generation

Authors:

Arslan Bisharat, Brian Ortiz, Eric Spencer, Khushboo Bhadauria, TaiNing Wang, George K. Thiruvathukal, Konstantin Läufer and Mohammed Abuhamad

Abstract: TLA$^+$ Has supported industrial verification at companies such as Amazon and Microsoft, yet writing correct TLA$^+$ specifications from natural language still requires time and expertise, which limits adoption. LLMs show promise, but no prior study measures whether they produce semantically correct TLA$^+$ specifications from natural language. This paper presents the first systematic evaluation of LLM-based TLA$^+$ specification synthesis from natural language. Our study evaluates 30 LLMs across eight families on a curated dataset of 205 TLA$^+$ specifications: 25 open-weight models across four prompting strategies (2,600 runs) and 5 proprietary models under few-shot prompting (130 runs), all validated by the SANY parser and TLC model checker. LLMs achieve up to 26.6\% syntactic correctness but only 8.6\% semantic correctness, with successes exclusive to progressive prompting. Results show that model size does not predict quality, e.g., DeepSeek r1:8b outperforms its 70B variant across all strategies, which suggests the importance of reasoning alignment for formal languages. Code-specialized models consistently underperform due to negative transfer from mainstream language training. We identify five recurring hallucination categories, all traceable to specific training data biases. These results suggest that current LLMs do not generate reliable TLA$^+$ specifications without expert oversight. We release the evaluation framework, code, and dataset to support reproducibility and future research.
Download

Paper Nr: 55
Title:

A Study of Cursorrules Files in GitHub Open Source Projects

Authors:

Shuang Sun, Jafar Akhoundali, Arina Kudriavtseva, Sengim Karayalcin and Olga Gadyatskaya

Abstract: Prompts are the primary mechanism for communicating with AI agents, and they directly influence the quality and reliability of AI-generated code. As AI-assisted programming becomes widely adopted, modern tools increasingly combine dynamic conversational prompts with static configuration-like prompt files. Despite the growing focus on prompt engineering, prior research has primarily focused on conversational prompts, while prompt files remain understudied. To address this gap, we conduct an empirical study of configuration prompt files in Cursor, a widely used AI-assisted code editor. We collect and analyze over 12,110 .cursorrules files from 11,427 GitHub repositories to characterize their distribution, evolution, and maintenance. Complementing this, we perform qualitative analysis on a random sample of 65 prompt files and develop a 65-code codebook capturing how developers express programming intent, project context, engineering practices, and security considerations. Our results show that .cursorrules files emerged rapidly from mid-2024. Their adoption is concentrated in small-scale, low-activity, single-maintainer repositories, suggesting toy projects rather than professional development. The content of prompt files is dominated by guidance on code quality and engineering practices, project structure and configuration, and maintainability, while security-related content appears less frequently. Our analysis shows that there is a continuity of themes and topics between the now-legacy .cursorrules files and the current standard .mdc files.
Download

Paper Nr: 114
Title:

Evidence-Gated Agentic Delivery: An Essence-Based Reference Model for Hybrid Human-Agent Software Processes

Authors:

Robin Nunkesser

Abstract: The growing use of AI agents in software engineering can no longer be discussed purely as a productivity improvement for isolated coding tasks. Emerging research and practice guidance indicate a broader process shift toward orchestrated human-AI collaboration, explicit review and validation gates, context-sensitive task decomposition, and tool-supported feedback loops, while early empirical work suggests a plausible risk of AI-accelerated quality degradation and technical debt accumulation if code generation scales faster than review, verification, and architectural practices. The field still lacks a stable lifecycle-level process model that consolidates these signals; the main gap is not the absence of ideas but the absence of a structured synthesis. Using Essence as a descriptive and comparative language, the paper contrasts classical process logics with current agentic workflow recommendations and proposes Evidence-Gated Agentic Delivery as an evidence-informed reference model. The model ties progress to alpha states and explicit evidence, keeps humans responsible for direction, risk, architecture, and release decisions, assigns agents bounded roles in exploration, implementation, and review preparation, and treats external stakeholders as explicit actors in intent validation. UI-centered work is then developed as a particularly instructive special case in which low-fi-to-mid-fi progression, executable alignment artifacts, and controlled transitions between device-like exploration and design-system-backed stabilization become process-relevant. Recent AI-native design systems increase the practical urgency of this problem space but do not remove the need for reviewable, evidence-gated, and code-near transitions between design exploration and implementation. The contribution is therefore both a process-oriented framing and a UI-centered refinement, intended to support empirical follow-up, tool design, and method adaptation for AI-augmented software engineering.
Download

Paper Nr: 117
Title:

From Data Lifting to Risk Estimation: A Process-Aware Pipeline for Clinical Pathway Monitoring

Authors:

Pasquale Ardimento, Mario Luca Bernardi, Marta Cimitile and Samuele Latorre

Abstract: This paper presents a reproducible and process-aware pipeline for predictive monitoring of clinical pathways. The approach integrates data lifting, temporal reconstruction, event log construction, prefix-based representations, and predictive modeling to support continuous reasoning on partially observed patient trajectories, overcoming the limitations of traditional retrospective process mining. The framework is evaluated on COVID-19 clinical pathways using ICU admission as the prediction target, considering 4,479 patient cases and 46,804 prefixes. Predictive models are trained and evaluated using a case-level split, with 896 patients in the test set. Logistic Regression achieves the best performance (AUC 0.906, F1-score 0.835). A detailed prefix-based analysis shows that predictive performance improves progressively as new clinical events become available, with AUC increasing from 0.642 at early stages to 0.942 at later stages of the pathway. The results highlight two key observations: predictive signals emerge progressively along clinical pathways, and process-aware representations provide a suitable framework for early risk estimation from evolving patient trajectories. Overall, the results show that predictive monitoring in healthcare benefits from continuous risk estimation based on evolving patient trajectories.
Download

Paper Nr: 120
Title:

Evaluating Bagging-Based Ensembles for Predicting Performance in Configurable Software Systems

Authors:

Taha El Hihi and Ali Idri

Abstract: Configurable software systems expose large configuration spaces in which different combinations of options can significantly affect non-functional properties such as execution time, memory usage, and energy consumption. An alternative to extensive benchmarking is to predict performance without executing the software. However, this remains challenging due to limited training data and sparse configuration landscapes. While prior work has mainly focused on individual machine learning and deep learning models, ensemble learning for configurable software performance prediction remains underexplored. In this paper, we investigate homogeneous ensembles based on Bagging to improve predictive performance. We construct ensembles using four base learners (Support Vector Regression, Regression Tree, Kernel Ridge Regression, and HINNPerf) and evaluate 16 bagging variants across eight publicly available configurable systems and five training sample sizes. We further analyze the impact of ensemble size and combination rule on predictive performance. Predictive performance is evaluated using statistical validation and multiple evaluation metrics. Results show that bagging-based ensembles achieve superior or comparable performance to single learners in several settings, with larger ensemble sizes and median-based aggregation showing the most consistent improvements. These findings provide empirical evidence that ensemble design choices can improve robustness in performance prediction under sparse configuration data.
Download

Paper Nr: 123
Title:

Exploring Persistent Configuration Decisions for Adaptive Data Provisioning

Authors:

Giovanni Donato Gallo, Federico Bergamini, Marco Napolitano and Daniela Micucci

Abstract: Adaptive data provisioning is a key challenge in modern systems operating over heterogeneous and dynamic data sources, where multiple providers may offer the same functionality with evolving quality characteristics. Existing approaches typically perform data source selection at each invocation based on current context and quality constraints. While this strategy maximizes responsiveness, it introduces runtime overhead and may lead to unstable behavior under noisy or delayed observations. The paper proposes ARES, a configuration-driven architecture for adaptive data provisioning. The approach elevates data source selection to an explicit architectural concern by separating the set of available providers from the active runtime configuration used to resolve requests, which is maintained over time and updated according to externally defined policies. We evaluate ARES through a controlled simulation involving multiple data sources with dynamic quality profiles. Preliminary results suggest that ARES can substantially reduce decision cost while maintaining acceptable levels of execution quality under the considered conditions. Moreover, configuration-level decisions exhibit higher effectiveness, enabling more robust adaptation despite imperfect estimated information. These findings provide initial evidence that configuration-level decision strategies may represent a promising architectural direction for balancing decision cost, execution quality, and adaptation stability in dynamic environments.
Download

Short Papers
Paper Nr: 18
Title:

Enhancing Code Quality through AI-Powered Metric-Driven Refactoring: A Multi-Model Analysis

Authors:

Tindwende Thierry Sawadogo and Fadel Toure

Abstract: The growing adoption of large language models (LLMs) in software engineering has introduced new opportunities but also risks in the software maintenance lifecycle. While LLMs can generate entire codebases from natural language prompts, such automatically generated or rapidly prototyped code often accumulates structural debt, making systematic refactoring increasingly urgent. This work investigates LLMs as metric-driven refactoring assistants rather than code generators. Six models (ChatGPT, Claude, Gemini, Grok, DeepSeek, and Qwen) were evaluated on two types of Java projects: three controlled applications with manually inflated structural metrics, and three real-world applications from public GitHub repositories. Using MetricsReloaded in IntelliJ IDEA, we measured four CK metrics: complexity (WMC), cohesion (LCOM), coupling (CBO), and inheritance depth (DIT). Results indicate that LLMs significantly reduce complexity and coupling, improving class simplicity and modularity. However, cohesion improvements remained limited, with LCOM proving especially elusive. Inheritance depth showed strong reductions in synthetic high-metric applications but minimal change in real projects. ChatGPT produced the most consistent and structurally stable refactoring outputs in real applications, though occasional cohesion deterioration occurred. These findings suggest that while LLMs are valuable assistants for structural improvement, their interventions require careful monitoring to avoid unintended trade-offs.
Download

Paper Nr: 21
Title:

Temporal Constrained Objects for Firewall Modeling

Authors:

Aswathy M S, Jinesh M Kannimoola and Bharat Jayaraman

Abstract: Firewall configurations are complex and error-prone, as they are often written in low-level languages that make their behavior difficult to understand and verify. This paper presents a novel approach to firewall modeling using Temporal Constrained Objects (TCOB), a declarative executable specification language. In our framework, the firewall and its associated network are modeled as objects, and access control rules are expressed as declarative constraints. The executable nature of TCOB enables time-based simulation of firewall behavior in response to streams of packets that include both legitimate and malicious traffic. We perform runtime verification by extracting finite-state models from execution traces and checking safety and liveness properties expressed in temporal logic. The packet-filtering firewall demonstrates how this approach can detect configuration errors and verify firewall behavior prior to deployment. All examples presented in this paper, including the case study, have been validated using an implementation of TCOB and are made publicly available from github.com/jineshmk/TCOB.
Download

Paper Nr: 36
Title:

A Stacked Regressor for the Prediction of the Number of Defects in Software Modules

Authors:

Rim El Jammal, Elissa Lichaa El Khoury, Leonardo Daou, Charbel Daoud, Jalal Possik and Danielle Azar

Abstract: This study proposes a Stacked Regressor (SR) model for software defect count prediction. The approach combines four heterogeneous base learners-Support Vector Regression (SVR), k-Nearest Neighbors (KNN), Random Forest Regressor (RFR), and Extra Trees Regressor (ETR)-whose predictions are aggregated through a meta-regressor. Two SR variants are implemented, differing only in the choice of the meta-regressor: SVR or RFR. The models are evaluated on 10 publicly available software projects comprising 34 versions under within-version and within-project settings. Experimental results show that the proposed SR approach consistently outperforms individual base learners in terms of MAE and MRE, while remaining competitive in RMSE and Pred(0.3). Statistical analysis further supports the robustness of the observed improvements. These findings indicate that stacking heterogeneous regression models can enhance the stability and generalization of software defect count prediction.
Download

Paper Nr: 41
Title:

A Study Based on Interviews about the Perceptions of Implementing Maturity Models Using Agile Initiatives in Public Bodies

Authors:

Alfredo Gabriel de Sousa Oliveira and Sandro Ronaldo Bezerra Oliveira

Abstract: The modernization of public administration, which aims to optimize efficiency and transparency, has led to the adoption of maturity models (CMMI and MPS.BR), alongside agile methodologies. This has been achieved despite the inherent complexity of bureaucratic rigidity and cultural resistance within the sector. This study focuses on the challenge of translating the theoretical basis, identified through a systematic literature review (SLR), into specific practices within the Brazilian government. To support this approach, the present study aimed to validate and expand upon the theoretical findings by confronting them with the empirical experience of national professionals. The main objective was to determine the extent to which operational reality aligns with best practices, identifying specific obstacles and gaps. Structured interviews were conducted with 13 software engineering professionals from the public bodies to ensure triangulation between theory and practice. The results emphasize the importance of hybrid models (e.g. SAFe and Lean Management) and reiterate that bureaucracy is the primary obstacle, mitigated by customizing roles, securing support from senior management, and providing continuous Scrum training.
Download

Paper Nr: 44
Title:

Applying the SofIA Methodology to the Design of Gamified Visual Rehabilitation Tools for AMD Patients: A Multidisciplinary Work

Authors:

S. Giuli-Bello, S. Pons-López, M. J. Bautista-Llamas, N. Sánchez-Gómez, J. A. García-García and M. J. Escalona

Abstract: Age-Related Macular Degeneration (AMD) is one of the leading causes of central vision loss in older adults, severely limiting their independence and quality of life. Despite the existence of visual rehabilitation therapies, lack of motivation and the monotony of traditional exercises often lead to poor treatment adherence. This article presents the design of a gamified technology platform specifically designed for the rehabilitation of visual perception in patients with AMD. The development is based on the SofIA (Software Engineering Methodology for Intelligent Applications) methodology, which has been extended using LLMs to enrich the user experience. Through a model-based approach, the functional requirements, system architecture, and design of clinically validated themed mini-games are detailed. The results demonstrate how SofIA enables the transformation of complex clinical needs into a technological solution in the context of e-health.
Download

Paper Nr: 64
Title:

From Requirement Engineering Analysis to Real Implementations: The GOReM Methodology Case Study

Authors:

Alfredo Cuzzocrea and Alfredo Garro

Abstract: This paper presents a methodological framework based on the Goal-Oriented Requirements Engineering Methodology (GOReM) for the systematic engineering of complex socio-technical systems in cultural heritage preservation. The approach establishes a traceable path from stakeholder goals to system implementation by formalizing relationships among actors, objectives, and functionalities. As a practical application, we introduce Food Atlas, a digital platform designed to valorize local food knowledge in Basilicata and Calabria (Italy). Utilizing sequential Context, Scenario, Use-Case, and Requirements Models, this work demonstrates how GOReM provides rigorous specifications to transition from conceptual analysis to concrete software architecture.
Download

Paper Nr: 72
Title:

Engineering Self-Adaptive and Autonomous Systems: A Critical Survey and an Adaptation–Assurance Framework

Authors:

Kashif Manzer, Dipak Yadav and Muhammad Abdul Basit Ur Rahim

Abstract: Self-adaptive systems (SAS) autonomously reconfigure in response to uncertain environments and evolving requirements. Two decades of research have produced a rich but fragmented body of work spanning architecture, machine learning, uncertainty management, and verification, each strand typically surveyed in isolation. This paper makes three contributions. First, it provides a critical survey, rather than a catalogue, of foundational and contemporary SAS methodologies, organized using the reporting principles of established systematic-review guidelines. Second, it introduces an original synthesizing artifact, the Adaptation–Assurance Gap Map, which positions each class of adaptation mechanism (rule-based, control-theoretic, search-based, model-based, reinforcement learning, deep predictive, federated, and LLM-assisted) against the maturity of assurance evidence routinely available for it, exposing systematically under-assured combinations. The map is governed by an explicit rating rubric, complemented by a technique-maturity model that includes an assurance-cost dimension. Third, it positions the framework against prior SAS taxonomies and converts the findings into a gap-to-research traceability matrix with concrete, falsifiable directions. Using exemplars (DeltaIoT, SWIM, and an ML-component retraining case), we show that the field’s principal weakness is not a shortage of adaptation mechanisms but a shortage of assurance that scales with them in scope, tempo, and cost.
Download

Paper Nr: 73
Title:

Models, Prompts, and Code! A Semi-Formal State Machine Language for Multi-Paradigmatic Software Development

Authors:

Oliver Engling, Felix Schwägerl and Thomas Buchmann

Abstract: Model-Driven Software Engineering has long excelled at generating code from static structural models, yet the specification and generation of dynamic behavioral models remains a persistent challenge. Meanwhile, Large Language Models (LLMs) offer flexible, natural-language based code generation but suffer from non-determinism and hallucinations. This paper presents a semi-formal approach that bridges these two paradigms for behavioral modeling via UML state machines. We contribute a textual modeling language that captures the essential elements of UML state diagrams-states, transitions, events, guards, and entry/exit actions-alongside a deterministic code generator that transforms state machine models into Java code following the Gang of Four State design pattern. The language supports two complementary action annotation styles: direct code fragments for concise, self-contained actions, and natural language descriptions for semantically richer behavior to be completed by an LLM weaver. LLM involvement is deliberately scoped to small, well-constrained action bodies, reducing token consumption and non-determinism compared to fully LLM-based approaches. Validated through the Gumball Machine case study, correctness is confirmed by automated tests covering state and transition coverage criteria, and repeating the LLM weaving step produced consistent results across all runs. Compared to both classical UML tooling and fully LLM-based generation, the approach offers stronger determinism, better traceability, lower cognitive modeling effort, and reduced computational cost, while retaining the flexibility to express complex action behavior in natural language where formal specification would be unnecessarily burdensome.
Download

Paper Nr: 82
Title:

Generalizability of Deep Learning Models for Java Code Clone Detection

Authors:

Thomas S. Heinze

Abstract: Deep Learning (DL) is becoming more and more widespread in clone detection, motivated by achieving near-perfect performance for this task. In particular in case of semantic code clones, which share only limited syntax but implement the same or similar functionality, Deep Learning appears to outperform conventional tools. In this paper, we want to investigate the generalizability of DL-based clone detectors for Java. We therefore replicate and evaluate the performance of five state-of-the-art DL-based clone detectors, including Transformers like CodeBERT and single-task models like FA-AST+GMN, in a zero-shot evaluation scenario, where we train/fine-tune and evaluate on different datasets and functionalities. Our experiments demonstrate that the models' generalizability to unseen code is limited. Further analysis reveals that the conventional clone detector NiCad even outperforms the DL-based clone detectors in such a zero-shot evaluation scenario.
Download

Paper Nr: 92
Title:

A Multi-Layer Empirical Validation Methodology for Security Protocols in Critical Communication Systems

Authors:

Budi Erixson and Jochen Seitz

Abstract: Modern railway systems increasingly depend on secure digital communication for safety-critical operations. This paper presents a multi-layer empirical validation methodology for Transport Layer Security (TLS) implementation on an Embedded Communication Module (ECM) designed for railway applications. Our approach combines application-level log analysis with network-level packet inspection to verify secure connection establishment, mutual authentication, data exchange integrity, and resilience against security threats. Experimental results confirm TLS handshake completion within 200ms, 100% bidirectional data exchange success rate with 24ms average round-trip time, and effective rejection of all unauthorized access attempts. A comparative analysis further positions TLS 1.3 as the optimal application-level security protocol for safety-critical railway communication.
Download

Paper Nr: 93
Title:

Assessing the Efficacy of Claude in Understanding Hand-Sketched UML Use Case Diagrams

Authors:

Mohamed El-Attar, Yasser Khan, Mahmood Niazi, Sajjad Mahmood, Mohammad Alshayeb and Mousa Al-kfairy

Abstract: UML use case diagrams constitute a primary vehicle for capturing functional requirements in model-driven software engineering. While prior empirical work has evaluated multimodal large language models (MLLMs) on computer-generated use case diagram images, the extent to which these models can interpret hand-sketched diagrams remains an open and practically important question. Hand-drawn diagrams are common in early-stage requirements elicitation, yet they introduce visual challenges absent from digital artifacts: variable stroke width, informal notation conventions, and inconsistent spatial layout. This paper reports preliminary empirical results from evaluating Claude on the task of enumerating notational constructs from 49 hand-sketched UML use case diagrams drawn from the corpus of Ražinskas et al. (2024). Results reveal a striking asymmetry: Claude achieves near-perfect F1 scores on stereotype-anchored constructs such as include relationships (F1 = 1.000), extend relationships (F1 = 1.000), and actor generalizations (F1 = 1.000), while collapsing almost entirely on bidirectional associations (F1 = 0.036). The dominant failure mechanism is a systematic substitution of bidirectional associations with directed associations, occurring in 47 of 49 diagrams. These findings establish a preliminary empirical baseline for hand-sketched diagram interpretation and motivate a research agenda for improving MLLM robustness on informal visual notation.
Download

Paper Nr: 99
Title:

Time-Series-Based Self-Healing Architecture for Incident Management in Infrastructure-as-Code

Authors:

Ali Ghamgosar Kisomi, Florian Hofer, Nabil El Ioini and Claus Pahl

Abstract: This paper presents a closed-loop self-healing architecture for incident management in Infrastructure-as-Code (IaC) environments, structured as an instantiation of the MAPE--K (Monitor--Analyze--Plan--Execute over Knowledge) pattern. The main contribution is an architecture that connects runtime monitoring, time-series-based anomaly analysis, remediation planning, and IaC-based execution into a codified and auditable feedback loop. We first analyze a catalog of 20 IaC incident-management rules to identify which incident types exhibit temporal behavior and may therefore benefit from time-series-based analysis. We then instantiate the architecture for one controlled SSH-related anomaly scenario, where Moving Average (MA) and ARIMA are used as lightweight statistical detectors and Ansible playbooks are used to trigger a temporary ban/unban remediation action. The results provide proof-of-concept evidence that time-series anomaly signals can be linked to codified IaC remediation within a complete detection-to-remediation loop.
Download

Paper Nr: 115
Title:

AI-Augmented Research Software Engineering: A Structured Experience Report from the Development of a Python Package

Authors:

Robin Nunkesser

Abstract: Generative AI has intensified interest in Automated Software Engineering, but most current evidence still concerns short, local coding tasks rather than the broader software engineering lifecycle. This paper presents a structured experience report on the development of a Python package for interpretable multiclass classification that hosts heterogeneous estimator families behind a shared interface. We analyze how AI assistance contributed to four recurring engineering activities-cross-language transfer, paper-to-code implementation, benchmark-driven algorithm refinement, and packaging/refactoring work-and how a small set of machine-checkable contracts acted as a cross-cutting enabler that made AI-assisted changes safer to accept. The contribution of the paper is threefold: a concrete research-software case from interpretable machine learning, a task-oriented account of where AI created practical leverage, and a set of lessons on planning, architecture, and validation for trustworthy use. The case suggests that generative AI is especially useful when requirements are only partially formalized, yet objective feedback from tests, benchmarks, and model quality metrics is available. At the same time, the study indicates that human oversight remains essential for semantic correctness, experimental validity, and maintainable software architecture. Overall, the results suggest that AI-augmented development is a relevant topic for scientific software engineering.
Download

Paper Nr: 116
Title:

Native Probes on Demand: Agent-Generated Reference Implementations for Layer-Bisection Debugging in Cross-Platform Apps

Authors:

Robin Nunkesser

Abstract: Cross-platform application frameworks promise a single codebase for multiple operating systems, but pay for this with a stack of abstraction layers-application code, third-party packages, framework runtime, platform-specific bridges, and the underlying operating system or device. When a defect manifests at this stack’s surface, fault localization is hard precisely because each layer is a plausible suspect. We argue that agent-generated native reference implementations-small vertical prototypes built directly against the platform’s native APIs with the help of coding agents-make differential, layer-bisection debugging an economically viable default tactic in cross-platform development. The contribution of this position paper is threefold: a layered fault model that makes the localization problem explicit, the proposal of native probes on demand as a concrete debugging mechanism enabled by agentic code generation, and a discussion of the conditions under which the mechanism fails (cross-layer interactions, timing-dependent behavior, probe drift) together with a research agenda for controlled empirical evaluation. The position is that agent-assisted native probes shift the cost balance of cross-platform debugging in a way that is qualitatively new: a tactic that was previously reserved for teams with full multi-platform expertise becomes available, on demand, to single-stack developers.
Download

Paper Nr: 121
Title:

Towards Agentic Support for the Chaos Engineering of Cyber-Physical Systems

Authors:

Abiola Paterne Chokki, Christophe Ponsard and Jean-François Daune

Abstract: Cyber-Physical Systems (CPS) require rigorous robustness testing, yet this activity remains largely manual and dependent on expert knowledge. Chaos engineering provides a structured methodology through characterizing the system, defining metrics, formulating hypotheses, and planning perturbations. However, it lacks systematic support. This paper investigates how AI can assist the systematic design of chaos engineering experiments for CPS. We show how the different phases of chaos engineering can be adapted to CPS contexts and how they can be effectively and efficiently supported by a multi-agent architecture, with GPT-4o mini powered phase-specific agents providing detailed justifications while keeping a human analyst in the loop either at the phase level or through global iterations. Preliminary results from three industrial case studies show significant benefits from AI assistance, with around 50% efficiency gains in the design phase while improving coverage. Beyond the CPS domain, we also discuss applicability to other target domains (e.g. industrial or financial systems) and properties like secure chaos engineering.
Download

Paper Nr: 126
Title:

Formalizing Model Selection in LLMOps: A Systematic UML-Based Process Model

Authors:

Maria Chernigovskaya, Abdulrahman Nahhas, Christian Haertel, Christian Daase and Klaus Turowski

Abstract: The efficient adoption of Large Language Models (LLMs) in enterprises requires formalizing and systematically implementing LLM Operations (LLMOps), as it could reduce costs and ensure the reproducibility of LLM solutions. One of the critical phases of LLMOps is selecting a suitable LLM, as it can significantly affect a system’s performance, feasibility, and maintainability during the operational phase. As a result, uninformed decisions about model selection that do not align with business, functional, and non-functional requirements may severely impact subsequent stages of the LLMOps life cycle. To investigate the model selection phase, we conducted an extensive Systematic Literature Review (SLR) and synthesized its findings to derive a set of activities fundamental to this phase. These activities are presented in an end-to-end UML activity diagram. The proposed model aims to support the formalization of model selection processes, improve decision-making, and enhance the traceability and transparency of LLMOps practices. This work forms part of a broader research effort toward the formalization of the entire LLMOps life cycle, with the goal of facilitating scalable and reliable integration of LLMs in enterprise environments.
Download

Paper Nr: 129
Title:

A Uniform and Privacy-Preserving Interface for the Clone Detector StoneDetector

Authors:

Wolfram Amme, Christopher Bärthel, Tim Bögel, Michael A. King and Thomas S. Heinze

Abstract: Code clone detectors unveil identical or similar fragments of code in codebases and thus help in improving code quality, supporting refactorings, and reducing technical debt. In this paper, we present our work on a modular architecture for clone detection based on a privacy-preserving and uniform interface. Using fingerprint sets, i.e., hashed code representations, as interface not only allows for decoupling code feature extraction and clone matching, and thus for analyzing anonymous code representations while the raw code can remain private, but also for uniformly integrating different variants of feature extractors. For validation, we extend the clone detector StoneDetector with respect to code features, i.e., tokens, abstract syntax trees, control flow graphs, besides the existing dominator trees, and new input languages, i.e., Python, C#, C/C++, besides Java.
Download

Paper Nr: 132
Title:

CodeEnhancer: An LLM-Assisted Framework for Automated Software Maintenance

Authors:

Shafiya Mubeen Umme and Muhammad Abdul Basit Ur Rahim

Abstract: Large Language Models (LLMs) are increasingly being applied to software engineering tasks such as code generation, bug fixing, and code summarization. This paper presents CodeEnhancer, an LLM-assisted framework for automated software maintenance through a unified workflow. The framework integrates bug fixing, code refactoring, code summarization, automatic comment generation, and programming-language conversion within a single environment. CodeEnhancer accepts source code as input, performs contextual analysis, generates task-specific transformations using transformer-based models, validates generated outputs, and presents maintainability-oriented improvements for developer review. Its architecture consists of source-code ingestion, task management, transformer-driven generation, output validation, and result presentation components. A maintainability-focused evaluation on open-source software projects demonstrates improvements in readability, modularity, and maintainability while preserving software functionality. Experimental results show reductions in code complexity and enhanced software organization through automated transformations. The paper also discusses key challenges in AI-assisted software engineering, including hallucinated code generation, semantic inconsistency, repository-level reasoning limitations, and validation reliability. Future research directions include retrieval-augmented software engineering, repository-aware reasoning, automated testing, and stronger validation mechanisms. The results demonstrate the potential of LLM-assisted frameworks to support practical software maintenance and improve developer productivity.
Download

Paper Nr: 133
Title:

From User Stories to Movement Features: A Requirements-Driven Approach to Pose-Based Dance Movement Analysis

Authors:

Said Daoudagh, Giacomo Ignesti, Davide Moroni, Laura Sebastiani and Paolo Paradisi

Abstract: Dance Movement Therapy (DMT) uses bodily movement as a medium for psychological, emotional, and physical support, yet movement dynamics are often assessed through qualitative and experience-dependent observation. This paper presents a user-story-driven agile process and a modular software pipeline for pose-based Dance Movement Analysis. The approach translates the needs of a DMT movement analyst into epics and user stories covering participant tracking, intra-participant features, inter-participant interaction features, and interactive visualization. The prototype integrates pose estimation, multi-person tracking, structured data persistence, feature extraction, and interactive inspection. A preliminary feasibility-oriented inspection of multi-person dance session videos shows that the pipeline can extract and visualize participant-associated movement features over time. The main contribution is the traceable mapping between domain-specific analysis needs and modular software components, supporting the incremental development of movement-analysis tools for real-world scenarios.
Download

Paper Nr: 30
Title:

A Certification-Oriented Cyber Range Based on a Digital Twin

Authors:

Ahmed Bokri, Khaled Rahal, Arbia Riahi and Wim Mees

Abstract: Security certification of detection platforms requires evaluation environments that combine operational realism with strict traceability. Conventional approaches rarely satisfy both conditions. In the context of Common Criteria (CC) certification, the Target of Evaluation (ToE) must be assessed in a deployed and operationally representative setting. Production infrastructures cannot serve this purpose due to confidentiality and availability constraints, while most Cyber Ranges are designed for training flexibility rather than the deterministic control required for certification-grade assessment. This work introduces a replicable Digital Twin (DT) environment designed for certification-driven evaluation of the multi-agent detection platform MASFAD. Deployed on the KYPO CR, the environment reproduces an enterprise-like architecture with realistic service dependencies and centralized telemetry pipelines. Infrastructure-as-code ensures deterministic redeployment and configuration consistency across repeated instantiations. Controlled benign background activity and APT-style adversarial scenarios generate multi-source operational telemetry. The environment was validated across five complete redeployments, confirming topology completeness, service availability, telemetry observability, and reproducible evidence generation.
Download

Paper Nr: 31
Title:

Design of Secure Recovery Connectors for Asynchronous Message Communications in Distributed Applications

Authors:

Juan Marcelo Gutierrez Carballo, Michael Shin and Hassan Gomaa

Abstract: This paper describes the design of secure recovery connectors that recover messages in asynchronous message communication when security is compromised. In a secure recovery connector, a security coordinator and a recovery manager are designed. The security coordinator delivers messages from the sender component to the receiver component. The recovery manager handles message recovery in the event of a communication security failure. The recovery manager analyzes message delivery, develops a recovery plan, and executes it to restore affected messages. A secure recovery connector comprises a secure recovery sender connector for the sender component and a secure recovery receiver connector for the receiver component. The secure recovery sender and receiver connectors independently recover the affected messages. We validated the secure recovery connectors through a publish/subscribe application.
Download

Paper Nr: 48
Title:

A Systematic Mapping-Based Support Instrument for Implementing the Ensuring Quality Capability Area in CMMI 3.0

Authors:

Larissa de Paula Serrão Garcia and Sandro Ronaldo Bezerra Oliveira

Abstract: This paper investigates how the Ensuring Quality capability area of Capability Maturity Model Integration (CMMI) 3.0 has been operationalized in academic research. A systematic mapping study grounded in the principles of Systematic Literature Review was conducted to identify and classify research contributions related to Requirements Development and Management (RDM), Process Quality Assurance (PQA), Verification and Validation (VV), and Peer Review (PR). A total of 34 primary studies were selected and analyzed according to addressed practice areas, targeted maturity levels, organizational contexts, and types of empirical evidence. The results reveal a predominance of implementation-oriented approaches, particularly focused on intermediate maturity levels, with strong representation of RDM and PQA practices. From the synthesis of the extracted evidence, 120 structured findings were identified and organized into six integrative dimensions, including implementation steps, tools, methodologies, artifacts, validation models, and organizational roles. Based on this synthesis, a support instrument is proposed to consolidate dispersed research evidence and assist organizations in implementing Ensuring Quality practices within CMMI 3.0 environments..
Download

Paper Nr: 58
Title:

Agentic AI Workflow: From Natural Language Requirements to Verifiable and Executable Models

Authors:

Vladimir Estivill-Castro and René Hexel

Abstract: We integrate Agentic Artificial Intelligence into the Behavior-Engineering Method. The goal is to facilitate the creation of complex systems (embedded systems, robotic systems, cyber-physical systems) through a workflow where humans collaborate with AI agents to transform natural language requirements into executable and verifiable models. The proposed approach stands out for its ability to maintain traceability from requirements to implementation. Unlike other uses of AI that focus only on generating code, this method emphasizes the construction of safe, explainable and transparent models where the human always maintains control of validation (human-in-the-loop).
Download

Paper Nr: 127
Title:

Towards a Pattern Language for Green Computing

Authors:

Martin Beisel and Benjamin Weder

Abstract: Software is used in our modern world to increase automation in almost all areas: From simple calculations to complex tasks, such as self-driving vehicles or coding agents based on artificial intelligence. While this automation increases efficiency and convenience for the users, it has an often overlooked negative impact on the environment, primarily caused by the severe energy and water consumption. Various approaches to reduce this impact and to develop and operate software more sustainably were developed in recent years. However, the wide adoption of these approaches is currently missing due to a lack of knowledge about green software development, operations, and usage. Hence, a common knowledge base must be established that facilitates applying green computing solutions. Patterns are a well-known concept to document and share knowledge about proven solutions to commonly recurring problems in an abstract manner. Therefore, they are also promising for documenting green computing solutions and best practices and to use them for reference or educa-tional purposes. However, there exists no pattern language documenting and connecting relevant knowledge about green software development, operation, and usage. In this paper, we envision a pattern language for green computing, covering the various phases of the software lifecycle in which green computing solutions can be applied, as well as important application areas, such as artificial intelligence or cloud computing.
Download

Area 3 - Software Systems and Applications

Full Papers
Paper Nr: 29
Title:

Trustworthy AI: Operationalizing Responsibility in Lifecycle-Aware AI Threat Modeling through RACI

Authors:

Faiza Tahir, Ubaid Ullah and Eric Bodden

Abstract: Artificial Intelligence (AI) is a key driver of digital transformation across sectors. However, its rapid adoption introduces significant challenges in governance, security, and accountability. Modern AI systems, particularly generative and adaptive models, exhibit non-deterministic behavior, evolving data dependencies, and distributed ownership. These characteristics limit the effectiveness of traditional threat modeling approaches. At the same time, existing governance frameworks treat accountability primarily as a managerial concern and do not integrate it into technical threat modeling processes. This disconnect leads to fragmented oversight, unclear role ownership, and increased security and compliance risks across the AI lifecycle. To address this gap, this paper proposes a lifecycle-aware threat modeling framework for Secure and Trustworthy AI that embeds RACI (Responsible, Accountable, Consulted, Informed) roles into each stage of the threat modeling process. By linking technical threat analysis with explicit accountability, the framework transforms governance into an operational security mechanism. It enables systematic identification of AI-specific risks while ensuring traceable decision-making and clear risk ownership. The framework further extends to distributed AI ecosystems (RACI+X) by incorporating external actors into the accountability structure. Overall, the approach strengthens resilience against evolving risks and supports secure, transparent, and accountable AI deployment.
Download

Paper Nr: 45
Title:

Continuous Quality Assessment of Web Applications through Software Observability

Authors:

Bachar Rima, Anas Shatnawi and Abdelhak-Djamel Seriai

Abstract: Understanding how web applications behave at runtime is central to their comprehension and maintenance. Continuous quality assessment supports this understanding by evaluating quality attributes such as performance, usability, and reliability during system operation. While software observability provides the technical foundation for such assessment, its practical realization remains limited by four interrelated challenges: (1) divergent stakeholder perspectives; (2) underspecified mappings between quality goals and the observable data needed to assess them; (3) performance overhead from indiscriminate data collection; and (4) intrusive code modifications for instrumentation. Existing approaches address these challenges separately but lack a unified, goal-driven framework connecting quality goals to the data and mechanisms that operationalize them. This paper introduces SoftScanner, an approach that integrates quality modeling, observability, and automated instrumentation for continuous assessment of frontend web applications. SoftScanner links ISO/IEC-aligned goals to runtime-measurable metrics and observable data (SSQMM), generates lightweight goal-specific instrumentation agents (SAIF), and computes normalized, traceable quality scores (SEQA). Evaluation on four web applications-two industrial and two open-source-shows that SoftScanner reduces assessment effort by orders of magnitude, achieves complete agreement with ground truth under the evaluated conditions, and substantially lowers runtime overhead compared to a general-purpose observability baseline.
Download

Paper Nr: 54
Title:

Agentic AI for Self-Healing Microservices: An LLM-Orchestrated Framework for Autonomous Fault Detection and Remediation in Regulated Enterprise Environments

Authors:

Ketankumar Savajiyani

Abstract: Enterprise-scale distributed microservices in regulated environments operate under stringent availability, latency, and auditability requirements. Traditional monitoring approaches detect anomalies reactively, after service degradation has already impacted end users or regulatory SLA (Service Level Agreement) obligations. This paper presents the Cognitive Agentic Self-Healing Platform (CASP): an LLM-orchestrated agentic system that continuously monitors distributed microservice environments, autonomously diagnoses fault conditions across six failure categories, and executes targeted remediation actions without human intervention. CASP integrates a structured four-phase autonomous loop comprising detection, diagnosis, remediation, and verification, with an LLM decision engine supporting both cloud-hosted and locally deployable backends, enabling deployment in air-gapped environments subject to data residency requirements. Evaluation on a controlled synthetic workload, calibrated against published benchmark profiles, demonstrates 88.3% overall diagnostic accuracy, an 83% reduction in mean recovery time compared to no self-healing, and a 53% reduction compared to static rule-based approaches. Post-recovery latency stabilizes within 7 minutes. The locally deployable LLM backend achieves p95 decision latency of 4.9 seconds, within the 5-second operational SLA threshold, making it viable for production deployment in regulated environments subject to data residency requirements.
Download

Paper Nr: 69
Title:

A Unified Framework for the Detection and Classification of Fatty Pancreas in Ultrasound Images

Authors:

Ioan-Tudor-Alexandru Anghel, Ciprian-Mihai Ceausescu, Elena Dana Nedelcu, Elena Raluca Știrban, Camelia Croitoru, Despina Ungureanu and Gabriela Pop

Abstract: Non-alcoholic fatty pancreas disease (NAFPD) is an underdiagnosed condition associated with metabolic syndrome, insulin resistance, and increased risk of pancreatic cancer. Diagnosis typically relies on subjective visual assessment of ultrasound images by clinicians. We propose an end-to-end framework for automatically classifying normal versus fatty pancreas from abdominal ultrasound images. Our method employs a TransUNet-based segmentation architecture with a ResNet encoder and transformer bottleneck to delineate the pancreas and the splenic vein, followed by anatomically-guided patch extraction and patient-level classification through pairwise texture comparison. The feature engineering mimics clinical reasoning by comparing the echogenicity of peri-venous fat to the pancreatic parenchyma, providing an interpretable signal for classification. The segmentation models are initialized via domain-specific transfer learning from a liver segmentation task. We validate the full pipeline on a clinical dataset of 214 abdominal ultrasound images with 107 expert-labeled cases using 5-fold cross-validation. SVM with RBF kernel achieves a mean cross-validated accuracy of 89.7% ± 1.8% and F1 of 0.898 ± 0.019, while the unsupervised K-Means baseline reaches 87.8% accuracy, demonstrating that the proposed features capture the relevant clinical signal even without labeled training data. To our knowledge, this is the first end-to-end automated framework for fatty pancreas classification from ultrasound using segmentation-guided texture analysis.
Download

Paper Nr: 90
Title:

From Accuracy to Reliability: A Trust-Centric Machine Learning Framework for Safe Decision-Making

Authors:

Yusuf Surajo, Shuib Basri, Abdullateef Oluwagbemiga Balogun, Hussaini Mamman and Aliyu Garba

Abstract: Accuracy alone is insufficient for machine learning systems that support high-stakes decisions under uncertainty and distribution shift. This paper proposes a trust-centric framework that integrates ensemble-based uncertainty estimation, maximum mean discrepancy (MMD) shift detection, a dependability signal, and safety-aware decision logic to prioritize reliable actions over raw predictive confidence. The framework first estimates prediction reliability and then modulates action selection through feasibility constraints and a conservative fallback policy when dependability is low. Evaluation on three high-stakes decision scenarios under controlled distribution-shift stress tests shows that the proposed framework reduces high-confidence errors from 18.3% to 6.8%, decreases constraint violations from 12.7% to 1.4%, and improves decision stability from 0.42 to 0.22 relative to an accuracy-only baseline, while maintaining competitive average utility. Ablation results further show that uncertainty weighting, shift detection, and fallback control each contribute to these gains. These findings support the need for reliability-aware, constraint-aware decision systems in safety-critical applications.
Download

Paper Nr: 103
Title:

TAE-MAGSAGE: Topology Aware Metric Learning for Graph Based Network Intrusion Detection

Authors:

Poonam Bala Nehru, Yunpeng Zhang, Renjie Hu and Changqing Luo

Abstract: The modern network environment, whether enterprise systems or critical infrastructure, is increasingly exposed to sophisticated cyber threats that must be effectively detected. The existing GNN-based approaches construct graphs using feature-similarity heuristics, and connect flows that are statistically similar to one another but not necessarily communicating, hence capturing geometry specific to the dataset. On the other hand, communication topology is a representation of interaction patterns based on real network behaviour. We introduce TAE-MAGSAGE, an edge-centric graph learning model which uses the observed communication structure to construct graphs and applies a line graph transformation to perform flow-level classification without collapsing the interaction relationships. A Mahalanobis-inspired metric warp in message passing reconfigures neighborhood similarity with respect to the discriminative feature dimensions, and a Ledoit–Wolf regularized Mahalanobis distance-based classifier learns class-conditional distributions to deal with severe class imbalance. TAE-MAGSAGE achieves an accuracy of 99.31% on the CIC-IDS-2017 dataset, macro F1 of 98.10%, and a false alarm rate of 0.56%, outperforming graph-based baselines. These results show that constructing graphs based on communication structure, combined with metric-conscious embedding and distribution-conscious classification, improves minority attack detection while reducing false alarms.
Download

Paper Nr: 107
Title:

A Hybrid Machine Learning–LLM Intrusion Detection Framework with Semantic Log Enrichment for ATMS Networks

Authors:

Muzamil Raheman Shaik, Yunpeng Zhang, Changqing Luo and Renjie Hu

Abstract: Modern Advanced Traffic Management Systems (ATMS) extensively use a range of heterogeneous IoT devices,including roadside units, traffic signal controllers, vehicle detectors, and dynamic message signs, which produce large volumes of fast network traffic and are vulnerable to cyber attacks. Conventional Intrusion Detection Systems (IDSs) have difficulty scaling to these scenarios and understanding the heterogeneous nature of cyber attacks, and the application of LLMs over all flows is not feasible due to computational constraints. We propose a hybrid two-stage IDS framework that can solve both problems. Stage 1 utilizes a Random Forest classifier to filter out benign traffic from suspicious flows with a binary F1-score of 0.980. In Stage 2, the flagged flows undergo semantic enrichment, transforming raw numerical traffic features to natural language descriptions, and then are inspected by finetuned LLMs. For example, we fine-tune LLaMA 3.1-8B using Low-Rank Adaptation (LoRA), and GPT-4o-mini and Gemini 2.5 Flash through provider APIs on the CIC-IoT-2023 dataset. The LLM-based stage produces a macro F1-score of 0.952 for suspicious traffic. Our proposed framework achieves a weighted end-to-end pipeline accuracy of 0.950, calculated by combining the Stage 1 traffic filtering performance and the Stage 2 attack classification performance across the entire test dataset. This metric reflects the overall effectiveness of the complete two-stage detection pipeline.
Download

Paper Nr: 119
Title:

Compliance by Architecture: A Case Study in Regulatory-Driven SaaS Design for UK Children’s Residential Care

Authors:

Branson Kouaya and Jagdev Bhogal

Abstract: Children’s residential care homes in the United Kingdom operate under a statutory inspection regime in which Ofsted evaluates care quality against the Social Care Common Inspection Framework (SCCIF), a structured judgement model requiring evidence across children’s progress, safeguarding, and leadership effectiveness. Existing compliance software organises records by operational category rather than by the regulatory evidence structure used during inspection; no published work has demonstrated how inspection framework structure can be embedded as a first-class software architecture concern. This paper argues that regulatory compliance problems are fundamentally architectural: regulatory frameworks can serve as organising models for data, access control, and interface design — a principle termed compliance by architecture — with the potential to reduce evidence retrieval burden and improve inspection preparedness. KingCare, a deployed multi-tenant SaaS platform for UK children’s residential care homes, is presented as a case study implementing this principle through ASP.NET Core, Blazor Server, Entity Framework Core global query filters, Azure SQL, and SCCIF-mapped evidence views; evaluation combined functional validation, expert review, and a System Usability Scale (SUS) study with 29 participants. Findings indicate that embedding SCCIF structure into the data architecture reduced expert evidence retrieval time from eight minutes to 45 seconds and produced a mean SUS score of 83.3, significantly exceeding the 68-point acceptability benchmark (t(28)=5.353, p<0.001, Cohen’s d=0.99). The paper contributes a transferable software engineering pattern for compliance-critical domains; limitations including single-expert validation and absence of longitudinal inspection-cycle data are discussed.
Download

Short Papers
Paper Nr: 28
Title:

A Data-Oriented Entity Component System Architecture for Real-Time Game Engines: The Blubber Engine Case Study

Authors:

Fadi Atwi and Mageda A. A. Sharafeddin

Abstract: Real-Time games demand predictable performance under tight frame-time budgets, yet many popular engines hide data layout and memory behavior behind object-oriented abstractions. This paper presents Blubber Engine, a low-level C game engine built around a hybrid data-oriented entity–component–system (ECS) architecture. Actors use dynamic component pools for flexible composition, while high-volume archetypes such as bullets, particles, and static geometry are stored in fixed, structure-of-arrays (SoA) layouts and updated via a grid-based collision system and global timer pools. The engine is validated through WhaleFall, a mechbased arena First Person Shooter (FPS) that exercises projectile-heavy combat, and a custom outline shader, demonstrating that conventional FPS mechanics can be supported without compromising data-oriented design. We empirically evaluate several design choices. A 3D boids benchmark compares structure-of-arrays (SoA), array-of-structures (AoS), and structure-of-pointers (SoP) layouts under identical spatial-partitioning and rendering. SoA roughly doubles the achievable frame rate relative to AoS and maintains performance while SoP suffers nearly 5× more cache misses and severe slowdowns as the working set outgrows cache. Microbenchmarks show that explicit SIMD intrinsics provide up to 3–4× higher throughput than scalar code while the working set fits in cache, and that pooling uniformly processed components (timers) yields ≈ 2× higher update rates and fewer L1 misses than inline per-archetype storage. Together, these results quantify the benefits and limits of data-oriented layouts in a production-style engine and provide practical guidance for ECS-based game engine design.
Download

Paper Nr: 32
Title:

A Security Taxonomy and Comparative Evaluation of Package Repository Architectures

Authors:

Arnaud Stoz

Abstract: Software supply chains are a critical and growing attack surface: virtually every software system depends on external packages, and a single compromised registry can affect millions of users. This paper reviews the architecture of ten widely used package managers - APT, Pacman, dnf/RPM, Homebrew, Nix, npm, pip, the Go module system, cargo, and Maven Central - evaluating each against three security properties: transparency, validity, and separation. We identify three primary repository topologies, two identity management models, and three package integrity mechanisms. The extended comparison reveals that no single architecture excels across all dimensions, and that the integrity mechanism is the primary differentiator between ecosystems.
Download

Paper Nr: 35
Title:

Une: A Position on Declarative, Natural-Language-Oriented DSLs for IoT Programming

Authors:

Francisco Morero-Peyrona, Javier Gutiérrez-Rodríguez and Nicolás Sánchez-Gómez

Abstract: The Internet of Things poses a persistent and largely unsolved tension: low-cost hardware demands low-level programming expertise, while accessible high-level abstractions assume costly infrastructure. We present Une, a declarative domain-specific language (DSL) for IoT that argues for a three-pillar design position: (i) a natural-language-oriented, command-centred syntax that dramatically lowers the cognitive barrier to entry; (ii) a rule-based formal core augmented with a subset of Interval Temporal Logic (ITL) that provides expressive, time-aware event-condition-action semantics without general-purpose programming constructs; and (iii) a transpilation-based, modular runtime—the Mingle platform—that achieves hardware agnosticism, hot-swappability, and cooperative distributed execution on devices as constrained as a single-board computer with low resources. Empirical comparison against Java (pure and with Pi4J) and Python + RPi.GPIO on a Raspberry Pi demonstrates reductions of up to 99% in lines of code and an order-of-magnitude improvement in maintainability index. A two-year live deployment across 117 devices in a four-room hotel corroborates the system’s operational robustness. We release an open-source reference implementation to catalyse further research on NL-oriented programming for the IoT.

Paper Nr: 46
Title:

Designing a Serious Game to Support Socio-Emotional Skills Development in Children with Autism Spectrum Disorder: A Context-Aware Approach for Senegal

Authors:

Awa Diattara and Cheikh Abdoul Ahad Mbacke Diop

Abstract: This work presents the design of a serious game aimed at developing socio-emotional skills in children with Autism Spectrum Disorder (ASD), particularly emotion recognition, emotional regulation, and social communication. Given the limitations of traditional educational approaches, serious games offer an engaging and adaptive alternative for children with ASD. After analyzing existing solutions such as EmoFace, JeStimule, and EmotiPlay, we propose a culturally contextualized serious game adapted to the Senegalese environment. The prototype integrates simplified avatars, immediate positive feedback, a narrative journey through Senegal (Dakar, Saint-Louis, Casamance), and 2D/3D mini-games focused on emotion recognition. Its technical architecture combines Unity, Node.js/Express.js, MongoDB, and React. The methodology relies on literature review, expert interviews, brainstorming sessions, and iterative development. Although the prototype has not yet been tested directly with children with ASD, expert feedback suggests promising potential for supporting socio-emotional learning in this population.
Download

Paper Nr: 47
Title:

From Runtime Reflection to Compile-Time Specialization: A Template-Based Approach to Runtime Libraries

Authors:

Teodor-Ștefan Duţu, Albert Guiman, Răzvan-George Niţu and Constantin-Eduard Stăniloiu

Abstract: In low-level programming, performance is usually the primary concern, the programmer having almost full control over the generated code, and therefore its metrics. This control is achieved through system-level programming languages, and most of them these days employ language design concepts such as generic programming and runtime type reflection, which the programmer can leverage depending on their needs (e.g. choosing between performance and flexibility). In the past, some proof-of-concept work has been done to convert D's runtime library (DRuntime) from a monolithic, TypeInfo-based architecture to a template-based one, observing initial performance improvements of up to 25%. In this paper, we consolidate and extend those results, detailing the performance impact of each hook and evaluating the trade-offs between performance, compilation time and binary size. Our findings confirm an increase in performance of up to 99% for the template-based implementations, with minimal impact on compilation time and binary size. This work is not limited to the D programming language, but can be extended to any other language that supports the same feature set, such as C++, Rust, and Go.
Download

Paper Nr: 62
Title:

A Comparative Study of LLMs and Human Judgment in UML Diagram Evaluation

Authors:

Olena Chebanyuk and Carles Sierra

Abstract: Large Language Models (LLMs) are increasingly used to evaluate software engineering artifacts. This paper investigates the reliability of LLMs in evaluating UML diagrams generated through reverse engineering processes (source code). We ask: do LLM assessments align with those of human experts? A COMAS-based framework is proposed for trust-aware LLM selection. In the original COMAS, indirect trust is computed via Dijkstra max-product chains. We replace this with direct human–LLM comparisons for each criterion independently. This is valid since LLMs can evaluate any diagram on demand. Trust is measured using an L1-norm-based divergence that is robust under small-sample conditions. The developed framework supports flexible per-criterion LLM selection via expert-defined thresholds and weights. An empirical study involved 30 students evaluating five UML sequence diagrams. Four evaluation criteria were used: completeness of requirements description, non-contradiction to requirement specification, UML notation compliance, and Miller’s principle. Four LLMs were compared: Groq, Gemini, Mistral, and Copilot. For 90% of participants, a combination of two or three LLMs outperformed any single model. Hybrid per-criterion LLM selection is a viable strategy for automated UML diagram evaluation.
Download

Paper Nr: 67
Title:

Architecture-Centric Code Migration for Legacy Industrial Systems Using LLMs

Authors:

Ayush Luhar, Dev Trivedi, Vatsal Patel, Vijetha Kamath, Utkarsh Balu Lubal and Muhammad Abdul Basit Ur Rahim

Abstract: This research focuses on Maven configuration and structure updates and explores how the CodeT5 model can automate the migration of Java 8 projects to Java 17. Manually migrating large Java applications is a tedious and error-prone task that requires significant developer time and attention. To create a high-quality training dataset, Java 8 projects are collected from GitHub and manually converted to Java 17 using large-scale modern language models such as ChatGPT and Claude. Each repository is migrated module-by-module to ensure structural and functional accuracy. This process has created a parallel dataset of approximately 100 repositories, formatted as a JSONL file to allow efficient fine-tuning of small CodeT5 models. The model fine-tuning is evaluated using standard metrics, including BLEU, ROUGE, and BERTScore. The results show strong semantic agreement between the generated and reference outputs, with a BERTScore F1 of 0.982 and token precision of 0.9990. The model accelerates parts of migration but remains unsuitable for fully automated use due to truncated outputs and incomplete Java file structures, with an average output-length ratio of 0.8 and an accuracy of 62% for the Java version.
Download

Paper Nr: 75
Title:

The Cost of Purity: Scalability Challenges in the Pure Operation-Based CRDT Framework

Authors:

Léo Olivier, Jim Bauwens, Marcos Didonet Del Fabro and Sébastien Gérard

Abstract: Conflict-free Replicated Data Types (CRDTs) are widely used to build fault-tolerant, highly available distributed systems, including collaborative applications (e.g., text editors), Local-First software, and distributed databases. The pure operation-based CRDT framework was introduced to simplify the design, implementation, and verification of replicated data types by cleanly separating communication concerns from data-type semantics. However, its scalability implications remain unexplored. This paper presents a systematic analysis of the time and space complexity challenges of the framework, identifying performance bottlenecks in causality tracking, timestamp representations, partially ordered logs, redundancy evaluation, query execution, and causal stability detection. We discuss practical mitigation strategies and design trade-offs, showing that while the framework is conceptually sound, achieving efficient implementations requires substantial engineering effort. We report preliminary results demonstrating the effectiveness of the proposed mitigation strategies.
Download

Paper Nr: 76
Title:

Hybrid Edge Monitoring and Dependable Alert Delivery for UAV-Assisted Cattle Monitoring

Authors:

Antonello Calabrò and Eda Marchetti

Abstract: Livestock monitoring in infrastructure-poor agricultural areas is challenging due to limited connectivity, energy constraints of wearable devices, and the need for timely anomaly detection. This paper presents a concern-oriented architecture for cattle monitoring combining LoRa-equipped collars, a UAV acting as a mobile gateway and edge monitoring node, and a farmer-side node with a configurable runtime monitoring interface. The architecture features lightweight on-board rule evaluation for low-latency anomaly detection and a dependable dispatcher that selects among Wi-Fi, LTE/4G, Iridium satellite, and deferred synchronization using a terrestrial-first, time-bounded escalation policy. Domain concerns such as missing beacons, geofence violations, and prolonged immobility are modeled as explicit runtime rules. An in~vitro evaluation shows that on-drone rule evaluation reduces detection latency by two orders of magnitude compared with ground-centric processing, while dependable multi-channel dispatch achieves 100% critical-alert delivery within the latency budget under simulated terrestrial outages, compared with 55-67% for fixed-policy configurations.
Download

Paper Nr: 80
Title:

Petri Net–Based Heuristic Scheduling for Improving the Efficiency of Reconfigurable Manufacturing Systems

Authors:

Salah Hammedi, Haythem Chniti and Lotfi Nabli

Abstract: This paper presents a hybrid scheduling framework for Reconfigurable Production Systems (RPS) that integrates Timed Petri Nets (TPNs) with three heuristic optimization algorithms: Genetic Algorithm (GA), Particle Swarm Optimization (PSO), and Simulated Annealing (SA). TPNs are employed to formally model system dynamics, resource constraints, and task dependencies, while heuristic algorithms optimize scheduling decisions to minimize makespan, reduce tardiness, and improve resource utilization. By combining formal system modeling with adaptive optimization, the proposed approach ensures both schedule feasibility and operational efficiency in dynamic manufacturing environments. Experimental results demonstrate that the framework outperforms traditional scheduling rules, including FCFS, SPT, and EDD, achieving a 25–30% reduction in makespan and more than 20% improvement in resource utilization. Furthermore, the integration of Petri-net state feedback with heuristic search enhances adaptability and robustness under reconfiguration events. The proposed framework provides an effective decision-support solution for intelligent production scheduling and contributes to the development of flexible and efficient Industry 4.0 manufacturing systems.
Download

Paper Nr: 81
Title:

AURORA: Adaptive Crypto-Compliant qUantum-Ready Architecture for zerO-tRust dAta Ecosystems

Authors:

Antonello Calabrò, Eda Marchetti and Sanaz Nikghadam-Hojjati

Abstract: Current privacy-enhancing architectures for cloud, edge, and IoT data sharing treat cryptographic protection, zero-trust verification, and regulatory compliance as separate concerns, limiting adaptability to evolving threats and dynamic regulations like the GDPR, Data Act, and AI Act. This paper introduces AURORA, a modular enclave-based architecture that unifies these aspects within a single framework. AURORA consists of two components: attested Privacy-Preserving Enclaves (P-PEs) with up to four specialized modules (Hives), and a Security Enclave Manager (SEM) that oversees attestation, key lifecycle, and policy distribution. We detail the Hive structure, including interfaces, responsibilities, and failure modes. An LLM-assisted governance layer translates regulatory texts into enforceable policies, subjecting generated policies to formal validation gates before deployment. The architecture is specified using a model-based systems engineering methodology, and we illustrate its use in a healthcare data-sharing workflow traced across architectural components.
Download

Paper Nr: 83
Title:

Studying Type System Usability in an Inexpensive and Replicable Way: A Repeated, Generated N-of-1 Trial on the Effect of (Nominal and Annotated) Static and Dynamic Types in Constructor Calls

Authors:

Stefan Hanenberg, Stefan Gries and Volker Gruhn

Abstract: There are ongoing discussions about possible pros and cons of static type systems. One reason could be that there are experiments that show a negative effect of static type systems while others show a positive effect. Because of that, replications of such experiments are indispensable. However, these experiments are not replicated, and one possible reason is that they are too expensive to replicate: the effort for a single participant is high (there are experiments in the literature where a single data point required 27 hours per participant). And since hardly other factors than type system are studied in the literature in a controlled way, insights from such experiments are relatively low. The present paper introduces a repeated, generated N-of-1 experiment on type systems that was executed on 22 participants who wrote constructor calls (with a varying number of parameters). The study reveals a strong type system effect (p < .001, η2 p = .163, Mdynamic Mstatic = 2.21): Participants required on average 121% more time with the dynamic type system. Additionally, there was a strong and large interaction effect on the measured differences (p < .001, η2p = .280) showing that with an increase of the number of parameters the difference between static and dynamic types become larger. Hence, the experiment was able to reveal a positive effect of static type systems and one additional factor that controls measured differences between type systems. The costs for the experiment were relatively low costs–it required on average 4.7 minutes per participant to get an analyzable data set consisting of twelve data points. We think that such kind of experiments can be used as a template for further experiments to reduce costs, to increase the chance of replications, and to study further factors in a controlled way.
Download

Paper Nr: 95
Title:

Kind of Quantity Analysis on a Shoestring

Authors:

Steve McKeever

Abstract: In scientific and engineering applications, physical quantities embodied as units of measurement (UoM) are frequently used. While managing units of measurement is a fairly mature topic in software engineering, more subtle metrological concepts such as distinct kinds and dimensionless quantities have had little traction. Many programming language libraries for units of measure adopt vector-based representations in which quantities are reduced to numeric values paired with exponent vectors over base dimensions. While effective for dimensional consistency checking, this approach collapses several distinct semantic layers. In particular, kinds of quantities are not represented explicitly such that torque and work are indistinguishable. We present a simple extension to the vector-based approach with a pairwise representation that retains information about how quantities are constructed, enhancing standard dimensional analysis with provenance tracking and principled diagnostics.
Download

Paper Nr: 102
Title:

Modeling and Mitigating Physical Layer Jamming in Connected Vehicular Networks

Authors:

Kumoulica Allu, Yunpeng Zhang, Changqing Luo and Renjie Hu

Abstract: Connected vehicles rely on Vehicle to Everything (V2X) communication to enable safety critical and cooperative driving applications. The open nature of wireless channels makes these systems vulnerable to physical layer jamming attacks, which can disrupt message exchange and potentially compromise traffic safety. In this paper, we present an integrated co-simulation framework that models jamming attacks in connected vehicular networks using OMNeT++, SUMO, and Veins. We emulate realistic barrage style jamming through protocol compliant interference at the IEEE 802.11p physical layer and evaluate its impact on key communication metrics including Packet Delivery Ratio (PDR), latency, and channel utilization. We further implement Frequency Hopping Spread Spectrum (FHSS) as a mitigation strategy and assess its effectiveness under sustained interference. Our results show that a single 200 mW jammer reduces PDR from 100% to 9.1%, and that FHSS reduces SNIR corrupted frames by 63.3% while simultaneously suppressing jammer throughput by 49%. Beyond the security evaluation, this work contributes a modular, reproducible simulation framework explicitly designed to support the vehicular security research community.
Download

Paper Nr: 111
Title:

Replication and Extension of FuseFL: Demystifying Faulty Code with LLM Step-by-Step Reasoning for Explainable Fault Localization

Authors:

Bansi Patel, Nishi Shah and Muhammad Abdul Basit Ur Rahim

Abstract: Fault localization is a critical yet time-consuming step in software debugging, requiring developers to identify the specific program elements responsible for failures. FuseFL, introduced by Widyasari et al. (2024), addresses this by combining Spectrum-Based Fault Localization (SBFL) results, test case execution outcomes, and natural language code descriptions as a structured prompt to a Large Language Model (LLM) to produce ranked fault predictions alongside step-by-step explanatory rationale. This study presents a full replication of FuseFL on the Refactory dataset and extends the evaluation to four open-source models via the Groq inference API: Llama 3.3 70B, Llama 3.1 8B, Qwen3 32B, and GPT-OSS 20B. An iterative refinement framework is also introduced, incorporating multi-step reasoning through initial explanation generation, self-critique, and refined synthesis. The replication confirms the Top-1 score of 197 for FuseFL (GPT-3.5), validating a 25.5% improvement over the replicated Ochiai baseline and a 31.3% improvement over the LLM baseline (Wu et al., 2023). Three of four Groq-hosted models exceed FuseFL (GPT-3.5) at Top-1: Llama 3.3 70B and Qwen3 32B each achieve 218 faults localized (+10.7%), while Llama 3.1 8B achieves 214 (+8.6%). Llama 3.3 70B's advantage is statistically significant at the 5% level (p = 0.046, d = 0.135). The iterative refinement framework produces more structured, root-cause-focused explanations compared to the original one-shot outputs in a qualitative analysis; formal quantitative evaluation of explanation quality remains an open direction for future work. All evaluation scripts and result files are publicly available at: https://github.com/Bansi5513/fusefl-replication-extension.
Download

Paper Nr: 39
Title:

A Data Security Risk Management Framework for Medical Device Software AI Model Lifecycle: Alpha Version

Authors:

Buddhika Jayaneththi, Fergal Mc Caffery and Gilbert Regan

Abstract: Assuring data security is a critical requirement that must be addressed across the entire lifecycle, i.e., from data ingestion to maintenance of an artificial intelligence (AI) model embedded within a medical device software (MDS). Implementation of a risk management process (RMP) is one of the most effective approaches for managing the data security risks. Although existing standards including ISO 14971, AAMI TIR57, ISO/IEC 27005, and NIST frameworks, provide high-level risk management guidance, they do not operationalise data security risk management across the MDS AI model lifecycle. Prior evaluations have identified several gaps and implementation challenges in current risk management standards and frameworks, including absence of AI-specific threat and vulnerability taxonomies, a structured risk estimation process, and a structured risk control implementation guidance. This paper presents the Alpha version of a data security risk management framework designed for MDS AI model lifecycle. The framework provides a comprehensive RMP by introducing AI model lifecycle-mapped assets, threats, vulnerabilities, controls, and control implementation details, a structured risk estimation model, and structured guidance for residual risk evaluation, benefit-risk analysis, overall residual risk acceptability, and risk management report preparation. The framework is currently undergoing expert review for validation and will subsequently be evaluated through industry implementation.
Download

Paper Nr: 42
Title:

Exploring the Effect of Multiple Languages on Code Suggestion Using ChatGPT 5.2

Authors:

Jonathan José Cardoso de Sales and Sandro Ronaldo Bezerra Oliveira

Abstract: Artificial Intelligence (AI)-based code suggestion tools are becoming increasingly relevant in the software development community. While several studies analyse the quality and security of these tools, relatively few systematic studies have investigated how different input text languages can affect the effectiveness of code generation models. Similar research has been conducted with other tools, addressing multiple programming languages and different languages and challenge platforms. However, it is important to expand this knowledge base by considering additional scenarios. In this study, we analyse the performance of ChatGPT 5.2 in generating Python solutions for 70 programming problems extracted from the Beecrowd repository, considering three languages: Portuguese, English and Spanish. These 70 challenges were selected to encompass a range of difficulty levels for mathematical problems. Each question was submitted to the model five times in each language and the accuracy rate was evaluated using the platform’s validation tests. It was observed that Portuguese prompts generally showed a slight advantage in terms of the accuracy rate compared to prompts in other languages. However, the analysis of variance (ANOVA) indicates that this variation was not significant at the 5% level. The aim of this article is to extend current knowledge about the impact of languages on code generation by demonstrating that the language used in the problem description may or may not affect the ability of AI models to provide correct solutions. Finally, this article discusses the influence of potential linguistic biases, as well as opportunities for future research to address other languages, different problem modalities and various AI tools.
Download

Paper Nr: 86
Title:

Verifying Machine Learning Testability Requirements with Provenance

Authors:

Lynn Vonderhaar, Tyler Thomas Procko and Omar Ochoa

Abstract: As Machine Learning (ML) becomes increasingly important in a variety of domains, including safety-critical ones, developers are becoming more interested in improving the rigor with which ML models are developed. These improvements further the field of ML Engineering, which aligns ML development with tried-and-true methods of software engineering and requirements engineering. Prior work in this area has defined Non-Functional Requirements (NFRs) for ML-based systems but also notes the difficulty in measuring and verifying these NFRs. Our previous work defines a novel provenance-driven approach that decomposes ML NFRs into provenance Functional Requirements (FRs) using a provenance NFR as a medium. This paper verifies the approach for testability NFRs by leveraging system provenance to increase traceability in three testability case studies. Specifying provenance artifacts to be saved enables verification of a provenance NFR and by extension, the testability NFR. The results show that provenance can quantify otherwise immeasurable testability NFRs, enabling more rigorous, requirements-based ML engineering.
Download

Paper Nr: 87
Title:

An AI-Driven Digital Twin Framework for Personalized COPD Treatment Optimization

Authors:

Hamid Mcheick, Pamela Achouh and Hassan Hajjdiab

Abstract: COPD is a progressive and heterogeneous pulmonary ailment that poses serious difficulties in its management due to the need for considering patient-to-patient variability in physiological parameters, disease state and reaction to different therapeutic measures. While artificial intelligence (AI) has demonstrated remarkable potential as a tool in decision making in medicine, most of AI approaches developed to date have been highly deterministic, meaning that they provide for just one output per one input. This becomes critical for COPD since even small alterations in pulmonary functionality, levels of oxygenation, blood gas composition, or performance in physical activity may change recommendations for treatment. In this study, an end-to-end AI-enabled Digital Twin solution is designed to optimize COPD treatment. The Digital Twin solution uses a multi-label machine learning algorithm and the Digital Twin simulator engine, and the entire solution is implemented via the web-based clinical application. A large COPD dataset consisting of 339,929 patients' records was used to train the model, and it underwent extensive data cleaning, normalization, feature extraction, imputation of missing values, and treatment coding. A multi-label classifier based on the LightGBM algorithm was trained using treatment decisions documented by physicians. To increase the robustness and explainability of decisions, the digital twin engine creates 200 realistic replicas of each patient based on controlled perturbation of their critical dynamic characteristics. Those replicas are analysed by the AI algorithm, and the aggregation of the resulting predictions is used to determine a recommendation, treatment stability score, and influence of each characteristic on the decision. This framework can be realized using a web-based system that allows physicians to sign up, manage patient information, run simulations, examine their results, analyse simulation history, and for administrators to monitor the usage and patient interactions. According to our experiments, our approach managed to reach 91.9% accuracy in total and 60% in exact matches. Moreover, the digital twin component provided valuable clinical insights regarding prediction robustness and uncertainty.
Download

Paper Nr: 110
Title:

Don’t Just Translate: Verify - LLM-Guided Solidity Migration with Semantic Guarantees

Authors:

Arnab Mukherjee, Soumyadip Bandyopadhyay, Raju Halder and Dominique Blouin

Abstract: Smart contracts operate in immutable blockchain environments where preserving correctness during software evolution is critical. The transition from Solidity 0.5.x to 0.8.x introduces important safety improvements but also semantic changes that make manual migration of legacy contracts error-prone. Although large language models (LLMs) can automatically translate code across versions, they offer no guarantee that the generated contracts preserve the original behavior. This paper presents a closed-loop framework for semantics-preserving smart contract migration that combines LLM-based code generation with formal verification. Our approach performs migration iteratively through compilation, bytecode-level equivalence checking, counterexample generation, and refinement. Behavioral equivalence is verified using differential fuzzing and symbolic execution over Ethereum Virtual Machine semantics, and detected discrepancies are fed back to guide improved LLM outputs.
Download

Paper Nr: 118
Title:

Closed-Loop Control Structure for LLMs

Authors:

César Fernández and María Asunción Vicente

Abstract: A novel architecture for reducing uncertainty in large language models (LLMs) while maintaining high-temperature generation is proposed. The method dynamically adapts the generation temperature according to an uncertainty estimate produced by an external LLM-based evaluator within a closed-loop control framework. The central hypothesis was that adaptive temperature control can reduce response uncertainty while preserving the benefits of high-temperature sampling. Several experiments, conducted on a virtual patient platform and on three subsets of the MMLU dataset, were performed to evaluate both the uncertainty estimation module (sensor module) and the complete control system. The proposed sensor module demonstrated high repeatability (average RSD of 5.35%) and discriminative performance (AUROC ranging from 0.868 to 0.980). The complete control architecture was evaluated under both a self-judge setup (the same LLM used for generation and evaluation) and a cross-model setup. Both configurations achieved similar levels of answer accuracy, comparable to those obtained with a fixed low-temperature strategy. However, differences were observed in the average final temperature of the accepted responses, which remained consistently higher in the self-judge setup (close to 1.0). In addition, computational costs (token consumption and latency) were consistently lower in the self-judge configuration. These results suggest that the self-judge setup is better aligned with the objectives of the proposed architecture. Future work will focus on large-scale evaluations and on further refinement of both the uncertainty estimation module and the control strategy.
Download

Paper Nr: 122
Title:

Agentic AI for Scientific Visualization: Tool-Calling Pipelines for Automated Chart and Diagram Generation in Research Writing

Authors:

Elisavet Persefoni Kanidou and Apostolos Ampatzoglou

Abstract: Producing publication-quality figures from research data is a persistent bottleneck in the scientific writing process, requiring both domain knowledge and visualization expertise that researchers cannot always apply simultaneously. We present two complementary tool-calling AI agent pipelines that together automate the end-to-end production of visual content for scientific manuscripts: a Chart Generation Agent that transforms tabular datasets into rendered statistical charts, and a Diagram Generation Agent that converts natural-language architectural or process descriptions into structured Mermaid diagrams. Both agents operate through a four-step tool-calling loop, using Gemini 2.5 Flash as the primary model with automatic fallback to a locally-hosted LLM for availability and data governance. The chart agent supports five chart types and multi-series visualizations; the diagram agent supports seven Mermaid diagram types including flowcharts, sequence diagrams, class diagrams, ER diagrams, state machines, Gantt charts, and mind maps. Integrated into an open-source research writing platform, both components provide SVG export, editable captions, and transparent agent reasoning traces. A preliminary evaluation with 15 researchers demonstrated 87% chart type accuracy, 73% publication-ready caption rate, and figures produced in under 3 minutes on average for the chart agent (objectively timed via screen-recording), compared to self-reported manual baselines an order of magnitude higher, alongside 91% diagram type accuracy for the diagram agent. The complete system is available as open source.
Download