AutoSQL reconstructs hidden database queries from Go ORM code at scale

Poorly written SQL queries can cripple cloud application performance, but extracting them from modern code frameworks remains a significant challenge. Go's ORM libraries build database queries imperatively—scattered across multiple method calls—making static analysis nearly impossible without new techniques.

The problem with imperative ORM code#

Most object-relational mapping (ORM) systems in Go don't produce SQL statements in one place. Instead, they assemble queries dynamically through a series of chained method invocations spread throughout codebases. This means traditional static analysis tools struggle to reconstruct what SQL will actually be executed at runtime, leaving developers unable to audit queries for performance issues before deployment.

How AutoSQL works#

The system, described in a paper submitted to arXiv, tackles this by building what researchers call a Code Index—a directed graph that maps dependencies between functions, types, and global variables. Rather than scanning code linearly, this index creates navigable edges that reveal how data flows through a program.

AutoSQL then traces backward from ORM invocation sites (where database calls occur) to find database-interacting functions, treating these as starting points. For each entry point, an LLM agent walks the Code Index to gather code fragments that influence SQL construction. When the graph can't resolve a particular retrieval goal, the system switches to pattern-based search—a hybrid strategy the researchers call Hybrid Context Retrieval. Once enough context is collected, the agent synthesizes the actual SQL template.

Evaluation results#

Testing across 579 entry points and 1,186 runtime-traced SQL statements from five large-scale Go repositories, AutoSQL achieved recall rates between 68.04% and 72.18%. This outperformed a static reachability baseline by 11.80% to 15.94% and exceeded existing methods by 8.52% to 21.50%.