Research shows that analysts and developers consider privacy as a security concept or as an afterthought, which may lead to non-compliance and violation of users' privacy. Most current approaches, however, focus on extracting legal requirements from the regulations and evaluating the compliance of software and processes with them. In this paper, we develop a novel approach based on chain-of-thought prompting (CoT), in-context-learning (ICL), and Large Language Models (LLMs) to extract privacy behaviors from various software documents prior to and during software development, and then generate privacy requirements in the format of user stories. Our results show that most commonly used LLMs, such as GPT-4o and Llama 3, can identify privacy behaviors and generate privacy user stories with F1 scores exceeding 0.8. We also show that the performance of these models could be improved through parameter-tuning. Our findings provide insight into using and optimizing LLMs for generating privacy requirements given software documents created prior to or throughout the software development lifecycle.
To provide privacy-aware software systems, it is crucial to consider privacy from the very beginning of the development. However, developers do not have the expertise and the knowledge required to embed the legal and social requirements for data protection into software systems. Objective: We present an approach to decrease privacy risks during agile software development by automatically detecting privacy-related information in the context of user story requirements, a prominent notation in agile Requirement Engineering (RE). Methods: The proposed approach combines Natural Language Processing …
KidneyTalk-open: No-code Deployment of a Private Large Language Model with Medical Documentation-Enhanced Knowledge Database for Kidney Disease
Tianjin University of Technology（天津理工大学）；National Institute of Health Data Science, Peking University（北京大学健康数据科学国家研究院）；Peking University First Hospital（北京大学第一医院）；Peking University People’s Hospital（北京大学人民医院）；Institute of Internet Industry, Tsinghua University（清华大学互联网产业研究院）；Chinese Academy of Medical Sciences（中国医学科学院）；State Key Laboratory of Vascular Homeostasis and Remodeling, Peking University（北京大学血管稳态与重构国家重点实验室）
Non-functional requirements (NFRs) are determinant for the success of software projects. However,they are characterized as hard to define, and in agile software development(ASD), are often given less priority and usually not documented. In this paper, we present the findings of the documentation practices and challenges of NFRs in companies utilizing ASD and propose guidelines for enhancing NFRs documentation in ASD. We interviewed practitioners from four companies and identified that epics, features, user stories, acceptance criteria,Definition of Done(DoD), product and sprint backlogs are us…
Preserving Privacy, Increasing Accessibility, and Reducing Cost: An On-Device Artificial Intelligence Model for Medical Transcription and Note Generation
Domain-Adapted Small Language Models for Reliable Clinical Triage
Department of Computer Science, Virginia Tech, Blacksburg, VA, US（弗吉尼亚理工学院计算机科学系，弗吉尼亚理工学院，布莱克斯堡，VA，美国）；Children’s National Hospital, Washington DC, USA（儿童医学中心，华盛顿特区，美国）
AutoDroid-V2: Boosting SLM-based GUI Agents via Code Generation
Institute for AI Industry Research (AIR), Tsinghua University（人工智能产业研究院（AIR），清华大学）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）；Beijing Academy of Artificial Intelligence (BAAI)（北京人工智能研究院）
Evaluating Fine-Tuned LLM Model For Medical Transcription With Small Low-Resource Languages Validated Dataset
School of ICT and Industrial Management（信息通信技术与工业管理学院）；Metropolia University of Applied Sciences（Metropolia应用科学大学）；Rensselaer Polytechnic Institute（伦斯勒理工学院）
Unlocking Public Catalogues: Instruction-Tuning LLMs for ICD Coding of German Tumor Diagnoses
University Medical Center of the Johannes Gutenberg University Mainz（美因茨约翰内斯·古腾堡大学医学中心）；University Cancer Center of the Johannes Gutenberg University Mainz（美因茨约翰内斯·古腾堡大学癌症中心）
Apps on mobile phones manipulate all sorts of data, including sensitive data, leading to privacy-related concerns. Recent regulations like the European GDPR provide rules for the processing of personal and sensitive data, like that no such data may be leaked without the consent of the user. Researchers have proposed sophisticated approaches to track sensitive data within mobile apps, all of which rely on specific lists of sensitive source and sink API methods. The data flow analysis results greatly depend on these lists' quality. Previous approaches either used incomplete hand-written lists th…
Stochastic Parrots or ICU Experts? Large Language Models in Critical Care Medicine: A Scoping Review
National Institute of Health Data Science, Peking University（北京大学健康医疗大数据国家研究院）；Institute of Medical Technology, Peking University Health Science Center（北京大学医学部医学技术研究院）；Institute for Artificial Intelligence, Peking University（北京大学人工智能研究院）；Advanced Institute of Information Technology, Peking University（北京大学信息技术高等研究院）；Peking University Third Hospital（北京大学第三医院）；University of Liverpool（利物浦大学）；Johns Hopkins School of Medicine（约翰斯·霍普金斯大学医学院）；University of California, Los Angeles（加州大学洛杉矶分校）；Peking University People’s Hospital（北京大学人民医院）
Mining Software Repositories (MSRs) is an evidence-based methodology that cross-links data to uncover actionable information about software systems. Empirical studies in software engineering often leverage MSR techniques as they allow researchers to unveil issues and flaws in software development so as to analyse the different factors contributing to them. Hence, counting on fine-grained information about the repositories and sources being mined (e.g., server names, and contributors' identities) is essential for the reproducibility and transparency of MSR studies. However, this can also introd…
The rise of mobile apps has brought greater convenience and customization for users. However, many apps use analytics services to collect a wide range of user interaction data purportedly to improve their service, while presenting app users with vague or incomplete information about this collection in their privacy policies. Typically, such policies neglect to describe all types of user interaction data or how the data is collected. User interaction data is not directly regulated by privacy legislation such as the GDPR. However, the extent and hidden nature of its collection means both that ap…
Defects in requirements specifications can have severe consequences during the software development lifecycle. Some of them may result in poor product quality and/or time and budget overruns due to incorrect or missing quality characteristics, such as security. This characteristic requires special attention in web applications because they have become a target for manipulating sensible data. Several concerns make security difficult to deal with. For instance, security requirements are often misunderstood and improperly specified due to lack of security expertise and emphasis on security during…
