University of Delaware
Abstract
In recent years, various software supply chain (SSC) attacks have posed
significant risks to the global community. Severe consequences may arise if
developers integrate insecure code snippets that are vulnerable to SSC attacks
into their products. Particularly, code generation techniques, such as large
language models (LLMs), have been widely utilized in the developer community.
However, LLMs are known to suffer from inherent issues when generating code,
including fabrication, misinformation, and reliance on outdated training data,
all of which can result in serious software supply chain threats. In this
paper, we investigate the security threats to the SSC that arise from these
inherent issues. We examine three categories of threats, including eleven
potential SSC-related threats, related to external components in source code,
and continuous integration configuration files. We find some threats in
LLM-generated code could enable attackers to hijack software and workflows,
while some others might cause potential hidden threats that compromise the
security of the software over time. To understand these security impacts and
severity, we design a tool, SSCGuard, to generate 439,138 prompts based on
SSC-related questions collected online, and analyze the responses of four
popular LLMs from GPT and Llama. Our results show that all identified
SSC-related threats persistently exist. To mitigate these risks, we propose a
novel prompt-based defense mechanism, namely Chain-of-Confirmation, to reduce
fabrication, and a middleware-based defense that informs users of various SSC
threats.
AI Insights - Eleven SSCârelated threats were catalogued, covering external code components and CI config files.
- 439,138 prompts probed GPT and Llama, revealing all threats persist.
- Prompt injection and jailbreak attacks were validated as vectors against LLMâintegrated apps.
- A middleware layer was proposed to alert developers to emerging SSC risks in real time.
- ChainâofâConfirmation prompts curb fabrication, cutting falseâpositive snippets.
- Hidden, timeâdriven vulnerabilities were found, showing LLM code can silently erode security over releases.
- Even wellâtrained LLMs can supply malicious dependencies, underscoring continuous SSC monitoring.
Federation University of
Abstract
The paper proposes a novel Economic Production Quantity (EPQ) inventory model
within a reverse logistics framework, addressing new and repaired products with
varying quality and demand patterns. The model integrates production and
remanufacturing rates as functions of lot sizes and cycle numbers to develop a
feasible inventory cost function. A key contribution of the study is
formulating a multiobjective optimization framework that simultaneously
minimizes inventory costs and accounts for environmental sustainability by
considering greenhouse gas (GHG) emissions and energy consumption during
production processes. The problem is formulated as a mixed-integer nonlinear
programming (MINLP) model, with integer constraints on lot sizes and cycle
counts and a continuous return rate. Numerical case studies taking test
problems from existing literature are used to validate the model through
extensive sensitivity analyses. Both mathematical optimization and heuristic
optimization methods are applied to solve multiobjective optimization problems,
and Pareto fronts are illustrated along with the interpretation of the results.
The results, obtained using solvers in MATLAB and AMPL, highlight the models
ability to balance operational efficiency and environmental responsibility.
Pareto frontiers generated from the analysis provide strategic insights for
decision-makers seeking to optimize cost and sustainability in inventory
systems.
AI Insights - The model assumes perfect knowledge of return rates, a practical limitation not mentioned in the abstract.
- No computational complexity analysis is provided, leaving scalability questions open.
- The authors recommend âNonlinear Multiobjective Optimizationâ for deeper mathematical insight.
- A 2021 study on priceâ and qualityâdependent return rates is cited, illustrating market dynamics integration.
- Learning effects are modeled in remanufacturing rates, a nuance absent from the abstract.
- An algorithmic framework for convex mixedâinteger nonlinear programs is proposed as an alternative to heuristics.
- The case study reports a 15âŻ% GHG reduction while keeping costs unchanged, a concrete performance metric.