dense-analysis / dense-analysis/neural
Implement safe analysis of ranges of code
- Dominant language
- Vim Script
- Stars
- 510
- Forks
- 20
- PR merge metrics
- No merged PRs in 30d
Description
Everyone and their mother is writing an OpenAI/ChatGPT or similar plugin. People want to analyse their code with machine learning, but are beginning to go about it all wrong. People have started copying and pasting entire regions of code into machine learning tools, whether manually, or through plugins in editors. This approach is fundamentally flawed for the following reasons.
1. This is a massive security risk. You could very easily leak passwords or other sensitive information to third parties, and you should never trust a third party.
2. This presents a massive risk for leaking intellectual property. You can be sure managers will ban any plugin from a company which might potentially send information that should not be shared to a third party.
3. The solution is only good for demos. Machine learning tools need to be prompted carefully to produce reliable results.
Instead of simply firing code or text at machine learning tools blindly, Neural will instead take the following approach.
1. Analyse code using local tools (and later local models) so information never leaves the host machine.
2. Produce reliable intermediate representations of code and text that can be pre-processed into safe prompts to send to machine learning tools.
3. Send safe data to third parties and return the results.
Nothing will ever be able to stop a user manually copying and pasting whole sections of code, but no sane software should automatically or implicitly introduce these risks to unwitting users. Software should lead you in the right direction, not the wrong one. In future, Dense Analysis will be working on and integrating with local FOSS machine learning models, which will offer a lot of power. The future of machine learning is not rate-limited third party providers hosting binary blobs you cannot audit, who share your data with God knows who, but models and tools entirely controlled by you.
Speaking in practical terms, we can very quickly implement this feature pretty easily.
1. Integrate with Neovim LSP and ALE (for example) LSP tooling that already exists.
2. Pull out semantic information about code.
3. Automatically remove potentially sensitive information from the semantic data analysed, producing abstract intermediate representations. (IR)
4. Prompt machine learning tools with that IR instead of the wholesale code, yielding similar results to wholesale code copying, without the aforementioned risks.
I think this plan can be implemented relatively quickly.
Contributor guide
Assessment
This issue has not been assessed yet.