# XSShield: Defending Against Stored XSS Attacks Using LLM-Based Semantic Understanding
## 3 XSShield Design
### Data Adaptor
#### 3.2.1 PDG Generator  
The PDG is an advanced extension of the Abstract Syntax Tree (AST), integrating control and data dependency information. This integration enhances code deconstruction and analysis efficiency through fine-grained AST operations, particularly benefiting code logical partitioning and behavioral representation ```
1:Initial prompt \(p_{0}\), datasets \(D_{\text{train}},D_{\text{test}}\), exploration coefficient \(c_{0}\), epochs \(T\), selection size \(k\) Output: Optimized prompt \(p^{*}\) and prompt set \(P\)
2:\(\prime\) * Prompt Expander*/
3:procedurePromptExpander(\(p,D_{\text{train}}\))
4:\(D_{\text{sample}}\leftarrow\text{Sample}(D_{\text{train}},\text{batch\_size})\)
5:\(pred\leftarrow\text{EvaluatePrompt}(p,D_{\text{sample}})\)
6:\(D_{\text{mismatch}}\leftarrow\{d_{j}\mid\text{pred}_{j}\
eq\text{label}\}\)
7:gradient \(\leftarrow\) GenerateGradient(\(p,D_{\text{mismatch}}\))
8:returnUpdatePrompt(\(p,\text{gradient}\))
9:endprocedure
10:\(\prime\) * Prompt Selector*/
11:procedurePromptSelector(\(P,D_{\text{test}},c,\mathbf{s},\mathbf{f},N\))
12:\(D_{\text{sample}}\leftarrow\text{Sample}(D_{\text{test}},\text{batch\_size})\)
13:forall\(p_{i}\in P\)do
14:\(Loss_{i}\leftarrow\frac{1}{|D_{\text{test}}|}\text{Manh}(\text{pred}_{p_{i}}(D_{ \text{test}}),\text{label})\)
15:\(\text{score}_{i}\gets 1-Loss_{i}\)
16:sampled_prompts \(\leftarrow\) weighted_\(p_{i}\)\(\text{rand}_{k}(\frac{s_{i}}{s_{i}+f_{i}}+c\sqrt{\frac{\text{ln}N}{s_{i}+f_{i}}})\)
17:\(s_{i}\gets s_{i}+\text{score}_{i}\times|D_{\text{sample}}|\)
18:\(f_{i}\gets f_{i}+(1-\text{score}_{i})\times|D_{\text{sample}}|\)
19:endfor
20:returnsampled_prompts,\(\mathbf{s},\mathbf{f}\)
21:endprocedure
22:\(\prime\) * Optimization Orchestrator*/
23:Initialize \(P\leftarrow\{p_{0}\}\), \(\mathbf{s},\mathbf{f}\leftarrow\mathbf{1}_{|P|}\), \(Loss_{\text{best}}\leftarrow\infty\)
24:for epoch \(t=1\) to \(T\)do
25:\(P_{\text{expanded}}\gets P\)
26:forall\(p_{i}\in P\)do
27:\(p_{\text{new}}\leftarrow\text{PromptExpander}(p_{i},D_{\text{train}})\)
28:\(P_{\text{expanded}}\gets P_{\text{expanded}}\cup\{p_{\text{new}}\}\)
29:endfor
30:\(P,\mathbf{s},\mathbf{f}\leftarrow\text{PromptSelector}(P_{\text{expanded}},D_{ \text{test}},c,\mathbf{s},\mathbf{f},t)\)
31:\(c\gets c_{0}/\sqrt{t}\)
32:forall\(p_{i}\in P\)do
33:\(Loss_{i}\leftarrow\frac{1}{|D_{\text{test}}|}\text{Manh}(\text{pred}_{p_{i}}(D_{ \text{test}}),\text{label})\)
34:if\(Loss_{i}<Loss_{\text{best}}\)then
35:\(Loss_{\text{best}}\leftarrow Loss_{i}\)
36:\(p^{*}\gets p_{i}\)
37:endif
38:endfor
39:endfor
40:return\(p^{*}\)
```

**Algorithm 1** Prompt-Optimization Workflow. **PDG Construction** adopts a systematic approach to transform JavaScript code into complete dependency graphs. The process begins with parsing code into AST to establish hierarchical structure, followed by multi-stage transformation: First, comprehensive analysis of data and control flow dependencies maps variable definitions and references through systematic AST traversal, establishing data dependency edges. Simultaneously, analysis of program branch patterns and conditional logic establishes control dependency relationships, ensuring accurate representation of execution paths. Finally, expression nodes in the PDG (operations such as assignments and calculations, derived from Esprima) and their subtrees are identified and integrated as semantically complete units for subsequent analysis. Here, we reference the implementation from GitHub repository [28] for PDG construction. **PDG Pruning** employs three optimization strategies to improve PDG efficiency while preserving core semantic information: control flow optimization, data flow optimization, and dead code elimination. Control Flow Optimization. This merges statement nodes with single child nodes into unified nodes while preserving parent-child information. For each statement node \(s\) with a single child node \(c\), it performs folding operations to create compound nodes, reducing graph complexity while maintaining control flow semantics integrity. Data Flow Optimization.