Guido Salvaneschi

Matteo Biagiola, Jahrim Gabriele Cesario, Luca Di Grazia et al.

Large Language Models (LLMs) have demonstrated strong capabilities in code generation, but their outputs frequently contain syntax or type errors that result in compilation failures. Constrained decoding has been proposed as a solution to mitigate compilation errors by construction, improving functional correctness as a byproduct. However, previous works overlook a critical aspect of constrained decoding: the alignment between constrainer (e.g., types), language model and the target specification language (e.g., TypeScript). Misalignment is caused by the constrainer being incomplete--rejecting programs that belong to the target--or unsound--allowing programs that are not part of the target. The bias created by incompleteness distorts the language model distribution, and can be detrimental for code generation. We evaluate this hypothesis using seven language models, two target languages, two constrainers, enforcing types and syntax during decoding, and we study how language models react to varying levels of incompleteness. On three benchmarks, when the constrainer is incomplete, unconstrained decoding significantly outperforms constrained decoding in terms of functional correctness. Incompleteness pushes the model into low-probability regions of the program space, causing the generation to frequently time out, and reducing functional correctness by up to 97%. These contributions make the community aware of the negative effects of misalignment in constrained decoding, and provide quantitative insights on how to design constrainers that are beneficial for code generation systems with formal guarantees.

Christoph Bühler, Matteo Biagiola, Luca Di Grazia et al.

Large Language Models (LLMs) have evolved into AI agents that interact with external tools and environments to perform complex tasks. The Model Context Protocol (MCP) has become the de facto standard for connecting agents with such resources, but security has lagged behind: thousands of MCP servers execute with unrestricted access to host systems, creating a broad attack surface. In this paper, we introduce AgentBound, the first access control framework for MCP servers. AgentBound combines a declarative policy mechanism, inspired by the Android permission model, with a policy enforcement engine that contains malicious behavior without requiring MCP server modifications. We build a dataset containing the 296 most popular MCP servers, and show that access control policies can be generated automatically from source code with 80.9% accuracy. We also show that AgentBound blocks the majority of security threats in several malicious MCP servers, and that policy enforcement engine introduces negligible overhead. Our contributions provide developers and project managers with a practical foundation for securing MCP servers while maintaining productivity, enabling researchers and tool builders to explore new directions for declarative access control and MCP security.

Danilo Pianini, Guido Salvaneschi

The 1st workshop on Architectures, Languages and Paradigms for IoT (ALP4IoT 2017), was held in Turin on September 19th, 2017. ALP4IoT was a satellite event of the 13th International Conference on integrated Formal Methods (iFM 2017). The workshop aimed at critically reviewing the state-of-the-art and the state-of-the-practice of formal techniques and software methods for the IoT, presenting open problems and challenges and triggering a discussion among the participants with different views and backgrounds. The Internet of Things is ushering a dramatic increase in number and variety of interconnected and smart objects. Communication capabilities and computational power are growingly embedded in everyday devices, including personal smart devices, public displays, cars, drones, and electronic tags. This state of the things opens an unprecedented range of research opportunities: the inherent distribution, mobility, situatedness, and heterogeneity of such devices call for proper scientific understanding of the foundations of such systems as well as for novel software methods. The workshop solicited original contributions on architectures, languages, paradigms, and techniques with potential practical and theoretical impact on software systems targeting the IoT, welcoming inter-disciplinary approaches.