Do Code LLMs Do Static Analysis?

TL;DR

This paper evaluates whether code LLMs can perform static analysis tasks essential for understanding code, finding that they perform poorly and that training on static analysis does not improve their code intelligence capabilities.

Contribution

The study systematically assesses code LLMs' static analysis abilities across multiple tasks and models, revealing their limitations and lack of transferability from static analysis training.

Findings

LLMs show poor performance on static analysis tasks

Pretraining on static analysis does not improve code intelligence tasks

Different models exhibit similar limitations in static analysis capabilities

Abstract

This paper investigates code LLMs' capability of static analysis during code intelligence tasks such as code summarization and generation. Code LLMs are now household names for their abilities to do some programming tasks that have heretofore required people. The process that people follow to do programming tasks has long been understood to require static analysis. For example, human programmers navigate the call graph of large programs to comprehend the different parts of those programs. Education in programming includes static analysis under the assumption that better static analysis skills beget better programming. While popular culture is replete with anthropomorphic references such as LLM ``reasoning'', in fact code LLMs could exhibit a wholly alien thought process to humans. This paper studies the specific question of static analysis by code LLMs. We use three different static analysis tasks (callgraph generation, AST generation, and dataflow generation) and three different code intelligence tasks (code generation, summarization, and translation) with two different open-source models (Gemini and GPT-4o) and closed-source models (CodeLlaMA and Jam) as our experiments. We found that LLMs show poor performance on static analysis tasks and that pretraining on the static analysis tasks does not generalize to better performance on the code intelligence tasks and vice versa.